authorizer.swagger.json

{
  "swagger": "2.0",
  "info": {
    "title": "authorizer/v1/annotations.proto",
    "version": "version not set"
  },
  "tags": [
    {
      "name": "AuthorizerAdminService"
    },
    {
      "name": "AuthorizerService"
    }
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/v1/admin/add_email_template": {
      "post": {
        "summary": "AddEmailTemplate creates a new email template for an event. Requires\nsuper-admin auth.",
        "operationId": "AuthorizerAdminService_AddEmailTemplate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AddEmailTemplateResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "AddEmailTemplateRequest mirrors model.AddEmailTemplateRequest. design is\noptional.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AddEmailTemplateRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/add_trusted_issuer": {
      "post": {
        "summary": "AddTrustedIssuer registers an external JWT issuer for a service account.\nsubject_claim defaults to \"sub\" when omitted. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AddTrustedIssuer",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AddTrustedIssuerResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "AddTrustedIssuerRequest mirrors model.AddTrustedIssuerRequest. jwks_url,\nsubject_claim, and spiffe_refresh_hint_seconds are optional; subject_claim\ndefaults to \"sub\" when unset.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AddTrustedIssuerRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/add_webhook": {
      "post": {
        "summary": "AddWebhook registers a new webhook for an event. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AddWebhook",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AddWebhookResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "AddWebhookRequest mirrors model.AddWebhookRequest. event_description is\noptional; when unset it defaults to the event name with dots replaced by\nspaces.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AddWebhookRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/audit_logs": {
      "post": {
        "summary": "AuditLogs returns a paginated, optionally-filtered list of audit log\nentries. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AuditLogs",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuditLogsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "AuditLogsRequest mirrors model.ListAuditLogRequest. All filter fields are\noptional; when unset no filtering is applied for that field.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AuditLogsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/create_service_account": {
      "post": {
        "summary": "CreateServiceAccount provisions a new machine/workload identity and returns\nthe generated client secret exactly once (only the bcrypt hash is stored).\nRequires super-admin auth.",
        "operationId": "AuthorizerAdminService_CreateServiceAccount",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateServiceAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "CreateServiceAccountRequest mirrors model.CreateServiceAccountRequest.\ndescription is optional; allowed_scopes must be non-empty (an empty scope set\nis DENY-ALL and is rejected by the service layer).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CreateServiceAccountRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/delete_email_template": {
      "post": {
        "summary": "DeleteEmailTemplate deletes an email template by id. Requires super-admin\nauth.",
        "operationId": "AuthorizerAdminService_DeleteEmailTemplate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteEmailTemplateResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "DeleteEmailTemplateRequest mirrors model.DeleteEmailTemplateRequest (a single\nemail template id).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteEmailTemplateRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/delete_service_account": {
      "post": {
        "summary": "DeleteServiceAccount deletes a service account by id, cascading to its\ntrusted issuers. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_DeleteServiceAccount",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteServiceAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "DeleteServiceAccountRequest mirrors model.ServiceAccountRequest (a single\nservice account id). Kept distinct from GetServiceAccountRequest and\nRotateServiceAccountSecretRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteServiceAccountRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/delete_trusted_issuer": {
      "post": {
        "summary": "DeleteTrustedIssuer deletes a trusted issuer by id. Requires super-admin\nauth.",
        "operationId": "AuthorizerAdminService_DeleteTrustedIssuer",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteTrustedIssuerResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "DeleteTrustedIssuerRequest mirrors model.TrustedIssuerRequest (a single\ntrusted issuer id). Kept distinct from GetTrustedIssuerRequest per buf's\none-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteTrustedIssuerRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/delete_user": {
      "post": {
        "summary": "DeleteUser deletes a user (and associated OTP/verification data) by email.\nRequires super-admin auth.",
        "operationId": "AuthorizerAdminService_DeleteUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteUserResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "DeleteUserRequest mirrors model.DeleteUserRequest.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteUserRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/delete_webhook": {
      "post": {
        "summary": "DeleteWebhook deletes a webhook by id. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_DeleteWebhook",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeleteWebhookResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "DeleteWebhookRequest mirrors model.WebhookRequest (a single webhook id). It is\nkept distinct from GetWebhookRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeleteWebhookRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/email_templates": {
      "post": {
        "summary": "EmailTemplates returns a paginated list of email templates. Requires\nsuper-admin auth.",
        "operationId": "AuthorizerAdminService_EmailTemplates",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EmailTemplatesResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EmailTemplatesRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/enable_access": {
      "post": {
        "summary": "EnableAccess re-enables a previously revoked user (clears the revoked\ntimestamp) and fires the access-enabled webhook. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_EnableAccess",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1EnableAccessResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "EnableAccessRequest mirrors model.UpdateAccessRequest (a single user id). It\nis kept distinct from RevokeAccessRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1EnableAccessRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/expand": {
      "post": {
        "summary": "FgaExpand returns the OpenFGA relationship/userset tree for (relation,\nobject) as a JSON string (the explainability primitive). Requires\nsuper-admin auth.",
        "operationId": "AuthorizerAdminService_FgaExpand",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaExpandResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaExpandRequest mirrors model.FgaExpandInput.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaExpandRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/list_users": {
      "post": {
        "summary": "FgaListUsers returns the fully-qualified user ids of user_type that have\nrelation on object (\"who can access this object?\"). Requires super-admin\nauth.",
        "operationId": "AuthorizerAdminService_FgaListUsers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaListUsersResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaListUsersRequest mirrors model.FgaListUsersInput.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaListUsersRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/model": {
      "get": {
        "summary": "FgaGetModel returns the active fine-grained authorization model as DSL. A\nstore with no model yet returns an empty model (not an error). Requires\nsuper-admin auth.",
        "operationId": "AuthorizerAdminService_FgaGetModel",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaGetModelResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerAdminService"
        ]
      },
      "post": {
        "summary": "FgaWriteModel installs a new fine-grained authorization model from its DSL\nand returns the new model id. Requires super-admin auth. Audited.",
        "operationId": "AuthorizerAdminService_FgaWriteModel",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaWriteModelResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaWriteModelRequest mirrors model.FgaWriteModelInput (the model DSL).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaWriteModelRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/reset": {
      "post": {
        "summary": "FgaReset deletes the entire fine-grained authorization store (the model,\nall its versions, and all tuples) and starts a fresh, empty store. Refused\nwhile any tuples still exist. Requires super-admin auth. Destructive and\naudited.",
        "operationId": "AuthorizerAdminService_FgaReset",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaResetResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaResetRequest takes no parameters; the whole store is reset.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaResetRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/tuples": {
      "post": {
        "summary": "FgaWriteTuples persists the given relationship tuples (additive). Requires\nsuper-admin auth. Audited.",
        "operationId": "AuthorizerAdminService_FgaWriteTuples",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaWriteTuplesResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaWriteTuplesRequest mirrors model.FgaWriteTuplesInput, reusing the shared\nFgaTupleInput message.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaWriteTuplesRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/tuples/delete": {
      "post": {
        "summary": "FgaDeleteTuples removes the given relationship tuples. Requires super-admin\nauth. Audited.",
        "operationId": "AuthorizerAdminService_FgaDeleteTuples",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaDeleteTuplesResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaDeleteTuplesRequest mirrors model.FgaWriteTuplesInput (same shape as a\nwrite; the tuples to remove).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaDeleteTuplesRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/fga/tuples/read": {
      "post": {
        "summary": "FgaReadTuples returns a page of persisted tuples matching the filter.\nRequires super-admin auth.",
        "operationId": "AuthorizerAdminService_FgaReadTuples",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1FgaReadTuplesResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "FgaReadTuplesRequest mirrors model.FgaReadTuplesInput. All filter fields are\noptional; an empty filter reads all tuples (paginated).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1FgaReadTuplesRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/invite_members": {
      "post": {
        "summary": "InviteMembers creates accounts for new emails and sends invite emails.\nRequires super-admin auth and a configured email service.",
        "operationId": "AuthorizerAdminService_InviteMembers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1InviteMembersResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "InviteMembersRequest mirrors model.InviteMemberRequest. redirect_uri is\noptional; when unset the configured app URL is used.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1InviteMembersRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/login": {
      "post": {
        "summary": "AdminLogin validates the admin secret and establishes an admin session\n(Set-Cookie for browser callers). Public entry point — the ONLY admin RPC\nthat does not require an existing super-admin session.",
        "operationId": "AuthorizerAdminService_AdminLogin",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminLoginResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1AdminLoginRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/logout": {
      "post": {
        "summary": "AdminLogout clears the admin session cookie. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AdminLogout",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminLogoutResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/meta": {
      "get": {
        "summary": "AdminMeta returns admin-only configuration metadata (configured roles,\ndefault roles, protected roles). Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AdminMeta",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminMetaResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/revoke_access": {
      "post": {
        "summary": "RevokeAccess revokes a user's access (sets the revoked timestamp), kills\ntheir sessions, and fires the access-revoked webhook. Requires super-admin\nauth.",
        "operationId": "AuthorizerAdminService_RevokeAccess",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeAccessResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "RevokeAccessRequest mirrors model.UpdateAccessRequest (a single user id). It\nis kept distinct from EnableAccessRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RevokeAccessRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/rotate_service_account_secret": {
      "post": {
        "summary": "RotateServiceAccountSecret replaces the stored client secret with a fresh\none and returns the new plaintext exactly once (the old secret stops\nvalidating immediately). Reuses CreateServiceAccountResponse — the only\nadmin message that carries a secret. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_RotateServiceAccountSecret",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CreateServiceAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "RotateServiceAccountSecretRequest mirrors model.ServiceAccountRequest (a\nsingle service account id). Kept distinct from DeleteServiceAccountRequest and\nGetServiceAccountRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RotateServiceAccountSecretRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/service_account": {
      "post": {
        "summary": "GetServiceAccount returns a single service account by id. The client secret\nis never surfaced. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_GetServiceAccount",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetServiceAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "GetServiceAccountRequest mirrors model.ServiceAccountRequest (a single service\naccount id). Kept distinct from DeleteServiceAccountRequest and\nRotateServiceAccountSecretRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GetServiceAccountRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/service_accounts": {
      "post": {
        "summary": "ServiceAccounts returns a paginated list of service accounts. Client secrets\nare never surfaced. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_ServiceAccounts",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ServiceAccountsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ServiceAccountsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/session": {
      "get": {
        "summary": "AdminSession refreshes the admin session cookie. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_AdminSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AdminSessionResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/test_endpoint": {
      "post": {
        "summary": "TestEndpoint sends a synthetic event payload to a webhook endpoint and\nreturns the HTTP status and response body. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_TestEndpoint",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1TestEndpointResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "TestEndpointRequest mirrors model.TestEndpointRequest. event_description is\noptional and unused by the test payload but accepted for parity.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1TestEndpointRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/trusted_issuer": {
      "post": {
        "summary": "GetTrustedIssuer returns a single trusted issuer by id. Requires super-admin\nauth.",
        "operationId": "AuthorizerAdminService_GetTrustedIssuer",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetTrustedIssuerResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "GetTrustedIssuerRequest mirrors model.TrustedIssuerRequest (a single trusted\nissuer id). Kept distinct from DeleteTrustedIssuerRequest per buf's\none-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GetTrustedIssuerRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/trusted_issuers": {
      "post": {
        "summary": "TrustedIssuers returns a paginated list of trusted issuers, optionally\nfiltered by service_account_id. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_TrustedIssuers",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1TrustedIssuersResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "TrustedIssuersRequest mirrors model.ListTrustedIssuersRequest.\nservice_account_id is optional; when unset issuers for all accounts are\nreturned.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1TrustedIssuersRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/update_email_template": {
      "post": {
        "summary": "UpdateEmailTemplate updates an existing email template's event, subject,\nbody, or design. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_UpdateEmailTemplate",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateEmailTemplateResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UpdateEmailTemplateRequest mirrors model.UpdateEmailTemplateRequest. Nullable\nGraphQL inputs use proto3 `optional` so an unset field is distinguishable from\nan empty value.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateEmailTemplateRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/update_service_account": {
      "post": {
        "summary": "UpdateServiceAccount updates a service account's name, description, allowed\nscopes, or active state. It never touches the client secret. Requires\nsuper-admin auth.",
        "operationId": "AuthorizerAdminService_UpdateServiceAccount",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateServiceAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UpdateServiceAccountRequest mirrors model.UpdateServiceAccountRequest.\nNullable GraphQL inputs use proto3 `optional`. allowed_scopes, when non-empty,\nreplaces the scope set; the service rejects a set that normalizes to empty.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateServiceAccountRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/update_trusted_issuer": {
      "post": {
        "summary": "UpdateTrustedIssuer updates a trusted issuer's name, JWKS URL, expected\naudience, active state, or SPIFFE refresh hint. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_UpdateTrustedIssuer",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateTrustedIssuerResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UpdateTrustedIssuerRequest mirrors model.UpdateTrustedIssuerRequest. Nullable\nGraphQL inputs use proto3 `optional` so an unset field is distinguishable from\nan empty value.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateTrustedIssuerRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/update_user": {
      "post": {
        "summary": "UpdateUser updates a user's profile, roles, MFA, or verification state and\nreturns the updated user. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_UpdateUser",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateUserResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UpdateUserRequest mirrors model.UpdateUserRequest. Nullable GraphQL inputs use\nproto3 `optional` so an unset field is distinguishable from an empty value\n(e.g. clearing a name vs leaving it untouched, or email_verified=false).",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateUserRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/update_webhook": {
      "post": {
        "summary": "UpdateWebhook updates an existing webhook's event, endpoint, headers, or\nenabled state. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_UpdateWebhook",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateWebhookResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UpdateWebhookRequest mirrors model.UpdateWebhookRequest. Nullable GraphQL\ninputs use proto3 `optional` so an unset field is distinguishable from an\nempty value.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateWebhookRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/user": {
      "post": {
        "summary": "User returns a single user by id or email. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_User",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UserResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "UserRequest fetches a single user by id or email; at least one must be set.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UserRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/users": {
      "post": {
        "summary": "Users returns a paginated list of all users. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_Users",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UsersResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UsersRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/verification_requests": {
      "post": {
        "summary": "VerificationRequests returns a paginated list of pending verification\nrequests. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_VerificationRequests",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1VerificationRequestsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerificationRequestsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/webhook": {
      "post": {
        "summary": "GetWebhook returns a single webhook by id. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_GetWebhook",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1GetWebhookResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "GetWebhookRequest mirrors model.WebhookRequest (a single webhook id). It is\nkept distinct from DeleteWebhookRequest per buf's one-message-per-RPC rule.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1GetWebhookRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/webhook_logs": {
      "post": {
        "summary": "WebhookLogs returns a paginated list of webhook delivery logs, optionally\nfiltered by webhook id. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_WebhookLogs",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1WebhookLogsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "description": "WebhookLogsRequest mirrors model.ListWebhookLogRequest. webhook_id is\noptional; when unset logs for all webhooks are returned.",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1WebhookLogsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/admin/webhooks": {
      "post": {
        "summary": "Webhooks returns a paginated list of webhooks. Requires super-admin auth.",
        "operationId": "AuthorizerAdminService_Webhooks",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1WebhooksResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1WebhooksRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerAdminService"
        ]
      }
    },
    "/v1/check_permissions": {
      "post": {
        "summary": "CheckPermissions evaluates one or more fine-grained permission checks\n(\"does the subject have \u003crelation\u003e on \u003cobject\u003e?\") in a single call and\nreturns one result per check, in order. The subject defaults to the\nauthenticated caller; an explicit `user` is honored only for super-admins\nor when it equals the caller's own subject. Fail-closed.",
        "operationId": "AuthorizerService_CheckPermissions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1CheckPermissionsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1CheckPermissionsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/deactivate_account": {
      "post": {
        "summary": "DeactivateAccount soft-deletes the caller's account and revokes all\nrefresh tokens as a side effect. OAuth has no concept of account\ndeactivation; this is the typed equivalent of SCIM PATCH active=false.",
        "operationId": "AuthorizerService_DeactivateAccount",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1DeactivateAccountResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1DeactivateAccountRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/forgot_password": {
      "post": {
        "operationId": "AuthorizerService_ForgotPassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ForgotPasswordResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ForgotPasswordRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/list_permissions": {
      "post": {
        "summary": "ListPermissions enumerates what the subject can access. With both\n`relation` and `object_type` set it answers \"which \u003cobject_type\u003es can I\n\u003crelation\u003e?\"; either or both filters may be omitted to enumerate every\nmatching (type, relation) pair of the active model. Results are capped;\n`truncated` reports when more permissions exist. Subject resolution\nfollows the same rules as CheckPermissions.",
        "operationId": "AuthorizerService_ListPermissions",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ListPermissionsResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ListPermissionsRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/login": {
      "post": {
        "summary": "Login authenticates with email/phone + password.",
        "operationId": "AuthorizerService_Login",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1LoginRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/logout": {
      "post": {
        "summary": "Logout ends the caller's current session. POST, not GET: logout mutates\nserver state (clears the session) and is audit-logged, so it must not be\na \"safe\" method per RFC 9110 §9.2.1 — GET would also expose it to CSRF.",
        "operationId": "AuthorizerService_Logout",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1LogoutResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/magic_link_login": {
      "post": {
        "summary": "MagicLinkLogin dispatches a passwordless email link. The clicked link\nhits the existing /verify_email browser handler.",
        "operationId": "AuthorizerService_MagicLinkLogin",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1MagicLinkLoginResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1MagicLinkLoginRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/meta": {
      "get": {
        "summary": "Meta returns server feature flags. No auth required.",
        "operationId": "AuthorizerService_Meta",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/authorizerv1Meta"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/profile": {
      "get": {
        "summary": "Profile returns the authenticated user.",
        "operationId": "AuthorizerService_Profile",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/authorizerv1User"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/resend_otp": {
      "post": {
        "operationId": "AuthorizerService_ResendOtp",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResendOtpResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ResendOtpRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/resend_verify_email": {
      "post": {
        "operationId": "AuthorizerService_ResendVerifyEmail",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResendVerifyEmailResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ResendVerifyEmailRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/reset_password": {
      "post": {
        "operationId": "AuthorizerService_ResetPassword",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ResetPasswordResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ResetPasswordRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/revoke": {
      "post": {
        "summary": "Revoke invalidates a refresh token. Typed mirror of RFC 7009.",
        "operationId": "AuthorizerService_Revoke",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1RevokeResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1RevokeRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/session": {
      "post": {
        "summary": "Session returns the AuthResponse bound to the caller's session cookie only.\nNOT exposed as an MCP tool — SessionResponse carries access_token,\nrefresh_token, id_token, authenticator_secret, and recovery codes,\nnone of which should land in an LLM transcript. (Security audit C1.)",
        "operationId": "AuthorizerService_Session",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SessionRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/signup": {
      "post": {
        "summary": "Signup registers a new user. Public; requires sign-up enabled in config.\nReturns AuthResponse with tokens + (browser callers) Set-Cookie headers.",
        "operationId": "AuthorizerService_Signup",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1SignupRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/update_profile": {
      "post": {
        "operationId": "AuthorizerService_UpdateProfile",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1UpdateProfileResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1UpdateProfileRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/validate_jwt_token": {
      "post": {
        "operationId": "AuthorizerService_ValidateJwtToken",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ValidateJwtTokenResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ValidateJwtTokenRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/validate_session": {
      "post": {
        "operationId": "AuthorizerService_ValidateSession",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1ValidateSessionResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1ValidateSessionRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/verify_email": {
      "post": {
        "operationId": "AuthorizerService_VerifyEmail",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerifyEmailRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    },
    "/v1/verify_otp": {
      "post": {
        "operationId": "AuthorizerService_VerifyOtp",
        "responses": {
          "200": {
            "description": "A successful response.",
            "schema": {
              "$ref": "#/definitions/v1AuthResponse"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/rpcStatus"
            }
          }
        },
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/v1VerifyOtpRequest"
            }
          }
        ],
        "tags": [
          "AuthorizerService"
        ]
      }
    }
  },
  "definitions": {
    "authorizerv1AdminMeta": {
      "type": "object",
      "properties": {
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "default_roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "protected_roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "description": "AdminMeta mirrors model.AdminMeta exactly (no version field)."
    },
    "authorizerv1Meta": {
      "type": "object",
      "properties": {
        "version": {
          "type": "string"
        },
        "client_id": {
          "type": "string"
        },
        "is_google_login_enabled": {
          "type": "boolean"
        },
        "is_facebook_login_enabled": {
          "type": "boolean"
        },
        "is_github_login_enabled": {
          "type": "boolean"
        },
        "is_linkedin_login_enabled": {
          "type": "boolean"
        },
        "is_apple_login_enabled": {
          "type": "boolean"
        },
        "is_discord_login_enabled": {
          "type": "boolean"
        },
        "is_twitter_login_enabled": {
          "type": "boolean"
        },
        "is_microsoft_login_enabled": {
          "type": "boolean"
        },
        "is_twitch_login_enabled": {
          "type": "boolean"
        },
        "is_roblox_login_enabled": {
          "type": "boolean"
        },
        "is_email_verification_enabled": {
          "type": "boolean"
        },
        "is_basic_authentication_enabled": {
          "type": "boolean"
        },
        "is_magic_link_login_enabled": {
          "type": "boolean"
        },
        "is_sign_up_enabled": {
          "type": "boolean"
        },
        "is_strong_password_enabled": {
          "type": "boolean"
        },
        "is_multi_factor_auth_enabled": {
          "type": "boolean"
        },
        "is_mobile_basic_authentication_enabled": {
          "type": "boolean"
        },
        "is_phone_verification_enabled": {
          "type": "boolean"
        }
      },
      "description": "Meta mirrors the GraphQL Meta type — server feature flags + provider\navailability, returned by the Meta query."
    },
    "authorizerv1User": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "email": {
          "type": "string",
          "description": "Either email or phone_number is always present."
        },
        "email_verified": {
          "type": "boolean"
        },
        "signup_methods": {
          "type": "string"
        },
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "middle_name": {
          "type": "string"
        },
        "nickname": {
          "type": "string"
        },
        "preferred_username": {
          "type": "string",
          "description": "Defaults to email when unset."
        },
        "gender": {
          "type": "string"
        },
        "birthdate": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "phone_number_verified": {
          "type": "boolean"
        },
        "picture": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        },
        "revoked_timestamp": {
          "type": "string",
          "format": "int64"
        },
        "is_multi_factor_auth_enabled": {
          "type": "boolean"
        },
        "app_data": {
          "$ref": "#/definitions/v1AppData",
          "description": "Free-form key/value bag — same as GraphQL `app_data: Map`."
        }
      },
      "description": "User mirrors the GraphQL User type. Returned by Profile and embedded in\nAuthResponse."
    },
    "protobufAny": {
      "type": "object",
      "properties": {
        "@type": {
          "type": "string"
        }
      },
      "additionalProperties": {}
    },
    "protobufNullValue": {
      "type": "string",
      "enum": [
        "NULL_VALUE"
      ],
      "default": "NULL_VALUE",
      "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\nThe JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value."
    },
    "rpcStatus": {
      "type": "object",
      "properties": {
        "code": {
          "type": "integer",
          "format": "int32"
        },
        "message": {
          "type": "string"
        },
        "details": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/protobufAny"
          }
        }
      }
    },
    "v1AddEmailTemplateRequest": {
      "type": "object",
      "properties": {
        "event_name": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "template": {
          "type": "string"
        },
        "design": {
          "type": "string"
        }
      },
      "description": "AddEmailTemplateRequest mirrors model.AddEmailTemplateRequest. design is\noptional."
    },
    "v1AddEmailTemplateResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1AddTrustedIssuerRequest": {
      "type": "object",
      "properties": {
        "service_account_id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "issuer_url": {
          "type": "string"
        },
        "key_source_type": {
          "type": "string"
        },
        "jwks_url": {
          "type": "string"
        },
        "expected_aud": {
          "type": "string"
        },
        "subject_claim": {
          "type": "string"
        },
        "issuer_type": {
          "type": "string"
        },
        "spiffe_refresh_hint_seconds": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "AddTrustedIssuerRequest mirrors model.AddTrustedIssuerRequest. jwks_url,\nsubject_claim, and spiffe_refresh_hint_seconds are optional; subject_claim\ndefaults to \"sub\" when unset."
    },
    "v1AddTrustedIssuerResponse": {
      "type": "object",
      "properties": {
        "trusted_issuer": {
          "$ref": "#/definitions/v1TrustedIssuer"
        }
      }
    },
    "v1AddWebhookRequest": {
      "type": "object",
      "properties": {
        "event_name": {
          "type": "string"
        },
        "event_description": {
          "type": "string"
        },
        "endpoint": {
          "type": "string"
        },
        "enabled": {
          "type": "boolean"
        },
        "headers": {
          "$ref": "#/definitions/v1AppData"
        }
      },
      "description": "AddWebhookRequest mirrors model.AddWebhookRequest. event_description is\noptional; when unset it defaults to the event name with dots replaced by\nspaces."
    },
    "v1AddWebhookResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1AdminLoginRequest": {
      "type": "object",
      "properties": {
        "admin_secret": {
          "type": "string"
        }
      }
    },
    "v1AdminLoginResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1AdminLogoutResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1AdminMetaResponse": {
      "type": "object",
      "properties": {
        "admin_meta": {
          "$ref": "#/definitions/authorizerv1AdminMeta"
        }
      }
    },
    "v1AdminSessionResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1AppData": {
      "type": "object",
      "properties": {
        "value": {
          "type": "object"
        }
      },
      "description": "AppData is a free-form key/value bag stored against a user. Mirrors the\nGraphQL `Map` scalar. Values are JSON-typed (string, number, bool, null,\nnested object, nested array) to match what the existing storage layer\naccepts."
    },
    "v1AuditLog": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "actor_id": {
          "type": "string"
        },
        "actor_type": {
          "type": "string"
        },
        "actor_email": {
          "type": "string"
        },
        "action": {
          "type": "string"
        },
        "resource_type": {
          "type": "string"
        },
        "resource_id": {
          "type": "string"
        },
        "ip_address": {
          "type": "string"
        },
        "user_agent": {
          "type": "string"
        },
        "metadata": {
          "type": "string"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "AuditLog mirrors model.AuditLog field-for-field."
    },
    "v1AuditLogsRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        },
        "action": {
          "type": "string"
        },
        "actor_id": {
          "type": "string"
        },
        "resource_type": {
          "type": "string"
        },
        "resource_id": {
          "type": "string"
        },
        "from_timestamp": {
          "type": "string",
          "format": "int64"
        },
        "to_timestamp": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "AuditLogsRequest mirrors model.ListAuditLogRequest. All filter fields are\noptional; when unset no filtering is applied for that field."
    },
    "v1AuditLogsResponse": {
      "type": "object",
      "properties": {
        "audit_logs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1AuditLog"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1AuthResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "should_show_email_otp_screen": {
          "type": "boolean"
        },
        "should_show_mobile_otp_screen": {
          "type": "boolean"
        },
        "should_show_totp_screen": {
          "type": "boolean"
        },
        "access_token": {
          "type": "string"
        },
        "id_token": {
          "type": "string"
        },
        "refresh_token": {
          "type": "string"
        },
        "expires_in": {
          "type": "string",
          "format": "int64"
        },
        "user": {
          "$ref": "#/definitions/authorizerv1User"
        },
        "authenticator_scanner_image": {
          "type": "string",
          "description": "TOTP enrolment artifacts (populated only when this AuthResponse\ninitiates TOTP setup; one-time, never re-shown)."
        },
        "authenticator_secret": {
          "type": "string"
        },
        "authenticator_recovery_codes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "description": "AuthResponse mirrors the GraphQL AuthResponse type. Returned (wrapped) by\nevery method that produces a session: Signup, Login, MagicLinkLogin,\nVerifyEmail, VerifyOtp, Session."
    },
    "v1CheckPermissionsRequest": {
      "type": "object",
      "properties": {
        "checks": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PermissionCheckInput"
          },
          "description": "The checks to evaluate; at least one, at most 100."
        },
        "user": {
          "type": "string",
          "description": "Optional explicit subject (\"type:id\", or a bare id treated as\n\"user:\u003cid\u003e\"). Honored only for super-admins or when it equals the\ncaller's own token subject; anything else is rejected."
        }
      }
    },
    "v1CheckPermissionsResponse": {
      "type": "object",
      "properties": {
        "results": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1PermissionCheckResult"
          },
          "description": "One result per supplied check, in order."
        }
      }
    },
    "v1CreateServiceAccountRequest": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "allowed_scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "description": "CreateServiceAccountRequest mirrors model.CreateServiceAccountRequest.\ndescription is optional; allowed_scopes must be non-empty (an empty scope set\nis DENY-ALL and is rejected by the service layer)."
    },
    "v1CreateServiceAccountResponse": {
      "type": "object",
      "properties": {
        "service_account": {
          "$ref": "#/definitions/v1ServiceAccount"
        },
        "client_secret": {
          "type": "string"
        }
      },
      "description": "CreateServiceAccountResponse carries the created service account plus the\nplaintext client_secret, returned exactly once. This is the ONLY admin\nmessage with a secret field; RotateServiceAccountSecret reuses it."
    },
    "v1DeactivateAccountRequest": {
      "type": "object"
    },
    "v1DeactivateAccountResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1DeleteEmailTemplateRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "DeleteEmailTemplateRequest mirrors model.DeleteEmailTemplateRequest (a single\nemail template id)."
    },
    "v1DeleteEmailTemplateResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1DeleteServiceAccountRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "DeleteServiceAccountRequest mirrors model.ServiceAccountRequest (a single\nservice account id). Kept distinct from GetServiceAccountRequest and\nRotateServiceAccountSecretRequest per buf's one-message-per-RPC rule."
    },
    "v1DeleteServiceAccountResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1DeleteTrustedIssuerRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "DeleteTrustedIssuerRequest mirrors model.TrustedIssuerRequest (a single\ntrusted issuer id). Kept distinct from GetTrustedIssuerRequest per buf's\none-message-per-RPC rule."
    },
    "v1DeleteTrustedIssuerResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1DeleteUserRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        }
      },
      "description": "DeleteUserRequest mirrors model.DeleteUserRequest."
    },
    "v1DeleteUserResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1DeleteWebhookRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "DeleteWebhookRequest mirrors model.WebhookRequest (a single webhook id). It is\nkept distinct from GetWebhookRequest per buf's one-message-per-RPC rule."
    },
    "v1DeleteWebhookResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1EmailTemplate": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "event_name": {
          "type": "string"
        },
        "template": {
          "type": "string"
        },
        "design": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "EmailTemplate mirrors model.EmailTemplate field-for-field."
    },
    "v1EmailTemplatesRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        }
      }
    },
    "v1EmailTemplatesResponse": {
      "type": "object",
      "properties": {
        "email_templates": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1EmailTemplate"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1EnableAccessRequest": {
      "type": "object",
      "properties": {
        "user_id": {
          "type": "string"
        }
      },
      "description": "EnableAccessRequest mirrors model.UpdateAccessRequest (a single user id). It\nis kept distinct from RevokeAccessRequest per buf's one-message-per-RPC rule."
    },
    "v1EnableAccessResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1FgaDeleteTuplesRequest": {
      "type": "object",
      "properties": {
        "tuples": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaTupleInput"
          }
        }
      },
      "description": "FgaDeleteTuplesRequest mirrors model.FgaWriteTuplesInput (same shape as a\nwrite; the tuples to remove)."
    },
    "v1FgaDeleteTuplesResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1FgaExpandRequest": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        }
      },
      "description": "FgaExpandRequest mirrors model.FgaExpandInput."
    },
    "v1FgaExpandResponse": {
      "type": "object",
      "properties": {
        "tree": {
          "type": "string"
        }
      }
    },
    "v1FgaGetModelResponse": {
      "type": "object",
      "properties": {
        "model": {
          "$ref": "#/definitions/v1FgaModel"
        }
      }
    },
    "v1FgaListUsersRequest": {
      "type": "object",
      "properties": {
        "object": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        },
        "user_type": {
          "type": "string"
        }
      },
      "description": "FgaListUsersRequest mirrors model.FgaListUsersInput."
    },
    "v1FgaListUsersResponse": {
      "type": "object",
      "properties": {
        "users": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "v1FgaModel": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "dsl": {
          "type": "string"
        }
      },
      "description": "FgaModel is a fine-grained authorization model: its id and DSL form. Mirrors\nmodel.FgaModel field-for-field. An empty model (both fields empty) is the\nvalid \"no model written yet\" state."
    },
    "v1FgaReadTuplesRequest": {
      "type": "object",
      "properties": {
        "user": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "page_size": {
          "type": "string",
          "format": "int64"
        },
        "continuation_token": {
          "type": "string"
        }
      },
      "description": "FgaReadTuplesRequest mirrors model.FgaReadTuplesInput. All filter fields are\noptional; an empty filter reads all tuples (paginated)."
    },
    "v1FgaReadTuplesResponse": {
      "type": "object",
      "properties": {
        "tuples": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaTuple"
          }
        },
        "continuation_token": {
          "type": "string"
        }
      }
    },
    "v1FgaRelationInput": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        }
      },
      "description": "FgaRelationInput is a (relation, object) requirement evaluated against the\nauthenticated caller during Session / ValidateJwtToken / ValidateSession.\nAND semantics, fail-closed. Mirrors the GraphQL FgaRelationInput type."
    },
    "v1FgaResetRequest": {
      "type": "object",
      "description": "FgaResetRequest takes no parameters; the whole store is reset."
    },
    "v1FgaResetResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1FgaTuple": {
      "type": "object",
      "properties": {
        "user": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        }
      },
      "description": "FgaTuple is one persisted relationship tuple returned by FgaReadTuples.\nMirrors model.FgaTuple field-for-field (the read shape; writes use the shared\nFgaTupleInput)."
    },
    "v1FgaTupleInput": {
      "type": "object",
      "properties": {
        "user": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        }
      },
      "description": "FgaTupleInput is one relationship tuple supplied as request-scoped context\nfor a permission check; contextual tuples are never persisted. Mirrors the\nGraphQL FgaTupleInput type."
    },
    "v1FgaWriteModelRequest": {
      "type": "object",
      "properties": {
        "dsl": {
          "type": "string"
        }
      },
      "description": "FgaWriteModelRequest mirrors model.FgaWriteModelInput (the model DSL)."
    },
    "v1FgaWriteModelResponse": {
      "type": "object",
      "properties": {
        "model": {
          "$ref": "#/definitions/v1FgaModel"
        }
      }
    },
    "v1FgaWriteTuplesRequest": {
      "type": "object",
      "properties": {
        "tuples": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaTupleInput"
          }
        }
      },
      "description": "FgaWriteTuplesRequest mirrors model.FgaWriteTuplesInput, reusing the shared\nFgaTupleInput message."
    },
    "v1FgaWriteTuplesResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1ForgotPasswordRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "state": {
          "type": "string"
        },
        "redirect_uri": {
          "type": "string"
        }
      }
    },
    "v1ForgotPasswordResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "should_show_mobile_otp_screen": {
          "type": "boolean",
          "description": "For SMS-driven flows the UI may need to render an OTP entry screen."
        }
      }
    },
    "v1GetServiceAccountRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "GetServiceAccountRequest mirrors model.ServiceAccountRequest (a single service\naccount id). Kept distinct from DeleteServiceAccountRequest and\nRotateServiceAccountSecretRequest per buf's one-message-per-RPC rule."
    },
    "v1GetServiceAccountResponse": {
      "type": "object",
      "properties": {
        "service_account": {
          "$ref": "#/definitions/v1ServiceAccount"
        }
      }
    },
    "v1GetTrustedIssuerRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "GetTrustedIssuerRequest mirrors model.TrustedIssuerRequest (a single trusted\nissuer id). Kept distinct from DeleteTrustedIssuerRequest per buf's\none-message-per-RPC rule."
    },
    "v1GetTrustedIssuerResponse": {
      "type": "object",
      "properties": {
        "trusted_issuer": {
          "$ref": "#/definitions/v1TrustedIssuer"
        }
      }
    },
    "v1GetWebhookRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "GetWebhookRequest mirrors model.WebhookRequest (a single webhook id). It is\nkept distinct from DeleteWebhookRequest per buf's one-message-per-RPC rule."
    },
    "v1GetWebhookResponse": {
      "type": "object",
      "properties": {
        "webhook": {
          "$ref": "#/definitions/v1Webhook"
        }
      }
    },
    "v1InviteMembersRequest": {
      "type": "object",
      "properties": {
        "emails": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "redirect_uri": {
          "type": "string"
        }
      },
      "description": "InviteMembersRequest mirrors model.InviteMemberRequest. redirect_uri is\noptional; when unset the configured app URL is used."
    },
    "v1InviteMembersResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        },
        "users": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/authorizerv1User"
          }
        }
      },
      "description": "InviteMembersResponse mirrors model.InviteMembersResponse (a message plus the\nlist of newly invited users)."
    },
    "v1ListPermissionsRequest": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string",
          "description": "Optional relation filter (e.g. \"can_view\")."
        },
        "object_type": {
          "type": "string",
          "description": "Optional object-type filter (e.g. \"document\")."
        },
        "user": {
          "type": "string",
          "description": "Optional explicit subject; same trust rules as CheckPermissionsRequest."
        }
      }
    },
    "v1ListPermissionsResponse": {
      "type": "object",
      "properties": {
        "objects": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Distinct fully-qualified object ids the subject can access."
        },
        "permissions": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Permission"
          },
          "description": "The (object, relation) detail — relevant when no relation filter was\nsupplied."
        },
        "truncated": {
          "type": "boolean",
          "description": "True when the result was capped (1000 entries) and more permissions\nexist."
        }
      }
    },
    "v1LoginRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "scope": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1LogoutResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1MagicLinkLoginRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "scope": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "state": {
          "type": "string"
        },
        "redirect_uri": {
          "type": "string"
        }
      }
    },
    "v1MagicLinkLoginResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1Pagination": {
      "type": "object",
      "properties": {
        "limit": {
          "type": "string",
          "format": "int64"
        },
        "page": {
          "type": "string",
          "format": "int64"
        },
        "offset": {
          "type": "string",
          "format": "int64"
        },
        "total": {
          "type": "string",
          "format": "int64"
        },
        "next_page_token": {
          "type": "string",
          "description": "Opaque cursor for the next page; empty when no more pages."
        }
      }
    },
    "v1PaginationRequest": {
      "type": "object",
      "properties": {
        "page": {
          "type": "string",
          "format": "int64",
          "description": "1-based page number. Ignored when page_token is set. Default 1."
        },
        "limit": {
          "type": "string",
          "format": "int64",
          "description": "Page size. Server enforces an upper bound (typically 100). Default 10."
        },
        "page_token": {
          "type": "string",
          "description": "Opaque cursor returned by the previous List call's `next_page_token`.\nPreferred for new clients (AIP-158). When set, `page` is ignored."
        }
      }
    },
    "v1Permission": {
      "type": "object",
      "properties": {
        "object": {
          "type": "string"
        },
        "relation": {
          "type": "string"
        }
      },
      "description": "Permission is one (object, relation) pair the subject holds: \"subject has\n`relation` on `object`\". Mirrors the GraphQL Permission type."
    },
    "v1PermissionCheckInput": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "contextual_tuples": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaTupleInput"
          }
        }
      },
      "description": "PermissionCheckInput is one permission to evaluate: \"does the subject have\n\u003crelation\u003e on \u003cobject\u003e?\". Mirrors the GraphQL PermissionCheckInput type."
    },
    "v1PermissionCheckResult": {
      "type": "object",
      "properties": {
        "relation": {
          "type": "string"
        },
        "object": {
          "type": "string"
        },
        "allowed": {
          "type": "boolean"
        }
      },
      "description": "PermissionCheckResult is the outcome of one permission check, echoing the\nchecked pair so batch results are self-describing (and positionally\naligned). Mirrors the GraphQL PermissionCheckResult type."
    },
    "v1ResendOtpRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1ResendOtpResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1ResendVerifyEmailRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "identifier": {
          "type": "string"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1ResendVerifyEmailResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1ResetPasswordRequest": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string",
          "description": "For email flows: the token from the reset email. For SMS flows: the OTP."
        },
        "otp": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "confirm_password": {
          "type": "string"
        }
      }
    },
    "v1ResetPasswordResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1RevokeAccessRequest": {
      "type": "object",
      "properties": {
        "user_id": {
          "type": "string"
        }
      },
      "description": "RevokeAccessRequest mirrors model.UpdateAccessRequest (a single user id). It\nis kept distinct from EnableAccessRequest per buf's one-message-per-RPC rule."
    },
    "v1RevokeAccessResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1RevokeRequest": {
      "type": "object",
      "properties": {
        "refresh_token": {
          "type": "string"
        }
      }
    },
    "v1RevokeResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1RotateServiceAccountSecretRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "description": "RotateServiceAccountSecretRequest mirrors model.ServiceAccountRequest (a\nsingle service account id). Kept distinct from DeleteServiceAccountRequest and\nGetServiceAccountRequest per buf's one-message-per-RPC rule."
    },
    "v1ServiceAccount": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "allowed_scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "is_active": {
          "type": "boolean"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "ServiceAccount mirrors model.ServiceAccount field-for-field. The client\nsecret is deliberately ABSENT (matching the GraphQL type): it is surfaced\nexactly once, only via CreateServiceAccountResponse.client_secret, and is\nnever returned by any get/list/update path."
    },
    "v1ServiceAccountsRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        }
      }
    },
    "v1ServiceAccountsResponse": {
      "type": "object",
      "properties": {
        "service_accounts": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1ServiceAccount"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1SessionRequest": {
      "type": "object",
      "properties": {
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "scope": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "state": {
          "type": "string"
        },
        "required_relations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaRelationInput"
          },
          "title": "Optional fine-grained authorization gate: each (relation, object) is\nchecked against the authenticated caller with AND semantics, fail-closed.\nRequires fine-grained authorization enabled"
        }
      }
    },
    "v1SignupRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "password": {
          "type": "string"
        },
        "confirm_password": {
          "type": "string"
        },
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "middle_name": {
          "type": "string"
        },
        "nickname": {
          "type": "string"
        },
        "gender": {
          "type": "string"
        },
        "birthdate": {
          "type": "string"
        },
        "picture": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "scope": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "redirect_uri": {
          "type": "string"
        },
        "is_multi_factor_auth_enabled": {
          "type": "boolean"
        },
        "state": {
          "type": "string"
        },
        "app_data": {
          "$ref": "#/definitions/v1AppData"
        }
      }
    },
    "v1TestEndpointRequest": {
      "type": "object",
      "properties": {
        "endpoint": {
          "type": "string"
        },
        "event_name": {
          "type": "string"
        },
        "event_description": {
          "type": "string"
        },
        "headers": {
          "$ref": "#/definitions/v1AppData"
        }
      },
      "description": "TestEndpointRequest mirrors model.TestEndpointRequest. event_description is\noptional and unused by the test payload but accepted for parity."
    },
    "v1TestEndpointResponse": {
      "type": "object",
      "properties": {
        "http_status": {
          "type": "string",
          "format": "int64"
        },
        "response": {
          "type": "string"
        }
      },
      "description": "TestEndpointResponse mirrors model.TestEndpointResponse."
    },
    "v1TrustedIssuer": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "service_account_id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "issuer_url": {
          "type": "string"
        },
        "key_source_type": {
          "type": "string"
        },
        "jwks_url": {
          "type": "string"
        },
        "expected_aud": {
          "type": "string"
        },
        "subject_claim": {
          "type": "string"
        },
        "issuer_type": {
          "type": "string"
        },
        "is_active": {
          "type": "boolean"
        },
        "spiffe_refresh_hint_seconds": {
          "type": "string",
          "format": "int64"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "TrustedIssuer mirrors model.TrustedIssuer field-for-field. It references its\nparent via service_account_id (not app_id). Optional pointer fields collapse\nto zero values on the wire."
    },
    "v1TrustedIssuersRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        },
        "service_account_id": {
          "type": "string"
        }
      },
      "description": "TrustedIssuersRequest mirrors model.ListTrustedIssuersRequest.\nservice_account_id is optional; when unset issuers for all accounts are\nreturned."
    },
    "v1TrustedIssuersResponse": {
      "type": "object",
      "properties": {
        "trusted_issuers": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1TrustedIssuer"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1UpdateEmailTemplateRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "event_name": {
          "type": "string"
        },
        "template": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "design": {
          "type": "string"
        }
      },
      "description": "UpdateEmailTemplateRequest mirrors model.UpdateEmailTemplateRequest. Nullable\nGraphQL inputs use proto3 `optional` so an unset field is distinguishable from\nan empty value."
    },
    "v1UpdateEmailTemplateResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1UpdateProfileRequest": {
      "type": "object",
      "properties": {
        "old_password": {
          "type": "string"
        },
        "new_password": {
          "type": "string"
        },
        "confirm_new_password": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "middle_name": {
          "type": "string"
        },
        "nickname": {
          "type": "string"
        },
        "gender": {
          "type": "string"
        },
        "birthdate": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "picture": {
          "type": "string"
        },
        "is_multi_factor_auth_enabled": {
          "type": "boolean",
          "description": "optional: absent means \"leave MFA unchanged\"; present false explicitly\ndisables MFA. A non-optional bool would make every partial update send\nfalse and silently disable MFA."
        },
        "app_data": {
          "$ref": "#/definitions/v1AppData"
        }
      }
    },
    "v1UpdateProfileResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1UpdateServiceAccountRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "allowed_scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "is_active": {
          "type": "boolean"
        }
      },
      "description": "UpdateServiceAccountRequest mirrors model.UpdateServiceAccountRequest.\nNullable GraphQL inputs use proto3 `optional`. allowed_scopes, when non-empty,\nreplaces the scope set; the service rejects a set that normalizes to empty."
    },
    "v1UpdateServiceAccountResponse": {
      "type": "object",
      "properties": {
        "service_account": {
          "$ref": "#/definitions/v1ServiceAccount"
        }
      }
    },
    "v1UpdateTrustedIssuerRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "jwks_url": {
          "type": "string"
        },
        "expected_aud": {
          "type": "string"
        },
        "is_active": {
          "type": "boolean"
        },
        "spiffe_refresh_hint_seconds": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "UpdateTrustedIssuerRequest mirrors model.UpdateTrustedIssuerRequest. Nullable\nGraphQL inputs use proto3 `optional` so an unset field is distinguishable from\nan empty value."
    },
    "v1UpdateTrustedIssuerResponse": {
      "type": "object",
      "properties": {
        "trusted_issuer": {
          "$ref": "#/definitions/v1TrustedIssuer"
        }
      }
    },
    "v1UpdateUserRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "email_verified": {
          "type": "boolean"
        },
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "middle_name": {
          "type": "string"
        },
        "nickname": {
          "type": "string"
        },
        "gender": {
          "type": "string"
        },
        "birthdate": {
          "type": "string"
        },
        "phone_number": {
          "type": "string"
        },
        "phone_number_verified": {
          "type": "boolean"
        },
        "picture": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "is_multi_factor_auth_enabled": {
          "type": "boolean"
        },
        "app_data": {
          "$ref": "#/definitions/v1AppData"
        }
      },
      "description": "UpdateUserRequest mirrors model.UpdateUserRequest. Nullable GraphQL inputs use\nproto3 `optional` so an unset field is distinguishable from an empty value\n(e.g. clearing a name vs leaving it untouched, or email_verified=false)."
    },
    "v1UpdateUserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/authorizerv1User"
        }
      }
    },
    "v1UpdateWebhookRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "event_name": {
          "type": "string"
        },
        "event_description": {
          "type": "string"
        },
        "endpoint": {
          "type": "string"
        },
        "enabled": {
          "type": "boolean"
        },
        "headers": {
          "$ref": "#/definitions/v1AppData"
        }
      },
      "description": "UpdateWebhookRequest mirrors model.UpdateWebhookRequest. Nullable GraphQL\ninputs use proto3 `optional` so an unset field is distinguishable from an\nempty value."
    },
    "v1UpdateWebhookResponse": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string"
        }
      }
    },
    "v1UserRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "email": {
          "type": "string"
        }
      },
      "description": "UserRequest fetches a single user by id or email; at least one must be set."
    },
    "v1UserResponse": {
      "type": "object",
      "properties": {
        "user": {
          "$ref": "#/definitions/authorizerv1User"
        }
      }
    },
    "v1UsersRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        }
      }
    },
    "v1UsersResponse": {
      "type": "object",
      "properties": {
        "users": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/authorizerv1User"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1ValidateJwtTokenRequest": {
      "type": "object",
      "properties": {
        "token_type": {
          "type": "string"
        },
        "token": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "required_relations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaRelationInput"
          },
          "description": "Optional fine-grained authorization gate (AND semantics, fail-closed)."
        }
      }
    },
    "v1ValidateJwtTokenResponse": {
      "type": "object",
      "properties": {
        "is_valid": {
          "type": "boolean"
        },
        "claims": {
          "$ref": "#/definitions/v1AppData",
          "description": "Free-form JWT claims (matches GraphQL ValidateJWTTokenResponse.claims)."
        }
      }
    },
    "v1ValidateSessionRequest": {
      "type": "object",
      "properties": {
        "cookie": {
          "type": "string"
        },
        "roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "required_relations": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1FgaRelationInput"
          },
          "description": "Optional fine-grained authorization gate (AND semantics, fail-closed)."
        }
      }
    },
    "v1ValidateSessionResponse": {
      "type": "object",
      "properties": {
        "is_valid": {
          "type": "boolean"
        },
        "user": {
          "$ref": "#/definitions/authorizerv1User"
        }
      }
    },
    "v1VerificationRequest": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "identifier": {
          "type": "string"
        },
        "token": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "expires": {
          "type": "string",
          "format": "int64"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        },
        "nonce": {
          "type": "string"
        },
        "redirect_uri": {
          "type": "string"
        }
      },
      "description": "VerificationRequest mirrors model.VerificationRequest field-for-field."
    },
    "v1VerificationRequestsRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        }
      }
    },
    "v1VerificationRequestsResponse": {
      "type": "object",
      "properties": {
        "verification_requests": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1VerificationRequest"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1VerifyEmailRequest": {
      "type": "object",
      "properties": {
        "token": {
          "type": "string"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1VerifyOtpRequest": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string",
          "description": "Exactly one of email / phone_number is required."
        },
        "phone_number": {
          "type": "string"
        },
        "otp": {
          "type": "string"
        },
        "is_totp": {
          "type": "boolean"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "v1Webhook": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "event_name": {
          "type": "string"
        },
        "event_description": {
          "type": "string"
        },
        "endpoint": {
          "type": "string"
        },
        "enabled": {
          "type": "boolean"
        },
        "headers": {
          "$ref": "#/definitions/v1AppData"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "Webhook mirrors model.Webhook field-for-field. headers is a free-form JSON\nobject (reusing the shared AppData wrapper around google.protobuf.Struct)."
    },
    "v1WebhookLog": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "http_status": {
          "type": "string",
          "format": "int64"
        },
        "response": {
          "type": "string"
        },
        "request": {
          "type": "string"
        },
        "webhook_id": {
          "type": "string"
        },
        "created_at": {
          "type": "string",
          "format": "int64"
        },
        "updated_at": {
          "type": "string",
          "format": "int64"
        }
      },
      "description": "WebhookLog mirrors model.WebhookLog field-for-field."
    },
    "v1WebhookLogsRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        },
        "webhook_id": {
          "type": "string"
        }
      },
      "description": "WebhookLogsRequest mirrors model.ListWebhookLogRequest. webhook_id is\noptional; when unset logs for all webhooks are returned."
    },
    "v1WebhookLogsResponse": {
      "type": "object",
      "properties": {
        "webhook_logs": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1WebhookLog"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    },
    "v1WebhooksRequest": {
      "type": "object",
      "properties": {
        "pagination": {
          "$ref": "#/definitions/v1PaginationRequest"
        }
      }
    },
    "v1WebhooksResponse": {
      "type": "object",
      "properties": {
        "webhooks": {
          "type": "array",
          "items": {
            "type": "object",
            "$ref": "#/definitions/v1Webhook"
          }
        },
        "pagination": {
          "$ref": "#/definitions/v1Pagination"
        }
      }
    }
  }
}