{
  "openapi": "3.1.0",
  "info": {
    "title": "Redcee API",
    "version": "1.0.0",
    "description": "Strict, config-scoped JSON API used by the Redcee CLI. Prefer the CLI when the caller can execute a process. No machine endpoint deletes secrets, purges history, manages organizations or access, or issues tokens."
  },
  "servers": [
    {
      "url": "https://redcee.com",
      "description": "Production"
    }
  ],
  "security": [
    {
      "bearerToken": []
    }
  ],
  "paths": {
    "/api/v1/config": {
      "get": {
        "operationId": "getConfig",
        "summary": "Inspect the token's config",
        "description": "Accepts either a read-only service token or an automation token.",
        "responses": {
          "200": {
            "description": "Config metadata",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Config"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "500": {
            "$ref": "#/components/responses/Internal"
          }
        }
      }
    },
    "/api/v1/secrets": {
      "get": {
        "operationId": "getEffectiveSecrets",
        "summary": "Retrieve the effective config",
        "description": "Returns current plaintext values. Accepts either token kind. The response is sensitive and must not be logged.",
        "responses": {
          "200": {
            "description": "Effective plaintext values",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EffectiveSecrets"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      },
      "post": {
        "operationId": "createSecret",
        "summary": "Create a secret",
        "description": "Requires an automation token. `expected_config_revision` is a decimal string. `operation_id` must be UUIDv7 and is the idempotency key.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateSecretRequest"
              }
            }
          }
        },
        "responses": {
          "201": {
            "$ref": "#/components/responses/MutationSucceeded"
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "422": {
            "$ref": "#/components/responses/Validation"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      }
    },
    "/api/v1/secrets/{name}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/SecretName"
        }
      ],
      "get": {
        "operationId": "getSecret",
        "summary": "Retrieve one current secret",
        "description": "Returns plaintext. Accepts either token kind. The response is sensitive and must not be logged.",
        "responses": {
          "200": {
            "description": "Current plaintext value",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretValue"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      },
      "put": {
        "operationId": "replaceSecret",
        "summary": "Replace a current secret",
        "description": "Requires an automation token. Omitting `secret_type` preserves the current classification.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReplaceSecretRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "$ref": "#/components/responses/MutationSucceeded"
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "422": {
            "$ref": "#/components/responses/Validation"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      }
    },
    "/api/v1/secrets/{name}/versions": {
      "get": {
        "operationId": "getSecretVersions",
        "summary": "List version metadata",
        "description": "Requires an automation token. Never returns historical plaintext.",
        "parameters": [
          {
            "$ref": "#/components/parameters/SecretName"
          },
          {
            "name": "page_size",
            "in": "query",
            "required": false,
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "before_version_number",
            "in": "query",
            "required": false,
            "description": "Canonical positive decimal string returned by the previous page.",
            "schema": {
              "$ref": "#/components/schemas/DecimalString"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Version metadata page",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecretHistory"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "422": {
            "$ref": "#/components/responses/Validation"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      }
    },
    "/api/v1/secrets/{name}/versions/{version_id}/rollback": {
      "post": {
        "operationId": "rollbackSecret",
        "summary": "Append a rollback version",
        "description": "Requires an automation token and an active current secret.",
        "parameters": [
          {
            "$ref": "#/components/parameters/SecretName"
          },
          {
            "$ref": "#/components/parameters/VersionId"
          }
        ],
        "requestBody": {
          "$ref": "#/components/requestBodies/ReplayRequest"
        },
        "responses": {
          "200": {
            "$ref": "#/components/responses/MutationSucceeded"
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "422": {
            "$ref": "#/components/responses/Validation"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      }
    },
    "/api/v1/secrets/{name}/versions/{version_id}/restore": {
      "post": {
        "operationId": "restoreSecret",
        "summary": "Append a restore version",
        "description": "Requires an automation token and a tombstoned current secret.",
        "parameters": [
          {
            "$ref": "#/components/parameters/SecretName"
          },
          {
            "$ref": "#/components/parameters/VersionId"
          }
        ],
        "requestBody": {
          "$ref": "#/components/requestBodies/ReplayRequest"
        },
        "responses": {
          "200": {
            "$ref": "#/components/responses/MutationSucceeded"
          },
          "400": {
            "$ref": "#/components/responses/InvalidRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "409": {
            "$ref": "#/components/responses/Conflict"
          },
          "422": {
            "$ref": "#/components/responses/Validation"
          },
          "503": {
            "$ref": "#/components/responses/Unavailable"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerToken": {
        "type": "http",
        "scheme": "bearer",
        "description": "Config-scoped rc_st_ read-only token or rc_at_ automation token."
      }
    },
    "parameters": {
      "SecretName": {
        "name": "name",
        "in": "path",
        "required": true,
        "schema": {
          "$ref": "#/components/schemas/SecretName"
        }
      },
      "VersionId": {
        "name": "version_id",
        "in": "path",
        "required": true,
        "schema": {
          "$ref": "#/components/schemas/UuidV7"
        }
      }
    },
    "requestBodies": {
      "ReplayRequest": {
        "required": true,
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ReplaySecretRequest"
            }
          }
        }
      }
    },
    "responses": {
      "MutationSucceeded": {
        "description": "Mutation committed or exact idempotent result replayed",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/MutationResult"
            }
          }
        }
      },
      "InvalidRequest": {
        "description": "Malformed JSON, unsupported media shape, or unknown field",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Missing, invalid, revoked, or expired token",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Forbidden": {
        "description": "Automation authority or the issuing account's current grant is insufficient",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "NotFound": {
        "description": "Resource not found in the token's config",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Conflict": {
        "description": "Revision, idempotency, lifecycle, or read conflict. Branch on error.code.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Validation": {
        "description": "A bounded request field is invalid",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Unavailable": {
        "description": "Vault temporarily unavailable",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Internal": {
        "description": "Internal failure",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      }
    },
    "schemas": {
      "UuidV7": {
        "type": "string",
        "format": "uuid",
        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
      },
      "DecimalString": {
        "type": "string",
        "pattern": "^[1-9][0-9]*$",
        "description": "Canonical positive decimal integer represented as a JSON string."
      },
      "SecretName": {
        "type": "string",
        "minLength": 1,
        "maxLength": 128,
        "pattern": "^[A-Z][A-Z0-9_]*$"
      },
      "SecretType": {
        "type": "string",
        "enum": [
          "opaque",
          "multiline",
          "json",
          "url",
          "integer",
          "boolean"
        ]
      },
      "Config": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "config_id",
          "config_revision",
          "protected"
        ],
        "properties": {
          "config_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "protected": {
            "type": "boolean"
          }
        }
      },
      "EffectiveSecrets": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "revision",
          "secrets"
        ],
        "properties": {
          "revision": {
            "type": "string",
            "description": "Opaque effective-config resolution revision."
          },
          "secrets": {
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "maxLength": 65536
            }
          }
        }
      },
      "SecretValue": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "revision",
          "key",
          "value"
        ],
        "properties": {
          "revision": {
            "type": "string"
          },
          "key": {
            "$ref": "#/components/schemas/SecretName"
          },
          "value": {
            "type": "string",
            "maxLength": 65536
          }
        }
      },
      "CreateSecretRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "name",
          "value",
          "expected_config_revision",
          "operation_id"
        ],
        "properties": {
          "name": {
            "$ref": "#/components/schemas/SecretName"
          },
          "value": {
            "type": "string",
            "maxLength": 65536
          },
          "secret_type": {
            "$ref": "#/components/schemas/SecretType",
            "default": "opaque"
          },
          "expected_config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "operation_id": {
            "$ref": "#/components/schemas/UuidV7"
          }
        }
      },
      "ReplaceSecretRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "value",
          "expected_config_revision",
          "operation_id"
        ],
        "properties": {
          "value": {
            "type": "string",
            "maxLength": 65536
          },
          "secret_type": {
            "$ref": "#/components/schemas/SecretType"
          },
          "expected_config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "operation_id": {
            "$ref": "#/components/schemas/UuidV7"
          }
        }
      },
      "ReplaySecretRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "expected_config_revision",
          "operation_id"
        ],
        "properties": {
          "expected_config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "operation_id": {
            "$ref": "#/components/schemas/UuidV7"
          }
        }
      },
      "MutationResult": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "secret_id",
          "version_id",
          "config_revision",
          "operation_id"
        ],
        "properties": {
          "secret_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "version_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "operation_id": {
            "$ref": "#/components/schemas/UuidV7"
          }
        }
      },
      "SecretVersion": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "version_id",
          "version_number",
          "name",
          "secret_type",
          "value_state",
          "source_version_id",
          "operation_id",
          "operation",
          "created_at",
          "is_current"
        ],
        "properties": {
          "version_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "version_number": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "name": {
            "$ref": "#/components/schemas/SecretName"
          },
          "secret_type": {
            "$ref": "#/components/schemas/SecretType"
          },
          "value_state": {
            "type": "string",
            "enum": [
              "value",
              "tombstone"
            ]
          },
          "source_version_id": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/UuidV7"
              },
              {
                "type": "null"
              }
            ]
          },
          "operation_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "operation": {
            "oneOf": [
              {
                "type": "string",
                "enum": [
                  "create",
                  "replace",
                  "duplicate",
                  "delete",
                  "restore",
                  "rollback"
                ]
              },
              {
                "type": "null"
              }
            ]
          },
          "created_at": {
            "type": "string",
            "format": "date-time"
          },
          "is_current": {
            "type": "boolean"
          }
        }
      },
      "SecretHistory": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "config_revision",
          "secret_id",
          "current_version_id",
          "versions",
          "next_before_version_number"
        ],
        "properties": {
          "config_revision": {
            "$ref": "#/components/schemas/DecimalString"
          },
          "secret_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "current_version_id": {
            "$ref": "#/components/schemas/UuidV7"
          },
          "versions": {
            "type": "array",
            "maxItems": 100,
            "items": {
              "$ref": "#/components/schemas/SecretVersion"
            }
          },
          "next_before_version_number": {
            "oneOf": [
              {
                "$ref": "#/components/schemas/DecimalString"
              },
              {
                "type": "null"
              }
            ]
          }
        }
      },
      "ErrorEnvelope": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "code",
              "message",
              "request_id"
            ],
            "properties": {
              "code": {
                "type": "string",
                "enum": [
                  "invalid_request",
                  "validation_error",
                  "invalid_token",
                  "insufficient_scope",
                  "not_found",
                  "read_conflict",
                  "revision_conflict",
                  "idempotency_conflict",
                  "lifecycle_conflict",
                  "service_unavailable",
                  "internal_error"
                ]
              },
              "message": {
                "type": "string"
              },
              "request_id": {
                "$ref": "#/components/schemas/UuidV7"
              }
            }
          }
        }
      }
    }
  }
}