{ "openapi": "3.1.0", "info": { "title": "Walwarden Public API", "version": "1.0.0-alpha", "description": "Public REST API v1 for scoped machine clients. This alpha slice exposes database and destination reads, backup trigger/status, evidence metadata, and restore create/status for CLI-local execution. The `restore create`/`status` pair opens and tracks a CLI-local restore session; end-to-end execution runs through the CLI `restore execute` bridge, proven against a live disposable target (E2E run e2e-20260607T1941-8beaa08, audit chain reaching restore.completed; evidence in #320)." }, "servers": [ { "url": "/api/v1" } ], "security": [ { "bearerApiKey": [] } ], "paths": { "/profile": { "get": { "operationId": "getProfile", "summary": "Validate API key profile", "description": "Returns safe machine-client identity metadata for the active API key. Requires a valid Bearer API key but no resource scope.", "responses": { "200": { "description": "Safe API-key profile metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetPublicApiProfileResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" } } } }, "/databases": { "get": { "operationId": "listDatabases", "summary": "List protected databases", "x-required-scope": "databases:read", "responses": { "200": { "description": "Protected databases in the API key organization", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListDatabasesResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" } } } }, "/databases/{databaseId}": { "get": { "operationId": "getDatabase", "summary": "Read a protected database", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/DatabaseId" } ], "responses": { "200": { "description": "Protected database summary", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetDatabaseResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/destinations": { "get": { "operationId": "listDestinations", "summary": "List backup destinations", "description": "Lists backup destination summaries without returning credential material.", "x-required-scope": "destinations:read", "responses": { "200": { "description": "Backup destinations in the API key organization", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListDestinationsResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" } } } }, "/destinations/{destinationId}": { "get": { "operationId": "getDestination", "summary": "Read a backup destination", "description": "Reads one backup destination summary without returning credential material.", "x-required-scope": "destinations:read", "parameters": [ { "$ref": "#/components/parameters/DestinationId" } ], "responses": { "200": { "description": "Backup destination summary", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetDestinationResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/databases/{databaseId}/backups": { "get": { "operationId": "listDatabaseBackups", "summary": "List backup jobs for a database", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/DatabaseId" } ], "responses": { "200": { "description": "Backup jobs for the database", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListDatabaseBackupsResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } }, "post": { "operationId": "triggerBackup", "summary": "Trigger an ad-hoc backup", "x-required-scope": "backups:trigger", "parameters": [ { "$ref": "#/components/parameters/DatabaseId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerBackupRequest" } } } }, "responses": { "202": { "description": "Backup job enqueued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerBackupResponse" } } } }, "400": { "$ref": "#/components/responses/InvalidRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "412": { "$ref": "#/components/responses/PreconditionFailed" } } } }, "/backups/{backupJobId}": { "get": { "operationId": "getBackup", "summary": "Read backup job status", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/BackupJobId" } ], "responses": { "200": { "description": "Backup job status and artifact metadata when available", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetBackupResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/evidence": { "get": { "operationId": "listEvidence", "summary": "List evidence metadata", "x-required-scope": "evidence:read", "parameters": [ { "name": "databaseId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Evidence metadata and proof semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListEvidenceResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" } } } }, "/evidence/{backupJobId}": { "get": { "operationId": "getEvidence", "summary": "Read evidence detail", "x-required-scope": "evidence:read", "parameters": [ { "$ref": "#/components/parameters/BackupJobId" } ], "responses": { "200": { "description": "Public evidence detail and proof semantics for one backup job", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetEvidenceResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/restores": { "post": { "operationId": "createRestore", "summary": "Create restore job", "description": "Creates a restore job for CLI-local execution from a completed backup. Raw target database credentials must remain client-side; the request sends only targetRedactedDsn. Do not claim this restore flow production-green until the #320 live disposable-target E2E proof is attached.", "x-required-scope": "restores:write", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRestoreRequest" } } } }, "responses": { "202": { "description": "Restore job created and CLI-local execution coordinates issued", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRestoreResponse" } } } }, "400": { "$ref": "#/components/responses/InvalidRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "412": { "$ref": "#/components/responses/PreconditionFailed" } } } }, "/restores/{restoreJobId}": { "get": { "operationId": "getRestore", "summary": "Read restore job status", "x-required-scope": "restores:read", "parameters": [ { "name": "restoreJobId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Restore job status with proof semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetRestoreResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/databases/{databaseId}/recovery/summary": { "get": { "operationId": "getRecoverySummary", "summary": "Read recovery and custody summary", "description": "Returns the latest decision-grade recovery window summary for a database.", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/DatabaseId" } ], "responses": { "200": { "description": "Latest recovery/custody summary", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoverySummaryResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/databases/{databaseId}/recovery/candidate": { "get": { "operationId": "getRecoveryCandidate", "summary": "Find incident-time recovery candidate", "description": "Returns the closest restore-ready snapshot/cursor candidate before the requested incident time.", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/DatabaseId" }, { "$ref": "#/components/parameters/IncidentTime" } ], "responses": { "200": { "description": "Incident-time recovery candidate decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryCandidateResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } }, "/recovery/windows/{windowId}/proof": { "get": { "operationId": "getRecoveryWindowProof", "summary": "Read recovery-window proof status", "description": "Returns proof and custody status for a selected recovery window without exposing raw segment internals.", "x-required-scope": "databases:read", "parameters": [ { "$ref": "#/components/parameters/WindowId" } ], "responses": { "200": { "description": "Recovery-window proof and custody status", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryWindowProofResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" } } } } }, "components": { "securitySchemes": { "bearerApiKey": { "type": "http", "scheme": "bearer", "description": "Walwarden API key issued from team settings with endpoint-specific scopes." } }, "parameters": { "DatabaseId": { "name": "databaseId", "in": "path", "required": true, "schema": { "type": "string" } }, "BackupJobId": { "name": "backupJobId", "in": "path", "required": true, "schema": { "type": "string" } }, "DestinationId": { "name": "destinationId", "in": "path", "required": true, "schema": { "type": "string" } }, "IdempotencyKey": { "name": "Idempotency-Key", "in": "header", "required": true, "schema": { "type": "string", "minLength": 1, "maxLength": 200 } }, "WindowId": { "name": "windowId", "in": "path", "required": true, "schema": { "type": "string", "minLength": 1 } }, "IncidentTime": { "name": "incidentTime", "in": "query", "required": true, "schema": { "type": "string", "format": "date-time" }, "description": "Incident timestamp, such as a bad release or suspicious activity cutoff." } }, "schemas": { "IsoDateTime": { "type": "string", "format": "date-time" }, "Provider": { "type": "string", "enum": [ "supabase", "neon", "rds", "aurora" ] }, "ProtectedDatabaseState": { "type": "string", "enum": [ "active", "degraded", "paused", "connection_drifted" ] }, "BackupJobState": { "type": "string", "enum": [ "queued", "claimed", "running", "finalizing", "completed", "failed_retryable", "failed_terminal", "cancelled", "timed_out" ] }, "BackupTrigger": { "type": "string", "enum": [ "adhoc", "scheduled" ] }, "RestoreMode": { "type": "string", "enum": [ "new_database", "in_place" ] }, "RestoreJobState": { "type": "string", "enum": [ "queued", "claimed", "downloading", "verifying", "restoring", "finalizing", "completed", "failed_retryable", "failed_terminal", "cancelled", "timed_out" ] }, "ProtectedDatabaseSummary": { "type": "object", "required": [ "id", "organizationId", "name", "provider", "scheduleTimezone", "restoreDrillTimezone", "retentionPolicyDays", "dataResidency", "state", "createdAt" ], "properties": { "id": { "type": "string", "minLength": 1 }, "organizationId": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "provider": { "$ref": "#/components/schemas/Provider" }, "scheduleCron": { "type": "string" }, "scheduleTimezone": { "type": "string", "minLength": 1 }, "restoreDrillCron": { "type": "string" }, "restoreDrillTimezone": { "type": "string", "minLength": 1 }, "retentionPolicyDays": { "type": "integer", "minimum": 1, "maximum": 365 }, "dataResidency": { "type": "string", "enum": [ "us", "eu", "apac" ] }, "state": { "$ref": "#/components/schemas/ProtectedDatabaseState" }, "lastSuccessfulBackupAt": { "$ref": "#/components/schemas/IsoDateTime" }, "createdAt": { "$ref": "#/components/schemas/IsoDateTime" } }, "additionalProperties": false }, "ListDatabasesResponse": { "type": "object", "required": [ "databases" ], "properties": { "databases": { "type": "array", "items": { "$ref": "#/components/schemas/ProtectedDatabaseSummary" } } }, "additionalProperties": false }, "GetDatabaseResponse": { "type": "object", "required": [ "database" ], "properties": { "database": { "$ref": "#/components/schemas/ProtectedDatabaseSummary" } }, "additionalProperties": false }, "DestinationKind": { "type": "string", "enum": [ "aws_s3", "minio", "gcs_s3_compat", "wasabi", "backblaze_b2" ] }, "DestinationState": { "type": "string", "enum": [ "unverified", "verifying", "verified", "failed", "suspended" ] }, "BackupDestinationSummary": { "type": "object", "required": [ "id", "organizationId", "kind", "region", "retentionFloorDays", "state", "createdAt" ], "properties": { "id": { "type": "string", "minLength": 1 }, "organizationId": { "type": "string", "minLength": 1 }, "kind": { "$ref": "#/components/schemas/DestinationKind" }, "region": { "type": "string", "minLength": 1 }, "retentionFloorDays": { "type": "integer", "minimum": 1, "maximum": 365 }, "state": { "$ref": "#/components/schemas/DestinationState" }, "lastVerifiedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "createdAt": { "$ref": "#/components/schemas/IsoDateTime" }, "bucketArn": { "type": "string" }, "bucketName": { "type": "string" } }, "additionalProperties": false }, "ListDestinationsResponse": { "type": "object", "required": [ "destinations" ], "properties": { "destinations": { "type": "array", "items": { "$ref": "#/components/schemas/BackupDestinationSummary" } } }, "additionalProperties": false }, "GetDestinationResponse": { "type": "object", "required": [ "destination" ], "properties": { "destination": { "$ref": "#/components/schemas/BackupDestinationSummary" } }, "additionalProperties": false }, "PublicApiProfile": { "type": "object", "required": [ "apiKeyId", "clientKind", "clientLabel", "autonomyLevel", "organizationId", "organizationSlug", "scopes" ], "properties": { "apiKeyId": { "type": "string", "minLength": 1 }, "clientKind": { "type": "string", "enum": [ "web", "cli", "mcp_external" ] }, "clientLabel": { "type": [ "string", "null" ], "minLength": 1 }, "autonomyLevel": { "type": "string", "enum": [ "read_only", "guided", "autonomous" ] }, "organizationId": { "type": "string", "minLength": 1 }, "organizationSlug": { "type": "string", "minLength": 1 }, "scopes": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "expiresAt": { "$ref": "#/components/schemas/IsoDateTime" } }, "additionalProperties": false }, "GetPublicApiProfileResponse": { "type": "object", "required": [ "profile" ], "properties": { "profile": { "$ref": "#/components/schemas/PublicApiProfile" } }, "additionalProperties": false }, "BackupArtifactSummary": { "type": "object", "required": [ "artifactKey", "manifestObjectKey", "sizeBytes", "checksumSha256", "recordedAt" ], "properties": { "artifactKey": { "type": "string", "minLength": 1 }, "manifestObjectKey": { "type": "string", "minLength": 1 }, "sizeBytes": { "type": "integer", "minimum": 0 }, "checksumSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "recordedAt": { "$ref": "#/components/schemas/IsoDateTime" } }, "additionalProperties": false }, "BackupJobSummary": { "type": "object", "required": [ "id", "protectedDatabaseId", "state", "trigger", "attempt", "enqueuedAt", "claimedAt" ], "properties": { "id": { "type": "string", "minLength": 1 }, "protectedDatabaseId": { "type": "string", "minLength": 1 }, "state": { "$ref": "#/components/schemas/BackupJobState" }, "trigger": { "$ref": "#/components/schemas/BackupTrigger" }, "attempt": { "type": "integer", "minimum": 0 }, "enqueuedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "claimedAt": { "oneOf": [ { "$ref": "#/components/schemas/IsoDateTime" }, { "type": "null" } ] } }, "additionalProperties": false }, "ListDatabaseBackupsResponse": { "type": "object", "required": [ "backupJobs" ], "properties": { "backupJobs": { "type": "array", "items": { "$ref": "#/components/schemas/BackupJobSummary" } } }, "additionalProperties": false }, "TriggerBackupRequest": { "type": "object", "properties": { "trigger": { "type": "string", "enum": [ "adhoc" ], "default": "adhoc" } }, "additionalProperties": false }, "TriggerBackupResponse": { "type": "object", "required": [ "backupJobId", "state", "enqueuedAt" ], "properties": { "backupJobId": { "type": "string", "minLength": 1 }, "state": { "$ref": "#/components/schemas/BackupJobState" }, "enqueuedAt": { "$ref": "#/components/schemas/IsoDateTime" } }, "additionalProperties": false }, "GetBackupResponse": { "type": "object", "required": [ "id", "organizationId", "protectedDatabaseId", "state", "trigger", "attempt", "enqueuedAt" ], "properties": { "id": { "type": "string", "minLength": 1 }, "organizationId": { "type": "string", "minLength": 1 }, "protectedDatabaseId": { "type": "string", "minLength": 1 }, "destinationId": { "type": "string", "minLength": 1 }, "state": { "$ref": "#/components/schemas/BackupJobState" }, "trigger": { "$ref": "#/components/schemas/BackupTrigger" }, "attempt": { "type": "integer", "minimum": 0 }, "enqueuedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "claimedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "startedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "completedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "errorKind": { "type": "string" }, "errorMessage": { "type": "string" }, "artifact": { "$ref": "#/components/schemas/BackupArtifactSummary" } }, "additionalProperties": false }, "IntegrityVerification": { "type": "object", "required": [ "id", "jobId", "organizationId", "artifactKey", "verifiedAt", "result" ], "properties": { "id": { "type": "string", "minLength": 1 }, "jobId": { "type": "string", "minLength": 1 }, "organizationId": { "type": "string", "minLength": 1 }, "artifactKey": { "type": "string", "minLength": 1 }, "verifiedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "result": { "type": "string", "enum": [ "passed", "failed", "timed_out" ] }, "message": { "type": "string" } }, "additionalProperties": false }, "EvidenceAuditEventSummary": { "type": "object", "required": [ "kind", "at" ], "properties": { "kind": { "type": "string" }, "at": { "$ref": "#/components/schemas/IsoDateTime" } }, "additionalProperties": false }, "EvidenceItem": { "type": "object", "required": [ "backupJobId", "artifactKey", "manifestObjectKey", "sizeBytes", "checksumSha256", "recordedAt", "integrityVerification", "auditEvents" ], "properties": { "backupJobId": { "type": "string", "minLength": 1 }, "artifactKey": { "type": "string", "minLength": 1 }, "manifestObjectKey": { "type": "string", "minLength": 1 }, "sizeBytes": { "type": "integer", "minimum": 0 }, "checksumSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "recordedAt": { "$ref": "#/components/schemas/IsoDateTime" }, "integrityVerification": { "oneOf": [ { "$ref": "#/components/schemas/IntegrityVerification" }, { "type": "null" } ] }, "auditEvents": { "type": "array", "items": { "$ref": "#/components/schemas/EvidenceAuditEventSummary" } } }, "additionalProperties": false }, "ProofSemantics": { "type": "object", "required": [ "completedBackup", "verifiedRestore", "provenRecoverability" ], "properties": { "completedBackup": { "type": "string" }, "verifiedRestore": { "type": "string" }, "provenRecoverability": { "type": "string" } }, "additionalProperties": false }, "ListEvidenceResponse": { "type": "object", "required": [ "evidence", "proofSemantics" ], "properties": { "evidence": { "type": "array", "items": { "$ref": "#/components/schemas/EvidenceItem" } }, "proofSemantics": { "$ref": "#/components/schemas/ProofSemantics" } }, "additionalProperties": false }, "GetEvidenceResponse": { "type": "object", "required": [ "evidence", "proofSemantics" ], "properties": { "evidence": { "$ref": "#/components/schemas/EvidenceItem" }, "proofSemantics": { "$ref": "#/components/schemas/ProofSemantics" } }, "additionalProperties": false }, "CreateRestoreRequest": { "type": "object", "required": [ "backupJobId", "targetRedactedDsn", "mode", "confirmDestructive" ], "properties": { "backupJobId": { "type": "string", "minLength": 1 }, "targetRedactedDsn": { "type": "string", "minLength": 1, "description": "Redacted target identity derived by the client. Raw target DSN/password must remain client-side." }, "mode": { "$ref": "#/components/schemas/RestoreMode" }, "confirmDestructive": { "type": "boolean", "description": "Must be true for in_place restores." } }, "additionalProperties": false }, "RestoreExecutionCoordinates": { "type": "object", "required": [ "jobId", "lockToken", "presignedS3Url", "manifestObjectKey", "expectedSizeBytes", "expectedSha256" ], "properties": { "jobId": { "type": "string", "format": "uuid" }, "lockToken": { "type": "string", "minLength": 1, "description": "Secret client-side restore lock token. Do not log or expose outside the CLI-local execution process." }, "presignedS3Url": { "type": "string", "format": "uri", "description": "Short-lived artifact download URL for CLI-local restore execution. Do not log." }, "manifestObjectKey": { "type": "string", "minLength": 1 }, "expectedSizeBytes": { "type": "integer", "minimum": 0 }, "expectedSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "additionalProperties": false }, "CreateRestoreResponse": { "type": "object", "required": [ "restoreJob", "execution" ], "properties": { "restoreJob": { "$ref": "#/components/schemas/RestoreJob" }, "execution": { "$ref": "#/components/schemas/RestoreExecutionCoordinates" } }, "additionalProperties": false }, "RestoreProof": { "type": "object", "required": [ "completedBackup", "verifiedRestore", "provenRecoverability" ], "properties": { "completedBackup": { "type": "boolean" }, "verifiedRestore": { "type": "boolean" }, "provenRecoverability": { "type": "boolean" } }, "additionalProperties": false }, "RestoreJob": { "type": "object", "required": [ "id", "databaseId", "manifestHash", "mode", "state", "createdAt", "finalizedAt", "heartbeatAt", "errorKind", "errorMessage", "proof" ], "properties": { "id": { "type": "string", "minLength": 1 }, "databaseId": { "type": "string", "minLength": 1 }, "manifestHash": { "type": "string" }, "mode": { "$ref": "#/components/schemas/RestoreMode" }, "state": { "$ref": "#/components/schemas/RestoreJobState" }, "createdAt": { "$ref": "#/components/schemas/IsoDateTime" }, "finalizedAt": { "oneOf": [ { "$ref": "#/components/schemas/IsoDateTime" }, { "type": "null" } ] }, "heartbeatAt": { "oneOf": [ { "$ref": "#/components/schemas/IsoDateTime" }, { "type": "null" } ] }, "errorKind": { "type": [ "string", "null" ] }, "errorMessage": { "type": [ "string", "null" ] }, "proof": { "$ref": "#/components/schemas/RestoreProof" } }, "additionalProperties": false }, "GetRestoreResponse": { "type": "object", "required": [ "restoreJob" ], "properties": { "restoreJob": { "$ref": "#/components/schemas/RestoreJob" } }, "additionalProperties": false }, "PublicApiError": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "object", "required": [ "code", "message", "requestId" ], "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "requestId": { "type": "string" }, "requiredScope": { "type": "string" }, "nextAction": { "type": "string" } } } } }, "RecoveryProofStatus": { "type": "string", "enum": [ "verified", "incomplete", "broken", "expired" ] }, "RecoveryCustodyStatus": { "type": "string", "enum": [ "complete", "incomplete" ] }, "RecoveryWindowDecision": { "type": "object", "required": [ "windowId", "databaseId", "snapshotTime", "validatedThrough", "targetCursor", "gapBeforeIncidentSeconds", "schemaDigest", "segmentCount", "proofStatus", "custodyStatus", "restoreAvailable", "exportAvailable", "reason", "summary", "recommendedAction" ], "properties": { "windowId": { "type": "string", "minLength": 1 }, "databaseId": { "type": "string", "minLength": 1 }, "snapshotTime": { "type": "string", "format": "date-time" }, "validatedThrough": { "type": "string", "format": "date-time" }, "targetCursor": { "type": "string", "minLength": 1 }, "gapBeforeIncidentSeconds": { "type": [ "integer", "null" ], "minimum": 0 }, "schemaDigest": { "anyOf": [ { "type": "string", "pattern": "^[a-f0-9]{64}$" }, { "type": "null" } ] }, "segmentCount": { "type": "integer", "minimum": 0 }, "proofStatus": { "$ref": "#/components/schemas/RecoveryProofStatus" }, "custodyStatus": { "$ref": "#/components/schemas/RecoveryCustodyStatus" }, "restoreAvailable": { "type": "boolean" }, "exportAvailable": { "type": "boolean" }, "reason": { "type": [ "string", "null" ], "minLength": 1 }, "summary": { "type": "string", "minLength": 1 }, "recommendedAction": { "type": "string", "minLength": 1 } } }, "RecoverySummaryResponse": { "type": "object", "required": [ "databaseId", "latest", "reason", "summary", "recommendedAction" ], "properties": { "databaseId": { "type": "string", "minLength": 1 }, "latest": { "anyOf": [ { "$ref": "#/components/schemas/RecoveryWindowDecision" }, { "type": "null" } ] }, "reason": { "type": [ "string", "null" ], "minLength": 1 }, "summary": { "type": "string", "minLength": 1 }, "recommendedAction": { "type": "string", "minLength": 1 } } }, "RecoveryCandidateResponse": { "type": "object", "required": [ "databaseId", "incidentTime", "recommended", "reason", "summary", "recommendedAction" ], "properties": { "databaseId": { "type": "string", "minLength": 1 }, "incidentTime": { "type": "string", "format": "date-time" }, "recommended": { "anyOf": [ { "$ref": "#/components/schemas/RecoveryWindowDecision" }, { "type": "null" } ] }, "reason": { "type": [ "string", "null" ], "minLength": 1 }, "summary": { "type": "string", "minLength": 1 }, "recommendedAction": { "type": "string", "minLength": 1 } } }, "RecoveryWindowProofResponse": { "type": "object", "required": [ "window", "proof" ], "properties": { "window": { "$ref": "#/components/schemas/RecoveryWindowDecision" }, "proof": { "type": "object", "required": [ "baselineArtifact", "cursorChain", "schemaDigest" ], "properties": { "baselineArtifact": { "type": "object", "required": [ "backupJobId", "retained", "checksumSha256" ], "properties": { "backupJobId": { "type": [ "string", "null" ], "minLength": 1 }, "retained": { "type": "boolean" }, "checksumSha256": { "anyOf": [ { "type": "string", "pattern": "^[a-f0-9]{64}$" }, { "type": "null" } ] } } }, "cursorChain": { "type": "object", "required": [ "targetCursor", "segmentCount", "contiguous" ], "properties": { "targetCursor": { "type": "string", "minLength": 1 }, "segmentCount": { "type": "integer", "minimum": 0 }, "contiguous": { "type": "boolean" } } }, "schemaDigest": { "anyOf": [ { "type": "string", "pattern": "^[a-f0-9]{64}$" }, { "type": "null" } ] } } } } } }, "responses": { "Unauthorized": { "description": "Missing or rejected bearer API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "Forbidden": { "description": "API key lacks the required scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "InvalidRequest": { "description": "Invalid request body, missing idempotency key, or malformed input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "Conflict": { "description": "Idempotency key is already in flight or was reused with a different body", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "NotFound": { "description": "Resource not found in the API key organization", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "PreconditionFailed": { "description": "Operation is not safe until the named precondition is resolved", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } }, "Unsupported": { "description": "Capability is intentionally unavailable in this public API slice", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicApiError" } } } } } } }