{"components":{"parameters":{"after":{"description":"The next_cursor from the previous page.","in":"query","name":"after","schema":{"type":"string"}},"idempotencyKey":{"description":"Retrying a POST with the same key replays the first answer.","in":"header","name":"Idempotency-Key","schema":{"maxLength":255,"type":"string"}},"limit":{"in":"query","name":"limit","schema":{"default":50,"maximum":100,"minimum":1,"type":"integer"}}},"schemas":{"Error":{"properties":{"error":{"properties":{"code":{"type":"string"},"details":{"type":"object"},"message":{"type":"string"}},"required":["code","message"],"type":"object"}},"required":["error"],"type":"object"}},"securitySchemes":{"managementKey":{"description":"A management API key (epb_mk_...).","scheme":"bearer","type":"http"}}},"info":{"description":"Manage an organization's EndPointBlank setup from code. Authenticate with a management API key from Settings > API Keys.","title":"EndPointBlank Management API","version":"v1"},"openapi":"3.1.0","paths":{"/clients/{client_id}/applications/{id}":{"delete":{"description":"Refused (has_dependents) while access grants or credentials depend on it.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientDeleteApplication","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application was deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Still in use, or intake refused the delete"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Delete an application"},"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientGetApplication","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Get an application"},"patch":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientUpdateApplication","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"name":{"type":"string"},"public":{"type":"boolean"}},"required":[],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The updated application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the change"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Rename an application or change whether it is public"}},"/clients/{client_id}/applications/{application_id}/environments":{"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientListApplicationEnvironments","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"application_id":{"format":"uuid","type":"string"},"base_url":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of application environments"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: List the environments an application runs in"},"post":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientCreateApplicationEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"base_url":{"examples":["https://api.example.com"],"type":"string"},"environment_id":{"format":"uuid","type":"string"}},"required":["environment_id","base_url"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"application_id":{"format":"uuid","type":"string"},"base_url":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Application not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the environment"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Place an application in an environment at a base URL"}},"/clients/{client_id}/grants/{id}":{"delete":{"description":"Revokes the grant unless an API package the client holds also derives it; still_granted_by_package then says the client keeps it through the package. Drops a pending one, or dismisses one refused on accept.","operationId":"deleteClientGrant","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"description":"A direct grant's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"type":"string"},"still_granted_by_package":{"description":"True when an API package the client holds also derives the grant, so the client keeps it through the package.","type":"boolean"}},"type":"object"}},"type":"object"}}},"description":"The direct grant was removed"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: client_accepted (a pending grant, and the client accepted while this was sent, so it is being applied)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Revoke a client's direct grant"}},"/clients/{client_id}/applications":{"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientListApplications","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of applications"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: List applications"},"post":{"description":"Places the application in each environment given a base URL; at least one is required.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientCreateApplication","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"environment_base_urls":{"additionalProperties":{"type":"string"},"description":"Environment id to base URL, e.g. https://api.example.com","type":"object"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":"string"},"public":{"type":"boolean"}},"required":["name","environment_base_urls"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The created application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the application"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Create an application"}},"/clients/{client_id}/packages/{id}":{"delete":{"description":"Revokes every grant the package was the client's last reason for. A grant also granted directly or by another package stays. Drops a pending one, or dismisses one refused on accept.","operationId":"deleteClientPackage","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"description":"A package assignment's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"type":"string"}},"type":"object"}},"type":"object"}}},"description":"The package was un-assigned"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: client_accepted (a pending assignment, and the client accepted while this was sent, so it is being applied)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Un-assign an API package from a client"},"patch":{"description":"Re-derives the client's grants from the package in the new environment, or moves a pending one. Refused (422) with nothing_published_in_environment when the package publishes nothing there, or (client_accepted) when the client accepted while this was sent.","operationId":"updateClientPackage","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"description":"A package assignment's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"environment_id":{"format":"uuid","type":"string"}},"required":["environment_id"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The assignment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: environment_not_found, nothing_published_in_environment, client_accepted (a pending assignment, and the client accepted while this was sent) or validation_failed"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Change the environment a client holds an API package in"}},"/clients/{client_id}/packages":{"get":{"description":"For a client that has not accepted its invite, the packages set up for it to get when it does (status pending).","operationId":"listClientPackages","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of assignments"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such client"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List the API packages a client holds"},"post":{"description":"Grants the client every endpoint the package publishes in environment_id, pushed to your intake. For a client that has not accepted its invite, sets the package up (status pending) to be assigned, and pushed, the moment it accepts; one that cannot be assigned then is kept as status refused with the reason, and your administrators are emailed. Refused (422) when the client already holds or is set up for the package (already_assigned) or the package publishes nothing in that environment (nothing_published_in_environment).","operationId":"assignClientPackage","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"environment_id":{"format":"uuid","type":"string"}},"required":["api_package_id","environment_id"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The assignment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such client"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: environment_not_found, api_package_not_found, already_assigned, nothing_published_in_environment or validation_failed"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Assign an API package to a client"}},"/clients/{id}":{"delete":{"description":"Deletes the invite. When it was your last accepted invite for that client organization, also un-assigns every API package the client holds from you and revokes every grant those packages and direct grants gave it; while another accepted invite links you to the same organization, its packages and grants stay. The revoke is run again a few minutes later, so an assignment or grant made while it ran is taken away too. Safe to retry: a client already removed answers 404 and nothing changes. Anything set up for a pending invite to get on accept is deleted with it. An unclaimed managed client is deleted with everything it holds: its applications with their environments and endpoints, its links to you, its pending claim invites, and its organization. Revoke its credentials first (managed_client_has_credentials otherwise). It is refused, changing nothing, while it holds what this does not remove (client_not_removable: message says what), and with client_not_managed if your customer claimed it before. The first step closes it to claims for good: no claim invite can be sent or accepted after it. A removal that stops partway (intake refusing a step: client_not_removable; intake unreachable or failing with a 5xx: intake_unavailable; any other answer from intake: intake_rejected) leaves what it removed removed and the client still here, and the same DELETE carries it on. While it is partway, its claim invites answer client_being_removed.","operationId":"deleteClient","parameters":[{"description":"A client's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"type":"string"}},"type":"object"}},"type":"object"}}},"description":"The client was removed"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"An unclaimed managed client that still has credentials, holds what removing it does not remove, or was claimed; or a removal intake refused partway, or answered unexpectedly (intake_rejected)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake could not be reached, or failed (5xx), partway; send the DELETE again"}},"summary":"Remove a client"},"get":{"operationId":"getClient","parameters":[{"description":"A client's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"accepted_at":{"format":"date-time","type":["string","null"]},"claimed_at":{"description":"When your customer claimed this managed client.","format":"date-time","type":["string","null"]},"client_organization":{"properties":{"id":{"format":"uuid","type":"string"},"name":{"type":"string"}},"type":["object","null"]},"contacts":{"items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"invite_code":{"description":"What the client accepts a code invite with: set while pending, null once accepted, and always null for an email invite, which only its invitee can accept. A secret: whoever redeems it becomes this client. Returned to write keys only; a read key's responses leave the field out.","type":["string","null"]},"invite_expires_at":{"description":"When an email invite's sign-up link stops working; null for a code invite and for an invite to an existing account, which has no link and never expires.","format":"date-time","type":["string","null"]},"invite_status":{"description":"Where the invite stands. declined and expired happen only to email invites; POST /clients/{client_id}/invite/link reopens an expired one. An invite to an existing account (managed: true with that user's email) never expires: it is pending until accepted or declined. DELETE /clients/{client_id}/invite answers revoked, after which the client is gone.","enum":["pending","accepted","declined","expired"],"type":"string"},"invitee_email":{"description":"The address an email invite is for (lower-cased), or null for a code invite.","format":"email","type":["string","null"]},"managed":{"description":"Created by you for your customer (POST /clients with managed: true). false for an invite, including the one POST /clients with managed: true answers when the email belongs to an EndPointBlank user. While claimed_at is null you manage its applications, environments and credentials under /clients/{client_id}/...","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"Managed clients only (null otherwise): your customer's address, lower-cased. While the client is unclaimed they can sign in with a one-time code sent to it to approve an AI agent for it. Set with POST /clients or PATCH /clients/{id}.","format":"email","type":["string","null"]},"pre_assignments":{"description":"On a single client only: API packages and grants set up before the client accepted that are not assignments or grants yet (pending, or refused on accept).","properties":{"grants":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"packages":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"}},"type":"object"},"status":{"enum":["pending","accepted"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The client"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Get a client"},"patch":{"description":"Sets or replaces owner_email on your managed client while it is unclaimed: the address your customer gets a one-time sign-in code at to approve an AI agent for it. A replaced address can no longer sign in, a sign-in it already made ends, and every AI agent it approved is revoked, at EndPointBlank and at intake; the new owner connects their own. Setting the address the client already has changes nothing. Nothing else is changed here.","operationId":"updateClient","parameters":[{"description":"A client's id.","in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"owner_email":{"format":"email","type":"string"}},"required":["owner_email"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"accepted_at":{"format":"date-time","type":["string","null"]},"claimed_at":{"description":"When your customer claimed this managed client.","format":"date-time","type":["string","null"]},"client_organization":{"properties":{"id":{"format":"uuid","type":"string"},"name":{"type":"string"}},"type":["object","null"]},"contacts":{"items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"invite_code":{"description":"What the client accepts a code invite with: set while pending, null once accepted, and always null for an email invite, which only its invitee can accept. A secret: whoever redeems it becomes this client. Returned to write keys only; a read key's responses leave the field out.","type":["string","null"]},"invite_expires_at":{"description":"When an email invite's sign-up link stops working; null for a code invite and for an invite to an existing account, which has no link and never expires.","format":"date-time","type":["string","null"]},"invite_status":{"description":"Where the invite stands. declined and expired happen only to email invites; POST /clients/{client_id}/invite/link reopens an expired one. An invite to an existing account (managed: true with that user's email) never expires: it is pending until accepted or declined. DELETE /clients/{client_id}/invite answers revoked, after which the client is gone.","enum":["pending","accepted","declined","expired"],"type":"string"},"invitee_email":{"description":"The address an email invite is for (lower-cased), or null for a code invite.","format":"email","type":["string","null"]},"managed":{"description":"Created by you for your customer (POST /clients with managed: true). false for an invite, including the one POST /clients with managed: true answers when the email belongs to an EndPointBlank user. While claimed_at is null you manage its applications, environments and credentials under /clients/{client_id}/...","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"Managed clients only (null otherwise): your customer's address, lower-cased. While the client is unclaimed they can sign in with a one-time code sent to it to approve an AI agent for it. Set with POST /clients or PATCH /clients/{id}.","format":"email","type":["string","null"]},"pre_assignments":{"description":"On a single client only: API packages and grants set up before the client accepted that are not assignments or grants yet (pending, or refused on accept).","properties":{"grants":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"packages":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"}},"type":"object"},"status":{"enum":["pending","accepted"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The client"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"validation_failed (owner_email missing or invalid), or client_not_managed (not your managed client, or already claimed)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Set a managed client's owner email"}},"/clients/{client_id}/invite/link":{"post":{"description":"For an email invite nobody has answered, expired or not: a new signup_url, in this answer only, valid for 14 days. The old link stops working. EndPointBlank sends nothing; send the link yourself.","operationId":"newClientInviteLink","parameters":[{"description":"A client's id.","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"accepted_at":{"format":"date-time","type":["string","null"]},"claimed_at":{"description":"When your customer claimed this managed client.","format":"date-time","type":["string","null"]},"client_organization":{"properties":{"id":{"format":"uuid","type":"string"},"name":{"type":"string"}},"type":["object","null"]},"contacts":{"items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"invite_code":{"description":"What the client accepts a code invite with: set while pending, null once accepted, and always null for an email invite, which only its invitee can accept. A secret: whoever redeems it becomes this client. Returned to write keys only; a read key's responses leave the field out.","type":["string","null"]},"invite_expires_at":{"description":"When an email invite's sign-up link stops working; null for a code invite and for an invite to an existing account, which has no link and never expires.","format":"date-time","type":["string","null"]},"invite_status":{"description":"Where the invite stands. declined and expired happen only to email invites; POST /clients/{client_id}/invite/link reopens an expired one. An invite to an existing account (managed: true with that user's email) never expires: it is pending until accepted or declined. DELETE /clients/{client_id}/invite answers revoked, after which the client is gone.","enum":["pending","accepted","declined","expired"],"type":"string"},"invitee_email":{"description":"The address an email invite is for (lower-cased), or null for a code invite.","format":"email","type":["string","null"]},"managed":{"description":"Created by you for your customer (POST /clients with managed: true). false for an invite, including the one POST /clients with managed: true answers when the email belongs to an EndPointBlank user. While claimed_at is null you manage its applications, environments and credentials under /clients/{client_id}/...","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"Managed clients only (null otherwise): your customer's address, lower-cased. While the client is unclaimed they can sign in with a one-time code sent to it to approve an AI agent for it. Set with POST /clients or PATCH /clients/{id}.","format":"email","type":["string","null"]},"pre_assignments":{"description":"On a single client only: API packages and grants set up before the client accepted that are not assignments or grants yet (pending, or refused on accept).","properties":{"grants":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"packages":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"}},"type":"object"},"signup_url":{"description":"Email invites only, and only in this answer: the sign-up link to send the invitee yourself. Not stored; make a new one with POST /clients/{client_id}/invite/link.","format":"uri","type":"string"},"status":{"enum":["pending","accepted"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The client"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"idempotency_replay_unavailable on a retry with the same key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"not_an_email_invite (a code invite, or an invite to an existing account, which has no link) or invite_not_open (accepted or declined)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Make a new sign-up link for an email invite"}},"/clients/{client_id}/portal_sessions":{"post":{"description":"Answers a URL that signs your customer in to the portal of the managed account you run for them, where they see and revoke the AI agents connected to it, without an EndPointBlank login or an emailed code (which keeps working too). Like Stripe's billing portal sessions: call it when the customer clicks through in your app and redirect their browser to `url` straight away. The URL works once and expires 60 seconds after it is created (`expires_at`); an expired or used one shows a page asking the customer to go back to your app. The sign-in it gives lasts 30 minutes and ends at once if the client is claimed or its owner_email changes.\n\nOnly for an unclaimed managed client of yours whose removal has not started and that has an owner_email (set it with PATCH /clients/{id}); the customer is signed in as that address. The portal shows no link back to your app and no Sign out: the customer stays in your app for both. An optional `return_url` is checked and echoed back: it must equal, byte for byte, one of the claim return URLs your organization's admins registered on the management API keys page. An empty `return_url` (\"\") is refused, not treated as absent.\n\nThe answer is never stored for an Idempotency-Key replay: a retry with the same key answers 409 idempotency_replay_unavailable. Create another session instead.","operationId":"createManagedClientPortalSession","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"return_url":{"description":"Checked and echoed back; the portal does not link to it. Must exactly equal one of your registered claim return URLs; omit it for none.","format":"uri","maxLength":2000,"type":"string"}},"type":"object"}}},"required":false},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"client_id":{"format":"uuid","type":"string"},"expires_at":{"format":"date-time","type":"string"},"return_url":{"format":"uri","type":["string","null"]},"url":{"description":"Single use. Redirect the customer's browser here.","format":"uri","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The portal session"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"An Idempotency-Key retry: the URL is never replayed"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not an unclaimed managed client of yours (client_not_managed), one whose removal has started (client_being_removed), one with no owner_email (owner_email_missing), or a return_url that is not one of your claim return URLs, the empty string included (return_url_not_registered)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Open your customer's managed account portal"}},"/clients/{client_id}/environments/{id}":{"delete":{"description":"Refused while access grants are scoped to it or credentials are bound to an application in it. The production environment can't be deleted.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientDeleteEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The environment was deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Protected, still in use, or intake refused the delete"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Delete an environment"},"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientGetEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Get an environment"},"patch":{"description":"The production environment can't be changed (protected).\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientUpdateEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"domain":{"maxLength":255,"type":"string"},"is_default":{"type":"boolean"},"name":{"maxLength":255,"type":"string"}},"required":[],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The updated environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, protected, or intake refused the change"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Update an environment"}},"/credentials/{id}/rotate":{"post":{"description":"The secret is in this answer and nowhere else. It is never stored for Idempotency-Key replay: a retry with the same key answers 409 idempotency_replay_unavailable instead, with the credential's location header. An error answer holds no secret and is replayed as usual. Only one previous secret is kept: rotating again ends the earlier secret's grace window immediately, so recover a lost answer by reading the credential, not by rotating again. Concurrent rotations of one credential race: only one of the secrets returned will work.","operationId":"rotateCredential","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"responses":{"200":{"description":"The credential, with the new client_secret shown once","headers":{"location":{"description":"The credential's path","schema":{"type":"string"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Idempotency-Key already used; the answer can't be replayed (idempotency_replay_unavailable), or an intake's own credential (intake_credential); nothing was rotated"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake refused the new secret"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake unreachable; the secret was not rotated"}},"summary":"Issue a new secret; the old one works for the grace window"}},"/api_packages/{id}/endpoints/{access_id}":{"delete":{"description":"Revokes every client grant the entry was the only reason for, on the provider's intake.","operationId":"removeApiPackageEndpoint","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"access_id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"},"warnings":{"description":"Client assignments of the package that now derive no grant.","items":{"properties":{"client_organization_id":{"format":"uuid","type":"string"},"code":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"message":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Remove an endpoint from an API package"}},"/clients/{client_id}/applications/{application_id}/environments/{id}":{"delete":{"description":"Refused (has_dependents) while access grants on the application in that environment, or credentials bound to it, depend on it.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientDeleteApplicationEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application left the environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Still in use, or intake refused the removal"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Remove an application from an environment"}},"/credentials":{"get":{"operationId":"listCredentials","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"},{"description":"Only credentials for this application environment. An id that is not a UUID matches nothing and answers an empty page, not 400.","in":"query","name":"application_environment_id","schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"A page of credentials and the next cursor"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List runtime client credentials (metadata only, never a secret)"},"post":{"description":"The secret is in this answer and nowhere else. It is never stored for Idempotency-Key replay: a retry with the same key answers 409 idempotency_replay_unavailable instead, with the credential's location header. An error answer holds no secret and is replayed as usual.","operationId":"createCredential","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"application_environment_id":{"format":"uuid","type":"string"}},"required":["application_environment_id"],"type":"object"}}},"required":true},"responses":{"201":{"description":"The credential, with client_secret shown once","headers":{"location":{"description":"The new credential's path","schema":{"type":"string"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such application environment in this organization"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Idempotency-Key already used; the answer can't be replayed"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the credential"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake unreachable; nothing was created"}},"summary":"Issue a credential for one of your application environments"}},"/clients/{client_id}/grants":{"get":{"description":"Grants derived from API packages are not listed here unless they were also granted directly. For a client that has not accepted its invite, the grants set up for it to get when it does (status pending).","operationId":"listClientGrants","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of direct grants"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such client"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List the grants a client holds directly"},"post":{"description":"Grants the whole client organization access to one endpoint of your application, or to every endpoint when target_endpoint_id is omitted, in one environment the application is deployed to. Pushed to your intake. For a client that has not accepted its invite, sets the grant up (status pending) to be made, and pushed, the moment it accepts; one that cannot be made then is kept as status refused with the reason, and your administrators are emailed.","operationId":"createClientGrant","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"environment_id":{"format":"uuid","type":"string"},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]}},"required":["target_application_id","environment_id"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The grant"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such client"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"grant_revoked_concurrently: the grant was made, then revoked by another request before it could be returned"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: application_not_found, endpoint_not_found, environment_not_in_application, already_granted or validation_failed"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Grant a client access to an application or endpoint"}},"/applications/{application_id}/environments":{"get":{"operationId":"listApplicationEnvironments","parameters":[{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"application_id":{"format":"uuid","type":"string"},"base_url":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of application environments"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List the environments an application runs in"},"post":{"operationId":"createApplicationEnvironment","parameters":[{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"base_url":{"examples":["https://api.example.com"],"type":"string"},"environment_id":{"format":"uuid","type":"string"}},"required":["environment_id","base_url"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"application_id":{"format":"uuid","type":"string"},"base_url":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Application not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the environment"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Place an application in an environment at a base URL"}},"/endpoints":{"get":{"operationId":"listEndpoints","parameters":[{"description":"Only this application's endpoints.","in":"query","name":"application_id","schema":{"format":"uuid","type":"string"}},{"description":"Only endpoints deployed in an application version of this name. Without application_id this matches the name in every application of the organization; combine it with application_id for one application's version.","in":"query","name":"version","schema":{"type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"action":{"type":"string"},"application_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"path":{"type":"string"},"public":{"type":"boolean"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of endpoints"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"application_id is not a UUID, or version is not a string"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List the organization's endpoints"}},"/clients":{"get":{"operationId":"listClients","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"accepted_at":{"format":"date-time","type":["string","null"]},"claimed_at":{"description":"When your customer claimed this managed client.","format":"date-time","type":["string","null"]},"client_organization":{"properties":{"id":{"format":"uuid","type":"string"},"name":{"type":"string"}},"type":["object","null"]},"contacts":{"items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"invite_code":{"description":"What the client accepts a code invite with: set while pending, null once accepted, and always null for an email invite, which only its invitee can accept. A secret: whoever redeems it becomes this client. Returned to write keys only; a read key's responses leave the field out.","type":["string","null"]},"invite_expires_at":{"description":"When an email invite's sign-up link stops working; null for a code invite and for an invite to an existing account, which has no link and never expires.","format":"date-time","type":["string","null"]},"invite_status":{"description":"Where the invite stands. declined and expired happen only to email invites; POST /clients/{client_id}/invite/link reopens an expired one. An invite to an existing account (managed: true with that user's email) never expires: it is pending until accepted or declined. DELETE /clients/{client_id}/invite answers revoked, after which the client is gone.","enum":["pending","accepted","declined","expired"],"type":"string"},"invitee_email":{"description":"The address an email invite is for (lower-cased), or null for a code invite.","format":"email","type":["string","null"]},"managed":{"description":"Created by you for your customer (POST /clients with managed: true). false for an invite, including the one POST /clients with managed: true answers when the email belongs to an EndPointBlank user. While claimed_at is null you manage its applications, environments and credentials under /clients/{client_id}/...","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"Managed clients only (null otherwise): your customer's address, lower-cased. While the client is unclaimed they can sign in with a one-time code sent to it to approve an AI agent for it. Set with POST /clients or PATCH /clients/{id}.","format":"email","type":["string","null"]},"pre_assignments":{"description":"On a single client only: API packages and grants set up before the client accepted that are not assignments or grants yet (pending, or refused on accept).","properties":{"grants":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"packages":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"}},"type":"object"},"status":{"enum":["pending","accepted"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of clients"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List clients (client invites, pending and accepted)"},"post":{"description":"Creates a client invite, as the portal's Invite Client form does. Counts against the plan's client limit. Without email, share the returned invite_code with the client; it accepts the invite from its own EndPointBlank organization. With email, the invite is for that address: an administrator of the client's organization whose confirmed email it is accepts it in EndPointBlank, and signup_url (in this answer only) is a link you send them yourself, since EndPointBlank sends no invite email. Signing up from it links their new organization. The answer is the same whether or not the address has an account. With managed: true, email is your customer's address. When it belongs to an EndPointBlank user, no managed client is created: that user is invited to the account they already have instead. Nothing is emailed and there is no signup_url; they accept or decline on their Providers page, and the invite never expires (invite_expires_at is null). The answer is that invite, with managed: false and invite_status pending, so stop provisioning; it is a client like any accepted invite once they accept. Otherwise the managed client is created as without email. packages and grants set up what the client gets when it accepts: they are assigned and granted, and pushed to your intake, as soon as it does, with nothing more for you to do. Each is checked as POST /clients/{client_id}/packages and /grants check it, and a refused one refuses the whole request.","operationId":"createClient","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"contacts":{"description":"Your contacts to share with the client. An existing contact with the same email (in any case) is reused. Listing one email twice is refused with invalid_contacts.","items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"email":{"description":"Invite by email address instead of a code. At most one unanswered invite per address (already_invited), and a daily limit (invite_rate_limited). The sign-up link works for 14 days. With managed: true, your customer's address: if it belongs to an EndPointBlank user they are invited instead (managed: false, no signup_url, never expires), with the same already_invited and invite_rate_limited refusals; otherwise it creates the managed client.","format":"email","type":["string","null"]},"grants":{"description":"Direct grants to make when the client accepts. Not with managed: true (invalid_managed); grant them afterwards with POST /clients/{client_id}/grants.","items":{"properties":{"environment_id":{"format":"uuid","type":"string"},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]}},"required":["target_application_id","environment_id"],"type":"object"},"type":"array"},"managed":{"default":false,"description":"Create the client's organization now and run it for your customer: no invite to accept, no users, set up under /clients/{client_id}/... until the customer claims it. With an email that belongs to an EndPointBlank user, invites that user instead: check managed in the answer.","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"With managed: true only (invalid_managed otherwise): your customer's address. They sign in to EndPointBlank with a one-time code sent to it to approve an AI agent for the managed client, without claiming it. Stored only when this request creates a managed client; replace it with PATCH /clients/{id}.","format":"email","type":["string","null"]},"packages":{"description":"API packages to assign when the client accepts. Not with managed: true (invalid_managed); assign them afterwards with POST /clients/{client_id}/packages.","items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"environment_id":{"format":"uuid","type":"string"}},"required":["api_package_id","environment_id"],"type":"object"},"type":"array"}},"required":["name"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"accepted_at":{"format":"date-time","type":["string","null"]},"claimed_at":{"description":"When your customer claimed this managed client.","format":"date-time","type":["string","null"]},"client_organization":{"properties":{"id":{"format":"uuid","type":"string"},"name":{"type":"string"}},"type":["object","null"]},"contacts":{"items":{"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"id":{"format":"uuid","type":"string"},"last_name":{"type":"string"},"phone_number":{"type":["string","null"]},"title":{"type":["string","null"]}},"required":["email","first_name","last_name"],"type":"object"},"type":"array"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"invite_code":{"description":"What the client accepts a code invite with: set while pending, null once accepted, and always null for an email invite, which only its invitee can accept. A secret: whoever redeems it becomes this client. Returned to write keys only; a read key's responses leave the field out.","type":["string","null"]},"invite_expires_at":{"description":"When an email invite's sign-up link stops working; null for a code invite and for an invite to an existing account, which has no link and never expires.","format":"date-time","type":["string","null"]},"invite_status":{"description":"Where the invite stands. declined and expired happen only to email invites; POST /clients/{client_id}/invite/link reopens an expired one. An invite to an existing account (managed: true with that user's email) never expires: it is pending until accepted or declined. DELETE /clients/{client_id}/invite answers revoked, after which the client is gone.","enum":["pending","accepted","declined","expired"],"type":"string"},"invitee_email":{"description":"The address an email invite is for (lower-cased), or null for a code invite.","format":"email","type":["string","null"]},"managed":{"description":"Created by you for your customer (POST /clients with managed: true). false for an invite, including the one POST /clients with managed: true answers when the email belongs to an EndPointBlank user. While claimed_at is null you manage its applications, environments and credentials under /clients/{client_id}/...","type":"boolean"},"name":{"type":"string"},"owner_email":{"description":"Managed clients only (null otherwise): your customer's address, lower-cased. While the client is unclaimed they can sign in with a one-time code sent to it to approve an AI agent for it. Set with POST /clients or PATCH /clients/{id}.","format":"email","type":["string","null"]},"pre_assignments":{"description":"On a single client only: API packages and grants set up before the client accepted that are not assignments or grants yet (pending, or refused on accept).","properties":{"grants":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"also_granted_by_api_package_ids":{"items":{"format":"uuid","type":"string"},"type":"array"},"client_organization_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"synced_at":{"format":"date-time","type":["string","null"]},"target_application_id":{"format":"uuid","type":"string"},"target_endpoint_id":{"format":"uuid","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"packages":{"items":{"properties":{"api_package_id":{"format":"uuid","type":"string"},"api_package_name":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"refusal":{"properties":{"at":{"format":"date-time","type":"string"},"code":{"type":"string"},"message":{"type":"string"}},"type":["object","null"]},"status":{"description":"active: the client holds it. pending: set up for a client that has not accepted its invite yet, applied when it does. refused: could not be applied when the client accepted; see refusal.","enum":["active","pending","refused"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"}},"type":"object"},"signup_url":{"description":"Email invites only, and only in this answer: the sign-up link to send the invitee yourself. Not stored; make a new one with POST /clients/{client_id}/invite/link.","format":"uri","type":"string"},"status":{"enum":["pending","accepted"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The new client: a managed client (managed: true), or, for managed: true with an existing user's email, a pending invite to that user (managed: false)"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"402":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The plan's client limit is reached"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"already_invited: the address has an invite from you nobody has answered; or idempotency_replay_unavailable on a retry of an email invite, whose signup_url is not replayed"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Refused: validation_failed (a blank name, an invalid contact or an invalid grant), invalid_contacts (contacts is not a list of objects, or lists one email twice), invalid_packages or invalid_grants (not a list of objects), a package or grant refusal (see the error code), invalid_managed (also when packages or grants come with managed: true), or intake_rejected (intake refused a managed client's organization)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"invite_rate_limited: the day's email invites are used up; Retry-After says when the next one can be made"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake unreachable; nothing was created"}},"summary":"Invite a client"}},"/clients/{client_id}/claim_invites":{"post":{"description":"Emails an invite to join the client's organization. The first person to accept claims it: it becomes an ordinary client with its own users, every credential you issued for it is rotated (the old secrets keep working for the grace window), and from then on its applications, environments and credentials answer 404 to your key. Sending again to the same address resends the invite.\n\nPass `return_to` to have the customer's browser sent back to you once accepting has claimed the client, the way an OAuth redirect_uri works: it must equal, byte for byte, one of the claim return URLs your organization's admins registered on the management API keys page (https, or http on a loopback host; no fragment). It is checked again when the customer is redirected, so removing a URL stops it being used by invites already sent; they land on EndPointBlank instead. A resend replaces the invite's return_to, with none when the resend names none; a resend from your client's page in EndPointBlank keeps it. An empty `return_to` (\"\") is not treated as absent: it answers 422 return_to_not_registered. An invite to an organization that was already claimed, or an acceptance that did not claim it, never redirects.","operationId":"createManagedClientClaimInvite","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"email":{"format":"email","type":"string"},"return_to":{"description":"Where to send the customer once they have claimed the client. Must exactly equal one of your registered claim return URLs; omit it for none (an empty string is refused, not treated as absent).","format":"uri","maxLength":2000,"type":"string"}},"required":["email"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"client_id":{"format":"uuid","type":"string"},"email":{"type":"string"},"expires_at":{"format":"date-time","type":"string"},"return_to":{"format":"uri","type":["string","null"]},"sent_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The invite was sent"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not an unclaimed managed client of yours, an invalid email, a return_to that is not one of your claim return URLs, the empty string included (return_to_not_registered), or a client whose removal has started (client_being_removed): send DELETE /clients/{id} again to finish it"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Invite your customer to claim a managed client"}},"/applications":{"get":{"operationId":"listApplications","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of applications"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List applications"},"post":{"description":"Places the application in each environment given a base URL; at least one is required.","operationId":"createApplication","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"environment_base_urls":{"additionalProperties":{"type":"string"},"description":"Environment id to base URL, e.g. https://api.example.com","type":"object"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":"string"},"public":{"type":"boolean"}},"required":["name","environment_base_urls"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The created application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the application"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Create an application"}},"/clients/{client_id}/environments":{"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientListEnvironments","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of environments"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: List environments"},"post":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientCreateEnvironment","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"domain":{"maxLength":255,"type":"string"},"is_default":{"type":"boolean"},"name":{"maxLength":255,"type":"string"}},"required":["name","domain"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The created environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the environment"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: Create an environment"}},"/organization":{"get":{"operationId":"getOrganization","responses":{"200":{"description":"The organization and the key used"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"The organization this key belongs to"}},"/clients/{client_id}/credentials/{id}/rotate":{"post":{"description":"The secret is in this answer and nowhere else. It is never stored for Idempotency-Key replay: a retry with the same key answers 409 idempotency_replay_unavailable instead, with the credential's location header. An error answer holds no secret and is replayed as usual. Only one previous secret is kept: rotating again ends the earlier secret's grace window immediately, so recover a lost answer by reading the credential, not by rotating again. Concurrent rotations of one credential race: only one of the secrets returned will work.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientRotateCredential","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"responses":{"200":{"description":"The credential, with the new client_secret shown once","headers":{"location":{"description":"The credential's path","schema":{"type":"string"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Idempotency-Key already used; the answer can't be replayed (idempotency_replay_unavailable), or an intake's own credential (intake_credential); nothing was rotated"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake refused the new secret"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake unreachable; the secret was not rotated"}},"summary":"Managed client: Issue a new secret; the old one works for the grace window"}},"/clients/{client_id}/invite":{"delete":{"description":"Revokes an invite the client has not accepted, code or email, pending, declined or expired. The invite is deleted with anything set up for it to get on accept, and its sign-up link stops working. Safe to retry: a revoked invite answers 404. An accepted client is removed with DELETE /clients/{id}.","operationId":"revokeClientInvite","parameters":[{"description":"A client's id.","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"type":"string"},"invite_status":{"enum":["revoked"],"type":"string"}},"type":"object"}},"type":"object"}}},"description":"The invite was revoked"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The key is read-only"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"invite_accepted: the client has accepted (a managed client always has); remove it with DELETE /clients/{id} instead"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Revoke a client's invite"}},"/api_packages":{"get":{"operationId":"listApiPackages","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_id":{"format":"uuid","type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of API packages"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List API packages"},"post":{"operationId":"createApiPackage","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"name":{"type":"string"}},"required":["name"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_id":{"format":"uuid","type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The API package"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or the name is taken"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Create an API package"}},"/api_packages/{id}/endpoints":{"get":{"operationId":"listApiPackageEndpoints","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"all_endpoints":{"type":"boolean"},"api_package_id":{"format":"uuid","type":"string"},"application_id":{"format":"uuid","type":"string"},"endpoint":{"properties":{"action":{"type":"string"},"id":{"format":"uuid","type":"string"},"path":{"type":"string"}},"type":["object","null"]},"endpoint_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of the package's endpoints"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Package not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List what an API package publishes"},"post":{"description":"Derives the grants of every client holding the package and pushes them to the provider's intake.","operationId":"addApiPackageEndpoint","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"application_id":{"format":"uuid","type":"string"},"endpoint_id":{"description":"Omit or null for every endpoint of the application.","format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"}},"required":["application_id","environment_id"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"all_endpoints":{"type":"boolean"},"api_package_id":{"format":"uuid","type":"string"},"application_id":{"format":"uuid","type":"string"},"endpoint":{"properties":{"action":{"type":"string"},"id":{"format":"uuid","type":"string"},"path":{"type":"string"}},"type":["object","null"]},"endpoint_id":{"format":"uuid","type":["string","null"]},"environment_id":{"format":"uuid","type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"}},"type":"object"},"warnings":{"description":"Client assignments of the package that now derive no grant.","items":{"properties":{"client_organization_id":{"format":"uuid","type":"string"},"code":{"type":"string"},"environment_id":{"format":"uuid","type":"string"},"message":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}},"description":"The endpoint was added"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Package not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, an id that does not exist, or already in the package"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Add an endpoint to an API package"}},"/applications/{id}":{"delete":{"description":"Refused (has_dependents) while access grants or credentials depend on it.","operationId":"deleteApplication","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application was deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Still in use, or intake refused the delete"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Delete an application"},"get":{"operationId":"getApplication","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Get an application"},"patch":{"operationId":"updateApplication","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"name":{"type":"string"},"public":{"type":"boolean"}},"required":[],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_group_id":{"format":"uuid","type":["string","null"]},"public":{"type":["boolean","null"]},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The updated application"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the change"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Rename an application or change whether it is public"}},"/applications/{application_id}/environments/{id}":{"delete":{"description":"Refused (has_dependents) while access grants on the application in that environment, or credentials bound to it, depend on it.","operationId":"deleteApplicationEnvironment","parameters":[{"in":"path","name":"application_id","required":true,"schema":{"type":"string"}},{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The application left the environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Still in use, or intake refused the removal"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Remove an application from an environment"}},"/clients/{client_id}/credentials/{id}":{"delete":{"description":"Removes it from intake, then deletes it. Its current and previous secrets stop authenticating.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientRevokeCredential","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"Revoked"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"An intake's own credential (intake_credential); nothing was revoked"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake refused the delete (intake_rejected; the revoke is queued, and the credential stops authenticating once intake takes it. It is still listed here until a retried DELETE succeeds.), or intake revoked it but the record could not be removed here (delete_refused; retry the DELETE)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake was not reached; the revoke is queued, and the credential stops authenticating once intake takes it. It is still listed here until a retried DELETE succeeds."}},"summary":"Managed client: Revoke a credential"},"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientGetCredential","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"The credential"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: A runtime client credential (metadata only)"}},"/api_packages/{id}":{"delete":{"description":"Refused with api_package_assigned while a client holds it.","operationId":"deleteApiPackage","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"Deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The package is assigned to clients"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Delete an API package"},"get":{"operationId":"getApiPackage","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_id":{"format":"uuid","type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The API package"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Get an API package"},"patch":{"operationId":"updateApiPackage","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"name":{"type":"string"}},"required":["name"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"name":{"type":"string"},"organization_id":{"format":"uuid","type":"string"},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The API package"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or the name is taken"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Rename an API package"}},"/clients/{client_id}/credentials":{"get":{"description":"Acts on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientListCredentials","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"},{"description":"Only credentials for this application environment. An id that is not a UUID matches nothing and answers an empty page, not 400.","in":"query","name":"application_environment_id","schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"A page of credentials and the next cursor"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Managed client: List runtime client credentials (metadata only, never a secret)"},"post":{"description":"The secret is in this answer and nowhere else. It is never stored for Idempotency-Key replay: a retry with the same key answers 409 idempotency_replay_unavailable instead, with the credential's location header. An error answer holds no secret and is replayed as usual.\n\nActs on your managed client's organization, only while the client is unclaimed; otherwise 404. A credential's secret is pushed only to the intake the client's organization is on.","operationId":"managedClientCreateCredential","parameters":[{"description":"A client's id (from GET /clients).","in":"path","name":"client_id","required":true,"schema":{"format":"uuid","type":"string"}},{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"application_environment_id":{"format":"uuid","type":"string"}},"required":["application_environment_id"],"type":"object"}}},"required":true},"responses":{"201":{"description":"The credential, with client_secret shown once","headers":{"location":{"description":"The new credential's path","schema":{"type":"string"}}}},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"No such application environment in this organization"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Idempotency-Key already used; the answer can't be replayed"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the credential"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake unreachable; nothing was created"}},"summary":"Managed client: Issue a credential for one of your application environments"}},"/environments/{id}":{"delete":{"description":"Refused while access grants are scoped to it or credentials are bound to an application in it. The production environment can't be deleted.","operationId":"deleteEnvironment","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"deleted":{"type":"boolean"},"id":{"format":"uuid","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The environment was deleted"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Protected, still in use, or intake refused the delete"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Delete an environment"},"get":{"operationId":"getEnvironment","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Get an environment"},"patch":{"description":"The production environment can't be changed (protected).","operationId":"updateEnvironment","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"domain":{"maxLength":255,"type":"string"},"is_default":{"type":"boolean"},"name":{"maxLength":255,"type":"string"}},"required":[],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The updated environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, protected, or intake refused the change"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Update an environment"}},"/environments":{"get":{"operationId":"listEnvironments","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/after"}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"type":["string","null"]}},"type":"object"}}},"description":"A page of environments"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid pagination"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"List environments"},"post":{"operationId":"createEnvironment","parameters":[{"$ref":"#/components/parameters/idempotencyKey"}],"requestBody":{"content":{"application/json":{"schema":{"properties":{"domain":{"maxLength":255,"type":"string"},"is_default":{"type":"boolean"},"name":{"maxLength":255,"type":"string"}},"required":["name","domain"],"type":"object"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"properties":{"data":{"properties":{"domain":{"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_default":{"type":"boolean"},"name":{"type":"string"},"production":{"description":"The system-managed production environment; it can't be changed.","type":"boolean"},"synced_at":{"format":"date-time","type":["string","null"]},"updated_at":{"format":"date-time","type":"string"}},"type":"object"}},"type":"object"}}},"description":"The created environment"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid fields, or intake refused the environment"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"Create an environment"}},"/credentials/{id}":{"delete":{"description":"Removes it from intake, then deletes it. Its current and previous secrets stop authenticating.","operationId":"revokeCredential","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"Revoked"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Read-only key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"An intake's own credential (intake_credential); nothing was revoked"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake refused the delete (intake_rejected; the revoke is queued, and the credential stops authenticating once intake takes it. It is still listed here until a retried DELETE succeeds.), or intake revoked it but the record could not be removed here (delete_refused; retry the DELETE)"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Intake was not reached; the revoke is queued, and the credential stops authenticating once intake takes it. It is still listed here until a retried DELETE succeeds."}},"summary":"Revoke a credential"},"get":{"operationId":"getCredential","parameters":[{"in":"path","name":"id","required":true,"schema":{"format":"uuid","type":"string"}}],"responses":{"200":{"description":"The credential"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing, invalid or revoked key"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Not found"},"429":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rate limited"}},"summary":"A runtime client credential (metadata only)"}}},"security":[{"managementKey":[]}],"servers":[{"url":"https://app.endpointblank.com/api/v1"}]}