schema.d.ts

/**
 * This file was auto-generated by openapi-typescript.
 * Do not make direct changes to the file.
 */

export interface paths {
    "/api/v1/auth/login": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Username/password login with optional TOTP */
        post: operations["postAuthLogin"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/logout": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Revoke the calling session */
        post: operations["postAuthLogout"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/refresh": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Rotate the refresh token; mint a new access+refresh pair */
        post: operations["postAuthRefresh"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/refresh-cookie": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Rotate the refresh cookie and mint a new session (browser flow)
         * @description Reads the HttpOnly `openwatch_refresh` cookie, rotates the underlying refresh token, mints a new session, and Set-Cookies both the rotated refresh cookie and a fresh `openwatch_session`. Used by the browser API client as the transparent on-401 retry hook so users with a live refresh window don't get bounced to /login on every inactivity timeout.
         */
        post: operations["postAuthRefreshCookie"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/me": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Return the calling identity */
        get: operations["getAuthMe"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/me/preferences": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Return the calling user's UI preferences
         * @description Per-user UI preferences (e.g. the /hosts grid-vs-table default). Self-scoped — any authenticated identity reads its own; no special permission. Unset keys are simply absent (the client falls back to its defaults). Spec system-user-preferences + api-user-preferences.
         */
        get: operations["getUsersMePreferences"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        /**
         * Merge a partial update into the calling user's UI preferences
         * @description Shallow-merges the provided keys into the caller's stored preferences and returns the merged result. Only the keys present in the body are changed; omitted keys are retained. Self-scoped.
         */
        patch: operations["patchUsersMePreferences"];
        trace?: never;
    };
    "/api/v1/auth/mfa:enroll": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Enroll the calling user in TOTP MFA */
        post: operations["postAuthMFAEnroll"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/mfa:verify": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Confirm an enrolled MFA secret by verifying a generated OTP */
        post: operations["postAuthMFAVerify"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/password:change": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Change the calling user's password */
        post: operations["postAuthPasswordChange"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/health": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Liveness + readiness probe (anonymous) */
        get: operations["getHealth"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/version": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Build/version metadata (anonymous) */
        get: operations["getVersion"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:echo": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Echo the request message; exercises idempotency + audit */
        post: operations["postDiagnosticsEcho"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/license": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Get the current license state (tier, features, quotas, status) */
        get: operations["getLicense"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/admin/license:verify": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Dry-run validate a JWT license without installing it */
        post: operations["postAdminLicenseVerify"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:premium-echo": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** License-gated echo; requires premium_diagnostics feature */
        post: operations["postDiagnosticsPremiumEcho"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:require-host-read": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Stage-0 RBAC demo; requires host:read permission */
        post: operations["postDiagnosticsRequireHostRead"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:require-host-write": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Stage-0 RBAC demo; requires host:write permission */
        post: operations["postDiagnosticsRequireHostWrite"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:evaluate-alert": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Stage-0 policy demo; evaluates the alert_thresholds policy */
        post: operations["postDiagnosticsEvaluateAlert"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:enqueue-test-job": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Stage-0 queue demo; enqueues a no-op job processed by the in-process worker */
        post: operations["postDiagnosticsEnqueueTestJob"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/admin/policies:reload": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Reload signed policy files from the configured directory */
        post: operations["postAdminPoliciesReload"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/diagnostics:require-remediation-execute": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Stage-0 RBAC+license demo; requires remediation:execute (RBAC) + premium_diagnostics (license) */
        post: operations["postDiagnosticsRequireRemediationExecute"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/me/permissions": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Effective permissions for the calling identity */
        get: operations["getAuthMePermissions"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/permissions:registry": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Full RBAC registry (categories, permissions, built-in roles) */
        get: operations["getAuthPermissionsRegistry"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List users */
        get: operations["getUsers"];
        put?: never;
        /** Create a user */
        post: operations["postUsers"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Fetch a user */
        get: operations["getUserByID"];
        put?: never;
        post?: never;
        /** Soft-delete a user */
        delete: operations["deleteUserByID"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}/roles:assign": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Assign a role to a user */
        post: operations["postUserRolesAssign"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}/roles:unassign": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Remove a role from a user */
        post: operations["postUserRolesUnassign"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}:reset-password": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Admin-reset a user's password (own or another's)
         * @description Sets a user's password on administrator authority - no current
         *     password required. The new password runs through the role-aware
         *     policy + breach screen; the target's active sessions are revoked so
         *     they must re-authenticate. RBAC: admin:user_manage. Spec api-users.
         */
        post: operations["postUserResetPassword"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}:disable": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Disable a user account
         * @description Marks the account disabled: it can no longer authenticate (login is
         *     rejected) and the user's active sessions are revoked immediately. An
         *     admin cannot disable their own account (lockout prevention, 409).
         *     RBAC: admin:user_manage. Spec api-users.
         */
        post: operations["postUserDisable"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/users/{id}:enable": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Re-enable a disabled user account
         * @description Clears the disabled flag so the user can authenticate again with a
         *     fresh login (sessions revoked while disabled stay dead). RBAC:
         *     admin:user_manage. Spec api-users.
         */
        post: operations["postUserEnable"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/roles:create": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Create a custom role */
        post: operations["postRolesCreate"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/roles": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List built-in roles */
        get: operations["getRoles"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/credentials": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List credentials (metadata only) */
        get: operations["getCredentials"];
        put?: never;
        /** Create a credential */
        post: operations["postCredentials"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/credentials/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Fetch a credential's metadata */
        get: operations["getCredentialByID"];
        put?: never;
        post?: never;
        /** Soft-delete a credential */
        delete: operations["deleteCredentialByID"];
        options?: never;
        head?: never;
        /**
         * Update a credential in place
         * @description Partial update of an existing active credential. Only the fields present in the body change; omitted fields are left untouched. Secret material (password, private_key, private_key_passphrase) is re-encrypted only when a non-empty value is supplied — omitting a secret keeps the stored ciphertext, so metadata can be edited without re-entering the key or password. scope and scope_id are immutable. Setting is_default=true on a system credential atomically demotes the previous system default.
         */
        patch: operations["patchCredentialByID"];
        trace?: never;
    };
    "/api/v1/credentials/{id}:clone": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Clone a credential into a new scope (system → host or host → host)
         * @description Copies the source credential's encrypted secret material verbatim into a new row with the target scope/scope_id. Used by the bulk import flow to attach a chosen credential template to each newly imported host without re-prompting for the secret material.
         */
        post: operations["postCredentialClone"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List hosts */
        get: operations["getHosts"];
        put?: never;
        /** Create a host */
        post: operations["postHosts"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Fetch a host with liveness + compliance enrichment */
        get: operations["getHostByID"];
        put?: never;
        post?: never;
        /** Soft-delete a host */
        delete: operations["deleteHostByID"];
        options?: never;
        head?: never;
        /** Update mutable host fields */
        patch: operations["patchHostByID"];
        trace?: never;
    };
    "/api/v1/hosts/{host_id}/credentials:resolve": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Resolve the credential that will be used for a host */
        post: operations["postHostCredentialsResolve"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{host_id}/maintenance": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Pause/resume liveness probes for a single host
         * @description Toggling maintenance_mode=true causes listProbeTargets to skip the host on every subsequent tick. The host_liveness row is left untouched, so resuming maintenance picks up from the last recorded state. v1.3.0.
         */
        put: operations["putHostMaintenance"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{host_id}/monitoring/history": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Tail the host's monitoring-history rows (most recent first)
         * @description Returns up to `limit` most-recent host_monitoring_history rows for diagnostics. Each row captures the per-layer pass/fail flags the multi-layer probe recorded. v1.3.0.
         */
        get: operations["getHostMonitoringHistory"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/audit/events": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List audit events (cursor-paginated, newest first) */
        get: operations["getAuditEvents"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/score": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Fleet-wide compliance score (passing/total) */
        get: operations["getFleetScore"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/liveness": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Host counts by reachability status */
        get: operations["getFleetLiveness"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/top-failing-rules": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Rules with the most failing hosts (descending) */
        get: operations["getFleetTopFailingRules"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/top-failing-hosts": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Hosts with the most failing rules (descending) */
        get: operations["getFleetTopFailingHosts"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/recent-changes": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Recent transactions (state changes), newest first */
        get: operations["getFleetRecentChanges"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/connectivity/breakdown": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * 4-state connectivity breakdown (online/degraded/critical/down/never_probed)
         * @description Derived per-state host counts for the Settings → Scanning &
         *     monitoring page. Bands come from `consecutive_failures`
         *     hysteresis: online=reachable+consec=0, degraded=reachable+consec>=1,
         *     critical=unreachable+consec<3, down=consec>=3, never_probed=no row.
         *     Counts sum to active host count. Spec api-fleet-connectivity-breakdown.
         */
        get: operations["getFleetConnectivityBreakdown"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/connectivity/config": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Read the connectivity-monitor runtime config + baked-in defaults */
        get: operations["getSystemConnectivityConfig"];
        /**
         * Update connectivity-monitor runtime config
         * @description Persists the new config, signals the in-process liveness service
         *     to Reload, and emits system.config.changed. Bounds are validated
         *     at the handler boundary — out-of-range values return 400.
         *     Spec api-system-connectivity.
         */
        put: operations["putSystemConnectivityConfig"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/intelligence/config": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Read the OS Intelligence scheduler runtime config + baked-in defaults
         * @description Returns the persisted IntelligenceConfig (or DefaultIntelligence
         *     when no row exists) PLUS the baked-in defaults sub-object so the
         *     UI can render a "reset to defaults" affordance without a
         *     round-trip. Mirrors api-system-connectivity v1.0.
         *     Spec api-system-intelligence-config.
         */
        get: operations["getSystemIntelligenceConfig"];
        /**
         * Update OS Intelligence scheduler runtime config
         * @description Persists the new config (interval_sec 300..86400, rate_limit
         *     1..200, maintenance_global boolean). Emits
         *     system.config.changed in the same write transaction. The
         *     in-process scheduler picks up the new values at the top of
         *     its next cycle — no hot-reload signal needed.
         *     Spec api-system-intelligence-config.
         */
        put: operations["putSystemIntelligenceConfig"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/discovery/config": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Read the OS discovery scheduler runtime config + baked-in defaults
         * @description Returns the persisted DiscoveryConfig (or DefaultDiscovery when
         *     no row exists) PLUS the baked-in defaults sub-object so the UI
         *     can render a "reset to defaults" affordance without a round-trip.
         *     Mirrors api-system-intelligence-config v1.0.
         *     Spec api-system-discovery-config.
         */
        get: operations["getSystemDiscoveryConfig"];
        /**
         * Update OS discovery scheduler runtime config
         * @description Persists the new config (interval_sec 3600..604800, rate_limit
         *     1..500, detect_on_first_contact boolean, maintenance_global
         *     boolean). Emits system.config.changed in the same write
         *     transaction. The in-process scheduler picks up the new values
         *     at the top of its next tick — no hot-reload signal needed.
         *     Spec api-system-discovery-config.
         */
        put: operations["putSystemDiscoveryConfig"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/discovery/sweep": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Enqueue a host.discovery job for every host with NULL os_discovered_at
         * @description One-off manual sweep used by the "Run now" affordance on the
         *     Settings page. Enqueues host.discovery jobs for non-deleted,
         *     non-maintenance hosts whose hosts.os_discovered_at IS NULL.
         *     Hosts already discovered are NOT re-enqueued — this is a
         *     catch-up, not a forced re-fingerprint. Returns the count of
         *     jobs enqueued so the UI can confirm the action.
         *     Spec api-system-discovery-config.
         */
        post: operations["postSystemDiscoverySweep"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/scan/config": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Read the adaptive compliance scan scheduler config + baked-in defaults
         * @description Returns the persisted ScanConfig (or DefaultScan when no row
         *     exists) PLUS the baked-in defaults sub-object so the UI can
         *     render a "reset to defaults" affordance without a round-trip.
         *     The six per-state intervals are the adaptive scheduler's tier
         *     ladder (scan plan decision #4: systemconfig, not a policy file).
         *     Spec api-system-scan-config.
         */
        get: operations["getSystemScanConfig"];
        /**
         * Update the adaptive compliance scan scheduler config
         * @description Persists the new config. Ladder minutes are CLAMPED into
         *     [5, 2880] and rate_limit into [1, 100] rather than rejected
         *     (the response echoes the clamped values); emits
         *     system.config.changed in the same write transaction. The
         *     in-process scheduler refreshes the config at the top of its
         *     next 60s tick. Spec api-system-scan-config.
         */
        put: operations["putSystemScanConfig"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/scan/schedule-preview": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * 24h forward projection of the compliance scan schedule
         * @description Read-only projection of host_compliance_schedule over the next
         *     24 hours (NOT a dry-run dispatch): per-hour due counts for the
         *     Settings schedule strip, the soonest next_scheduled_scan, the
         *     count of hosts already due, and the live scan queue depth.
         *     Spec api-system-scan-config.
         */
        get: operations["getSystemScanSchedulePreview"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/compliance/states": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Fleet host counts per compliance state
         * @description One row per ComplianceState in ladder order (critical,
         *     non_compliant, partial, mostly_compliant, compliant, unknown)
         *     with the count of live hosts whose host_compliance_schedule
         *     row is in that state. States with zero hosts are still listed
         *     so the Settings steppers can render a stable six-row layout.
         *     Spec api-system-scan-config.
         */
        get: operations["getFleetComplianceStates"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/scan/variables": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List the corpus-used kensa rule-template variables with defaults and overrides
         * @description One entry per variable the installed rule corpus actually
         *     references (kensa ships more built-in defaults than the corpus
         *     uses; unused ones are not listed). Each entry carries the
         *     built-in default, the operator override when set, the count
         *     and ids of affected rules, and the configure_me flag marking
         *     organization-specific placeholder defaults
         *     (rsyslog_remote_server, chrony_ntp_pool, banner_text) that
         *     operators should always review. Spec api-system-scan-config.
         */
        get: operations["getSystemScanVariables"];
        /**
         * Replace the operator variable overrides
         * @description PUT replaces the FULL override map (absent names revert to the
         *     built-in defaults). Unknown variable names (not used by the
         *     installed corpus) are rejected with 400 naming the offending
         *     key; overrides equal to the built-in default are dropped at
         *     write time. Emits system.config.changed. The scan path reloads
         *     the rule corpus with the merged variables on the next scan.
         *     Spec api-system-scan-config.
         */
        put: operations["putSystemScanVariables"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/exceptions": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List a host's compliance exceptions
         * @description Per-host exception list for the Compliance tab + Watchlist row.
         *     By default returns open rows (requested + approved); ?history=true
         *     returns every row. RBAC: exception:read. Spec
         *     api-compliance-exceptions.
         */
        get: operations["getHostExceptions"];
        put?: never;
        /**
         * Request a compliance exception (rule waiver) on a host
         * @description Submits a requested exception for a host+rule. One open
         *     (requested or approved) exception is allowed per host+rule; a
         *     duplicate returns 409. The requester is the authenticated user.
         *     RBAC: exception:request. Spec api-compliance-exceptions.
         */
        post: operations["postHostException"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/compliance/exceptions": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Fleet-wide compliance exception queue
         * @description Fleet exception list, optionally filtered by status (requested,
         *     approved, rejected, revoked, expired). Newest first, capped at
         *     500. RBAC: exception:read. Spec api-compliance-exceptions.
         */
        get: operations["getComplianceExceptions"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/exceptions/{xid}:approve": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Approve a requested exception
         * @description requested -> approved. The reviewer must differ from the
         *     requester (separation of duties, 409). RBAC: exception:approve.
         *     Spec api-compliance-exceptions.
         */
        post: operations["postExceptionApprove"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/exceptions/{xid}:reject": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Reject a requested exception
         * @description requested -> rejected. The reviewer must differ from the
         *     requester (409). RBAC: exception:approve. Spec
         *     api-compliance-exceptions.
         */
        post: operations["postExceptionReject"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/exceptions/{xid}:revoke": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Revoke an active exception before its expiry
         * @description approved -> revoked. RBAC: exception:revoke (dangerous). Spec
         *     api-compliance-exceptions.
         */
        post: operations["postExceptionRevoke"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List remediation requests (fleet or filtered)
         * @description Remediation request queue, newest first, optionally filtered by
         *     status, host_id, or rule_id; capped at limit (default 200). RBAC:
         *     remediation:read. Spec api-remediation.
         */
        get: operations["listRemediationRequests"];
        put?: never;
        /**
         * Request a remediation (fix) for a failing rule on a host
         * @description Submits a pending_approval remediation request for a host+rule and
         *     records the projected per-framework compliance lift. One open request
         *     is allowed per host+rule; a duplicate returns 409. The requester is
         *     the authenticated user. This NEVER contacts the host. RBAC:
         *     remediation:request. Spec api-remediation.
         */
        post: operations["requestRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get a remediation request
         * @description RBAC: remediation:read. Spec api-remediation.
         */
        get: operations["getRemediationRequest"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}/steps": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List a remediation request's transaction journal (steps)
         * @description Per-step Kensa transaction journal (Capture/Apply/Validate/Commit
         *     outcomes). Empty until the request is executed (executing is the
         *     OpenWatch+ licensed track). RBAC: remediation:read. Spec
         *     api-remediation.
         */
        get: operations["listRemediationSteps"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}:approve": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Approve a pending remediation request
         * @description pending_approval -> approved. The reviewer must differ from the
         *     requester (separation of duties, 409). RBAC: remediation:approve.
         *     Spec api-remediation.
         */
        post: operations["approveRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}:reject": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Reject a pending remediation request
         * @description pending_approval -> rejected. The reviewer must differ from the
         *     requester (409). RBAC: remediation:approve. Spec api-remediation.
         */
        post: operations["rejectRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}:dry-run": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Dry-run a remediation (preview)
         * @description Would connect to the host and report what an apply changes, without
         *     applying. Free core (remediation:execute). Not yet implemented; returns
         *     501. Spec api-remediation.
         */
        post: operations["dryRunRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}:execute": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Execute an approved single-rule remediation (free core)
         * @description Applies the fix on the host (Kensa Capture/Apply/Validate/Commit),
         *     queued to the remediation worker. Free core: requires
         *     remediation:execute (single-rule manual remediation is not
         *     license-gated). The request must be in the 'approved' state; poll
         *     GET /requests/{rid} for the executed|failed outcome. Spec api-remediation.
         */
        post: operations["executeRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/remediation/requests/{rid}:rollback": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Roll back an executed remediation (free core)
         * @description Restores the captured pre-state, queued to the remediation worker. Free
         *     core: requires remediation:rollback. The request must be in the
         *     'executed' state. Spec api-remediation.
         */
        post: operations["rollbackRemediation"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/groups": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Fleet group summary + every group with its rollup
         * @description Returns the Groups-page KPI summary and the full list of groups
         *     (sites first, then OS categories), each with its computed member
         *     rollup. RBAC: host:read. Spec api-groups.
         */
        get: operations["getGroups"];
        put?: never;
        /**
         * Create a group
         * @description Create a site (manual membership) or an OS category (manual
         *     workload group or auto group keyed on os_family). RBAC:
         *     host:write. Spec api-groups.
         */
        post: operations["postGroup"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/groups/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Delete a group
         * @description Removes the group (members cascade). RBAC: host:write. Spec
         *     api-groups.
         */
        delete: operations["deleteGroup"];
        options?: never;
        head?: never;
        /**
         * Update a group's display fields
         * @description Patch name, subtype, and color. Kind and membership are
         *     immutable. RBAC: host:write. Spec api-groups.
         */
        patch: operations["patchGroup"];
        trace?: never;
    };
    "/api/v1/groups/{id}:maintenance": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Toggle a group's maintenance flag
         * @description Sets the maintenance flag on or off. RBAC: host:write. Spec
         *     api-groups.
         */
        post: operations["postGroupMaintenance"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/groups/{id}/members": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Add a host to a manual group
         * @description Assigns a host to a manual group (auto groups derive their
         *     members and reject this with 400). RBAC: host:write. Spec
         *     api-groups.
         */
        post: operations["postGroupMember"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/groups/{id}/members/{host_id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Remove a host from a manual group
         * @description Removes a host from a manual group. RBAC: host:write. Spec
         *     api-groups.
         */
        delete: operations["deleteGroupMember"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/reports": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List generated reports (newest first)
         * @description Returns the Reports library: every generated report, newest
         *     first. RBAC: host:read. Spec api-reports.
         */
        get: operations["getReports"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/reports:generate": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Generate a Fleet Compliance Executive Summary
         * @description Computes a point-in-time posture snapshot from current data
         *     (host_rule_state pass/fail counts + critical, host count, top
         *     failing rules) and stores it as an immutable report. The MVP
         *     generates only the executive summary for all hosts. RBAC:
         *     host:write. Spec api-reports.
         */
        post: operations["postReportGenerate"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/reports/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Fetch one report (with its stored JSON posture)
         * @description Returns a single report by id, including the stored JSON
         *     content. RBAC: host:read. Spec api-reports.
         */
        get: operations["getReportByID"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/scans": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List a host's compliance scans (newest first)
         * @description Returns the scan_runs history for one host, newest first, backing
         *     the scan-history drill-down at /scans (expand a host to see its
         *     scans). host_id is required. Cursor pagination by queued_at.
         *     RBAC: scan:read. Spec api-scans.
         */
        get: operations["getScans"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/scans/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * One scan's metadata + per-rule results (no inline evidence)
         * @description Returns a scan's scan_runs metadata plus every rule's durable
         *     verdict for that scan (status, severity, framework refs,
         *     has_evidence). The raw check output is NOT inlined here; fetch it
         *     per rule via the evidence endpoint. RBAC: scan:read. Spec
         *     api-scans.
         */
        get: operations["getScanByID"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/scans/{id}/rules/{ruleId}/evidence": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * One rule's full evidence for a scan (the drill-down payload)
         * @description Returns one rule's durable evidence for a scan: the verdict
         *     detail, the structured per-command checks (command, captured
         *     output, exit code, expected/actual), and framework refs. This is
         *     the proof behind the verdict, exposed only under /api/v1/scans and
         *     gated by scan:read (the host-detail Compliance tab stays
         *     evidence-free). Spec api-scans.
         */
        get: operations["getScanRuleEvidence"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/scans/{id}/rules/{ruleId}/oscal": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * One rule's outcome as an OSCAL 1.0.6 Assessment Results document
         * @description Renders one rule's stored outcome as a standalone OSCAL 1.0.6
         *     Assessment Results document (one finding + observation),
         *     reconstructed from the durable scan store via Kensa's exporter.
         *     RBAC: scan:read. Spec api-scans.
         */
        get: operations["getScanRuleOSCAL"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/scans/{id}/oscal": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * A whole scan as an OSCAL 1.0.6 Assessment Results document
         * @description Renders an entire scan as a single OSCAL 1.0.6 Assessment Results
         *     document (one finding + observation per rule), reconstructed from
         *     the durable scan store via Kensa's exporter — the audit-window
         *     artifact for that scan. RBAC: scan:read. Spec api-scans.
         */
        get: operations["getScanOSCAL"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/rules": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List the Kensa rule library (the full rule catalog)
         * @description Returns every Kensa rule with its normalized framework references
         *     and a remediation summary, for the rule-library browser on /scans.
         *     Reference data (the corpus is static), filtered client-side. RBAC:
         *     scan:read. Spec api-rules.
         */
        get: operations["getRules"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/system/connectivity/status": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Read the connectivity-monitor in-process metrics + maintenance flag */
        get: operations["getSystemConnectivityStatus"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/connectivity:check": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Synchronous on-demand reachability probe for a single host
         * @description Calls the same in-process probe machinery the periodic loop uses
         *     (credential-free TCP-banner on port 22), persists to
         *     host_liveness, and returns the fresh result. Idempotency-Key
         *     required. Spec api-host-connectivity-check.
         */
        post: operations["postHostConnectivityCheck"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/scans": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Enqueue an on-demand compliance scan for a single host
         * @description Creates a scan run (the scan_runs logbook row) and enqueues the
         *     HMAC-signed scan job the worker executes via Kensa. Returns 202
         *     with the scan id — the scan itself is asynchronous; completion
         *     lands in host_rule_state/transactions and is announced on the
         *     event bus. 409 when a run for this host is already queued or
         *     running. Idempotency-Key required. Requires host:write.
         *     Spec api-host-scan.
         */
        post: operations["postHostScan"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/compliance": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Per-host compliance lens (one scan, many framework views)
         * @description Projects the host's full host_rule_state corpus through an
         *     optional framework lens. scan_context carries the latest
         *     completed scan_runs row for the host (nulls when never
         *     scanned). summary counts every status plus a score_pct
         *     (passing/total as a percentage, one decimal, 0 when total is
         *     0). categories groups the same rows by kensa catalog category
         *     (uncategorized when unknown), sorted failing DESC then
         *     category ASC. rules lists EVERY row (pass/fail/skipped/error),
         *     severity-ordered then rule_id ASC, with control_ids projected
         *     for the requested framework (empty otherwise). The stored
         *     per-rule check output is never exposed. The per-host corpus is
         *     bounded (~539 rules), so this is one unpaginated query.
         *     Requires host:read. Spec api-host-compliance v1.1.0.
         */
        get: operations["getHostCompliance"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/compliance/schedule": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * One host's adaptive-scan schedule (Auto-scan tile)
         * @description The host's row from the adaptive scheduler: compliance state,
         *     next scheduled scan, current interval, and the pause flags
         *     (per-host maintenance + the scheduler-wide enabled/maintenance
         *     config). A host without a schedule row returns state unknown
         *     with a null next_scan_at - never an error.
         *     Spec api-system-scan-config.
         */
        get: operations["getHostComplianceSchedule"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/compliance/trend": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Daily compliance posture trend for one host
         * @description Per-day posture snapshots over the trailing window (default 30
         *     days, clamped 1..90): score_pct, passing, failing, total. Days
         *     without a snapshot are absent from the array; history
         *     accumulates from the daily rollup going forward. Spec
         *     api-compliance-trend.
         */
        get: operations["getHostComplianceTrend"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/compliance/trend": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Daily fleet compliance trend
         * @description Per-day fleet aggregates over the trailing window (default 30
         *     days, clamped 1..90): average score across snapshotted hosts,
         *     host count, total failing rules, and hosts carrying critical
         *     findings. Powers the hosts-page average-compliance delta.
         *     Spec api-compliance-trend.
         */
        get: operations["getFleetComplianceTrend"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/compliance/frameworks": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List the frameworks the host's rule state maps to
         * @description Distinct framework_refs keys across the host's host_rule_state
         *     rows with the number of rules mapped to each, ordered by
         *     framework id. Empty when the host has never been scanned.
         *     Backs the lens picker on the host compliance view. Requires
         *     host:read. Spec api-host-compliance v1.1.0.
         */
        get: operations["getHostComplianceFrameworks"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/compliance/failed-rules": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List a host's currently-failing compliance rules
         * @description Returns host_rule_state rows with current_status=fail for the
         *     host, ordered by severity (critical > high > medium > low >
         *     unset) then last_checked_at DESC. Titles and categories come
         *     from the in-memory kensa rule catalog; when the catalog is
         *     unavailable, title falls back to the rule id. The optional
         *     framework filter restricts rows to those whose framework_refs
         *     contains the key and projects that framework's control ids
         *     into control_ids. total_failing is the post-filter, pre-limit
         *     count. Requires host:read. Spec api-host-compliance.
         */
        get: operations["getHostFailedRules"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/fleet/scan-queue": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Scan-queue depth split by lifecycle state
         * @description Counts of scan_runs rows in the queued and running states.
         *     Terminal (completed/failed) runs are excluded. Requires
         *     host:read. Spec api-host-compliance.
         */
        get: operations["getFleetScanQueue"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/intelligence/events": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List OS Intelligence change events
         * @description Returns the change events the OS Intelligence collector
         *     recorded — newly opened ports, package updates, service
         *     failures, etc. Cursor pagination on detected_at DESC. Filter
         *     by host_id, event_code, severity, since/until. Spec
         *     api-os-intelligence.
         */
        get: operations["getIntelligenceEvents"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/intelligence/state/{host_id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Last full Intelligence snapshot for one host
         * @description Returns the most recent host_intelligence_state row for the
         *     given host. 404 hosts.not_found if the host is unknown OR if
         *     no Intelligence cycle has populated the row yet (operators
         *     cannot probe host existence via this endpoint). Spec
         *     api-os-intelligence.
         */
        get: operations["getIntelligenceState"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List persisted alerts (paginated, filterable)
         * @description Returns alerts in the alerts table — written by the
         *     system-alert-router persistence amendment (v1.1.0). Cursor
         *     pagination on occurred_at DESC. RBAC: alert:read. Spec
         *     api-alerts.
         */
        get: operations["getAlerts"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Single alert by id
         * @description Returns the alert row (including terminal states — resolved /
         *     dismissed are still queryable). RBAC: alert:read. Spec api-alerts.
         */
        get: operations["getAlertByID"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts/{id}:acknowledge": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Acknowledge an active alert
         * @description active -> acknowledged. RBAC: alert:write. Spec api-alerts.
         */
        post: operations["postAlertAcknowledge"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts/{id}:silence": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Silence an alert until a timestamp (or indefinitely)
         * @description active|acknowledged -> silenced. Optional body.until specifies
         *     when the silence elapses; missing means indefinite. Past until
         *     returns 400. RBAC: alert:write. Spec api-alerts.
         */
        post: operations["postAlertSilence"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts/{id}:resolve": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Resolve an alert
         * @description active|acknowledged|silenced -> resolved. RBAC: alert:write. Spec api-alerts.
         */
        post: operations["postAlertResolve"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/alerts/{id}:dismiss": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Dismiss an alert (terminal)
         * @description Any non-dismissed state -> dismissed. RBAC: alert:write. Spec api-alerts.
         */
        post: operations["postAlertDismiss"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/activity": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Unified Activity feed (UNION over alerts + transactions + intelligence + audit + monitoring)
         * @description Returns the per-source RBAC-filtered union of recent events.
         *     Caller's permissions decide which sources contribute; hidden_count
         *     reports how many rows the caller's RBAC suppressed so the UI
         *     can render "N visible / M hidden". Spec api-activity.
         */
        get: operations["getActivity"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/system-info": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Read the latest Discovery facts for one host
         * @description Returns the most recent host_system_info row for the given
         *     host. Populated by system-host-discovery (synchronous via
         *     POST /hosts/{id}/discovery:run or async by the scheduler).
         *     404 hosts.not_found if (a) the host is unknown, (b) the
         *     host is soft-deleted, or (c) the host exists but Discovery
         *     has not run yet — operators cannot probe host existence
         *     via this endpoint. Spec api-host-system-info.
         */
        get: operations["getHostSystemInfo"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/hosts/{id}/discovery:run": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Synchronous on-demand OS fingerprint discovery for a single host
         * @description Opens one SSH session against the host using its resolved
         *     credential, runs the closed-set probe batch (os-release, uname,
         *     meminfo, df, hostname, getenforce, aa-status, firewall), parses
         *     the outputs, upserts host_system_info + denormalized hosts.os_*
         *     columns in a single transaction, publishes
         *     eventbus.HostDiscovered, and emits the host.discovery.completed
         *     audit event. Spec system-host-discovery.
         */
        post: operations["postHostDiscoveryRun"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/notifications/channels": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List notification channels (secrets redacted) */
        get: operations["getNotificationChannels"];
        put?: never;
        /** Create a notification channel */
        post: operations["postNotificationChannel"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/notifications/channels/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Fetch a notification channel (secret redacted) */
        get: operations["getNotificationChannel"];
        put?: never;
        post?: never;
        /** Delete a notification channel */
        delete: operations["deleteNotificationChannel"];
        options?: never;
        head?: never;
        /** Update a notification channel */
        patch: operations["patchNotificationChannel"];
        trace?: never;
    };
    "/api/v1/notifications/channels/{id}:test": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /** Send a synthetic test alert through the channel */
        post: operations["testNotificationChannel"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/tokens": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List API tokens (metadata only; secrets never returned) */
        get: operations["getAPITokens"];
        put?: never;
        /** Create an API token (the secret is returned once, here only) */
        post: operations["postAPIToken"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/tokens/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /** Revoke an API token */
        delete: operations["deleteAPIToken"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth-policy": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** View the workspace authentication policy */
        get: operations["getAuthPolicy"];
        /** Replace the workspace authentication policy */
        put: operations["putAuthPolicy"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/sso/providers": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List SSO providers (metadata only; client secret never returned) */
        get: operations["getSSOProviders"];
        put?: never;
        /** Create an SSO provider */
        post: operations["postSSOProvider"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/sso/providers/enabled": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** List enabled SSO providers for the sign-in picker (anonymous) */
        get: operations["getSSOProvidersEnabled"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/sso/providers/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** View one SSO provider (metadata only) */
        get: operations["getSSOProvider"];
        /** Update an SSO provider (omit client_secret to keep the existing one) */
        put: operations["putSSOProvider"];
        post?: never;
        /** Delete an SSO provider (cascades its identities + states) */
        delete: operations["deleteSSOProvider"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/sso/{id}/login": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** Begin SSO sign-in — redirects to the IdP authorization endpoint */
        get: operations["getAuthSSOLogin"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/api/v1/auth/sso/{id}/callback": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /** SSO redirect-back — exchanges the code, issues a session, redirects into the app */
        get: operations["getAuthSSOCallback"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
}
export type webhooks = Record<string, never>;
export interface components {
    schemas: {
        AuthLoginRequest: {
            username: string;
            password: string;
            otp?: string;
        };
        AuthLoginResponse: {
            access_token: string;
            refresh_token: string;
            user: components["schemas"]["AuthMeResponse"];
            /** @description True when workspace policy requires MFA but the user has not enrolled. The session is still issued (soft enforcement); the client must force MFA enrollment before anything else. */
            mfa_enrollment_required?: boolean;
        };
        AuthRefreshRequest: {
            refresh_token: string;
        };
        AuthMeResponse: {
            /** Format: uuid */
            id: string;
            username: string;
            email: string;
            role: string;
        };
        UserPreferences: {
            /** @enum {string} */
            hosts_view_default?: "table" | "cards";
            /** @enum {string} */
            density?: "comfortable" | "compact";
            /** @enum {string} */
            accent_color?: "info" | "ok" | "brand2";
            /** @enum {string} */
            landing_page?: "hosts" | "dashboard" | "reports";
            /** @enum {string} */
            date_format?: "us12" | "iso24" | "long24";
            reduce_motion?: boolean;
        };
        AuthMFAEnrollResponse: {
            provisioning_uri: string;
        };
        AuthMFAVerifyRequest: {
            otp: string;
        };
        AuthPasswordChangeRequest: {
            current_password: string;
            new_password: string;
        };
        UserResponse: {
            /** Format: uuid */
            id: string;
            username: string;
            email: string;
            /** @description Role IDs assigned to the user. Populated by the list endpoint (GET /users); other responses may omit it. */
            roles?: string[];
            /** Format: date-time */
            last_password_change_at?: string;
            /** Format: date-time */
            created_at?: string;
            /** Format: date-time */
            updated_at?: string;
            /**
             * Format: date-time
             * @description Non-null when the account is disabled (cannot authenticate)
             */
            disabled_at?: string | null;
        };
        UserPasswordResetRequest: {
            new_password: string;
        };
        UsersListResponse: {
            users: components["schemas"]["UserResponse"][];
        };
        /** @description A delivery channel. SECRETS are NEVER returned — the SMTP password, and the slack/webhook URL + token, are write-only. For email channels the NON-secret config is returned so the edit form can pre-fill: smtp_host (also target_hint), smtp_port, from, to, username. */
        NotificationChannel: {
            /** Format: uuid */
            id: string;
            /** @enum {string} */
            type: "slack" | "webhook" | "email";
            name: string;
            enabled: boolean;
            /** @description Non-secret host (URL host or SMTP host) */
            target_hint: string;
            /** @description Alert tags this channel matches; empty = every alert */
            tag_filter: {
                [key: string]: string;
            };
            /** @description SMTP port (email channels) */
            smtp_port?: number | null;
            /** @description Sender address (email channels) */
            from?: string | null;
            /** @description Recipient addresses (email channels) */
            to?: string[] | null;
            /** @description SMTP username (email; the password is never returned) */
            username?: string | null;
            /** Format: date-time */
            created_at: string;
            /** Format: date-time */
            updated_at: string;
        };
        NotificationChannelList: {
            channels: components["schemas"]["NotificationChannel"][];
        };
        /** @description For slack/webhook supply url (https, public host). For email supply smtp_host/smtp_port/from/to (and username/password if the relay authenticates). All secrets are stored encrypted and never returned. */
        NotificationChannelCreate: {
            /** @enum {string} */
            type: "slack" | "webhook" | "email";
            name: string;
            /** @default true */
            enabled: boolean;
            /** @description Target URL (https, public host) for slack/webhook. Stored encrypted. */
            url?: string;
            /** @description Optional bearer token for webhook auth. Stored encrypted. */
            token?: string;
            /** @description SMTP relay host (email). Stored encrypted. */
            smtp_host?: string;
            /** @description SMTP relay port (email) */
            smtp_port?: number;
            /** @description SMTP auth username (email). Stored encrypted. */
            username?: string;
            /** @description SMTP auth password (email). Stored encrypted. */
            password?: string;
            /** @description Envelope From address (email). */
            from?: string;
            /** @description Recipient addresses (email). */
            to?: string[];
            tag_filter?: {
                [key: string]: string;
            };
        };
        /** @description Updates name/enabled/tag_filter. Supplying the secret config (url for slack/webhook, or smtp_host for email) replaces it; omitting it leaves the stored secret unchanged. */
        NotificationChannelUpdate: {
            name: string;
            enabled: boolean;
            url?: string;
            token?: string;
            smtp_host?: string;
            smtp_port?: number;
            username?: string;
            password?: string;
            from?: string;
            to?: string[];
            tag_filter?: {
                [key: string]: string;
            };
        };
        /** @description API token metadata. The secret is NEVER included. */
        ApiToken: {
            /** Format: uuid */
            id: string;
            name: string;
            /** @description Non-secret display prefix (e.g. owk_a1b2c3d4) */
            prefix: string;
            /** @description The role whose permissions the token carries */
            role_id: string;
            /** Format: date-time */
            created_at: string;
            /** Format: date-time */
            expires_at?: string | null;
            /** Format: date-time */
            last_used_at?: string | null;
            /** Format: date-time */
            revoked_at?: string | null;
        };
        ApiTokenList: {
            tokens: components["schemas"]["ApiToken"][];
        };
        ApiTokenCreateRequest: {
            name: string;
            /** @description Role the token acts as (must be a known role) */
            role_id: string;
            /** Format: date-time */
            expires_at?: string | null;
        };
        /** @description The raw token is shown ONCE, in this create response only. Store it now; it cannot be retrieved again. */
        ApiTokenCreated: {
            /** @description The raw secret. Shown once. */
            token: string;
            api_token: components["schemas"]["ApiToken"];
        };
        /** @description Workspace-wide authentication policy. */
        AuthPolicy: {
            /** @description When true, every user must have MFA enrolled (soft-enforced at login). */
            require_mfa: boolean;
            /** @description Inactivity window. A session expires this many seconds after its last use. */
            session_idle_timeout_seconds: number;
            /** @description Absolute lifetime cap regardless of activity, in seconds. */
            session_absolute_timeout_seconds: number;
            /** Format: date-time */
            updated_at: string;
            /** Format: uuid */
            updated_by?: string | null;
        };
        /** @description Replaces the whole policy. Bounds (enforced server-side): idle 300..86400 s, absolute 3600..2592000 s, absolute >= idle. */
        AuthPolicyUpdateRequest: {
            require_mfa: boolean;
            session_idle_timeout_seconds: number;
            session_absolute_timeout_seconds: number;
        };
        /** @description SSO provider metadata. The client secret is NEVER included. */
        SSOProvider: {
            /** Format: uuid */
            id: string;
            name: string;
            /** @description Protocol (oidc) */
            type: string;
            /** @description OIDC issuer URL */
            issuer: string;
            client_id: string;
            /** @description Space-delimited OAuth scopes */
            scopes: string;
            /** @description Role granted to users provisioned via this provider */
            default_role: string;
            enabled: boolean;
            /** Format: date-time */
            created_at: string;
            /** Format: date-time */
            updated_at?: string;
        };
        SSOProviderList: {
            providers: components["schemas"]["SSOProvider"][];
        };
        SSOProviderCreateRequest: {
            name: string;
            /** @description OIDC issuer URL (https) */
            issuer: string;
            client_id: string;
            /** @description Stored encrypted; never returned */
            client_secret: string;
            /** @description Space-delimited; openid is always added */
            scopes?: string;
            /** @description Role for provisioned users (default viewer) */
            default_role?: string;
            enabled?: boolean;
        };
        /** @description Omit client_secret (or send empty) to keep the stored secret. */
        SSOProviderUpdateRequest: {
            name: string;
            issuer: string;
            client_id: string;
            /** @description Optional; empty keeps the existing secret */
            client_secret?: string;
            scopes?: string;
            default_role?: string;
            enabled?: boolean;
        };
        /** @description The minimal, non-secret shape rendered on the anonymous login page. */
        SSOEnabledProvider: {
            /** Format: uuid */
            id: string;
            name: string;
        };
        SSOEnabledList: {
            providers: components["schemas"]["SSOEnabledProvider"][];
        };
        UserCreateRequest: {
            username: string;
            email: string;
            password: string;
        };
        UserRoleAssignRequest: {
            role_id: string;
        };
        CustomRoleCreateRequest: {
            id: string;
            description: string;
            permissions: string[];
        };
        CustomRoleResponse: {
            id: string;
            description: string;
            is_built_in: boolean;
            permissions: string[];
        };
        CredentialResponse: {
            /** Format: uuid */
            id: string;
            /** @enum {string} */
            scope: "system" | "host";
            /** Format: uuid */
            scope_id?: string | null;
            name: string;
            description?: string;
            username: string;
            /** @enum {string} */
            auth_method: "ssh_key" | "password" | "both";
            ssh_key_fingerprint?: string;
            ssh_key_type?: string;
            ssh_key_bits?: number;
            ssh_key_comment?: string;
            is_default: boolean;
            is_active: boolean;
            /** Format: uuid */
            created_by?: string;
            /** Format: date-time */
            created_at?: string;
            /** Format: date-time */
            updated_at?: string;
        };
        CredentialListResponse: {
            credentials: components["schemas"]["CredentialResponse"][];
        };
        HostResponse: {
            /** Format: uuid */
            id: string;
            hostname: string;
            ip_address: string;
            port: number;
            display_name?: string;
            description?: string;
            environment: string;
            tags?: string[];
            /** Format: uuid */
            group_id?: string | null;
            username?: string;
            /** Format: uuid */
            created_by?: string;
            /** Format: date-time */
            created_at?: string;
            /** Format: date-time */
            updated_at?: string;
            maintenance_mode?: boolean;
            check_priority?: number;
            /** @description Distro ID from /etc/os-release (e.g. rhel, ubuntu, rocky, centos, almalinux, debian, opensuse-leap, sles); rollup family (rhel | debian | suse | alpine | arch | gentoo | other) ONLY when ID was empty; null pre-Discovery. Spec system-host-discovery v1.3.0 AC-22. */
            os_family?: string | null;
            os_version?: string | null;
            /** @description e.g. x86_64, aarch64 */
            architecture?: string | null;
            /** @description e.g. platform:el9 */
            platform_identifier?: string | null;
            /** Format: date-time */
            os_discovered_at?: string | null;
        };
        HostLiveness: {
            /** @enum {string} */
            reachability_status: "reachable" | "unreachable" | "unknown";
            /** @enum {string} */
            monitoring_state?: "online" | "degraded" | "critical" | "down" | "maintenance" | "unknown";
            /** Format: date-time */
            last_probe_at?: string | null;
            last_response_ms?: number | null;
            consecutive_failures?: number;
            ping_consecutive_failures?: number;
            ping_consecutive_successes?: number;
            ssh_consecutive_failures?: number;
            ssh_consecutive_successes?: number;
            privilege_consecutive_failures?: number;
            privilege_consecutive_successes?: number;
            /** Format: date-time */
            last_state_change_at?: string | null;
            last_error_type?: string | null;
        };
        HostMaintenanceRequest: {
            /** @description true = pause probes; false = resume */
            enabled: boolean;
        };
        HostMonitoringHistoryEntry: {
            /** Format: int64 */
            id: number;
            /** Format: uuid */
            host_id: string;
            /** Format: date-time */
            check_time: string;
            /** @enum {string} */
            monitoring_state: "online" | "degraded" | "critical" | "down" | "maintenance" | "unknown";
            /** @enum {string|null} */
            previous_state?: "online" | "degraded" | "critical" | "down" | "maintenance" | "unknown" | null;
            response_time_ms?: number | null;
            ping_ok?: boolean | null;
            ssh_ok?: boolean | null;
            privilege_ok?: boolean | null;
            /** @enum {string|null} */
            failed_layer?: "ping" | "ssh" | "privilege" | null;
            error_message?: string | null;
            error_type?: string | null;
        };
        HostMonitoringHistoryResponse: {
            /** Format: uuid */
            host_id: string;
            entries: components["schemas"]["HostMonitoringHistoryEntry"][];
        };
        HostComplianceSummary: {
            /** Format: int64 */
            passing: number;
            /** Format: int64 */
            failing: number;
            /** Format: int64 */
            skipped: number;
            /** Format: int64 */
            error: number;
            /** Format: int64 */
            total: number;
        };
        HostFailedRule: {
            rule_id: string;
            /** @description Catalog title; falls back to rule_id when the catalog lacks the rule. */
            title: string;
            /** @description Catalog category; empty when unknown. */
            category: string;
            /** @description Stored severity; empty when the scan recorded none. */
            severity: string;
            /** @description Control ids for the requested framework; empty unless ?framework= is given. */
            control_ids: string[];
            /** Format: date-time */
            last_checked_at: string;
            check_count: number;
        };
        HostFailedRulesResponse: {
            /**
             * Format: int64
             * @description Count of ALL failing rows for the host (post-framework-filter, pre-limit).
             */
            total_failing: number;
            rules: components["schemas"]["HostFailedRule"][];
        };
        HostScanContext: {
            /**
             * Format: date-time
             * @description finished_at of the latest completed scan run; null when never scanned.
             */
            last_scan_at: string | null;
            /**
             * Format: uuid
             * @description id of the latest completed scan run; null when never scanned.
             */
            scan_id: string | null;
            /** @description Policy version of the latest completed run; empty when never scanned. */
            policy_version: string;
            /** @description Wall-clock duration of the latest completed run (finished_at - started_at); null when never scanned or timestamps absent. */
            duration_seconds?: number | null;
        };
        HostComplianceLensSummary: {
            /** Format: int64 */
            passing: number;
            /** Format: int64 */
            failing: number;
            /** Format: int64 */
            skipped: number;
            /** Format: int64 */
            error: number;
            /** Format: int64 */
            total: number;
            /**
             * Format: double
             * @description passing/total as a percentage rounded to one decimal; 0 when total is 0.
             */
            score_pct: number;
        };
        HostComplianceCategory: {
            /** @description Kensa catalog category; uncategorized when the catalog lacks the rule. */
            category: string;
            /** Format: int64 */
            passing: number;
            /** Format: int64 */
            failing: number;
            /** Format: int64 */
            total: number;
        };
        HostComplianceRule: {
            rule_id: string;
            /** @description Catalog title; falls back to rule_id when the catalog lacks the rule. */
            title: string;
            /** @description First sentence of the catalog description; empty when the catalog lacks the rule. Catalog text only, never stored check output. */
            description: string;
            /** @description Catalog category; uncategorized when unknown. */
            category: string;
            /** @description Stored severity; empty when the scan recorded none. */
            severity: string;
            /** @description current_status of the rule on this host (pass, fail, skipped, error). */
            status: string;
            /** @description Control ids for the requested framework; empty unless ?framework= is given. */
            control_ids: string[];
            /** Format: date-time */
            last_checked_at: string;
        };
        HostComplianceLensResponse: {
            scan_context: components["schemas"]["HostScanContext"];
            summary: components["schemas"]["HostComplianceLensSummary"];
            categories: components["schemas"]["HostComplianceCategory"][];
            rules: components["schemas"]["HostComplianceRule"][];
        };
        HostComplianceFramework: {
            framework_id: string;
            /**
             * Format: int64
             * @description Number of host_rule_state rows mapped to this framework.
             */
            rule_count: number;
            /** @description Rows mapped to this framework with current_status pass. */
            passing: number;
            /** @description Rows mapped to this framework with current_status fail. */
            failing: number;
            /**
             * Format: float
             * @description passing/rule_count as a percentage rounded to one decimal; 0 when rule_count is 0. Powers the per-lens score on the View-as chips.
             */
            score_pct: number;
        };
        HostComplianceFrameworksResponse: {
            /** @description The all-rules aggregate (framework_id "all"). Powers the All-rules chip score. */
            overall: components["schemas"]["HostComplianceFramework"];
            frameworks: components["schemas"]["HostComplianceFramework"][];
        };
        HostListComplianceSummary: {
            /** Format: int64 */
            passing: number;
            /** Format: int64 */
            failing: number;
            /** Format: int64 */
            skipped: number;
            /** Format: int64 */
            error: number;
            /** Format: int64 */
            total: number;
            /**
             * Format: int64
             * @description Rows with current_status=fail and critical severity (case-insensitive).
             */
            critical_failing: number;
        };
        FleetScanQueue: {
            /** Format: int64 */
            queued: number;
            /** Format: int64 */
            running: number;
        };
        HostDetailResponse: {
            host: components["schemas"]["HostResponse"];
            /** @description Null when no liveness probe has ever run against this host. */
            liveness?: components["schemas"]["HostLiveness"] | null;
            compliance_summary: components["schemas"]["HostComplianceSummary"];
        };
        HostListItem: {
            /** Format: uuid */
            id: string;
            hostname: string;
            ip_address: string;
            port: number;
            display_name?: string;
            description?: string;
            environment: string;
            tags?: string[];
            /** Format: uuid */
            group_id?: string | null;
            username?: string;
            /** Format: uuid */
            created_by?: string;
            /** Format: date-time */
            created_at?: string;
            /** Format: date-time */
            updated_at?: string;
            maintenance_mode?: boolean;
            check_priority?: number;
            /** Format: date-time */
            last_scan_at?: string | null;
            /** Format: uuid */
            latest_scan_id?: string | null;
            /** @description Null when no liveness probe has ever run against this host. */
            liveness?: components["schemas"]["HostLiveness"] | null;
            /** @description Null when the host has no host_rule_state rows (never scanned). */
            compliance_summary?: components["schemas"]["HostListComplianceSummary"] | null;
            os_family?: string | null;
            os_version?: string | null;
            architecture?: string | null;
            platform_identifier?: string | null;
            /** Format: date-time */
            os_discovered_at?: string | null;
        };
        HostListResponse: {
            hosts: components["schemas"]["HostListItem"][];
        };
        HostCreateRequest: {
            hostname: string;
            ip_address: string;
            port?: number;
            display_name?: string;
            description?: string;
            environment?: string;
            tags?: string[];
            /** Format: uuid */
            group_id?: string | null;
            username?: string;
        };
        HostUpdateRequest: {
            ip_address?: string;
            port?: number;
            display_name?: string;
            description?: string;
            environment?: string;
            tags?: string[];
            /** Format: uuid */
            group_id?: string | null;
            username?: string;
        };
        CredentialCreateRequest: {
            /** @enum {string} */
            scope: "system" | "host";
            /** Format: uuid */
            scope_id?: string | null;
            name: string;
            description?: string;
            username: string;
            /** @enum {string} */
            auth_method: "ssh_key" | "password" | "both";
            password?: string;
            private_key?: string;
            private_key_passphrase?: string;
            is_default?: boolean;
        };
        CredentialUpdateRequest: {
            name?: string;
            description?: string;
            username?: string;
            /** @enum {string} */
            auth_method?: "ssh_key" | "password" | "both";
            /** @description Re-encrypts and replaces the stored password when non-empty; omit to keep the current secret */
            password?: string;
            /** @description Re-encrypts and replaces the stored key when non-empty; omit to keep the current secret */
            private_key?: string;
            /** @description Re-encrypts and replaces the stored passphrase when non-empty; omit to keep the current secret */
            private_key_passphrase?: string;
            /** @description Setting true on a system credential atomically demotes the previous system default */
            is_default?: boolean;
        };
        CredentialCloneRequest: {
            /** @enum {string} */
            scope: "system" | "host";
            /**
             * Format: uuid
             * @description Required when scope=host
             */
            scope_id?: string | null;
            /** @description Defaults to '<source name> (clone)' when omitted */
            name?: string;
            /** @description Mark this clone as the system default (only valid when scope=system) */
            is_default?: boolean;
        };
        HealthResponse: {
            /** @enum {string} */
            status: "healthy" | "degraded";
            db_connected: boolean;
            version: string;
        };
        VersionResponse: {
            /** @description OpenWatch semver (ldflags-injected) */
            openwatch: string;
            /** @description Embedded Kensa engine module version (build info) */
            kensa: string;
            /** @description Go toolchain version the binary was built with */
            go: string;
            /** @description Abbreviated git commit */
            commit: string;
            /** @description ISO-8601 build timestamp */
            build_time: string;
        };
        EchoRequest: {
            message: string;
        };
        EchoResponse: {
            echoed: string;
            correlation_id: string;
            /** Format: uuid */
            audit_event_id?: string;
        };
        LicenseStateResponse: {
            /** @enum {string} */
            tier: "free" | "openwatch_plus" | "enterprise";
            /** @enum {string} */
            status: "active" | "grace" | "expired" | "no_license" | "invalid";
            features: string[];
            customer_id?: string;
            /** Format: date-time */
            expires_at?: string | null;
            in_grace_period?: boolean;
            using_prev_key?: boolean;
        };
        LicenseVerifyRequest: {
            license_jwt: string;
        };
        LicenseVerifyResponse: {
            is_valid: boolean;
            verify_result: string;
            tier?: string | null;
            features?: string[] | null;
            /** Format: date-time */
            expires_at?: string | null;
            warnings?: string[] | null;
        };
        AuditEvent: {
            /** Format: uuid */
            id: string;
            correlation_id: string;
            action: string;
            message?: string;
            severity?: string;
            actor_type: string;
            actor_id?: string | null;
            actor_label?: string | null;
            resource_type?: string | null;
            resource_id?: string | null;
            /** Format: date-time */
            occurred_at: string;
            /** Format: date-time */
            recorded_at?: string;
            detail?: {
                [key: string]: unknown;
            };
            redactions?: string[];
        };
        AuditEventsPage: {
            items: components["schemas"]["AuditEvent"][];
            /** @description Opaque cursor; pass as ?cursor= to fetch the next page */
            next_cursor: string | null;
        };
        FleetScore: {
            /**
             * Format: double
             * @description Passing rules / (passing + failing) across all hosts. 0..1.
             */
            passing_fraction: number;
            /**
             * Format: int64
             * @description Count of host_rule_state rows where current_status is pass or fail.
             */
            total_evaluations: number;
        };
        FleetLiveness: {
            /** Format: int64 */
            reachable: number;
            /** Format: int64 */
            unreachable: number;
            /** Format: int64 */
            unknown: number;
            /** Format: int64 */
            never_probed: number;
        };
        ConnectivityBreakdown: {
            /**
             * Format: int64
             * @description reachable + consecutive_failures=0
             */
            online: number;
            /**
             * Format: int64
             * @description reachable + consecutive_failures>=1
             */
            degraded: number;
            /**
             * Format: int64
             * @description unreachable + consecutive_failures<3
             */
            critical: number;
            /**
             * Format: int64
             * @description consecutive_failures>=3
             */
            down: number;
            /**
             * Format: int64
             * @description no host_liveness row exists
             */
            never_probed: number;
        };
        ConnectivityConfig: {
            /** @description Probe interval for reachable hosts with consecutive_failures=0 (60..86400). Default 900 (15m) */
            online_sec: number;
            /** @description Probe interval for reachable hosts with consecutive_failures>=1 (60..86400). Default 300 (5m) */
            degraded_sec: number;
            /** @description Probe interval for unreachable hosts below the threshold (60..86400). Default 120 (2m) */
            critical_sec: number;
            /** @description Probe interval for hosts at or above the threshold (60..86400). Default 1800 (30m) */
            down_sec: number;
            /** @description Persisted band interval for hosts in maintenance (60..86400). Default 3600 (60m). Not yet auto-applied; tracked for the per-host maintenance slice */
            maintenance_sec: number;
            /** @description Per-probe TCP-banner timeout in seconds (1..30) */
            timeout_sec: number;
            /** @description Consecutive failures before reachable→unreachable (1..10) */
            unreachable_threshold: number;
            /** @description Max concurrent SSH connections during fleet sweeps (1..200) */
            rate_limit: number;
            /** @description When true, probe loop ticks but probes no hosts */
            maintenance_global: boolean;
        };
        ConnectivityConfigResponse: {
            config: components["schemas"]["ConnectivityConfig"];
            defaults: components["schemas"]["ConnectivityConfig"];
        };
        IntelligenceConfig: {
            /** @description Per-host cadence the scheduler advances next_intelligence_at by after a successful RunCycle (300..86400). Default 3600 (1h) */
            interval_sec: number;
            /** @description Max concurrent RunCycles per scheduler instance (1..200). Default 10 */
            rate_limit: number;
            /** @description When true, the scheduler loop ticks but RunCycles no hosts */
            maintenance_global: boolean;
        };
        IntelligenceConfigResponse: {
            config: components["schemas"]["IntelligenceConfig"];
            defaults: components["schemas"]["IntelligenceConfig"];
        };
        DiscoveryConfig: {
            /** @description Per-host cadence — a host's discovery becomes due once now() - hosts.os_discovered_at exceeds this many seconds. 3600..604800. Default 86400 (24h) */
            interval_sec: number;
            /** @description Max host.discovery jobs enqueued per scheduler tick (1..500). Default 25. Bounds thundering-herd on a fleet that hits NULL os_discovered_at simultaneously */
            rate_limit: number;
            /** @description When true, POST /api/v1/hosts auto-enqueues a host.discovery job for the new host before returning 201. When false, new hosts stay at hosts.os_discovered_at NULL until the scheduler picks them up or an operator clicks Re-run discovery */
            detect_on_first_contact: boolean;
            /** @description When true, the scheduler loop ticks but enqueues no jobs and the host-create gate behaves as if detect_on_first_contact is false */
            maintenance_global: boolean;
        };
        DiscoveryConfigResponse: {
            config: components["schemas"]["DiscoveryConfig"];
            defaults: components["schemas"]["DiscoveryConfig"];
        };
        DiscoverySweepResponse: {
            /** @description Count of host.discovery jobs persisted by this sweep. Zero is a valid steady state (every host already discovered, or fleet empty) */
            enqueued: number;
        };
        ScanConfig: {
            /** @description Master switch for the adaptive scheduler. When false the loop ticks but dispatches nothing. On-demand scans are unaffected */
            enabled: boolean;
            /** @description Re-scan interval (minutes) for never-classified hosts. Clamped into [5, 2880] */
            unknown_mins: number;
            /** @description Re-scan interval (minutes) for hosts in the critical band (score under 20 or any critical finding). Clamped into [5, 2880] */
            critical_mins: number;
            /** @description Re-scan interval (minutes) for the non_compliant band (score 20 to 49). Clamped into [5, 2880] */
            non_compliant_mins: number;
            /** @description Re-scan interval (minutes) for the partial band (score 50 to 69). Clamped into [5, 2880] */
            partial_mins: number;
            /** @description Re-scan interval (minutes) for the mostly_compliant band (score 70 to 89). Clamped into [5, 2880] */
            mostly_compliant_mins: number;
            /** @description Re-scan interval (minutes) for the compliant band (score 90 and above). Clamped into [5, 2880] */
            compliant_mins: number;
            /** @description Max hosts dispatched per 60s scheduler tick. Clamped into [1, 100] */
            rate_limit: number;
            /** @description When true the scheduler loop ticks but dispatches nothing (fleet-wide pause) */
            maintenance_global: boolean;
        };
        ScanConfigResponse: {
            config: components["schemas"]["ScanConfig"];
            defaults: components["schemas"]["ScanConfig"];
        };
        ScanSchedulePreview: {
            /**
             * Format: date-time
             * @description Soonest next_scheduled_scan across non-maintenance hosts; null when no schedule rows exist
             */
            next_scan_at?: string | null;
            /** @description Hosts whose next_scheduled_scan has already passed (dispatch backlog) */
            due_now: number;
            /** @description scan_runs rows currently queued */
            queued_jobs: number;
            /** @description scan_runs rows currently running */
            running_jobs: number;
            /** @description 24 entries, one per hour from now; due count of hosts whose next_scheduled_scan falls inside that hour */
            buckets: {
                /** @description Hours from now (0 = the coming hour) */
                hour_offset: number;
                due_count: number;
            }[];
        };
        ScanVariablesResponse: {
            /** @description Corpus-used variables sorted by name */
            variables: {
                name: string;
                /** @description kensa built-in default in effect without an override */
                default: string;
                /** @description Effective value (override when set, else the default) */
                value: string;
                overridden: boolean;
                /** @description Count of corpus rules referencing the variable */
                affects_rules: number;
                /** @description The referencing rule ids, sorted */
                rule_ids: string[];
                /** @description Organization-specific placeholder default the operator should always review */
                configure_me: boolean;
            }[];
        };
        ScanVariableOverrides: {
            /** @description Variable name to override value. PUT replaces the full map */
            overrides: {
                [key: string]: string;
            };
        };
        Exception: {
            /** Format: uuid */
            id: string;
            /** Format: uuid */
            host_id: string;
            /** @description Hostname, populated on list responses (empty on single-row lifecycle results) */
            host_name?: string;
            rule_id: string;
            reason: string;
            /** @enum {string} */
            status: "requested" | "approved" | "rejected" | "revoked" | "expired";
            /** Format: uuid */
            requested_by: string;
            /** Format: uuid */
            reviewed_by?: string | null;
            review_note?: string;
            /** Format: date-time */
            expires_at?: string | null;
            /** Format: date-time */
            requested_at: string;
            /** Format: date-time */
            reviewed_at?: string | null;
        };
        ExceptionList: {
            exceptions: components["schemas"]["Exception"][];
        };
        ExceptionRequest: {
            rule_id: string;
            reason: string;
            /**
             * Format: date-time
             * @description Optional expiry; null means active until revoked
             */
            expires_at?: string | null;
        };
        ExceptionReview: {
            /** @description Optional reviewer note */
            note?: string;
        };
        /** @description Estimated per-framework compliance-score delta (percentage points) if the rule flips to pass. Best-effort; a field is null when that framework's data is unavailable for the host. */
        ProjectedLift: {
            /** Format: double */
            cis?: number | null;
            /** Format: double */
            stig?: number | null;
            /** Format: double */
            nist?: number | null;
        };
        RemediationRequest: {
            /** Format: uuid */
            id: string;
            /** Format: uuid */
            host_id: string;
            /** @description Hostname, populated on list responses (empty on single-row lifecycle results) */
            host_name?: string;
            rule_id: string;
            /** @enum {string} */
            status: "pending_approval" | "approved" | "rejected" | "dry_run_complete" | "executing" | "executed" | "rolled_back" | "failed";
            /** Format: uuid */
            requested_by: string;
            /** Format: uuid */
            reviewed_by?: string | null;
            review_note?: string;
            /** Format: uuid */
            scan_run_id?: string | null;
            /** @description Kensa remediation handler id (empty when unknown at request time) */
            mechanism?: string;
            reboot_required?: boolean;
            transactional?: boolean;
            projected_lift?: components["schemas"]["ProjectedLift"];
            /** Format: date-time */
            requested_at: string;
            /** Format: date-time */
            reviewed_at?: string | null;
        };
        RemediationRequestList: {
            requests: components["schemas"]["RemediationRequest"][];
        };
        RemediationRequestCreate: {
            /** Format: uuid */
            host_id: string;
            rule_id: string;
            /**
             * Format: uuid
             * @description Optional provenance - the scan run whose finding this remediates
             */
            scan_run_id?: string | null;
        };
        RemediationReview: {
            /** @description Optional reviewer note */
            note?: string;
        };
        RemediationStep: {
            /** Format: uuid */
            id: string;
            rule_id: string;
            mechanism?: string;
            /** @enum {string|null} */
            phase_result?: "committed" | "rolled_back" | "skipped" | null;
            dry_run: boolean;
            /** Format: date-time */
            applied_at?: string | null;
        };
        RemediationStepList: {
            steps: components["schemas"]["RemediationStep"][];
        };
        Group: {
            /** Format: uuid */
            id: string;
            name: string;
            /** @enum {string} */
            kind: "site" | "os_category";
            /** @description Free-form sub-classifier (may be empty) */
            subtype: string;
            /** @description Design-token color key (e.g. info) */
            color: string;
            /** @enum {string} */
            membership: "manual" | "auto";
            /** @description OS family an auto group matches on (empty for manual groups) */
            match_family?: string;
            maintenance: boolean;
            /** Format: date-time */
            created_at: string;
            /** Format: date-time */
            updated_at: string;
        };
        GroupMember: {
            /** Format: uuid */
            host_id: string;
            hostname: string;
            /** @description Host monitoring band (online, down, unknown, ...) */
            status: string;
        };
        GroupRollup: {
            hosts: number;
            online: number;
            down: number;
            critical_hosts: number;
            /** @description Mean compliance across scanned members; null when none scanned */
            avg_compliance_pct?: number | null;
            members: components["schemas"]["GroupMember"][];
        };
        GroupWithRollup: components["schemas"]["Group"] & {
            rollup: components["schemas"]["GroupRollup"];
        };
        GroupSummary: {
            groups: number;
            sites: number;
            os_categories: number;
            hosts_maintenance: number;
            /** @description Fleet mean compliance; null when nothing scanned */
            avg_compliance_pct?: number | null;
            ungrouped: number;
        };
        GroupListResponse: {
            summary: components["schemas"]["GroupSummary"];
            groups: components["schemas"]["GroupWithRollup"][];
        };
        Report: {
            /** Format: uuid */
            id: string;
            title: string;
            /** @enum {string} */
            kind: "executive";
            scope_label: string;
            /** Format: date-time */
            data_as_of: string;
            generated_by: string;
            format: string;
            /**
             * @description The rendered JSON posture document. For an executive summary:
             *     compliance_pct, host_count, passing_rules, failing_rules,
             *     critical_issues, top_failing_rules.
             */
            content: {
                [key: string]: unknown;
            };
            /** Format: date-time */
            created_at: string;
        };
        ReportListResponse: {
            reports: components["schemas"]["Report"][];
        };
        /** @description One scan_runs row — a scan's metadata and outcome counts. */
        ScanSummary: {
            /** Format: uuid */
            scan_id: string;
            /** Format: uuid */
            host_id: string;
            hostname?: string;
            ip_address?: string;
            /** @description queued | running | completed | failed */
            status: string;
            /** @description on_demand | scheduled */
            trigger_source: string;
            /** Format: date-time */
            queued_at: string;
            /** Format: date-time */
            started_at?: string | null;
            /** Format: date-time */
            finished_at?: string | null;
            policy_version: string;
            rules_pass: number;
            rules_fail: number;
            rules_skipped: number;
            rules_error: number;
        };
        ScanList: {
            scans: components["schemas"]["ScanSummary"][];
            /**
             * Format: date-time
             * @description Pass as ?cursor= to fetch the next page; absent when exhausted
             */
            next_cursor?: string;
        };
        /** @description Host-independent remediation summary from the kensa read model (facts only; risk level is operator policy, owned by OpenWatch). */
        RuleRemediation: {
            /** @description true when an automated (non-manual) remediation exists */
            available: boolean;
            /** @description distinct remediation mechanisms across implementations (e.g. config_set, service_enabled) */
            mechanisms: string[];
            /** @description services the remediation reloads or restarts */
            restarts_services: string[];
            /** @description kensa reboot signal: "boot-param" (staged boot change, pending reboot) or "none" (not a complete requires-reboot answer) */
            reboot_behavior: string;
        };
        /** @description One normalized Kensa rule for the library browser. */
        RuleListItem: {
            id: string;
            title: string;
            description: string;
            /** @description the rule's apply path is a capturable atomic transaction (the "atomic" signal) */
            transactional: boolean;
            /** @description critical | high | medium | low */
            severity: string;
            category: string;
            tags: string[];
            /** @description framework_id -> control ids (same shape as scan results) */
            framework_refs: {
                [key: string]: string[];
            };
            remediation: components["schemas"]["RuleRemediation"];
        };
        RuleList: {
            rules: components["schemas"]["RuleListItem"][];
            /** @description total rules in the library */
            total: number;
        };
        /** @description One rule's durable verdict for a scan. No inline check output. */
        ScanRuleResult: {
            rule_id: string;
            /** @description human rule title from the catalog (falls back to rule_id) */
            title: string;
            /** @description catalog category (falls back to "uncategorized") */
            category: string;
            /** @description pass | fail | skipped | error */
            status: string;
            /** @description critical | high | medium | low | "" when unset */
            severity: string;
            /** @description one-line catalog description of what the rule checks; empty when uncatalogued */
            description?: string;
            /** @description framework_id -> control ids */
            framework_refs: {
                [key: string]: string[];
            };
            skip_reason?: string;
            /** @description true when this rule has stored check output to drill into */
            has_evidence: boolean;
        };
        ScanDetail: {
            scan: components["schemas"]["ScanSummary"];
            results: components["schemas"]["ScanRuleResult"][];
        };
        /** @description One command's reproducible evidence (mirrors kensa CheckEvidence). */
        ScanCheckEvidence: {
            method: string;
            command?: string;
            stdout?: string;
            stderr?: string;
            exit_code: number;
            expected?: string;
            actual?: string;
            truncated?: boolean;
        };
        /** @description One rule's full drill-down payload — the stored evidence unwrapped plus metadata. */
        ScanRuleEvidence: {
            rule_id: string;
            /** @description pass | fail | skipped | error */
            status: string;
            severity: string;
            /** @description human-readable verdict context */
            detail: string;
            /** @description present only when status is error */
            error?: string;
            checks: components["schemas"]["ScanCheckEvidence"][];
            framework_refs: {
                [key: string]: string[];
            };
            skip_reason?: string;
        };
        /** @description An OSCAL 1.0.6 Assessment Results document (JSON), as produced by Kensa's exporter. Opaque to OpenWatch — passed through verbatim. */
        OscalDocument: {
            [key: string]: unknown;
        };
        GroupCreate: {
            name: string;
            /** @enum {string} */
            kind: "site" | "os_category";
            subtype?: string;
            color?: string;
            /** @enum {string} */
            membership: "manual" | "auto";
            /** @description Required for auto membership; must be empty for manual */
            match_family?: string;
        };
        GroupUpdate: {
            name: string;
            subtype?: string;
            color?: string;
        };
        GroupMaintenanceRequest: {
            on: boolean;
        };
        GroupMemberRequest: {
            /** Format: uuid */
            host_id: string;
        };
        HostComplianceSchedule: {
            /** @description The scan config enabled flag */
            scheduler_enabled: boolean;
            /** @description True when the scheduler dispatches nothing fleet-wide (disabled or global maintenance) */
            scheduler_paused: boolean;
            /** @enum {string} */
            compliance_state: "critical" | "non_compliant" | "partial" | "mostly_compliant" | "compliant" | "unknown";
            /**
             * Format: date-time
             * @description Null when the host has no schedule row yet
             */
            next_scan_at?: string | null;
            /** @description Current per-state interval; 0 when unseeded */
            interval_minutes: number;
            /** @description Per-host maintenance flag on the schedule row */
            host_maintenance: boolean;
        };
        HostComplianceTrend: {
            /** @description One entry per day with a snapshot, oldest first */
            days: {
                /** Format: date */
                date: string;
                score_pct: number;
                passing: number;
                failing: number;
                total: number;
            }[];
        };
        FleetComplianceTrend: {
            /** @description One entry per day with snapshots, oldest first */
            days: {
                /** Format: date */
                date: string;
                avg_score_pct: number;
                hosts: number;
                failing: number;
                critical_hosts: number;
            }[];
        };
        FleetComplianceStates: {
            /** @description One entry per ComplianceState in ladder order; zero-count states included */
            states: {
                /** @enum {string} */
                state: "critical" | "non_compliant" | "partial" | "mostly_compliant" | "compliant" | "unknown";
                host_count: number;
            }[];
        };
        ConnectivityStatus: {
            /**
             * Format: date-time
             * @description Most recent probe-start time; null until the first tick
             */
            last_probe_at?: string | null;
            /** Format: int64 */
            probe_count: number;
            /** Format: int64 */
            probe_success_count: number;
            /** Format: int64 */
            probe_failure_count: number;
            /** Format: int64 */
            state_transition_count: number;
            /** @description Mirrors connectivity_config.maintenance_global */
            maintenance_active: boolean;
        };
        ConnectivityCheckResult: {
            reachable: boolean;
            /** @description 0 on failure */
            response_time_ms: number;
            /** @description tcp_timeout, connection_refused, banner_mismatch, or tcp_error; null on success */
            error_type?: string | null;
            /** Format: date-time */
            probed_at: string;
            /**
             * @description Post-hysteresis status (same value the periodic loop would write)
             * @enum {string}
             */
            new_reachability_status: "reachable" | "unreachable" | "unknown";
        };
        ScanRunQueued: {
            /**
             * Format: uuid
             * @description scan_runs.id == queue job id == transactions.scan_id
             */
            scan_id: string;
            /** @enum {string} */
            status: "queued";
            /** Format: date-time */
            queued_at: string;
        };
        IntelligenceEvent: {
            /** Format: uuid */
            id: string;
            /** Format: uuid */
            host_id: string;
            /** @description Closed taxonomy: e.g. system.package.updated */
            event_code: string;
            /** @enum {string} */
            severity: "info" | "low" | "medium" | "high" | "critical";
            detail?: {
                [key: string]: unknown;
            };
            /** Format: date-time */
            occurred_at: string;
            /** Format: date-time */
            detected_at: string;
            correlation_id?: string;
        };
        IntelligenceEventsPage: {
            items: components["schemas"]["IntelligenceEvent"][];
            next_cursor?: string | null;
        };
        IntelligenceState: {
            /** Format: uuid */
            host_id: string;
            /** @description Free-form host_intelligence_state.snapshot — mirrors collector.Snapshot */
            snapshot: {
                [key: string]: unknown;
            };
            /** Format: date-time */
            collected_at: string;
        };
        Alert: {
            /** Format: uuid */
            id: string;
            dedup_key: string;
            alert_type: string;
            /** @enum {string} */
            severity: "info" | "low" | "medium" | "high" | "critical";
            /** Format: uuid */
            host_id?: string | null;
            rule_id?: string;
            title: string;
            body?: string;
            tags?: {
                [key: string]: string;
            };
            /** @enum {string} */
            state: "active" | "acknowledged" | "silenced" | "resolved" | "dismissed";
            /** Format: date-time */
            occurred_at: string;
            /** Format: uuid */
            acknowledged_by?: string | null;
            /** Format: date-time */
            acknowledged_at?: string | null;
            /** Format: uuid */
            silenced_by?: string | null;
            /** Format: date-time */
            silenced_until?: string | null;
            /** Format: uuid */
            resolved_by?: string | null;
            /** Format: date-time */
            resolved_at?: string | null;
            /** Format: uuid */
            dismissed_by?: string | null;
            /** Format: date-time */
            dismissed_at?: string | null;
            /** Format: date-time */
            created_at?: string;
            /** Format: date-time */
            updated_at?: string;
        };
        AlertsPage: {
            items: components["schemas"]["Alert"][];
            next_cursor?: string | null;
        };
        Activity: {
            /** Format: uuid */
            id: string;
            /** @enum {string} */
            source: "alert" | "transaction" | "intelligence" | "audit" | "monitoring";
            /** @enum {string} */
            severity: "info" | "low" | "medium" | "high" | "critical";
            /** Format: uuid */
            host_id?: string | null;
            title: string;
            summary?: string;
            /** Format: date-time */
            occurred_at: string;
        };
        ActivityPage: {
            items: components["schemas"]["Activity"][];
            hidden_count: number;
            next_cursor?: string | null;
        };
        /** @description Optional body for POST lifecycle endpoints. silence accepts an optional until; all accept a reason for the audit detail. */
        AlertLifecycleRequest: {
            reason?: string;
            /** Format: date-time */
            until?: string | null;
        };
        /**
         * @description Result of a Discovery run. Mirrors the host_system_info table
         *     column-for-column. Spec system-host-discovery.
         */
        HostSystemInfo: {
            /** Format: uuid */
            host_id: string;
            os_name?: string | null;
            os_version?: string | null;
            os_version_full?: string | null;
            os_id?: string | null;
            os_id_like?: string | null;
            os_pretty_name?: string | null;
            platform_identifier?: string | null;
            /** @description Distro ID from /etc/os-release (rhel, ubuntu, rocky, ...); rollup family (rhel/debian/suse/alpine/arch/gentoo/other) only when ID was empty. Spec system-host-discovery v1.3.0 AC-22. */
            os_family?: string | null;
            kernel_name?: string | null;
            kernel_release?: string | null;
            kernel_version?: string | null;
            architecture?: string | null;
            mem_total_mb?: number | null;
            mem_available_mb?: number | null;
            swap_total_mb?: number | null;
            disk_total_gb?: number | null;
            disk_used_gb?: number | null;
            disk_free_gb?: number | null;
            hostname?: string | null;
            fqdn?: string | null;
            /** @description Enforcing | Permissive | Disabled | empty if not present */
            selinux_status?: string | null;
            apparmor_enabled?: boolean | null;
            /** @description firewalld | ufw | nftables | iptables | empty */
            firewall_service?: string | null;
            firewall_status?: string | null;
            /** Format: date-time */
            collected_at: string;
        };
        FleetRuleFailure: {
            rule_id: string;
            /** Format: int64 */
            failing_host_count: number;
        };
        FleetTopFailingRules: {
            items: components["schemas"]["FleetRuleFailure"][];
        };
        FleetHostFailure: {
            /** Format: uuid */
            host_id: string;
            /** Format: int64 */
            failing_rule_count: number;
        };
        FleetTopFailingHosts: {
            items: components["schemas"]["FleetHostFailure"][];
        };
        FleetTransaction: {
            /** Format: uuid */
            id: string;
            /** Format: uuid */
            host_id: string;
            rule_id: string;
            /** @enum {string} */
            status: "pass" | "fail" | "skipped" | "error";
            severity?: string;
            /** @enum {string} */
            change_kind: "first_seen" | "state_changed" | "severity_changed";
            /** Format: date-time */
            occurred_at: string;
        };
        FleetRecentChanges: {
            items: components["schemas"]["FleetTransaction"][];
        };
        ErrorEnvelope: {
            error: {
                code: string;
                /** @enum {string} */
                fault: "client" | "server" | "policy" | "external";
                retryable: boolean;
                human_message: string;
                detail?: {
                    [key: string]: unknown;
                };
                correlation_id?: string;
            };
        };
        AuthMePermissionsResponse: {
            identity: {
                id: string;
                role: string;
                is_anonymous: boolean;
            };
            permissions: string[];
        };
        PermissionEntry: {
            id: string;
            category: string;
            description: string;
            dangerous: boolean;
            license_gated?: string;
        };
        CategoryEntry: {
            id: string;
            description: string;
        };
        RoleEntry: {
            id: string;
            description: string;
            is_built_in: boolean;
            permissions: string[];
        };
        PermissionsRegistryResponse: {
            categories: components["schemas"]["CategoryEntry"][];
            permissions: components["schemas"]["PermissionEntry"][];
            roles: components["schemas"]["RoleEntry"][];
        };
        AdminRolesResponse: {
            roles: components["schemas"]["RoleEntry"][];
        };
        EvaluateAlertRequest: {
            score: number;
        };
        PolicyDecisionResponse: {
            outcome: string;
            policy_type: string;
            policy_version: string;
            reason: string;
            human_message?: string;
            detail?: {
                [key: string]: unknown;
            };
        };
        EnqueueTestJobResponse: {
            /** Format: uuid */
            job_id: string;
            correlation_id: string;
        };
        PoliciesReloadResponse: {
            outcomes: {
                [key: string]: string;
            };
        };
    };
    responses: {
        /** @description Validation, pagination, or idempotency error */
        BadRequest: {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorEnvelope"];
            };
        };
        /** @description Wrong HTTP method */
        MethodNotAllowed: {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorEnvelope"];
            };
        };
        /** @description Caller lacks the required permission */
        Forbidden: {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorEnvelope"];
            };
        };
        /** @description Resource not found */
        NotFound: {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorEnvelope"];
            };
        };
        /** @description Backing service not wired on the server */
        ServiceUnavailable: {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorEnvelope"];
            };
        };
    };
    parameters: never;
    requestBodies: never;
    headers: never;
    pathItems: never;
}
export type $defs = Record<string, never>;
export interface operations {
    postAuthLogin: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuthLoginRequest"];
            };
        };
        responses: {
            /** @description Login succeeded; tokens issued */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthLoginResponse"];
                };
            };
            /** @description Invalid credentials or MFA required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAuthLogout: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Session revoked */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
        };
    };
    postAuthRefresh: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuthRefreshRequest"];
            };
        };
        responses: {
            /** @description New token pair issued */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthLoginResponse"];
                };
            };
            /** @description Refresh token invalid, expired, or reused (cascade revoke triggered) */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAuthRefreshCookie: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Cookies rotated; identity returned */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthMeResponse"];
                };
            };
            /** @description Refresh cookie missing, invalid, expired, or reused. Both auth cookies are cleared. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getAuthMe: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Identity */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthMeResponse"];
                };
            };
            /** @description No valid session or bearer */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getUsersMePreferences: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The caller's stored preferences */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserPreferences"];
                };
            };
            /** @description No valid session or bearer */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    patchUsersMePreferences: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserPreferences"];
            };
        };
        responses: {
            /** @description The merged preferences */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserPreferences"];
                };
            };
            /** @description Malformed body */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description No valid session or bearer */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAuthMFAEnroll: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Provisioning URI returned for the authenticator app */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthMFAEnrollResponse"];
                };
            };
        };
    };
    postAuthMFAVerify: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuthMFAVerifyRequest"];
            };
        };
        responses: {
            /** @description MFA verified */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description MFA OTP invalid or replayed */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAuthPasswordChange: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuthPasswordChangeRequest"];
            };
        };
        responses: {
            /** @description Password updated */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description New password rejected by policy */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Current password wrong */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHealth: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Service is healthy */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HealthResponse"];
                };
            };
            /** @description Service is degraded or unavailable */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getVersion: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Version metadata for this deployment */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["VersionResponse"];
                };
            };
        };
    };
    postDiagnosticsEcho: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
                "X-Correlation-Id"?: string;
            };
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EchoRequest"];
            };
        };
        responses: {
            /** @description Echo succeeded */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EchoResponse"];
                };
            };
            400: components["responses"]["BadRequest"];
            405: components["responses"]["MethodNotAllowed"];
            /** @description Idempotency-Key reused with different body */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getLicense: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description License state */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["LicenseStateResponse"];
                };
            };
        };
    };
    postAdminLicenseVerify: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["LicenseVerifyRequest"];
            };
        };
        responses: {
            /** @description Verification result (success or typed failure) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["LicenseVerifyResponse"];
                };
            };
        };
    };
    postDiagnosticsPremiumEcho: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EchoRequest"];
            };
        };
        responses: {
            /** @description Echoed */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EchoResponse"];
                };
            };
            /** @description License does not include premium_diagnostics feature */
            402: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postDiagnosticsRequireHostRead: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EchoRequest"];
            };
        };
        responses: {
            /** @description Echoed (caller holds host:read) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EchoResponse"];
                };
            };
            /** @description Caller lacks host:read */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postDiagnosticsRequireHostWrite: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EchoRequest"];
            };
        };
        responses: {
            /** @description Echoed (caller holds host:write) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EchoResponse"];
                };
            };
            /** @description Caller lacks host:write */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postDiagnosticsEvaluateAlert: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EvaluateAlertRequest"];
            };
        };
        responses: {
            /** @description Policy decision */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PolicyDecisionResponse"];
                };
            };
        };
    };
    postDiagnosticsEnqueueTestJob: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Job accepted; worker will drain */
            202: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EnqueueTestJobResponse"];
                };
            };
        };
    };
    postAdminPoliciesReload: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Per-type reload outcomes */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PoliciesReloadResponse"];
                };
            };
            /** @description Caller lacks policy:reload */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postDiagnosticsRequireRemediationExecute: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["EchoRequest"];
            };
        };
        responses: {
            /** @description Echoed */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["EchoResponse"];
                };
            };
            /** @description License does not include remediation_execution */
            402: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks remediation:execute */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getAuthMePermissions: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Permission list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthMePermissionsResponse"];
                };
            };
        };
    };
    getAuthPermissionsRegistry: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Registry */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PermissionsRegistryResponse"];
                };
            };
        };
    };
    getUsers: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description User list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UsersListResponse"];
                };
            };
            /** @description Caller lacks user:read */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postUsers: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserCreateRequest"];
            };
        };
        responses: {
            /** @description User created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserResponse"];
                };
            };
            /** @description Validation or policy failure */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks user:write */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getUserByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description User */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserResponse"];
                };
            };
            /** @description User not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    deleteUserByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description User not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postUserRolesAssign: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserRoleAssignRequest"];
            };
        };
        responses: {
            /** @description Role assigned */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Unknown role id */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postUserRolesUnassign: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserRoleAssignRequest"];
            };
        };
        responses: {
            /** @description Role removed (idempotent) */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
        };
    };
    postUserResetPassword: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserPasswordResetRequest"];
            };
        };
        responses: {
            /** @description Password reset; the target's sessions were revoked */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description New password rejected by policy (too short/long/breached) */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks admin:user_manage permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description User not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postUserDisable: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The disabled user */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserResponse"];
                };
            };
            /** @description Caller lacks admin:user_manage permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description User not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Cannot disable your own account */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postUserEnable: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The re-enabled user */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserResponse"];
                };
            };
            /** @description Caller lacks admin:user_manage permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description User not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postRolesCreate: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["CustomRoleCreateRequest"];
            };
        };
        responses: {
            /** @description Custom role created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CustomRoleResponse"];
                };
            };
            /** @description Permission unknown */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Role id taken */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getRoles: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Role list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AdminRolesResponse"];
                };
            };
            /** @description Caller lacks role:read */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getCredentials: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Credential metadata list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialListResponse"];
                };
            };
            /** @description Caller lacks credential:read */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postCredentials: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["CredentialCreateRequest"];
            };
        };
        responses: {
            /** @description Credential created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialResponse"];
                };
            };
            /** @description Validation, invalid scope, host not found, or invalid SSH key */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Multiple system defaults */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getCredentialByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Credential metadata */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialResponse"];
                };
            };
            /** @description Credential not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    deleteCredentialByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted (is_active=false) */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Credential not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    patchCredentialByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["CredentialUpdateRequest"];
            };
        };
        responses: {
            /** @description Updated credential metadata */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialResponse"];
                };
            };
            /** @description Validation failure (unknown auth_method, missing required secret) */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Credential not found or already soft-deleted */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description is_default=true collides with an existing system default */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postCredentialClone: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["CredentialCloneRequest"];
            };
        };
        responses: {
            /** @description Clone created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialResponse"];
                };
            };
            /** @description Invalid scope, host not found, or validation failure */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Source credential not found or already soft-deleted */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description is_default=true collides with an existing system default */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHosts: {
        parameters: {
            query?: {
                environment?: string;
                tag?: string;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Host list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostListResponse"];
                };
            };
            /** @description Caller lacks host:read */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHosts: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["HostCreateRequest"];
            };
        };
        responses: {
            /** @description Host created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostResponse"];
                };
            };
            /** @description Validation failure (bad hostname, ip, port, etc.) */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Hostname already exists in environment */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostByID: {
        parameters: {
            query?: {
                /** @description Filter compliance_summary to host_rule_state rows whose framework_refs contains this key (v1.2.0). Liveness is unaffected. */
                framework?: string;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Host detail (includes liveness + compliance_summary) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostDetailResponse"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    deleteHostByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted (deleted_at set) */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    patchHostByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["HostUpdateRequest"];
            };
        };
        responses: {
            /** @description Host updated */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostResponse"];
                };
            };
            /** @description Validation failure */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHostCredentialsResolve: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                host_id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Resolved credential metadata */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["CredentialResponse"];
                };
            };
            /** @description No credential available for host or system default */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putHostMaintenance: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                host_id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["HostMaintenanceRequest"];
            };
        };
        responses: {
            /** @description Updated host */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostResponse"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostMonitoringHistory: {
        parameters: {
            query?: {
                limit?: number;
            };
            header?: never;
            path: {
                host_id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description History rows newest-first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostMonitoringHistoryResponse"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getAuditEvents: {
        parameters: {
            query?: {
                action?: string;
                correlation_id?: string;
                actor_type?: string;
                /** @description Filter to events whose resource_type matches (e.g. "host"). Pair with resource_id for a single resource's audit trail. */
                resource_type?: string;
                /** @description Filter to events whose resource_id matches (e.g. a host UUID). Typically paired with resource_type. */
                resource_id?: string;
                since?: string;
                until?: string;
                cursor?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Page of audit events */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuditEventsPage"];
                };
            };
            400: components["responses"]["BadRequest"];
        };
    };
    getFleetScore: {
        parameters: {
            query?: {
                /** @description Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0). */
                framework?: string;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Fleet score */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetScore"];
                };
            };
            /** @description Authentication required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetLiveness: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Liveness rollup */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetLiveness"];
                };
            };
            /** @description Authentication required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetTopFailingRules: {
        parameters: {
            query?: {
                /** @description Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0). */
                framework?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Ranked rule failures */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetTopFailingRules"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Authentication required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetTopFailingHosts: {
        parameters: {
            query?: {
                /** @description Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0). */
                framework?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Ranked host failures */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetTopFailingHosts"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Authentication required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetRecentChanges: {
        parameters: {
            query?: {
                /** @description Filter to transactions whose framework_refs contains this key (v1.1.0). */
                framework?: string;
                /** @description Filter to transactions strictly newer than this RFC3339 timestamp */
                since?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Recent transaction page */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetRecentChanges"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Authentication required */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetConnectivityBreakdown: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Per-state counts */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ConnectivityBreakdown"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemConnectivityConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current config + defaults sub-object */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ConnectivityConfigResponse"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putSystemConnectivityConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ConnectivityConfig"];
            };
        };
        responses: {
            /** @description Updated config snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ConnectivityConfig"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks system:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemIntelligenceConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current config + defaults sub-object */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["IntelligenceConfigResponse"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putSystemIntelligenceConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["IntelligenceConfig"];
            };
        };
        responses: {
            /** @description Updated config snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["IntelligenceConfig"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks system:config:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemDiscoveryConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current config + defaults sub-object */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DiscoveryConfigResponse"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putSystemDiscoveryConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["DiscoveryConfig"];
            };
        };
        responses: {
            /** @description Updated config snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DiscoveryConfig"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks system:config:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postSystemDiscoverySweep: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Sweep dispatched */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DiscoverySweepResponse"];
                };
            };
            /** @description Caller lacks system:config:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemScanConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current config + defaults sub-object */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanConfigResponse"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putSystemScanConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ScanConfig"];
            };
        };
        responses: {
            /** @description Updated (clamped) config snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanConfig"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks system:config:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemScanSchedulePreview: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Schedule projection */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanSchedulePreview"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetComplianceStates: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Per-state host counts */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetComplianceStates"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemScanVariables: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Corpus-used variables sorted by name */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanVariablesResponse"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    putSystemScanVariables: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ScanVariableOverrides"];
            };
        };
        responses: {
            /** @description The normalized override map that was persisted */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanVariableOverrides"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks system:config:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostExceptions: {
        parameters: {
            query?: {
                history?: boolean;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Exceptions, newest first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ExceptionList"];
                };
            };
            /** @description Caller lacks exception:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Unknown or deleted host */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHostException: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ExceptionRequest"];
            };
        };
        responses: {
            /** @description The requested exception */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Exception"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks exception:request permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Unknown or deleted host */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description An open exception already exists for this host and rule */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getComplianceExceptions: {
        parameters: {
            query?: {
                status?: "requested" | "approved" | "rejected" | "revoked" | "expired";
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Exceptions, newest first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ExceptionList"];
                };
            };
            /** @description Caller lacks exception:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postExceptionApprove: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                xid: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["ExceptionReview"];
            };
        };
        responses: {
            /** @description The approved exception */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Exception"];
                };
            };
            /** @description Caller lacks exception:approve permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Exception not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Not in the requested state, or reviewer is the requester */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postExceptionReject: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                xid: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["ExceptionReview"];
            };
        };
        responses: {
            /** @description The rejected exception */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Exception"];
                };
            };
            /** @description Caller lacks exception:approve permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Exception not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Not in the requested state, or reviewer is the requester */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postExceptionRevoke: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                xid: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["ExceptionReview"];
            };
        };
        responses: {
            /** @description The revoked exception */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Exception"];
                };
            };
            /** @description Caller lacks exception:revoke permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Exception not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Not in the approved state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    listRemediationRequests: {
        parameters: {
            query?: {
                status?: "pending_approval" | "approved" | "rejected" | "dry_run_complete" | "executing" | "executed" | "rolled_back" | "failed";
                host_id?: string;
                rule_id?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Remediation requests, newest first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationRequestList"];
                };
            };
            /** @description Caller lacks remediation:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    requestRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["RemediationRequestCreate"];
            };
        };
        responses: {
            /** @description The created remediation request (pending approval) */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationRequest"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks remediation:request permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Unknown or deleted host */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description An open remediation request already exists for this host and rule */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getRemediationRequest: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The remediation request */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationRequest"];
                };
            };
            /** @description Caller lacks remediation:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    listRemediationSteps: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Steps, in apply order */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationStepList"];
                };
            };
            /** @description Caller lacks remediation:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    approveRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["RemediationReview"];
            };
        };
        responses: {
            /** @description The approved remediation request */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationRequest"];
                };
            };
            /** @description Caller lacks remediation:approve permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Not in the pending_approval state, or reviewer is the requester */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    rejectRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["RemediationReview"];
            };
        };
        responses: {
            /** @description The rejected remediation request */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RemediationRequest"];
                };
            };
            /** @description Caller lacks remediation:approve permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Not in the pending_approval state, or reviewer is the requester */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    dryRunRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Caller lacks remediation:execute permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Dry-run not yet implemented */
            501: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    executeRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Execution queued; poll GET /requests/{rid} for executed|failed */
            202: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Caller lacks remediation:execute permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Request is not in the approved state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    rollbackRemediation: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                rid: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Rollback queued */
            202: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Caller lacks remediation:rollback permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Remediation request not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Request is not in the executed state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getGroups: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Summary plus groups with rollups */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["GroupListResponse"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postGroup: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["GroupCreate"];
            };
        };
        responses: {
            /** @description The created group */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Group"];
                };
            };
            /** @description Invalid group definition */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description An auto group already exists for that OS family */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    deleteGroup: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Group not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    patchGroup: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["GroupUpdate"];
            };
        };
        responses: {
            /** @description The updated group */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Group"];
                };
            };
            /** @description Invalid update */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Group not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postGroupMaintenance: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["GroupMaintenanceRequest"];
            };
        };
        responses: {
            /** @description The updated group */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Group"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Group not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postGroupMember: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["GroupMemberRequest"];
            };
        };
        responses: {
            /** @description Member added */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Cannot add a member to an auto group */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Group not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    deleteGroupMember: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
                host_id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Member removed */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getReports: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The reports library */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ReportListResponse"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postReportGenerate: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": Record<string, never>;
            };
        };
        responses: {
            /** @description The generated report */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Report"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getReportByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The report */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Report"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Report not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getScans: {
        parameters: {
            query: {
                host_id: string;
                limit?: number;
                /** @description queued_at of the last row already seen (RFC3339); omit to start at the newest */
                cursor?: string;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The host's scan history page */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanList"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getScanByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The scan detail */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanDetail"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Scan not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getScanRuleEvidence: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
                ruleId: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The rule's evidence */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanRuleEvidence"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Scan or rule not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getScanRuleOSCAL: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
                ruleId: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description OSCAL 1.0.6 Assessment Results JSON */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["OscalDocument"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Scan or rule not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getScanOSCAL: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description OSCAL 1.0.6 Assessment Results JSON */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["OscalDocument"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Scan not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getRules: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The rule library */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RuleList"];
                };
            };
            /** @description Caller is not authenticated */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Caller lacks scan:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getSystemConnectivityStatus: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Metrics snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ConnectivityStatus"];
                };
            };
            /** @description Caller lacks system:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHostConnectivityCheck: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Probe result */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ConnectivityCheckResult"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description A probe for this host is already in flight */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHostScan: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Scan run created and job enqueued */
            202: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ScanRunQueued"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description A scan for this host is already queued or running */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostCompliance: {
        parameters: {
            query?: {
                /** @description Filter to rows whose framework_refs contains this key and project its control ids; summary and categories are recomputed under the filter. */
                framework?: string;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Compliance lens (scan context + summary + categories + rules) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostComplianceLensResponse"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostComplianceSchedule: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Schedule projection for the host */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostComplianceSchedule"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Unknown or deleted host */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostComplianceTrend: {
        parameters: {
            query?: {
                /** @description Trailing window in days; clamped into [1, 90] */
                days?: number;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Daily points, oldest first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostComplianceTrend"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Unknown or deleted host */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetComplianceTrend: {
        parameters: {
            query?: {
                /** @description Trailing window in days; clamped into [1, 90] */
                days?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Daily fleet points, oldest first */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetComplianceTrend"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostComplianceFrameworks: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Frameworks with per-framework mapped-rule counts */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostComplianceFrameworksResponse"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostFailedRules: {
        parameters: {
            query?: {
                /** @description Max rules returned. Clamped to [1, 100]; default 10. */
                limit?: number;
                /** @description Filter to rows whose framework_refs contains this key and project its control ids. */
                framework?: string;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Failing rules, severity-ordered */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostFailedRulesResponse"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getFleetScanQueue: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Queued and running scan counts */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["FleetScanQueue"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getIntelligenceEvents: {
        parameters: {
            query?: {
                host_id?: string;
                event_code?: string;
                severity?: "info" | "low" | "medium" | "high" | "critical";
                since?: string;
                until?: string;
                cursor?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Events page */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["IntelligenceEventsPage"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getIntelligenceState: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                host_id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Last snapshot */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["IntelligenceState"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host unknown OR no snapshot yet */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getAlerts: {
        parameters: {
            query?: {
                state?: "active" | "acknowledged" | "silenced" | "resolved" | "dismissed";
                host_id?: string;
                severity?: "info" | "low" | "medium" | "high" | "critical";
                since?: string;
                until?: string;
                cursor?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Alerts page */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AlertsPage"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks alert:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getAlertByID: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Alert */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Alert"];
                };
            };
            /** @description Caller lacks alert:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Alert not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAlertAcknowledge: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["AlertLifecycleRequest"];
            };
        };
        responses: {
            /** @description Updated alert */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Alert"];
                };
            };
            /** @description Caller lacks alert:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Alert not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Invalid transition for current state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAlertSilence: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["AlertLifecycleRequest"];
            };
        };
        responses: {
            /** @description Updated alert */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Alert"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks alert:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Alert not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Invalid transition for current state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAlertResolve: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["AlertLifecycleRequest"];
            };
        };
        responses: {
            /** @description Updated alert */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Alert"];
                };
            };
            /** @description Caller lacks alert:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Alert not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Invalid transition for current state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postAlertDismiss: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: {
            content: {
                "application/json": components["schemas"]["AlertLifecycleRequest"];
            };
        };
        responses: {
            /** @description Updated alert */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Alert"];
                };
            };
            /** @description Caller lacks alert:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Alert not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Invalid transition for current state */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getActivity: {
        parameters: {
            query?: {
                source?: "alert" | "transaction" | "intelligence" | "audit" | "monitoring";
                severity?: "info" | "low" | "medium" | "high" | "critical";
                host_id?: string;
                since?: string;
                until?: string;
                cursor?: string;
                limit?: number;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Activity page */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ActivityPage"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Anonymous caller */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getHostSystemInfo: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Latest HostSystemInfo for the host */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostSystemInfo"];
                };
            };
            /** @description Caller lacks host:read permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host unknown OR no Discovery row yet */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    postHostDiscoveryRun: {
        parameters: {
            query?: never;
            header: {
                "Idempotency-Key": string;
            };
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Discovery result — the captured SystemFacts */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HostSystemInfo"];
                };
            };
            400: components["responses"]["BadRequest"];
            /** @description Caller lacks host:write permission */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host not found */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Host unreachable — SSH dial or credential resolve failed */
            502: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
            /** @description Discovery service not wired on the server */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorEnvelope"];
                };
            };
        };
    };
    getNotificationChannels: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["NotificationChannelList"];
                };
            };
            403: components["responses"]["Forbidden"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    postNotificationChannel: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["NotificationChannelCreate"];
            };
        };
        responses: {
            /** @description Channel created (secret redacted) */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["NotificationChannel"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    getNotificationChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["NotificationChannel"];
                };
            };
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    deleteNotificationChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            403: components["responses"]["Forbidden"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    patchNotificationChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["NotificationChannelUpdate"];
            };
        };
        responses: {
            /** @description Updated channel (secret redacted) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["NotificationChannel"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    testNotificationChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Test alert delivered */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
            503: components["responses"]["ServiceUnavailable"];
        };
    };
    getAPITokens: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Token list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ApiTokenList"];
                };
            };
            403: components["responses"]["Forbidden"];
        };
    };
    postAPIToken: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ApiTokenCreateRequest"];
            };
        };
        responses: {
            /** @description Token created; the raw secret is present in this response only */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ApiTokenCreated"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
        };
    };
    deleteAPIToken: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Revoked (idempotent) */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            403: components["responses"]["Forbidden"];
        };
    };
    getAuthPolicy: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current policy */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthPolicy"];
                };
            };
            403: components["responses"]["Forbidden"];
        };
    };
    putAuthPolicy: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuthPolicyUpdateRequest"];
            };
        };
        responses: {
            /** @description Policy updated */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuthPolicy"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
        };
    };
    getSSOProviders: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Provider list */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SSOProviderList"];
                };
            };
            403: components["responses"]["Forbidden"];
        };
    };
    postSSOProvider: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SSOProviderCreateRequest"];
            };
        };
        responses: {
            /** @description Provider created */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SSOProvider"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
        };
    };
    getSSOProvidersEnabled: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Enabled providers (id + name only) */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SSOEnabledList"];
                };
            };
        };
    };
    getSSOProvider: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Provider */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SSOProvider"];
                };
            };
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
        };
    };
    putSSOProvider: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SSOProviderUpdateRequest"];
            };
        };
        responses: {
            /** @description Provider updated */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SSOProvider"];
                };
            };
            400: components["responses"]["BadRequest"];
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
        };
    };
    deleteSSOProvider: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Deleted */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            403: components["responses"]["Forbidden"];
            404: components["responses"]["NotFound"];
        };
    };
    getAuthSSOLogin: {
        parameters: {
            query?: {
                return_to?: string;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Redirect to the identity provider */
            302: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            404: components["responses"]["NotFound"];
        };
    };
    getAuthSSOCallback: {
        parameters: {
            query?: {
                code?: string;
                state?: string;
                error?: string;
            };
            header?: never;
            path: {
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Redirect into the app (success) or to /login with an error */
            302: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
        };
    };
}