basePath: /api
consumes:
- application/json
definitions:
  agentconfig.Change:
    properties:
      path:
        description: RFC 6901 pointer
        type: string
      reason:
        type: string
      safety:
        $ref: '#/definitions/agentconfig.Safety'
      value:
        description: the source / env name that triggered the class
        type: string
    type: object
  agentconfig.DiffEntry:
    properties:
      from:
        type: object
      op:
        description: add | remove | replace
        type: string
      path:
        type: string
      to:
        type: object
    type: object
  agentconfig.FieldError:
    properties:
      code:
        description: stable machine code (R43), one of FieldCode*
        type: string
      message:
        description: human text
        type: string
      path:
        description: RFC 6901 pointer into the snake_case config ("" = root)
        type: string
    type: object
  agentconfig.OverlayDocument:
    properties:
      created-at:
        description: omitted for revision 0
        type: string
      overlay:
        type: object
      revision:
        type: integer
    type: object
  agentconfig.PluginReport:
    properties:
      lib-version:
        description: |-
          LibVersion is the version of github.com/compliance-framework/agent the plugin binary
          was built with, from its Go build info. Empty when unknown: no build info, or a
          replace or devel build.
        type: string
      name:
        description: the plugin's key under plugins in the config
        type: string
      source:
        description: the configured source
        type: string
    type: object
  agentconfig.RemoteConfig:
    properties:
      allow_local_sources:
        description: default false
        type: boolean
      mode:
        description: |-
          Mode is off, report, apply_safe or apply_all. Unset means report for an agent with
          credentials (it reports but never applies), off without (see Normalize).
        type: string
      overridable_config_flags:
        description: default []
        items:
          type: string
        type: array
      poll_interval:
        type: string
      trusted_sources:
        description: default []
        items:
          type: string
        type: array
    type: object
  agentconfig.Report:
    properties:
      agent-version:
        description: <= 64
        type: string
      applied-revision:
        type: integer
      attempted-revision:
        type: integer
      base:
        type: object
      daemon:
        description: false = one-shot run; pruned after 24h (R10, R37)
        type: boolean
      effective:
        type: object
      effective-digest:
        type: string
      error:
        description: <= 8 KiB, truncated server-side
        type: string
      hostname:
        description: <= 255
        type: string
      mode:
        type: string
      plugins:
        description: |-
          Plugins are the instance's plugins and the agent library each was built with (R76),
          so the UI can show policy compatibility before a save. Older agents omit it.
        items:
          $ref: '#/definitions/agentconfig.PluginReport'
        type: array
      reason:
        type: string
      remote-config:
        allOf:
        - $ref: '#/definitions/agentconfig.RemoteConfig'
        description: normalized; snake_case inside
      status:
        type: string
      truncated:
        description: agent dropped/trimmed parts to fit MaxReportBytes (R10)
        type: boolean
      unsafe:
        items:
          $ref: '#/definitions/agentconfig.Change'
        type: array
      warnings:
        description: 'R41: tolerated file-origin problems'
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
    type: object
  agentconfig.Safety:
    enum:
    - safe
    - unsafe
    - forbidden
    type: string
    x-enum-varnames:
    - Safe
    - Unsafe
    - Forbidden
  api.Error:
    properties:
      errors:
        additionalProperties: {}
        type: object
    type: object
  artifact.Info:
    properties:
      digest:
        type: string
      mediaType:
        type: string
      sizeBytes:
        type: integer
    type: object
  auth.AuthHandler:
    type: object
  authn.JWK:
    properties:
      alg:
        type: string
      e:
        type: string
      kid:
        type: string
      kty:
        type: string
      "n":
        type: string
      use:
        type: string
    type: object
  datatypes.JSONMap:
    additionalProperties: true
    type: object
  datatypes.JSONType-labelfilter_Filter:
    type: object
  datatypes.JSONType-oscalTypes_1_1_3_ObjectiveStatus:
    type: object
  datatypes.JSONType-relational_Address:
    type: object
  datatypes.JSONType-relational_Base64:
    type: object
  datatypes.JSONType-relational_Citation:
    type: object
  datatypes.JSONType-relational_CombinationRule:
    type: object
  datatypes.JSONType-relational_EvidenceSignature:
    type: object
  datatypes.JSONType-relational_FlatWithoutGrouping:
    type: object
  datatypes.JSONType-relational_ImplementationStatus:
    type: object
  datatypes.JSONType-relational_ImportProfile:
    type: object
  datatypes.JSONType-relational_IncludeAll:
    type: object
  datatypes.JSONType-relational_ParameterSelection:
    type: object
  datatypes.JSONType-relational_SecurityImpactLevel:
    type: object
  datatypes.JSONType-relational_Status:
    type: object
  datatypes.JSONType-relational_SystemComponentStatus:
    type: object
  datatypes.JSONType-relational_SystemInformation:
    type: object
  digest.EvidenceItem:
    properties:
      description:
        type: string
      expiresAt:
        description: Formatted expiration date string (empty if no expiration)
        type: string
      id:
        type: string
      labels:
        items:
          type: string
        type: array
      status:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  digest.EvidenceSummary:
    properties:
      expiredCount:
        format: int64
        type: integer
      notSatisfiedCount:
        format: int64
        type: integer
      otherCount:
        format: int64
        type: integer
      satisfiedCount:
        format: int64
        type: integer
      topExpired:
        description: Top items for the digest email
        items:
          $ref: '#/definitions/digest.EvidenceItem'
        type: array
      topNotSatisfied:
        items:
          $ref: '#/definitions/digest.EvidenceItem'
        type: array
      totalCount:
        format: int64
        type: integer
    type: object
  evidence.SignatureDetail:
    properties:
      signature:
        $ref: '#/definitions/relational.EvidenceSignature'
      status:
        type: string
    type: object
  evidence.StatusCount:
    properties:
      count:
        type: integer
      status:
        type: string
    type: object
  evidence.VerificationChecks:
    properties:
      hash_match:
        type: boolean
      signature_valid:
        type: boolean
      signed_content_matches:
        type: boolean
      temporal_valid:
        type: boolean
    type: object
  evidence.VerificationResult:
    properties:
      checks:
        $ref: '#/definitions/evidence.VerificationChecks'
      claims:
        $ref: '#/definitions/relational.EvidenceSignatureClaims'
      content_hash:
        $ref: '#/definitions/relational.Hash'
      errors:
        items:
          type: string
        type: array
      is_valid:
        type: boolean
      signature:
        $ref: '#/definitions/relational.EvidenceSignature'
      signed_at:
        type: string
      signer:
        $ref: '#/definitions/relational.EvidenceSignatureSigner'
      status:
        type: string
    type: object
  gorm.DeletedAt:
    properties:
      time:
        type: string
      valid:
        description: Valid is true if Time is not NULL
        type: boolean
    type: object
  handler.CreatedEvidenceResponse:
    properties:
      activities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Activity'
        type: array
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      description:
        type: string
      end:
        type: string
      expires:
        type: string
      id:
        type: string
      inventory-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      labels:
        items:
          $ref: '#/definitions/relational.Labels'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      signature:
        $ref: '#/definitions/relational.EvidenceSignature'
      start:
        type: string
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.ObjectiveStatus'
      subject-references:
        description: |-
          SubjectReferences are the evidence's subjects in display order. Present (possibly
          empty) on responses that load them, so clients can tell "no subjects" from "not
          supported"; omitted otherwise.
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SubjectReference'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  handler.EvidenceActivity:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      steps:
        items:
          $ref: '#/definitions/handler.EvidenceActivityStep'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  handler.EvidenceActivityStep:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  handler.EvidenceComponent:
    properties:
      description:
        type: string
      identifier:
        description: |-
          components/common/ssh
          components/common/github-repository
          components/common/github-organisation
          components/common/ubuntu-22
          components/internal/auth-policy
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      protocols:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      title:
        type: string
      type:
        description: |-
          Software
          Service
        type: string
    type: object
  handler.EvidenceCreateRequest:
    properties:
      activities:
        description: What steps did we take to create this evidence
        items:
          $ref: '#/definitions/handler.EvidenceActivity'
        type: array
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      components:
        description: Which components of the subject are being observed. A tool, user,
          policy etc.
        items:
          $ref: '#/definitions/handler.EvidenceComponent'
        type: array
      description:
        type: string
      end:
        type: string
      expires:
        type: string
      inventory-items:
        items:
          $ref: '#/definitions/handler.EvidenceInventoryItem'
        type: array
      labels:
        additionalProperties:
          type: string
        description: Assigning labels to Evidence makes it searchable and easily usable
          in the UI
        type: object
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        description: Who or What is generating this evidence
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      policy-artifacts:
        allOf:
        - $ref: '#/definitions/handler.EvidencePolicyArtifacts'
        description: |-
          The stored artifacts the evidence was produced from, so its evaluation can be played
          back. The API records them as signed props. Optional.
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      start:
        description: When did we start collecting the evidence, and when did the process
          end, and how long is it valid for ?
        type: string
      status:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ObjectiveStatus'
        description: Did we satisfy what was being tested for, or did we fail ?
      subjects:
        description: Who or What are we providing evidence for. What's under test.
        items:
          $ref: '#/definitions/handler.EvidenceSubject'
        type: array
      title:
        type: string
      uuid:
        description: |-
          UUID needs to remain consistent for a piece of evidence being collected periodically.
          It represents the "stream" of the same observation being made over time.
          For the same checks, performed on the same machine, the UUID for each check should remain the same.
          For the same check, performed on two different machines, the UUID should differ.
        type: string
    type: object
  handler.EvidenceInventoryItem:
    properties:
      description:
        type: string
      identifier:
        description: |-
          user/chris@linguine.tech
          operating-system/ubuntu/22.4
          web-server/ec2/i-12345
        type: string
      implemented-components:
        items:
          properties:
            identifier:
              type: string
          type: object
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      title:
        type: string
      type:
        description: "\"operating-system\"\tdescription=\"System software that manages
          computer hardware, software resources, and provides common services for
          computer programs.\"\n\"database\"\t\t\tdescription=\"An electronic collection
          of data, or information, that is specially organized for rapid search and
          retrieval.\"\n\"web-server\"\t\t\tdescription=\"A system that delivers content
          or services to end users over the Internet or an intranet.\"\n\"dns-server\"\t\t\tdescription=\"A
          system that resolves domain names to internet protocol (IP) addresses.\"\n\"email-server\"\t\tdescription=\"A
          computer system that sends and receives electronic mail messages.\"\n\"directory-server\"\tdescription=\"A
          system that stores, organizes and provides access to directory information
          in order to unify network resources.\"\n\"pbx\"\t\t\t\tdescription=\"A private
          branch exchange (PBX) provides a a private telephone switchboard.\"\n\"firewall\"\t\t\tdescription=\"A
          network security system that monitors and controls incoming and outgoing
          network traffic based on predetermined security rules.\"\n\"router\"\t\t\t\tdescription=\"A
          physical or virtual networking device that forwards data packets between
          computer networks.\"\n\"switch\"\t\t\t\tdescription=\"A physical or virtual
          networking device that connects devices within a computer network by using
          packet switching to receive and forward data to the destination device.\"\n\"storage-array\"\t\tdescription=\"A
          consolidated, block-level data storage capability.\"\n\"appliance\"\t\t\tdescription=\"A
          physical or virtual machine that centralizes hardware, software, or services
          for a specific purpose.\""
        type: string
    type: object
  handler.EvidencePlaybackArtifacts:
    properties:
      bundle:
        $ref: '#/definitions/artifact.Info'
      input:
        $ref: '#/definitions/artifact.Info'
      policyData:
        $ref: '#/definitions/artifact.Info'
    type: object
  handler.EvidencePlaybackComparison:
    properties:
      missingViolationIds:
        description: MissingViolationIDs were recorded but not found by the replay.
        items:
          type: string
        type: array
      newViolationIds:
        description: NewViolationIDs were found by the replay but not recorded.
        items:
          type: string
        type: array
      statusMatches:
        type: boolean
      unidentifiedViolations:
        description: UnidentifiedViolations have no id, so cannot be compared.
        type: integer
    type: object
  handler.EvidencePlaybackFile:
    properties:
      containsPackage:
        description: ContainsPackage marks the file defining the package that produced
          the evidence.
        type: boolean
      path:
        type: string
      source:
        type: string
    type: object
  handler.EvidencePlaybackRecorded:
    properties:
      status:
        type: string
      violationIds:
        items:
          type: string
        type: array
    type: object
  handler.EvidencePlaybackReplay:
    properties:
      error:
        description: Error explains why the agent would not have turned the result
          into evidence.
        type: string
      rawJson:
        type: string
      status:
        type: string
      title:
        type: string
      violations:
        items:
          $ref: '#/definitions/handler.EvidencePlaybackViolation'
        type: array
    type: object
  handler.EvidencePlaybackResponse:
    properties:
      artifacts:
        $ref: '#/definitions/handler.EvidencePlaybackArtifacts'
      available:
        description: Available is false when the evidence cannot be played back; Reason
          says why.
        type: boolean
      bundleDataJson:
        type: string
      comparison:
        $ref: '#/definitions/handler.EvidencePlaybackComparison'
      errors:
        description: Errors are why the replay could not run, for example a policy
          the sandbox forbids.
        items:
          $ref: '#/definitions/policyeval.EvalError'
        type: array
      evaluatedAt:
        type: string
      inputJson:
        type: string
      inputTruncated:
        description: |-
          InputTruncated means InputJSON holds only the first part of the input; the full input
          is the input artifact.
        type: boolean
      package:
        description: Package is the policy package that produced the evidence.
        type: string
      policyDataJson:
        description: JSON documents are pretty-printed strings, shown as they are.
        type: string
      policyFiles:
        items:
          $ref: '#/definitions/handler.EvidencePlaybackFile'
        type: array
      prints:
        items:
          type: string
        type: array
      reason:
        type: string
      recorded:
        $ref: '#/definitions/handler.EvidencePlaybackRecorded'
      replay:
        $ref: '#/definitions/handler.EvidencePlaybackReplay'
    type: object
  handler.EvidencePlaybackViolation:
    properties:
      description:
        type: string
      id:
        type: string
      remarks:
        type: string
      rules:
        description: |-
          Rules are the `violation` rules that produced it, by file and line. Empty when they
          could not be located.
        items:
          $ref: '#/definitions/policyeval.RuleLocation'
        type: array
      title:
        type: string
    type: object
  handler.EvidencePolicyArtifacts:
    properties:
      bundle-digest:
        type: string
      input-digest:
        type: string
      policy-data-digest:
        type: string
    type: object
  handler.EvidenceRiskResponse:
    properties:
      description:
        type: string
      id:
        type: string
      impact:
        type: string
      likelihood:
        type: string
      source-type:
        type: string
      ssp-id:
        type: string
      ssp-title:
        type: string
      status:
        type: string
      title:
        type: string
    type: object
  handler.EvidenceSignatureResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/evidence.SignatureDetail'
        description: Wrapped response data
    type: object
  handler.EvidenceSignatureVerificationResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/evidence.VerificationResult'
        description: Wrapped response data
    type: object
  handler.EvidenceSubject:
    properties:
      description:
        type: string
      identifier:
        description: Identifier is the legacy way to name a subject, used when SubjectUUID
          isn't set.
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      subject-uuid:
        description: |-
          SubjectUUID names an existing subject: a defined component, SSP system component, party
          or user (see GET /subjects). Its type and title come from that subject.
        type: string
      type:
        description: |-
          InventoryItem
          Component
        type: string
    type: object
  handler.FilterImportFileResult:
    properties:
      count:
        type: integer
      filename:
        type: string
      message:
        type: string
      success:
        type: boolean
    type: object
  handler.FilterImportResponse:
    properties:
      failed_count:
        type: integer
      results:
        items:
          $ref: '#/definitions/handler.FilterImportFileResult'
        type: array
      successful_count:
        type: integer
      total_dashboards:
        type: integer
      total_files:
        type: integer
    type: object
  handler.FilterWithAssociations:
    properties:
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
        type: array
      filter:
        $ref: '#/definitions/datatypes.JSONType-labelfilter_Filter'
      id:
        type: string
      name:
        type: string
      sspId:
        type: string
    type: object
  handler.ForControl.EvidenceDataListResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.PublicEvidenceResponse'
        type: array
      metadata:
        $ref: '#/definitions/handler.ForControl.responseMetadata'
    type: object
  handler.ForControl.responseMetadata:
    properties:
      control:
        $ref: '#/definitions/oscalTypes_1_1_3.Control'
    type: object
  handler.GenericDataListResponse-array_oscalTypes_1_1_3_Control:
    properties:
      data:
        description: Items from the list response
        items:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.Control'
          type: array
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-evidence_StatusCount:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/evidence.StatusCount'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_EvidenceRiskResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.EvidenceRiskResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_FilterWithAssociations:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.FilterWithAssociations'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_OverTime_HeartbeatInterval:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.OverTime.HeartbeatInterval'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_StatusInterval:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.StatusInterval'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_agentInstanceSummary:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.agentInstanceSummary'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_availableNotificationProviderResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.availableNotificationProviderResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_effectiveRole:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.effectiveRole'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_groupMemberResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.groupMemberResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_groupResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.groupResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_milestoneResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.milestoneResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_notificationProviderStatusResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.notificationProviderStatusResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_poamItemResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.poamItemResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.riskScoreTimeseriesResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_selectableUserResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.selectableUserResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_systemNotificationResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.systemNotificationResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-handler_userGroupMembershipResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/handler.userGroupMembershipResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_AiDiagnosticsRun:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.AiDiagnosticsRun'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_ControlExportOffer:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.ControlExportOffer'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_InventoryItemWithSource:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.InventoryItemWithSource'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_ProfileHandler:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.ProfileHandler'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_catalogOffering:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.catalogOffering'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_controlSuggestionResultResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.controlSuggestionResultResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_dashboardSuggestionEventResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.dashboardSuggestionEventResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_dashboardSuggestionResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.dashboardSuggestionResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_leveragedControlResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.leveragedControlResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_profileSummary:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.profileSummary'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_resolvedWithCatalogsResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.resolvedWithCatalogsResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscal_responsibilityFilterResponse:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscal.responsibilityFilterResponse'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_AssessmentPlan:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlan'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_AssessmentResults:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentResults'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_AssociatedActivity:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssociatedActivity'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_AttestationStatements:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AttestationStatements'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ByComponent:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Capability:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Capability'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Catalog:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Catalog'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ComponentDefinition:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ComponentDefinition'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Control:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationResponsibility:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationSet:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ControlStatementImplementation:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlStatementImplementation'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_DefinedComponent:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Finding:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Group:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ImplementedRequirement:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirement'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ImplementedRequirementControlImplementation:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirementControlImplementation'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Import:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Import'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ImportComponentDefinition:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportComponentDefinition'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_IncorporatesComponent:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.IncorporatesComponent'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_InheritedControlImplementation:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InheritedControlImplementation'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_InventoryItem:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_LeveragedAuthorization:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.LeveragedAuthorization'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Observation:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Party:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Party'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestones'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_PoamItem:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PoamItem'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_ProvidedControlImplementation:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Resource:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Result:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Result'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Risk:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_Role:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Role'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_SatisfiedControlImplementationResponsibility:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_SystemComponent:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_SystemSecurityPlan:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemSecurityPlan'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-oscalTypes_1_1_3_SystemUser:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-poam_PoamItemControlLink:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/poam.PoamItemControlLink'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-poam_PoamItemEvidenceLink:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/poam.PoamItemEvidenceLink'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-poam_PoamItemFindingLink:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/poam.PoamItemFindingLink'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-poam_PoamItemRiskLink:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/poam.PoamItemRiskLink'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_CCFRoleAssignment:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.CCFRoleAssignment'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_SSOGroupMapping:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.SSOGroupMapping'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_SSPExportOffering:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.SSPExportOffering'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_SSPExportOfferingAllowedDownstream:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.SSPExportOfferingAllowedDownstream'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_SSPLeverageLink:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.SSPLeverageLink'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_SystemComponentSuggestion:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.SystemComponentSuggestion'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-relational_User:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/relational.User'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-string:
    properties:
      data:
        description: Items from the list response
        items:
          type: string
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-suggestions_LabelKeyInput:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/suggestions.LabelKeyInput'
        type: array
      meta: {}
    type: object
  handler.GenericDataListResponse-suggestions_LabelSetInput:
    properties:
      data:
        description: Items from the list response
        items:
          $ref: '#/definitions/suggestions.LabelSetInput'
        type: array
      meta: {}
    type: object
  handler.GenericDataResponse-agentconfig_OverlayDocument:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/agentconfig.OverlayDocument'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-array_handler_catalogLinkSummary:
    properties:
      data:
        description: Wrapped response data
        items:
          $ref: '#/definitions/handler.catalogLinkSummary'
        type: array
    type: object
  handler.GenericDataResponse-array_oscalTypes_1_1_3_AssessmentAssets:
    properties:
      data:
        description: Wrapped response data
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
        type: array
    type: object
  handler.GenericDataResponse-array_oscalTypes_1_1_3_AssessmentSubject:
    properties:
      data:
        description: Wrapped response data
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
    type: object
  handler.GenericDataResponse-array_oscalTypes_1_1_3_Task:
    properties:
      data:
        description: Wrapped response data
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
        type: array
    type: object
  handler.GenericDataResponse-auth_AuthHandler:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/auth.AuthHandler'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-digest_EvidenceSummary:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/digest.EvidenceSummary'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_CreatedEvidenceResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.CreatedEvidenceResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_EvidencePlaybackResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.EvidencePlaybackResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_FilterImportResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.FilterImportResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_FilterWithAssociations:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.FilterWithAssociations'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_PublicEvidenceResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.PublicEvidenceResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_SubscriptionsResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.SubscriptionsResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_agentConfigRevisionResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.agentConfigRevisionResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_agentInstanceDetail:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.agentInstanceDetail'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_bulkControlLinkResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.bulkControlLinkResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_catalogLinkResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.catalogLinkResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_configPreviewResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.configPreviewResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_configuredSystemDestinationResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.configuredSystemDestinationResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_evidenceConfigResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.evidenceConfigResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_groupResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.groupResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_milestoneResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.milestoneResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_poamItemResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.poamItemResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_publicUserResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.publicUserResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_remediationTemplateResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.remediationTemplateResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_riskResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.riskResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_testNotificationResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.testNotificationResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-handler_threatIDResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/handler.threatIDResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-notificationtroubleshooting_DiagnosticsResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/notificationtroubleshooting.DiagnosticsResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-notificationtroubleshooting_HealthResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/notificationtroubleshooting.HealthResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-notificationtroubleshooting_JobDetail:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/notificationtroubleshooting.JobDetail'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_AiDiagnosticsRunDetail:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.AiDiagnosticsRunDetail'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_AiDiagnosticsSummary:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.AiDiagnosticsSummary'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_BuildByPropsResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.BuildByPropsResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_ImportResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.ImportResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_InventoryItemWithSource:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.InventoryItemWithSource'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_ProfileComplianceProgress:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.ProfileComplianceProgress'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_ProfileHandler:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.ProfileHandler'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_SharedResponsibilityRollup:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.SharedResponsibilityRollup'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_acceptDashboardSuggestionsResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.acceptDashboardSuggestionsResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_catalogOffering:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.catalogOffering'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_dashboardSuggestionConfigResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.dashboardSuggestionConfigResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_dashboardSuggestionPreviewResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.dashboardSuggestionPreviewResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_dashboardSuggestionRunResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.dashboardSuggestionRunResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscal_generalizeDashboardSuggestionsResponse:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscal.generalizeDashboardSuggestionsResponse'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Activity:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Activity'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentAssets:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlan:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlan'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlanTermsAndConditions:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlanTermsAndConditions'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentResults:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AssessmentResults'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentSubject:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AttestationStatements:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AttestationStatements'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_AuthorizationBoundary:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.AuthorizationBoundary'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Capability:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Capability'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Catalog:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Catalog'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ComponentDefinition:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ComponentDefinition'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Control:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Control'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementation:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementation'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationResponsibility:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationSet:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_DataFlow:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.DataFlow'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_DefinedComponent:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Diagram:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Export:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Export'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Finding:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Finding'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Group:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Group'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ImplementedRequirement:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirement'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Import:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Import'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ImportAp:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ImportAp'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ImportProfile:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ImportProfile'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ImportSsp:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ImportSsp'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_InheritedControlImplementation:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.InheritedControlImplementation'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_InventoryItem:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_LeveragedAuthorization:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.LeveragedAuthorization'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_LocalDefinitions:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.LocalDefinitions'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Merge:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Merge'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Metadata:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Modify:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Modify'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_NetworkArchitecture:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.NetworkArchitecture'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Observation:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Observation'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Party:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Party'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestones'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestonesLocalDefinitions:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestonesLocalDefinitions'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_PoamItem:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.PoamItem'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Profile:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Profile'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_ProvidedControlImplementation:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Resource:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Resource'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Result:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Result'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Risk:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Risk'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Role:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Role'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SatisfiedControlImplementationResponsibility:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Statement:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Statement'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemCharacteristics:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemCharacteristics'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemComponent:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemId:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemId'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemImplementation:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemImplementation'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemSecurityPlan:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemSecurityPlan'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_SystemUser:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-oscalTypes_1_1_3_Task:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/oscalTypes_1_1_3.Task'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-poam_PoamItemControlLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/poam.PoamItemControlLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-poam_PoamItemEvidenceLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/poam.PoamItemEvidenceLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-poam_PoamItemFindingLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/poam.PoamItemFindingLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-poam_PoamItemRiskLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/poam.PoamItemRiskLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_CCFRoleAssignment:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.CCFRoleAssignment'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_ControlLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.ControlLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_Filter:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.Filter'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_FilterResponsibility:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.FilterResponsibility'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_SSOGroupMapping:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.SSOGroupMapping'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_SSPExportOffering:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.SSPExportOffering'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_SSPExportOfferingAllowedDownstream:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.SSPExportOfferingAllowedDownstream'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_SSPExportOfferingItem:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.SSPExportOfferingItem'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_User:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.User'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-relational_UserGroup:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/relational.UserGroup'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-risks_RiskComponentLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/risks.RiskComponentLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-risks_RiskControlLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/risks.RiskControlLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-risks_RiskEvidenceLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/risks.RiskEvidenceLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-risks_RiskSubjectLink:
    properties:
      data:
        allOf:
        - $ref: '#/definitions/risks.RiskSubjectLink'
        description: Wrapped response data
    type: object
  handler.GenericDataResponse-string:
    properties:
      data:
        description: Wrapped response data
        type: string
    type: object
  handler.GroupsHandler:
    type: object
  handler.HeartbeatCreateRequest:
    properties:
      config_digest:
        description: ConfigDigest is agentconfig.Digest of the effective config; sent
          whenever mode != off.
        type: string
      config_revision:
        description: |-
          ConfigRevision is the APPLIED configuration revision, 0 when running from the file only
          (R45). Absent for old agents and mode off.
        type: integer
      created_at:
        type: string
      uuid:
        description: UUID is the agent instance id.
        type: string
    required:
    - created_at
    - uuid
    type: object
  handler.LineageCompliance:
    properties:
      assessedPercent:
        type: number
      compliancePercent:
        type: number
      inherited:
        type: integer
      notSatisfied:
        type: integer
      satisfied:
        type: integer
      totalControls:
        type: integer
      unknown:
        type: integer
    type: object
  handler.LineageLeverageInheritedFrom:
    properties:
      offeringId:
        type: string
      offeringTitle:
        type: string
      offeringVersion:
        type: integer
      upstreamSspId:
        type: string
      upstreamSspTitle:
        type: string
    type: object
  handler.LineageLeverageLink:
    properties:
      byComponentId:
        type: string
      controlId:
        type: string
      driftRiskId:
        type: string
      id:
        type: string
      inheritedFrom:
        $ref: '#/definitions/handler.LineageLeverageInheritedFrom'
      outstandingResponsibilities:
        items:
          $ref: '#/definitions/leverage.Responsibility'
        type: array
      providedUuid:
        type: string
      responsibilities:
        items:
          $ref: '#/definitions/leverage.Responsibility'
        type: array
      responsibilityPosture:
        additionalProperties:
          type: string
        description: |-
          ResponsibilityPosture is keyed by responsibility UUID. UI must fence these keys
          from camelCasing.
        type: object
      satisfaction:
        $ref: '#/definitions/relational.SSPLeverageSatisfaction'
      statementId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPLeverageStatus'
    type: object
  handler.LineageLeverageRow:
    properties:
      links:
        items:
          $ref: '#/definitions/handler.LineageLeverageLink'
        type: array
      sspId:
        type: string
      sspTitle:
        type: string
    type: object
  handler.LineageLeverageSummary:
    properties:
      links:
        type: integer
      outstandingCount:
        type: integer
      satisfaction:
        type: string
      status:
        type: string
      totalResponsibilities:
        type: integer
    type: object
  handler.LineageLinkage:
    properties:
      operationalControls:
        type: integer
      policies:
        type: integer
      procedures:
        type: integer
      unanchored:
        type: boolean
      unmapped:
        type: boolean
    type: object
  handler.LineageNode:
    properties:
      catalogId:
        type: string
      childrenCount:
        type: integer
      collectedAt:
        type: string
      compliance:
        $ref: '#/definitions/handler.LineageCompliance'
      controlId:
        type: string
      evidenceId:
        type: string
      expires:
        type: string
      firstSeenAt:
        type: string
      groupId:
        type: string
      hasChildren:
        type: boolean
      impact:
        type: string
      key:
        type: string
      lastReviewedAt:
        type: string
      lastSeenAt:
        type: string
      likelihood:
        type: string
      linkage:
        $ref: '#/definitions/handler.LineageLinkage'
      linkedEvidenceCount:
        type: integer
      nodeType:
        type: string
      postureCounts:
        $ref: '#/definitions/handler.LineagePostureCounts'
      reason:
        description: Evidence-node detail.
        type: string
      relationship:
        description: |-
          Relationship describes how this node relates to the parent it was expanded
          from (group | control | implements | documents | has-risk | has-evidence),
          so a node-link graph can label/style edges. Empty for roots.
        type: string
      reviewDeadline:
        type: string
      risk:
        $ref: '#/definitions/handler.LineageRisk'
      riskId:
        type: string
      score:
        type: integer
      severity:
        description: Risk-node detail.
        type: string
      ssp:
        allOf:
        - $ref: '#/definitions/handler.LineageSSPStatus'
        description: |-
          SSP-scoped posture (sspId set): SSP on operational control nodes, and
          PostureCounts on structural nodes tallying their controls' postures.
          SSPBreakdown replaces both in the global (no sspId) view on control nodes.
      sspBreakdown:
        $ref: '#/definitions/handler.LineageSSPBreakdown'
      sspId:
        description: |-
          RiskSSPID/RiskSSPTitle identify the single SSP a risk node belongs to
          (risk_register_risks.ssp_id is not-null — every risk has exactly one).
          Populated regardless of scope so the UI can group risk nodes by SSP in
          the unscoped "All SSPs" view.
        type: string
      sspTitle:
        type: string
      statement:
        description: |-
          Statement is the control's requirement prose (OSCAL "statement" part),
          surfaced for hover/tooltip in the lineage tree & graph. Control nodes only.
        type: string
      status:
        type: string
      title:
        type: string
    type: object
  handler.LineagePostureCounts:
    properties:
      attention:
        type: integer
      inherited:
        type: integer
      notApplicable:
        type: integer
      notSatisfied:
        type: integer
      outOfScope:
        type: integer
      planned:
        type: integer
      satisfied:
        type: integer
    type: object
  handler.LineageRisk:
    properties:
      counts:
        $ref: '#/definitions/handler.LineageRiskCounts'
      mutedScoreSum:
        type: integer
      openScoreSum:
        type: integer
    type: object
  handler.LineageRiskCounts:
    properties:
      investigating:
        type: integer
      mitigatingImplemented:
        type: integer
      mitigatingPlanned:
        type: integer
      open:
        type: integer
      riskAccepted:
        type: integer
    type: object
  handler.LineageSSPBreakdown:
    properties:
      attention:
        type: integer
      inherited:
        type: integer
      notApplicable:
        type: integer
      notSatisfied:
        type: integer
      outOfScope:
        type: integer
      planned:
        type: integer
      satisfied:
        type: integer
      totalSsps:
        type: integer
    type: object
  handler.LineageSSPRow:
    properties:
      evidenceStatus:
        type: string
      implementationStatus:
        type: string
      inProfile:
        type: boolean
      leverage:
        $ref: '#/definitions/handler.LineageLeverageSummary'
      posture:
        type: string
      sspId:
        type: string
      sspTitle:
        type: string
    type: object
  handler.LineageSSPStatus:
    properties:
      evidenceStatus:
        type: string
      implementationStatus:
        type: string
      inProfile:
        type: boolean
      leverage:
        $ref: '#/definitions/handler.LineageLeverageSummary'
      posture:
        type: string
    type: object
  handler.OverTime.HeartbeatInterval:
    properties:
      interval:
        type: string
      total:
        type: integer
    type: object
  handler.PublicEvidenceResponse:
    properties:
      activities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Activity'
        type: array
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      description:
        type: string
      end:
        type: string
      expires:
        type: string
      id:
        type: string
      inventory-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      labels:
        items:
          $ref: '#/definitions/relational.Labels'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      start:
        type: string
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.ObjectiveStatus'
      subject-references:
        description: |-
          SubjectReferences are the evidence's subjects in display order. Present (possibly
          empty) on responses that load them, so clients can tell "no subjects" from "not
          supported"; omitted otherwise.
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SubjectReference'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  handler.SetCatalogActiveRequest:
    properties:
      active:
        type: boolean
    required:
    - active
    type: object
  handler.StatusInterval:
    properties:
      interval:
        type: string
      statuses:
        items:
          $ref: '#/definitions/evidence.StatusCount'
        type: array
    type: object
  handler.SubscriptionsResponse:
    properties:
      notifications:
        additionalProperties:
          items:
            type: string
          type: array
        description: |-
          Notifications maps notification types to delivery channels.
          Supported types include taskAvailable, evidenceDigest, taskDailyDigest, and riskNotifications.
        type: object
    type: object
  handler.UpdateSubscriptionsRequest:
    properties:
      notifications:
        additionalProperties:
          items:
            type: string
          type: array
        description: |-
          Notifications maps notification types to delivery channels.
          Supported types include taskAvailable, evidenceDigest, taskDailyDigest, and riskNotifications.
        type: object
    type: object
  handler.UserHandler:
    type: object
  handler.acceptRiskRequest:
    properties:
      justification:
        type: string
      review-deadline:
        type: string
    type: object
  handler.addComponentLinkRequest:
    properties:
      component-id:
        type: string
    type: object
  handler.addControlLinkRequest:
    properties:
      catalog-id:
        type: string
      control-id:
        type: string
    type: object
  handler.addEvidenceLinkRequest:
    properties:
      evidence-id:
        type: string
    type: object
  handler.addLinkRequest:
    properties:
      id:
        type: string
    required:
    - id
    type: object
  handler.addSubjectLinkRequest:
    properties:
      subject-id:
        type: string
    type: object
  handler.agentConfigPreviewRequest:
    properties:
      overlay:
        type: object
    type: object
  handler.agentConfigPutRequest:
    properties:
      comment:
        type: string
      overlay:
        type: object
    type: object
  handler.agentConfigRevertRequest:
    properties:
      comment:
        type: string
    type: object
  handler.agentConfigRevisionResponse:
    properties:
      agent-id:
        type: string
      comment:
        type: string
      created-at:
        type: string
      created-by:
        type: string
      overlay:
        description: omitted in lists
        type: object
      overlay-size:
        type: integer
      revert-of:
        type: integer
      revision:
        type: integer
    type: object
  handler.agentInstanceCounts:
    properties:
      failed:
        type: integer
      fresh:
        type: integer
      in-sync:
        type: integer
      out-of-sync:
        type: integer
      pending:
        type: integer
      rejected:
        type: integer
      stale:
        type: integer
      total:
        type: integer
      unknown:
        type: integer
    type: object
  handler.agentInstanceDetail:
    properties:
      agent-version:
        type: string
      applied-revision:
        type: integer
      attempted-revision:
        type: integer
      base:
        type: object
      daemon:
        type: boolean
      effective:
        type: object
      effective-digest:
        type: string
      error:
        type: string
      first-seen-at:
        type: string
      heartbeat-config-revision:
        type: integer
      hostname:
        type: string
      instance-id:
        type: string
      last-seen-at:
        type: string
      mode:
        type: string
      plugins:
        description: |-
          Plugins are the reported plugins and the agent library each was built with (R76).
          Empty until an agent that reports them does.
        items:
          $ref: '#/definitions/agentconfig.PluginReport'
        type: array
      reason:
        type: string
      remote-config:
        type: object
      report-stale:
        description: heartbeat digest != reported digest
        type: boolean
      reported-at:
        type: string
      stale:
        type: boolean
      status:
        description: applied|rejected|failed|not-applicable|pending|unknown
        type: string
      sync-status:
        description: in-sync|out-of-sync|not-applicable|unknown
        type: string
      truncated:
        type: boolean
      unsafe:
        items:
          $ref: '#/definitions/agentconfig.Change'
        type: array
      warnings:
        description: R41
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
    type: object
  handler.agentInstanceSummary:
    properties:
      agent-version:
        type: string
      applied-revision:
        type: integer
      attempted-revision:
        type: integer
      daemon:
        type: boolean
      effective-digest:
        type: string
      error:
        type: string
      first-seen-at:
        type: string
      heartbeat-config-revision:
        type: integer
      hostname:
        type: string
      instance-id:
        type: string
      last-seen-at:
        type: string
      mode:
        type: string
      plugins:
        description: |-
          Plugins are the reported plugins and the agent library each was built with (R76).
          Empty until an agent that reports them does.
        items:
          $ref: '#/definitions/agentconfig.PluginReport'
        type: array
      reason:
        type: string
      remote-config:
        type: object
      report-stale:
        description: heartbeat digest != reported digest
        type: boolean
      reported-at:
        type: string
      stale:
        type: boolean
      status:
        description: applied|rejected|failed|not-applicable|pending|unknown
        type: string
      sync-status:
        description: in-sync|out-of-sync|not-applicable|unknown
        type: string
      truncated:
        type: boolean
      unsafe:
        items:
          $ref: '#/definitions/agentconfig.Change'
        type: array
      warnings:
        description: R41
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
    type: object
  handler.agentInstancesMeta:
    properties:
      counts:
        $ref: '#/definitions/handler.agentInstanceCounts'
      desired-revision:
        type: integer
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      total-pages:
        type: integer
    type: object
  handler.attachFilterResponsibilityRequest:
    properties:
      controlId:
        description: |-
          Optional control to also link the filter to (so control-level compliance
          surfaces include it). The link's provenance is recorded: detaching the
          responsibility removes the control link only if this attach created it.
        type: string
      responsibilityUuid:
        description: The upstream ControlImplementationResponsibility this filter
          should evidence.
        format: uuid
        type: string
      sspId:
        description: |-
          The DOWNSTREAM SSP that inherits the responsibility (matched against
          ssp_leverage_links.downstream_ssp_id).
        format: uuid
        type: string
    required:
    - responsibilityUuid
    - sspId
    type: object
  handler.availableNotificationProviderResponse:
    properties:
      description:
        type: string
      displayName:
        type: string
      enabled:
        type: boolean
      error:
        type: string
      metadata:
        additionalProperties:
          type: string
        type: object
      providerType:
        type: string
    type: object
  handler.bulkControlLinkRequest:
    properties:
      links:
        items:
          $ref: '#/definitions/handler.createControlLinkRequest'
        type: array
    type: object
  handler.bulkControlLinkResponse:
    properties:
      created:
        type: integer
      skipped:
        type: integer
    type: object
  handler.catalogLinkRequest:
    properties:
      relationshipType:
        type: string
      sourceCatalogId:
        type: string
      target:
        $ref: '#/definitions/handler.controlRefRequest'
    type: object
  handler.catalogLinkResponse:
    properties:
      created:
        type: integer
      deleted:
        type: integer
      skipped:
        type: integer
    type: object
  handler.catalogLinkSummary:
    properties:
      controlCount:
        type: integer
      relationshipType:
        type: string
      sourceCatalogId:
        type: string
      targetCatalogId:
        type: string
      targetControlId:
        type: string
    type: object
  handler.configPreviewResponse:
    properties:
      desired-revision:
        type: integer
      instances:
        items:
          $ref: '#/definitions/handler.instancePreview'
        type: array
      omitted-instances:
        description: |-
          OmittedInstances counts the instances with a reported base the preview bounds left
          out (at most agentcfg.PreviewMaxInstances instances and PreviewMaxConfigBytes of
          reported config; validated instances first, then newest first).
        type: integer
      overlay-errors:
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
      standalone:
        type: boolean
    type: object
  handler.configuredSystemDestinationResponse:
    properties:
      destinationTarget:
        type: string
      providerType:
        type: string
    type: object
  handler.controlLinkResponse:
    properties:
      catalog-id:
        type: string
      control-id:
        type: string
      created-at:
        type: string
      poam-item-id:
        type: string
    type: object
  handler.controlRefRequest:
    properties:
      catalogId:
        type: string
      controlId:
        type: string
    type: object
  handler.createControlLinkRequest:
    properties:
      relationshipType:
        type: string
      source:
        $ref: '#/definitions/handler.controlRefRequest'
      target:
        $ref: '#/definitions/handler.controlRefRequest'
    type: object
  handler.createFilterRequest:
    properties:
      components:
        items:
          type: string
        type: array
      controls:
        items:
          type: string
        type: array
      filter:
        $ref: '#/definitions/labelfilter.Filter'
      name:
        type: string
      sspId:
        description: System Security Plan ID. On PUT, omitted or null clears the binding
          to global.
        example: 00000000-0000-0000-0000-000000000000
        format: uuid
        type: string
        x-nullable: true
    required:
    - filter
    - name
    type: object
  handler.createMilestoneRequest:
    properties:
      description:
        type: string
      order-index:
        description: |-
          OrderIndex is a pointer so that clients can explicitly set 0 without it
          being indistinguishable from an omitted field.
        type: integer
      planned-completion-date:
        type: string
      remarks:
        type: string
      responsible-party:
        type: string
      status:
        type: string
      title:
        type: string
    required:
    - title
    type: object
  handler.createPoamItemRequest:
    properties:
      acceptance-rationale:
        type: string
      control-refs:
        items:
          $ref: '#/definitions/handler.poamControlRefRequest'
        type: array
      created-from-risk-id:
        type: string
      description:
        type: string
      evidence-ids:
        items:
          type: string
        type: array
      finding-ids:
        items:
          type: string
        type: array
      milestones:
        items:
          $ref: '#/definitions/handler.createMilestoneRequest'
        type: array
      planned-completion-date:
        type: string
      primary-owner-user-id:
        type: string
      resource-required:
        type: string
      risk-ids:
        items:
          type: string
        type: array
      source-type:
        type: string
      ssp-id:
        type: string
      status:
        type: string
      title:
        type: string
    required:
    - ssp-id
    - title
    type: object
  handler.createRiskRequest:
    properties:
      acceptance-justification:
        type: string
      description:
        type: string
      impact:
        type: string
      last-reviewed-at:
        type: string
      likelihood:
        type: string
      owner-assignments:
        items:
          $ref: '#/definitions/handler.riskOwnerAssignmentRequest'
        type: array
      primary-owner-user-id:
        type: string
      remediation-template:
        $ref: '#/definitions/handler.remediationTemplateRequest'
      review-deadline:
        type: string
      risk-template-id:
        type: string
      ssp-id:
        type: string
      status:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/handler.threatIDRequest'
        type: array
      title:
        type: string
    type: object
  handler.createRoleAssignmentRequest:
    properties:
      assigneeId:
        type: string
      assigneeType:
        type: string
      roleName:
        type: string
    required:
    - assigneeId
    - assigneeType
    - roleName
    type: object
  handler.createSystemNotificationDestinationRequest:
    properties:
      destinationTarget:
        type: string
      providerType:
        type: string
    required:
    - destinationTarget
    - providerType
    type: object
  handler.effectiveRole:
    properties:
      assignmentId:
        type: string
      inherited:
        description: false = a direct grant to the subject
        type: boolean
      roleName:
        type: string
      source:
        description: config (immutable) | manual (deletable)
        type: string
      viaGroup:
        description: the granting group's name, when inherited
        type: string
    type: object
  handler.evidenceConfigResponse:
    properties:
      manual-subject-required:
        description: ManualSubjectRequired is true when evidence submitted by a user
          must name a subject.
        type: boolean
    type: object
  handler.evidenceLinkResponse:
    properties:
      created-at:
        type: string
      evidence-id:
        type: string
      poam-item-id:
        type: string
    type: object
  handler.filteredSearchRequest:
    properties:
      filter:
        $ref: '#/definitions/labelfilter.Filter'
    required:
    - filter
    type: object
  handler.findingLinkResponse:
    properties:
      created-at:
        type: string
      finding-id:
        type: string
      poam-item-id:
        type: string
    type: object
  handler.groupMemberResponse:
    properties:
      displayName:
        type: string
      inherited:
        description: |-
          Inherited is true when the membership was materialized from an SSO IdP group (source=sso).
          Such memberships are owned by the IdP: the remove-member API refuses to delete them, so the
          UI must surface them as read-only rather than offering a Remove action that 403s.
        type: boolean
      userId:
        type: string
    type: object
  handler.groupResponse:
    properties:
      createdAt:
        type: string
      deletedAt:
        $ref: '#/definitions/gorm.DeletedAt'
      description:
        type: string
      id:
        type: string
      memberCount:
        type: integer
      name:
        description: |-
          Name is the group's policy-facing identifier — the token that appears in
          subject.groups and that role-assignment config matches on. Unique among live groups.
        type: string
      source:
        description: |-
          Source records how the group came to exist: GroupSourceManual (an admin created it via the API)
          or GroupSourceSSO (SSO provisioning materialized it from a group_mapping value). It defaults to
          manual so admin-created and pre-attribution groups are never auto-removed. Only sso groups that
          have become fully unreferenced are cleaned up at boot (CleanupOrphanedSSOGroups); the source is
          set only when the group is first created, so an admin group that later appears in SSO config
          stays manual.
        type: string
      updatedAt:
        type: string
    type: object
  handler.instancePreview:
    properties:
      changes:
        items:
          $ref: '#/definitions/agentconfig.Change'
        type: array
      diff-vs-current:
        items:
          $ref: '#/definitions/agentconfig.DiffEntry'
        type: array
      effective:
        type: object
      errors:
        description: introduced by the overlay (R59)
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
      hostname:
        type: string
      instance-id:
        type: string
      mode:
        type: string
      stale:
        type: boolean
      validated:
        description: 'R48: PUT validates against this instance; its errors block a
          save'
        type: boolean
      warnings:
        description: 'already in Merge(base, {}): from the host file, non-blocking
          (R59)'
        items:
          $ref: '#/definitions/agentconfig.FieldError'
        type: array
      will-apply:
        type: boolean
      will-apply-reason:
        description: mode-off|mode-report|unsafe-changes|forbidden-changes|invalid-config
        type: string
    type: object
  handler.milestoneResponse:
    properties:
      completionDate:
        type: string
      createdAt:
        type: string
      description:
        type: string
      id:
        type: string
      orderIndex:
        type: integer
      plannedCompletionDate:
        type: string
      poam-item-id:
        type: string
      remarks:
        type: string
      responsibleParty:
        type: string
      status:
        type: string
      title:
        type: string
      updatedAt:
        type: string
    type: object
  handler.notificationProviderStatusResponse:
    properties:
      enabled:
        type: boolean
      providerType:
        type: string
    type: object
  handler.poamControlRefRequest:
    properties:
      catalogId:
        type: string
      controlId:
        type: string
    required:
    - catalogId
    - controlId
    type: object
  handler.poamItemResponse:
    properties:
      acceptanceRationale:
        type: string
      completedAt:
        type: string
      controlLinks:
        items:
          $ref: '#/definitions/handler.controlLinkResponse'
        type: array
      createdAt:
        type: string
      description:
        type: string
      evidenceLinks:
        items:
          $ref: '#/definitions/handler.evidenceLinkResponse'
        type: array
      findingLinks:
        items:
          $ref: '#/definitions/handler.findingLinkResponse'
        type: array
      id:
        type: string
      lastStatusChangeAt:
        type: string
      milestones:
        items:
          $ref: '#/definitions/handler.milestoneResponse'
        type: array
      plannedCompletionDate:
        type: string
      primaryOwnerUserId:
        type: string
      resourceRequired:
        type: string
      riskLinks:
        items:
          $ref: '#/definitions/handler.riskLinkResponse'
        type: array
      sourceType:
        type: string
      sspId:
        type: string
      status:
        type: string
      title:
        type: string
      updatedAt:
        type: string
    type: object
  handler.promoteToPoamRequest:
    properties:
      deadline:
        description: Deadline maps to PoamItem.PlannedCompletionDate.
        type: string
      milestones:
        description: |-
          Milestones are additional milestones to append after any copied from the
          risk's RemediationTemplate.
        items:
          $ref: '#/definitions/handler.createMilestoneRequest'
        type: array
      primaryOwnerUserId:
        description: |-
          PrimaryOwnerUserID optionally overrides the POAM item owner.
          If omitted, the risk's own PrimaryOwnerUserID is inherited automatically.
        type: string
      resourceRequired:
        description: ResourceRequired is a free-text planning field describing effort
          or budget needed.
        type: string
      title:
        description: |-
          Title overrides the risk's title as the POAM item title.
          If omitted, the risk's own title is used.
        type: string
    type: object
  handler.publicUserResponse:
    properties:
      id:
        type: string
      name:
        type: string
    type: object
  handler.remediationTaskRequest:
    properties:
      order-index:
        type: integer
      title:
        type: string
    type: object
  handler.remediationTaskResponse:
    properties:
      id:
        type: string
      order-index:
        type: integer
      title:
        type: string
    type: object
  handler.remediationTemplateRequest:
    properties:
      description:
        type: string
      tasks:
        items:
          $ref: '#/definitions/handler.remediationTaskRequest'
        type: array
      title:
        type: string
    type: object
  handler.remediationTemplateResponse:
    properties:
      description:
        type: string
      id:
        type: string
      tasks:
        items:
          $ref: '#/definitions/handler.remediationTaskResponse'
        type: array
      title:
        type: string
    type: object
  handler.reviewRiskRequest:
    properties:
      decision:
        type: string
      impact:
        type: string
      likelihood:
        type: string
      next-review-deadline:
        type: string
      notes:
        type: string
      reviewed-at:
        type: string
    type: object
  handler.riskControlLinkResponse:
    properties:
      catalog-id:
        type: string
      control-id:
        type: string
    type: object
  handler.riskLinkResponse:
    properties:
      created-at:
        type: string
      poam-item-id:
        type: string
      risk-id:
        type: string
    type: object
  handler.riskOwnerAssignmentRequest:
    properties:
      is-primary:
        type: boolean
      owner-kind:
        type: string
      owner-ref:
        type: string
    type: object
  handler.riskOwnerAssignmentResponse:
    properties:
      is-primary:
        type: boolean
      owner-kind:
        type: string
      owner-ref:
        type: string
    type: object
  handler.riskResponse:
    properties:
      acceptance-justification:
        type: string
      component-ids:
        items:
          type: string
        type: array
      control-links:
        items:
          $ref: '#/definitions/handler.riskControlLinkResponse'
        type: array
      created-at:
        type: string
      dedupe-key:
        type: string
      description:
        type: string
      evidence-ids:
        items:
          type: string
        type: array
      first-seen-at:
        type: string
      id:
        type: string
      impact:
        type: string
      last-reviewed-at:
        type: string
      last-seen-at:
        type: string
      likelihood:
        type: string
      owner-assignments:
        items:
          $ref: '#/definitions/handler.riskOwnerAssignmentResponse'
        type: array
      primary-owner-user-id:
        type: string
      remediation-template:
        $ref: '#/definitions/handler.remediationTemplateResponse'
      review-deadline:
        type: string
      risk-template-id:
        type: string
      source-type:
        type: string
      ssp-id:
        type: string
      status:
        type: string
      subject-ids:
        items:
          type: string
        type: array
      threat-ids:
        items:
          $ref: '#/definitions/handler.threatIDResponse'
        type: array
      title:
        type: string
      updated-at:
        type: string
    type: object
  handler.riskScoreResponse:
    properties:
      actor-user-id:
        type: string
      baseline-score:
        type: integer
      created-at:
        type: string
      id:
        type: string
      impact:
        type: string
      likelihood:
        type: string
      occurred-at:
        type: string
      open-baseline-score:
        type: integer
      open-residual-score:
        type: integer
      residual-score:
        type: integer
      risk-id:
        type: string
      source-event-type:
        type: string
      ssp-id:
        type: string
      status:
        type: string
    type: object
  handler.riskScoreTimeseriesResponse:
    properties:
      bucket-start:
        type: string
      open-baseline-score:
        type: integer
      open-residual-score:
        type: integer
    type: object
  handler.selectableUserResponse:
    properties:
      displayName:
        type: string
      id:
        type: string
    type: object
  handler.systemNotificationResponse:
    properties:
      configuredDestinations:
        items:
          $ref: '#/definitions/handler.configuredSystemDestinationResponse'
        type: array
      name:
        type: string
    type: object
  handler.testNotificationRequest:
    properties:
      destinationTarget:
        type: string
      mode:
        enum:
        - enqueue
        type: string
      providerType:
        enum:
        - email
        - slack
        type: string
    required:
    - destinationTarget
    - providerType
    type: object
  handler.testNotificationResponse:
    properties:
      accepted:
        type: boolean
      destinationTarget:
        type: string
      jobIds:
        items:
          type: integer
        type: array
      message:
        type: string
      mode:
        type: string
      providerType:
        type: string
    type: object
  handler.threatIDRequest:
    properties:
      id:
        type: string
      system:
        type: string
      title:
        type: string
      url:
        type: string
    type: object
  handler.threatIDResponse:
    properties:
      id:
        type: string
      system:
        type: string
      threat-ref-id:
        type: string
      title:
        type: string
      url:
        type: string
    type: object
  handler.updateMilestoneRequest:
    properties:
      description:
        type: string
      order-index:
        type: integer
      planned-completion-date:
        type: string
      remarks:
        type: string
      responsible-party:
        type: string
      status:
        type: string
      title:
        type: string
    type: object
  handler.updatePoamItemRequest:
    properties:
      acceptance-rationale:
        type: string
      add-control-refs:
        items:
          $ref: '#/definitions/handler.poamControlRefRequest'
        type: array
      add-evidence-ids:
        items:
          type: string
        type: array
      add-finding-ids:
        items:
          type: string
        type: array
      add-risk-ids:
        description: Link management — add/remove in the same call as scalar updates.
        items:
          type: string
        type: array
      description:
        type: string
      planned-completion-date:
        type: string
      primary-owner-user-id:
        type: string
      remove-control-refs:
        items:
          $ref: '#/definitions/handler.poamControlRefRequest'
        type: array
      remove-evidence-ids:
        items:
          type: string
        type: array
      remove-finding-ids:
        items:
          type: string
        type: array
      remove-risk-ids:
        items:
          type: string
        type: array
      status:
        type: string
      title:
        type: string
    type: object
  handler.updateRiskRequest:
    properties:
      acceptance-justification:
        type: string
      description:
        type: string
      impact:
        type: string
      last-reviewed-at:
        type: string
      likelihood:
        type: string
      owner-assignments:
        items:
          $ref: '#/definitions/handler.riskOwnerAssignmentRequest'
        type: array
      primary-owner-user-id:
        type: string
      remediation-template:
        $ref: '#/definitions/handler.remediationTemplateRequest'
      review-deadline:
        type: string
      review-justification:
        type: string
      risk-template-id:
        type: string
      status:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/handler.threatIDRequest'
        type: array
      title:
        type: string
    type: object
  handler.userGroupMembershipResponse:
    properties:
      groupId:
        type: string
      groupName:
        type: string
      inherited:
        type: boolean
    type: object
  labelfilter.Condition:
    properties:
      label:
        description: Label name (e.g., "type", "group", "app").
        type: string
      operator:
        description: Operator (e.g., "=", "!=", etc.).
        type: string
      value:
        description: Value for the condition (e.g., "ssh", "prod").
        type: string
    type: object
  labelfilter.Filter:
    properties:
      scope:
        $ref: '#/definitions/labelfilter.Scope'
    type: object
  labelfilter.Query:
    properties:
      operator:
        description: Logical operator (e.g., "AND", "OR").
        type: string
      scopes:
        description: Scopes can be either `Condition` or nested `Query`.
        items:
          $ref: '#/definitions/labelfilter.Scope'
        type: array
    type: object
  labelfilter.Scope:
    properties:
      condition:
        $ref: '#/definitions/labelfilter.Condition'
      query:
        $ref: '#/definitions/labelfilter.Query'
    type: object
  leverage.Responsibility:
    properties:
      description:
        type: string
      responsibilityUuid:
        type: string
    type: object
  notificationtroubleshooting.ConfiguredSystemDestinationResponse:
    properties:
      destinationTarget:
        type: string
      providerType:
        type: string
    type: object
  notificationtroubleshooting.DiagnosticCheck:
    properties:
      code:
        type: string
      jobId:
        type: integer
      label:
        type: string
      message:
        type: string
      status:
        type: string
    type: object
  notificationtroubleshooting.DiagnosticsResponse:
    properties:
      checks:
        items:
          $ref: '#/definitions/notificationtroubleshooting.DiagnosticCheck'
        type: array
      configuredDestinations:
        items:
          $ref: '#/definitions/notificationtroubleshooting.ConfiguredSystemDestinationResponse'
        type: array
      notificationName:
        type: string
      recommendedActions:
        items:
          type: string
        type: array
      status:
        type: string
      subscriberCounts:
        $ref: '#/definitions/notificationtroubleshooting.SubscriberCounts'
    type: object
  notificationtroubleshooting.HealthResponse:
    properties:
      notifications:
        items:
          $ref: '#/definitions/notificationtroubleshooting.NotificationHealth'
        type: array
      providers:
        items:
          $ref: '#/definitions/notificationtroubleshooting.ProviderStatus'
        type: array
      schedules:
        items:
          $ref: '#/definitions/notificationtroubleshooting.ScheduleHealth'
        type: array
      warnings:
        items:
          $ref: '#/definitions/notificationtroubleshooting.TroubleshootingWarning'
        type: array
      worker:
        $ref: '#/definitions/notificationtroubleshooting.WorkerHealth'
    type: object
  notificationtroubleshooting.JobDetail:
    properties:
      args:
        additionalProperties: {}
        type: object
      attempt:
        type: integer
      attemptedAt:
        format: date-time
        type: string
      correlationId:
        type: string
      createdAt:
        format: date-time
        type: string
      errors:
        items:
          $ref: '#/definitions/notificationtroubleshooting.SanitizedAttemptError'
        type: array
      finalizedAt:
        format: date-time
        type: string
      id:
        type: integer
      kind:
        type: string
      lastError:
        type: string
      maxAttempts:
        type: integer
      metadata:
        additionalProperties:
          type: string
        type: object
      notificationKind:
        type: string
      provider:
        type: string
      queue:
        type: string
      scheduledAt:
        format: date-time
        type: string
      sourceJobId:
        type: string
      sourceJobKind:
        type: string
      stale:
        type: boolean
      state:
        type: string
      target:
        type: string
    type: object
  notificationtroubleshooting.JobListItem:
    properties:
      attempt:
        type: integer
      attemptedAt:
        format: date-time
        type: string
      correlationId:
        type: string
      createdAt:
        format: date-time
        type: string
      finalizedAt:
        format: date-time
        type: string
      id:
        type: integer
      kind:
        type: string
      lastError:
        type: string
      maxAttempts:
        type: integer
      notificationKind:
        type: string
      provider:
        type: string
      queue:
        type: string
      scheduledAt:
        format: date-time
        type: string
      sourceJobId:
        type: string
      sourceJobKind:
        type: string
      stale:
        type: boolean
      state:
        type: string
      target:
        type: string
    type: object
  notificationtroubleshooting.JobSummary:
    properties:
      createdAt:
        format: date-time
        type: string
      finalizedAt:
        format: date-time
        type: string
      id:
        type: integer
      state:
        type: string
    type: object
  notificationtroubleshooting.JobsListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/notificationtroubleshooting.JobListItem'
        type: array
      pagination:
        $ref: '#/definitions/notificationtroubleshooting.Pagination'
    type: object
  notificationtroubleshooting.NotificationHealth:
    properties:
      configuredDestinations:
        items:
          $ref: '#/definitions/notificationtroubleshooting.ConfiguredSystemDestinationResponse'
        type: array
      name:
        type: string
      subscriberCounts:
        $ref: '#/definitions/notificationtroubleshooting.SubscriberCounts'
      warnings:
        items:
          $ref: '#/definitions/notificationtroubleshooting.TroubleshootingWarning'
        type: array
    type: object
  notificationtroubleshooting.Pagination:
    properties:
      nextCursor:
        type: string
    type: object
  notificationtroubleshooting.ProviderStatus:
    properties:
      description:
        type: string
      displayName:
        type: string
      enabled:
        type: boolean
      metadata:
        additionalProperties:
          type: string
        type: object
      providerType:
        type: string
    type: object
  notificationtroubleshooting.QueueSummary:
    properties:
      available:
        type: integer
      completed24h:
        type: integer
      discarded24h:
        type: integer
      maxWorkers:
        type: integer
      name:
        type: string
      oldestAvailableAt:
        type: string
      retryable:
        type: integer
      running:
        type: integer
      scheduled:
        type: integer
      staleCount:
        type: integer
      staleThresholdSeconds:
        type: integer
    type: object
  notificationtroubleshooting.SanitizedAttemptError:
    properties:
      at:
        type: string
      attempt:
        type: integer
      error:
        type: string
    type: object
  notificationtroubleshooting.ScheduleHealth:
    properties:
      deliveryKind:
        type: string
      enabled:
        type: boolean
      jobKind:
        type: string
      lastJob:
        $ref: '#/definitions/notificationtroubleshooting.JobSummary'
      name:
        type: string
      nextRunAt:
        type: string
      queue:
        type: string
      schedule:
        type: string
    type: object
  notificationtroubleshooting.SubscriberCounts:
    properties:
      email:
        type: integer
      slack:
        type: integer
      totalUsers:
        type: integer
    type: object
  notificationtroubleshooting.TroubleshootingWarning:
    properties:
      code:
        type: string
      message:
        type: string
      severity:
        type: string
      target:
        type: string
    type: object
  notificationtroubleshooting.WorkerHealth:
    properties:
      enabled:
        type: boolean
      mode:
        type: string
      pollOnly:
        type: boolean
      queues:
        items:
          $ref: '#/definitions/notificationtroubleshooting.QueueSummary'
        type: array
    type: object
  oscal.AiDiagnosticsConfig:
    properties:
      maxCallsPerRun:
        type: integer
      maxControlsPerChunk:
        type: integer
      maxLabelSetsPerChunk:
        type: integer
      model:
        type: string
      promptVersion:
        type: string
      queueWorkers:
        type: integer
    type: object
  oscal.AiDiagnosticsHealthCheck:
    properties:
      id:
        type: string
      message:
        type: string
      recommendedActions:
        items:
          type: string
        type: array
      status:
        type: string
    type: object
  oscal.AiDiagnosticsQueue:
    properties:
      available:
        type: integer
      completed24h:
        type: integer
      discarded24h:
        type: integer
      maxWorkers:
        type: integer
      name:
        type: string
      oldestAvailableAt:
        type: string
      retryable:
        type: integer
      running:
        type: integer
      scheduled:
        type: integer
    type: object
  oscal.AiDiagnosticsRun:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheHitRatio:
        type: number
      cacheReadInputTokens:
        type: integer
      completedAt:
        type: string
      completedCells:
        type: integer
      durationMs:
        type: integer
      failedCells:
        type: integer
      id:
        type: string
      inputTokens:
        type: integer
      mappingsRejected:
        type: integer
      mappingsReturned:
        type: integer
      model:
        type: string
      outputTokens:
        type: integer
      plannedCalls:
        type: integer
      promptVersion:
        type: string
      rateLimitedTotal:
        type: integer
      sspId:
        type: string
      sspName:
        type: string
      startedAt:
        type: string
      status:
        type: string
      triggeredBy:
        $ref: '#/definitions/oscal.suggestionEventActor'
    type: object
  oscal.AiDiagnosticsRunCell:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheReadInputTokens:
        type: integer
      cellIndex:
        type: integer
      completedAt:
        type: string
      controlKeys:
        items:
          type: string
        type: array
      error:
        type: string
      inputTokens:
        type: integer
      labelSetHashes:
        items:
          type: string
        type: array
      mappingsRejected:
        type: integer
      mappingsReturned:
        type: integer
      outputTokens:
        type: integer
      rateLimitedCount:
        type: integer
      status:
        type: string
    type: object
  oscal.AiDiagnosticsRunDetail:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheHitRatio:
        type: number
      cacheReadInputTokens:
        type: integer
      cells:
        items:
          $ref: '#/definitions/oscal.AiDiagnosticsRunCell'
        type: array
      completedAt:
        type: string
      completedCells:
        type: integer
      durationMs:
        type: integer
      events:
        items:
          $ref: '#/definitions/oscal.dashboardSuggestionEventResponse'
        type: array
      failedCells:
        type: integer
      id:
        type: string
      inputTokens:
        type: integer
      mappingsRejected:
        type: integer
      mappingsReturned:
        type: integer
      model:
        type: string
      outputTokens:
        type: integer
      plannedCalls:
        type: integer
      promptVersion:
        type: string
      rateLimitedTotal:
        type: integer
      sspId:
        type: string
      sspName:
        type: string
      startedAt:
        type: string
      status:
        type: string
      triggeredBy:
        $ref: '#/definitions/oscal.suggestionEventActor'
    type: object
  oscal.AiDiagnosticsSummary:
    properties:
      checks:
        items:
          $ref: '#/definitions/oscal.AiDiagnosticsHealthCheck'
        type: array
      config:
        $ref: '#/definitions/oscal.AiDiagnosticsConfig'
      enabled:
        type: boolean
      queue:
        $ref: '#/definitions/oscal.AiDiagnosticsQueue'
      totals:
        $ref: '#/definitions/oscal.AiDiagnosticsTotals'
    type: object
  oscal.AiDiagnosticsTotals:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheHitRatio:
        type: number
      cacheReadInputTokens:
        type: integer
      cellsCompleted:
        type: integer
      cellsFailed:
        type: integer
      inputTokens:
        type: integer
      mappingsRejected:
        type: integer
      mappingsReturned:
        type: integer
      outputTokens:
        type: integer
      rateLimitedTotal:
        type: integer
      runs:
        type: integer
      runsByStatus:
        additionalProperties:
          format: int64
          type: integer
        type: object
      suggestionsAccepted:
        type: integer
      suggestionsPending:
        type: integer
      suggestionsRejected:
        type: integer
    type: object
  oscal.ApplySuggestionRequest:
    properties:
      component-definition-id:
        format: uuid
        type: string
      defined-component-id:
        format: uuid
        type: string
    required:
    - component-definition-id
    - defined-component-id
    type: object
  oscal.BuildByPropsRequest:
    properties:
      catalogId:
        type: string
      matchStrategy:
        description: all | any
        type: string
      rules:
        items:
          $ref: '#/definitions/oscal.rule'
        type: array
      title:
        type: string
      version:
        type: string
    type: object
  oscal.BuildByPropsResponse:
    properties:
      controlIds:
        items:
          type: string
        type: array
      profile:
        $ref: '#/definitions/oscalTypes_1_1_3.Profile'
      profileId:
        type: string
    type: object
  oscal.ControlExportOffer:
    properties:
      componentTitle:
        type: string
      componentUuid:
        type: string
      controlId:
        type: string
      itemId:
        type: string
      offeringId:
        type: string
      offeringStatus:
        $ref: '#/definitions/relational.SSPExportOfferingStatus'
      offeringTitle:
        type: string
      offeringVersion:
        type: integer
      provided:
        $ref: '#/definitions/oscal.controlExportProvided'
      responsibilities:
        items:
          $ref: '#/definitions/oscal.controlExportResponsibility'
        type: array
      statementId:
        type: string
      upstreamSspId:
        type: string
      upstreamSspTitle:
        type: string
    type: object
  oscal.CreateInventoryItemRequest:
    properties:
      destination:
        description: '"ssp", "poam", or "unattached"'
        type: string
      destination_id:
        type: string
      inventory_item:
        $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
    type: object
  oscal.ImportFileResult:
    properties:
      filename:
        type: string
      message:
        type: string
      success:
        type: boolean
      title:
        type: string
      type:
        type: string
    type: object
  oscal.ImportResponse:
    properties:
      failed_count:
        type: integer
      results:
        items:
          $ref: '#/definitions/oscal.ImportFileResult'
        type: array
      successful_count:
        type: integer
      total_files:
        type: integer
    type: object
  oscal.InventoryItemWithSource:
    properties:
      description:
        type: string
      implemented-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedComponent'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      source:
        type: string
      source_id:
        type: string
      source_type:
        type: string
      uuid:
        type: string
    type: object
  oscal.ProfileComplianceControl:
    properties:
      catalogId:
        type: string
      computedStatus:
        type: string
      controlId:
        type: string
      groupId:
        type: string
      groupTitle:
        type: string
      implemented:
        type: boolean
      leverage:
        allOf:
        - $ref: '#/definitions/oscal.ProfileComplianceControlLeverage'
        description: |-
          Leverage carries the badge/tooltip payload for an inherited (or leverage-linked but
          uncredited) control. Present only when sspId is supplied and the control has at
          least one leverage link; omitted otherwise.
      statusCounts:
        items:
          $ref: '#/definitions/oscal.ProfileComplianceStatusCount'
        type: array
      title:
        type: string
    type: object
  oscal.ProfileComplianceControlLeverage:
    properties:
      inherited:
        type: boolean
      inheritedFrom:
        items:
          $ref: '#/definitions/oscal.ProfileComplianceLeverageOrigin'
        type: array
      links:
        type: integer
      outstandingCount:
        type: integer
      satisfaction:
        $ref: '#/definitions/relational.SSPLeverageSatisfaction'
      status:
        $ref: '#/definitions/relational.SSPLeverageStatus'
      totalResponsibilities:
        type: integer
    type: object
  oscal.ProfileComplianceGroup:
    properties:
      compliancePercent:
        type: integer
      id:
        type: string
      inherited:
        description: |-
          Inherited counts inherited-credited controls in this group; it counts as compliant
          in CompliancePercent (same rule as the summary).
        type: integer
      notSatisfied:
        type: integer
      satisfied:
        type: integer
      title:
        type: string
      totalControls:
        type: integer
      unknown:
        type: integer
    type: object
  oscal.ProfileComplianceImplementation:
    properties:
      implementationPercent:
        type: integer
      implementedControls:
        type: integer
      unimplementedControls:
        type: integer
    type: object
  oscal.ProfileComplianceLeverageOrigin:
    properties:
      offeringId:
        type: string
      offeringTitle:
        type: string
      offeringVersion:
        type: integer
      upstreamSspId:
        type: string
      upstreamSspTitle:
        type: string
    type: object
  oscal.ProfileComplianceProgress:
    properties:
      controls:
        items:
          $ref: '#/definitions/oscal.ProfileComplianceControl'
        type: array
      groups:
        items:
          $ref: '#/definitions/oscal.ProfileComplianceGroup'
        type: array
      implementation:
        $ref: '#/definitions/oscal.ProfileComplianceImplementation'
      scope:
        $ref: '#/definitions/oscal.ProfileComplianceScope'
      summary:
        $ref: '#/definitions/oscal.ProfileComplianceSummary'
    type: object
  oscal.ProfileComplianceScope:
    properties:
      id:
        type: string
      title:
        type: string
      type:
        type: string
    type: object
  oscal.ProfileComplianceStatusCount:
    properties:
      count:
        type: integer
      status:
        type: string
    type: object
  oscal.ProfileComplianceSummary:
    properties:
      assessedPercent:
        type: integer
      compliancePercent:
        type: integer
      implementedControls:
        type: integer
      inherited:
        description: |-
          Inherited counts controls credited to an upstream leverage link (all links active,
          all live-derived full, no decisive downstream evidence). It counts as compliant in
          CompliancePercent and as assessed in AssessedPercent; it is populated only when
          sspId is supplied, and is emitted as 0 (never omitted) otherwise.
        type: integer
      notSatisfied:
        type: integer
      satisfied:
        type: integer
      totalControls:
        type: integer
      unknown:
        type: integer
    type: object
  oscal.ProfileHandler:
    type: object
  oscal.SharedResponsibilityInherits:
    properties:
      byComponentUuid:
        type: string
      controlId:
        type: string
      description:
        type: string
      inheritedUuid:
        type: string
      leverageLinkId:
        type: string
      offeringId:
        type: string
      offeringVersion:
        type: integer
      providedUuid:
        type: string
      satisfaction:
        $ref: '#/definitions/relational.SSPLeverageSatisfaction'
      statementId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPLeverageStatus'
      upstreamSspId:
        type: string
      upstreamSspTitle:
        type: string
    type: object
  oscal.SharedResponsibilityLegacy:
    properties:
      byComponentUuid:
        type: string
      controlId:
        type: string
      reason:
        description: |-
          Reason is "requirement-anchored export", or "requirement-anchored inherited/satisfied" when
          the by-component carries consumer-side rows but no export of its own.
        type: string
    type: object
  oscal.SharedResponsibilityProvides:
    properties:
      byComponentUuid:
        type: string
      componentTitle:
        type: string
      componentUuid:
        type: string
      controlId:
        type: string
      exportUuid:
        type: string
      offered:
        description: |-
          Offered reports whether an item on one of this SSP's *published* offerings already points
          at one of these provided-uuids — i.e. whether a downstream can actually find and subscribe
          to the capability, as opposed to it merely existing in the control-implementation tree.
          An item on a draft/deprecated/revoked offering does not count: nothing can reach it.
        type: boolean
      provided:
        items:
          $ref: '#/definitions/oscal.controlExportProvided'
        type: array
      responsibilities:
        items:
          $ref: '#/definitions/oscal.controlExportResponsibility'
        type: array
      statementId:
        type: string
    type: object
  oscal.SharedResponsibilityRollup:
    properties:
      inherits:
        items:
          $ref: '#/definitions/oscal.SharedResponsibilityInherits'
        type: array
      legacy:
        items:
          $ref: '#/definitions/oscal.SharedResponsibilityLegacy'
        type: array
      provides:
        items:
          $ref: '#/definitions/oscal.SharedResponsibilityProvides'
        type: array
      satisfies:
        items:
          $ref: '#/definitions/oscal.SharedResponsibilitySatisfies'
        type: array
    type: object
  oscal.SharedResponsibilitySatisfies:
    properties:
      byComponentUuid:
        type: string
      controlId:
        type: string
      description:
        type: string
      responsibilityUuid:
        type: string
      responsibleRoles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      satisfiedUuid:
        type: string
      statementId:
        type: string
    type: object
  oscal.SystemComponentRequest:
    properties:
      definedComponentId:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      protocols:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemComponentStatus'
      title:
        type: string
      type:
        type: string
      uuid:
        type: string
    type: object
  oscal.acceptDashboardSuggestionsResponse:
    properties:
      acceptedFilterIds:
        items:
          type: string
        type: array
      suggestions:
        items:
          $ref: '#/definitions/oscal.dashboardSuggestionResponse'
        type: array
    type: object
  oscal.addProfileRequest:
    properties:
      profileId:
        type: string
    type: object
  oscal.allowedDownstreamRequest:
    properties:
      downstreamSspId:
        type: string
    type: object
  oscal.catalogOffering:
    properties:
      contentHash:
        type: string
      createdAt:
        type: string
      createdById:
        type: string
      description:
        type: string
      id:
        type: string
      items:
        items:
          $ref: '#/definitions/oscal.catalogOfferingItem'
        type: array
      publishedAt:
        type: string
      sspId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPExportOfferingStatus'
      title:
        type: string
      updatedAt:
        type: string
      version:
        type: integer
    type: object
  oscal.catalogOfferingItem:
    properties:
      componentUuid:
        type: string
      controlId:
        type: string
      id:
        type: string
      offeringId:
        type: string
      providedUuid:
        type: string
      responsibilities:
        items:
          $ref: '#/definitions/oscal.upstreamResponsibility'
        type: array
      statementId:
        type: string
    type: object
  oscal.controlExportProvided:
    properties:
      description:
        type: string
      uuid:
        type: string
    type: object
  oscal.controlExportResponsibility:
    properties:
      description:
        type: string
      providedUuid:
        type: string
      uuid:
        type: string
    type: object
  oscal.controlSuggestionResultResponse:
    properties:
      controlCatalogId:
        type: string
      controlId:
        type: string
      evaluatedAt:
        type: string
      outcome:
        type: string
      runId:
        type: string
      suggestionCount:
        type: integer
    type: object
  oscal.createExportOfferingItemRequest:
    properties:
      componentUuid:
        type: string
      controlId:
        type: string
      providedUuid:
        type: string
      statementId:
        description: |-
          StatementID is required on every write. The statement is the canonical anchor for
          shared responsibility: a control is too coarse to attribute a provided capability
          against, and a requirement-anchored item leaves the downstream unable to say which
          clause the upstream discharges. Still a *string (not string) because the DB column
          stays nullable for legacy rows that pre-date this constraint — see
          migrateBackfillOfferingItemStatementIDs.
        type: string
    type: object
  oscal.createExportOfferingRequest:
    properties:
      description:
        type: string
      title:
        type: string
    type: object
  oscal.dashboardSuggestionConfigResponse:
    properties:
      enabled:
        type: boolean
    type: object
  oscal.dashboardSuggestionConstraintsRequest:
    properties:
      excluded-labels:
        items:
          $ref: '#/definitions/oscal.labelSelectorRequest'
        type: array
      mandatory-labels:
        items:
          $ref: '#/definitions/oscal.labelSelectorRequest'
        type: array
      only-action:
        description: OnlyAction restricts suggestions to "new_filter" or "extend_filter".
        type: string
      only-controls-without-filters:
        description: |-
          OnlyControlsWithoutFilters scopes generation to controls that currently
          have no dashboard filter attached. Resolved into the control scope, so it
          is not persisted as an output constraint.
        type: boolean
    type: object
  oscal.dashboardSuggestionDecisionRequest:
    properties:
      ids:
        items:
          type: string
        type: array
      reason:
        type: string
    required:
    - ids
    type: object
  oscal.dashboardSuggestionEventResponse:
    properties:
      actor:
        $ref: '#/definitions/oscal.suggestionEventActor'
      actorUserId:
        type: string
      details:
        type: string
      eventType:
        type: string
      id:
        type: string
      occurredAt:
        type: string
      payload:
        $ref: '#/definitions/datatypes.JSONMap'
      runId:
        type: string
      snapshot:
        $ref: '#/definitions/datatypes.JSONMap'
      suggestionId:
        type: string
    type: object
  oscal.dashboardSuggestionPreviewResponse:
    properties:
      controlCount:
        type: integer
      exceedsLimit:
        type: boolean
      labelSetCount:
        type: integer
      maxCallsPerRun:
        type: integer
      plannedCalls:
        type: integer
    type: object
  oscal.dashboardSuggestionResponse:
    properties:
      acceptedFilterId:
        type: string
      addedByUser:
        description: AddedByUser marks rows created during a group edit (no AI baseline).
        type: boolean
      confidence:
        type: number
      controlCatalogId:
        type: string
      controlId:
        type: string
      controlTitle:
        type: string
      decidedAt:
        type: string
      decidedByUserId:
        type: string
      editedAt:
        type: string
      editedByUserId:
        type: string
      id:
        type: string
      isGeneralization:
        description: |-
          IsGeneralization marks rows produced by the deterministic filter-merge
          detector (Part 2). Such a row proposes the generalized label set G that
          merges several near-duplicate SSP filters that differ by one generalizable
          label. Accepting it moves controls onto G and off the source filters.
        type: boolean
      isUserEdited:
        type: boolean
      labelSet:
        $ref: '#/definitions/datatypes.JSONMap'
      labelSetHash:
        type: string
      originalProposedFilterLabelSet:
        allOf:
        - $ref: '#/definitions/datatypes.JSONMap'
        description: |-
          AI baseline captured at first user edit (set-once) so the UI can render a
          diff of what the user changed. Nil on AI-generated, never-edited rows and
          on rows the user added during an edit (AddedByUser).
      originalProposedFilterName:
        type: string
      proposedFilterLabelSet:
        $ref: '#/definitions/datatypes.JSONMap'
      proposedFilterName:
        type: string
      reasoning:
        type: string
      rejectReason:
        type: string
      removedControlIds:
        description: |-
          RemovedControlIds mirrors, onto every surviving group row, the control IDs
          removed from the group during edits, so the card can show them struck-out.
        items:
          type: string
        type: array
      runId:
        type: string
      sourceFilterIds:
        description: |-
          SourceFilterIDs are the SSP filters this generalization merges, recorded so
          the UI can explain the merge and the accept path can detach controls from
          them. Nil on ordinary (non-generalization) rows.
        items:
          type: string
        type: array
      sspId:
        type: string
      status:
        type: string
      targetFilterId:
        type: string
      targetFilterName:
        type: string
    type: object
  oscal.dashboardSuggestionRunResponse:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheReadInputTokens:
        type: integer
      cells:
        items:
          $ref: '#/definitions/suggestions.DashboardSuggestionRunCell'
        type: array
      completedAt:
        type: string
      completedCells:
        type: integer
      constraints:
        $ref: '#/definitions/datatypes.JSONMap'
      error:
        type: string
      failedCells:
        type: integer
      id:
        type: string
      inputTokens:
        type: integer
      labelFilter:
        allOf:
        - $ref: '#/definitions/datatypes.JSONMap'
        description: |-
          LabelFilter is the evidence-scoping label filter applied to this run, so the
          worker can restrict its per-cell evidence scan and the UI can show it.
      model:
        type: string
      outputTokens:
        type: integer
      plannedCalls:
        type: integer
      promptVersion:
        type: string
      rateLimitedCount:
        type: integer
      scope:
        $ref: '#/definitions/datatypes.JSONMap'
      sspId:
        type: string
      startedAt:
        type: string
      stats:
        $ref: '#/definitions/datatypes.JSONMap'
      status:
        type: string
      suggestionCount:
        type: integer
      suggestions:
        items:
          $ref: '#/definitions/suggestions.DashboardSuggestion'
        type: array
      triggeredByUserId:
        type: string
    type: object
  oscal.dashboardSuggestionScopeRequest:
    properties:
      control-keys:
        items:
          type: string
        type: array
      label-filter:
        allOf:
        - $ref: '#/definitions/labelfilter.Filter'
        description: |-
          LabelFilter scopes which evidence (and therefore which label sets) feed the
          run, using the same label-filter expression as evidence search.
      label-set-hashes:
        items:
          type: string
        type: array
    type: object
  oscal.editDashboardSuggestionGroupRequest:
    properties:
      add-control-keys:
        items:
          type: string
        type: array
      ids:
        items:
          type: string
        type: array
      proposed-filter-label-set:
        additionalProperties:
          type: string
        type: object
      proposed-filter-name:
        type: string
      remove-ids:
        items:
          type: string
        type: array
    required:
    - ids
    type: object
  oscal.generalizeDashboardSuggestionsResponse:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheReadInputTokens:
        type: integer
      candidates:
        type: integer
      cells:
        items:
          $ref: '#/definitions/suggestions.DashboardSuggestionRunCell'
        type: array
      completedAt:
        type: string
      constraints:
        $ref: '#/definitions/datatypes.JSONMap'
      error:
        type: string
      id:
        type: string
      inputTokens:
        type: integer
      inserted:
        type: integer
      labelFilter:
        allOf:
        - $ref: '#/definitions/datatypes.JSONMap'
        description: |-
          LabelFilter is the evidence-scoping label filter applied to this run, so the
          worker can restrict its per-cell evidence scan and the UI can show it.
      model:
        type: string
      outputTokens:
        type: integer
      plannedCalls:
        type: integer
      promptVersion:
        type: string
      rateLimitedCount:
        type: integer
      scope:
        $ref: '#/definitions/datatypes.JSONMap'
      sspId:
        type: string
      startedAt:
        type: string
      stats:
        $ref: '#/definitions/datatypes.JSONMap'
      status:
        type: string
      suggestionCount:
        type: integer
      suggestions:
        items:
          $ref: '#/definitions/suggestions.DashboardSuggestion'
        type: array
      triggeredByUserId:
        type: string
    type: object
  oscal.generateDashboardSuggestionsRequest:
    properties:
      constraints:
        $ref: '#/definitions/oscal.dashboardSuggestionConstraintsRequest'
      scope:
        $ref: '#/definitions/oscal.dashboardSuggestionScopeRequest'
      supersede-pending:
        type: boolean
    type: object
  oscal.labelSelectorRequest:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  oscal.leveragedControlInheritedFrom:
    properties:
      offeringId:
        type: string
      offeringTitle:
        type: string
      offeringVersion:
        type: integer
      upstreamSspId:
        type: string
    type: object
  oscal.leveragedControlResponse:
    properties:
      byComponentId:
        description: |-
          ByComponentId is the downstream by-component the link's inherited entry hangs off —
          the anchor for authoring satisfied entries against this link's responsibilities.
          Nil only if the inherited row was deleted out from under the link.
        type: string
      controlId:
        type: string
      driftRiskId:
        description: |-
          DriftRiskID is the open drift risk for this link (BCH-1341's applyDriftToLink /
          computeDedupeKeyForLeverageDrift convention), set only when Status is Drifted and a
          matching risk is still open — nil otherwise (including for Revoked, which has no
          re-attest path and thus no risk to link).
        type: string
      id:
        type: string
      inheritedFrom:
        $ref: '#/definitions/oscal.leveragedControlInheritedFrom'
      outstandingResponsibilities:
        items:
          $ref: '#/definitions/oscal.upstreamResponsibility'
        type: array
      providedUuid:
        description: |-
          ProvidedUuid is the upstream provided capability this link consumes — the key the
          downstream's inherited entries reference.
        type: string
      responsibilities:
        description: |-
          Responsibilities is the FULL upstream responsibility set under this link (uuid +
          description). Downstream surfaces label every responsibility from this — including ones
          already satisfied — so the responsibility's own text is never replaced by a satisfied
          entry's "how we handle this" wording. OutstandingResponsibilities is the not-yet-covered
          subset (unchanged).
        items:
          $ref: '#/definitions/oscal.upstreamResponsibility'
        type: array
      responsibilityPosture:
        additionalProperties:
          type: string
        description: |-
          ResponsibilityPosture is the live, evidence-backed posture (satisfied /
          not-satisfied / unknown) per upstream responsibility uuid under this link's
          provided-uuid — computed via filter_responsibilities (BCH-1339), independent of
          Satisfaction/OutstandingResponsibilities above (which reflect what was attested at
          subscribe time, not current evidence).
        type: object
      satisfaction:
        $ref: '#/definitions/relational.SSPLeverageSatisfaction'
      statementId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPLeverageStatus'
    type: object
  oscal.profileSummary:
    properties:
      id:
        type: string
      title:
        type: string
    type: object
  oscal.resolvedWithCatalogsResponse:
    properties:
      catalog-id:
        type: string
      class:
        type: string
      control-id:
        type: string
      title:
        type: string
    type: object
  oscal.responsibilityFilterResponse:
    properties:
      controlId:
        type: string
      controlLinkCreated:
        description: |-
          ControlLinkCreated reports whether the attachment created (or co-owns) the
          filter→control link — detaching such an attachment may also unlink the control.
        type: boolean
      filterId:
        type: string
      filterName:
        type: string
      responsibilityUuid:
        type: string
    type: object
  oscal.rule:
    properties:
      name:
        type: string
      ns:
        type: string
      operator:
        description: equals | contains | regex | in
        type: string
      value:
        type: string
    type: object
  oscal.subscribeItemRequest:
    properties:
      itemId:
        type: string
      satisfiedResponsibilityUuids:
        items:
          type: string
        type: array
    type: object
  oscal.subscribeRequest:
    properties:
      downstreamSspId:
        type: string
      items:
        items:
          $ref: '#/definitions/oscal.subscribeItemRequest'
        type: array
    type: object
  oscal.suggestionEventActor:
    properties:
      id:
        type: string
      name:
        type: string
    type: object
  oscal.updateOfferingStatusRequest:
    properties:
      status:
        enum:
        - deprecated
        - revoked
        type: string
    required:
    - status
    type: object
  oscal.upstreamResponsibility:
    properties:
      description:
        type: string
      responsibilityUuid:
        type: string
    type: object
  oscalTypes_1_1_3.Action:
    properties:
      date:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      system:
        type: string
      type:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Activity:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-controls:
        $ref: '#/definitions/oscalTypes_1_1_3.ReviewedControls'
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      steps:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Step'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Addition:
    properties:
      by-id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Parameter'
        type: array
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      position:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      title:
        type: string
    type: object
  oscalTypes_1_1_3.Address:
    properties:
      addr-lines:
        items:
          type: string
        type: array
      city:
        type: string
      country:
        type: string
      postal-code:
        type: string
      state:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.Alteration:
    properties:
      adds:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Addition'
        type: array
      control-id:
        type: string
      removes:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Removal'
        type: array
    type: object
  oscalTypes_1_1_3.AssessedControls:
    properties:
      description:
        type: string
      exclude-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessedControlsSelectControlById'
        type: array
      include-all:
        $ref: '#/definitions/oscalTypes_1_1_3.IncludeAll'
      include-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessedControlsSelectControlById'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.AssessedControlsSelectControlById:
    properties:
      control-id:
        type: string
      statement-ids:
        items:
          type: string
        type: array
    type: object
  oscalTypes_1_1_3.AssessmentAssets:
    properties:
      assessment-platforms:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlatform'
        type: array
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
    type: object
  oscalTypes_1_1_3.AssessmentLog:
    properties:
      entries:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentLogEntry'
        type: array
    type: object
  oscalTypes_1_1_3.AssessmentLogEntry:
    properties:
      description:
        type: string
      end:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      logged-by:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.LoggedBy'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedTask'
        type: array
      remarks:
        type: string
      start:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AssessmentPart:
    properties:
      class:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      name:
        type: string
      ns:
        type: string
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPart'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      prose:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AssessmentPlan:
    properties:
      assessment-assets:
        $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
      assessment-subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      import-ssp:
        $ref: '#/definitions/oscalTypes_1_1_3.ImportSsp'
      local-definitions:
        $ref: '#/definitions/oscalTypes_1_1_3.LocalDefinitions'
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      reviewed-controls:
        $ref: '#/definitions/oscalTypes_1_1_3.ReviewedControls'
      tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
        type: array
      terms-and-conditions:
        $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlanTermsAndConditions'
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AssessmentPlanTermsAndConditions:
    properties:
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPart'
        type: array
    type: object
  oscalTypes_1_1_3.AssessmentPlatform:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      title:
        type: string
      uses-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.UsesComponent'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AssessmentResults:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      import-ap:
        $ref: '#/definitions/oscalTypes_1_1_3.ImportAp'
      local-definitions:
        $ref: '#/definitions/oscalTypes_1_1_3.LocalDefinitions'
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      results:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Result'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AssessmentSubject:
    properties:
      description:
        type: string
      exclude-subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectSubjectById'
        type: array
      include-all:
        $ref: '#/definitions/oscalTypes_1_1_3.IncludeAll'
      include-subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectSubjectById'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.AssociatedActivity:
    properties:
      activity-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
    type: object
  oscalTypes_1_1_3.AssociatedRisk:
    properties:
      risk-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.AttestationStatements:
    properties:
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPart'
        type: array
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
    type: object
  oscalTypes_1_1_3.AuthorizationBoundary:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.AuthorizedPrivilege:
    properties:
      description:
        type: string
      functions-performed:
        items:
          type: string
        type: array
      title:
        type: string
    type: object
  oscalTypes_1_1_3.BackMatter:
    properties:
      resources:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
        type: array
    type: object
  oscalTypes_1_1_3.Base64:
    properties:
      filename:
        type: string
      media-type:
        type: string
      value:
        type: string
    type: object
  oscalTypes_1_1_3.ByComponent:
    properties:
      component-uuid:
        type: string
      description:
        type: string
      export:
        $ref: '#/definitions/oscalTypes_1_1_3.Export'
      implementation-status:
        $ref: '#/definitions/oscalTypes_1_1_3.ImplementationStatus'
      inherited:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InheritedControlImplementation'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      satisfied:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SetParameter'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Capability:
    properties:
      control-implementations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
        type: array
      description:
        type: string
      incorporates-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.IncorporatesComponent'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Catalog:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
        type: array
      groups:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
        type: array
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      params:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Parameter'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Characterization:
    properties:
      facets:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Facet'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origin:
        $ref: '#/definitions/oscalTypes_1_1_3.Origin'
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
    type: object
  oscalTypes_1_1_3.Citation:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      text:
        type: string
    type: object
  oscalTypes_1_1_3.CombinationRule:
    properties:
      method:
        type: string
    type: object
  oscalTypes_1_1_3.ComponentDefinition:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      capabilities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Capability'
        type: array
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
        type: array
      import-component-definitions:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportComponentDefinition'
        type: array
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ConstraintTest:
    properties:
      expression:
        type: string
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.Control:
    properties:
      class:
        type: string
      controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Parameter'
        type: array
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      title:
        type: string
    type: object
  oscalTypes_1_1_3.ControlImplementation:
    properties:
      description:
        type: string
      implemented-requirements:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirement'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SetParameter'
        type: array
    type: object
  oscalTypes_1_1_3.ControlImplementationResponsibility:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      provided-uuid:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ControlImplementationSet:
    properties:
      description:
        type: string
      implemented-requirements:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirementControlImplementation'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SetParameter'
        type: array
      source:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ControlStatementImplementation:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      statement-id:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.CustomGrouping:
    properties:
      groups:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.CustomGroupingGroup'
        type: array
      insert-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InsertControls'
        type: array
    type: object
  oscalTypes_1_1_3.CustomGroupingGroup:
    properties:
      class:
        type: string
      groups:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.CustomGroupingGroup'
        type: array
      id:
        type: string
      insert-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InsertControls'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Parameter'
        type: array
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      title:
        type: string
    type: object
  oscalTypes_1_1_3.DataFlow:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.DefinedComponent:
    properties:
      control-implementations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
        type: array
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      protocols:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      title:
        type: string
      type:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Diagram:
    properties:
      caption:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.DocumentId:
    properties:
      identifier:
        type: string
      scheme:
        type: string
    type: object
  oscalTypes_1_1_3.EventTiming:
    properties:
      at-frequency:
        $ref: '#/definitions/oscalTypes_1_1_3.FrequencyCondition'
      on-date:
        $ref: '#/definitions/oscalTypes_1_1_3.OnDateCondition'
      within-date-range:
        $ref: '#/definitions/oscalTypes_1_1_3.OnDateRangeCondition'
    type: object
  oscalTypes_1_1_3.Export:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      provided:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
        type: array
      remarks:
        type: string
      responsibilities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
        type: array
    type: object
  oscalTypes_1_1_3.Facet:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      system:
        type: string
      value:
        type: string
    type: object
  oscalTypes_1_1_3.Finding:
    properties:
      description:
        type: string
      implementation-statement-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-observations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedObservation'
        type: array
      related-risks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssociatedRisk'
        type: array
      remarks:
        type: string
      target:
        $ref: '#/definitions/oscalTypes_1_1_3.FindingTarget'
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.FindingTarget:
    properties:
      description:
        type: string
      implementation-status:
        $ref: '#/definitions/oscalTypes_1_1_3.ImplementationStatus'
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.ObjectiveStatus'
      target-id:
        type: string
      title:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.FlatWithoutGrouping:
    additionalProperties: true
    type: object
  oscalTypes_1_1_3.FrequencyCondition:
    properties:
      period:
        type: integer
      unit:
        type: string
    type: object
  oscalTypes_1_1_3.Group:
    properties:
      class:
        type: string
      controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
        type: array
      groups:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Parameter'
        type: array
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      title:
        type: string
    type: object
  oscalTypes_1_1_3.Hash:
    properties:
      algorithm:
        type: string
      value:
        type: string
    type: object
  oscalTypes_1_1_3.IdentifiedSubject:
    properties:
      subject-placeholder-uuid:
        type: string
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
    type: object
  oscalTypes_1_1_3.Impact:
    properties:
      adjustment-justification:
        type: string
      base:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      selected:
        type: string
    type: object
  oscalTypes_1_1_3.ImplementationStatus:
    properties:
      remarks:
        type: string
      state:
        type: string
    type: object
  oscalTypes_1_1_3.ImplementedComponent:
    properties:
      component-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
    type: object
  oscalTypes_1_1_3.ImplementedRequirement:
    properties:
      by-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
        type: array
      control-id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SetParameter'
        type: array
      statements:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Statement'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ImplementedRequirementControlImplementation:
    properties:
      control-id:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SetParameter'
        type: array
      statements:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlStatementImplementation'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Import:
    properties:
      exclude-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectControlById'
        type: array
      href:
        type: string
      include-all:
        $ref: '#/definitions/oscalTypes_1_1_3.IncludeAll'
      include-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectControlById'
        type: array
    type: object
  oscalTypes_1_1_3.ImportAp:
    properties:
      href:
        type: string
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.ImportComponentDefinition:
    properties:
      href:
        type: string
    type: object
  oscalTypes_1_1_3.ImportProfile:
    properties:
      href:
        type: string
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.ImportSsp:
    properties:
      href:
        type: string
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.IncludeAll:
    additionalProperties: true
    type: object
  oscalTypes_1_1_3.IncorporatesComponent:
    properties:
      component-uuid:
        type: string
      description:
        type: string
    type: object
  oscalTypes_1_1_3.InformationType:
    properties:
      availability-impact:
        $ref: '#/definitions/oscalTypes_1_1_3.Impact'
      categorizations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InformationTypeCategorization'
        type: array
      confidentiality-impact:
        $ref: '#/definitions/oscalTypes_1_1_3.Impact'
      description:
        type: string
      integrity-impact:
        $ref: '#/definitions/oscalTypes_1_1_3.Impact'
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.InformationTypeCategorization:
    properties:
      information-type-ids:
        items:
          type: string
        type: array
      system:
        type: string
    type: object
  oscalTypes_1_1_3.InheritedControlImplementation:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      provided-uuid:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.InsertControls:
    properties:
      exclude-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectControlById'
        type: array
      include-all:
        $ref: '#/definitions/oscalTypes_1_1_3.IncludeAll'
      include-controls:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectControlById'
        type: array
      order:
        type: string
    type: object
  oscalTypes_1_1_3.InventoryItem:
    properties:
      description:
        type: string
      implemented-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedComponent'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.LeveragedAuthorization:
    properties:
      date-authorized:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      party-uuid:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Link:
    properties:
      href:
        type: string
      media-type:
        type: string
      rel:
        type: string
      resource-fragment:
        type: string
      text:
        type: string
    type: object
  oscalTypes_1_1_3.LocalDefinitions:
    properties:
      activities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Activity'
        type: array
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      inventory-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      objectives-and-methods:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.LocalObjective'
        type: array
      remarks:
        type: string
      users:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
        type: array
    type: object
  oscalTypes_1_1_3.LocalObjective:
    properties:
      control-id:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.Location:
    properties:
      address:
        $ref: '#/definitions/oscalTypes_1_1_3.Address'
      email-addresses:
        items:
          type: string
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      telephone-numbers:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.TelephoneNumber'
        type: array
      title:
        type: string
      urls:
        items:
          type: string
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.LoggedBy:
    properties:
      party-uuid:
        type: string
      role-id:
        type: string
    type: object
  oscalTypes_1_1_3.Matching:
    properties:
      pattern:
        type: string
    type: object
  oscalTypes_1_1_3.Merge:
    properties:
      as-is:
        type: boolean
      combine:
        $ref: '#/definitions/oscalTypes_1_1_3.CombinationRule'
      custom:
        $ref: '#/definitions/oscalTypes_1_1_3.CustomGrouping'
      flat:
        $ref: '#/definitions/oscalTypes_1_1_3.FlatWithoutGrouping'
    type: object
  oscalTypes_1_1_3.Metadata:
    properties:
      actions:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Action'
        type: array
      document-ids:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.DocumentId'
        type: array
      last-modified:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      locations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Location'
        type: array
      oscal-version:
        type: string
      parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Party'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      published:
        type: string
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      revisions:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RevisionHistoryEntry'
        type: array
      roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Role'
        type: array
      title:
        type: string
      version:
        type: string
    type: object
  oscalTypes_1_1_3.MitigatingFactor:
    properties:
      description:
        type: string
      implementation-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SubjectReference'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Modify:
    properties:
      alters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Alteration'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ParameterSetting'
        type: array
    type: object
  oscalTypes_1_1_3.NetworkArchitecture:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.ObjectiveStatus:
    properties:
      reason:
        type: string
      remarks:
        type: string
      state:
        type: string
    type: object
  oscalTypes_1_1_3.Observation:
    properties:
      collected:
        type: string
      description:
        type: string
      expires:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      methods:
        items:
          type: string
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      relevant-evidence:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelevantEvidence'
        type: array
      remarks:
        type: string
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SubjectReference'
        type: array
      title:
        type: string
      types:
        items:
          type: string
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.OnDateCondition:
    properties:
      date:
        type: string
    type: object
  oscalTypes_1_1_3.OnDateRangeCondition:
    properties:
      end:
        type: string
      start:
        type: string
    type: object
  oscalTypes_1_1_3.Origin:
    properties:
      actors:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.OriginActor'
        type: array
      related-tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedTask'
        type: array
    type: object
  oscalTypes_1_1_3.OriginActor:
    properties:
      actor-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      role-id:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.Parameter:
    properties:
      class:
        type: string
      constraints:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ParameterConstraint'
        type: array
      depends-on:
        type: string
      guidelines:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ParameterGuideline'
        type: array
      id:
        type: string
      label:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      select:
        $ref: '#/definitions/oscalTypes_1_1_3.ParameterSelection'
      usage:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  oscalTypes_1_1_3.ParameterConstraint:
    properties:
      description:
        type: string
      tests:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ConstraintTest'
        type: array
    type: object
  oscalTypes_1_1_3.ParameterGuideline:
    properties:
      prose:
        type: string
    type: object
  oscalTypes_1_1_3.ParameterSelection:
    properties:
      choice:
        items:
          type: string
        type: array
      how-many:
        type: string
    type: object
  oscalTypes_1_1_3.ParameterSetting:
    properties:
      class:
        type: string
      constraints:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ParameterConstraint'
        type: array
      depends-on:
        type: string
      guidelines:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ParameterGuideline'
        type: array
      label:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      param-id:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      select:
        $ref: '#/definitions/oscalTypes_1_1_3.ParameterSelection'
      usage:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  oscalTypes_1_1_3.Part:
    properties:
      class:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      name:
        type: string
      ns:
        type: string
      parts:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      prose:
        type: string
      title:
        type: string
    type: object
  oscalTypes_1_1_3.Party:
    properties:
      addresses:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Address'
        type: array
      email-addresses:
        items:
          type: string
        type: array
      external-ids:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PartyExternalIdentifier'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      location-uuids:
        items:
          type: string
        type: array
      member-of-organizations:
        items:
          type: string
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      short-name:
        type: string
      telephone-numbers:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.TelephoneNumber'
        type: array
      type:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.PartyExternalIdentifier:
    properties:
      id:
        type: string
      scheme:
        type: string
    type: object
  oscalTypes_1_1_3.PlanOfActionAndMilestones:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      findings:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
        type: array
      import-ssp:
        $ref: '#/definitions/oscalTypes_1_1_3.ImportSsp'
      local-definitions:
        $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestonesLocalDefinitions'
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      observations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
        type: array
      poam-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PoamItem'
        type: array
      risks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
        type: array
      system-id:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemId'
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.PlanOfActionAndMilestonesLocalDefinitions:
    properties:
      assessment-assets:
        $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      inventory-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.PoamItem:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PoamItemOrigin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-findings:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedFinding'
        type: array
      related-observations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedObservation'
        type: array
      related-risks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssociatedRisk'
        type: array
      remarks:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.PoamItemOrigin:
    properties:
      actors:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.OriginActor'
        type: array
    type: object
  oscalTypes_1_1_3.PortRange:
    properties:
      end:
        type: integer
      start:
        type: integer
      transport:
        type: string
    type: object
  oscalTypes_1_1_3.Profile:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      imports:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Import'
        type: array
      merge:
        $ref: '#/definitions/oscalTypes_1_1_3.Merge'
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      modify:
        $ref: '#/definitions/oscalTypes_1_1_3.Modify'
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Property:
    properties:
      class:
        type: string
      group:
        type: string
      name:
        type: string
      ns:
        type: string
      remarks:
        type: string
      uuid:
        type: string
      value:
        type: string
    type: object
  oscalTypes_1_1_3.Protocol:
    properties:
      name:
        type: string
      port-ranges:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PortRange'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ProvidedControlImplementation:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ReferencedControlObjectives:
    properties:
      description:
        type: string
      exclude-objectives:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectObjectiveById'
        type: array
      include-all:
        $ref: '#/definitions/oscalTypes_1_1_3.IncludeAll'
      include-objectives:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SelectObjectiveById'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.RelatedFinding:
    properties:
      finding-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.RelatedObservation:
    properties:
      observation-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.RelatedTask:
    properties:
      identified-subject:
        $ref: '#/definitions/oscalTypes_1_1_3.IdentifiedSubject'
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
      task-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.RelevantEvidence:
    properties:
      description:
        type: string
      href:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.Removal:
    properties:
      by-class:
        type: string
      by-id:
        type: string
      by-item-name:
        type: string
      by-name:
        type: string
      by-ns:
        type: string
    type: object
  oscalTypes_1_1_3.RequiredAsset:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SubjectReference'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Resource:
    properties:
      base64:
        $ref: '#/definitions/oscalTypes_1_1_3.Base64'
      citation:
        $ref: '#/definitions/oscalTypes_1_1_3.Citation'
      description:
        type: string
      document-ids:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.DocumentId'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      rlinks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResourceLink'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ResourceLink:
    properties:
      hashes:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Hash'
        type: array
      href:
        type: string
      media-type:
        type: string
    type: object
  oscalTypes_1_1_3.Response:
    properties:
      description:
        type: string
      lifecycle:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      required-assets:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RequiredAsset'
        type: array
      tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ResponsibleParty:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      party-uuids:
        items:
          type: string
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      role-id:
        type: string
    type: object
  oscalTypes_1_1_3.ResponsibleRole:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      party-uuids:
        items:
          type: string
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      role-id:
        type: string
    type: object
  oscalTypes_1_1_3.Result:
    properties:
      assessment-log:
        $ref: '#/definitions/oscalTypes_1_1_3.AssessmentLog'
      attestations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AttestationStatements'
        type: array
      description:
        type: string
      end:
        type: string
      findings:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      local-definitions:
        $ref: '#/definitions/oscalTypes_1_1_3.LocalDefinitions'
      observations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      reviewed-controls:
        $ref: '#/definitions/oscalTypes_1_1_3.ReviewedControls'
      risks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
        type: array
      start:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.ReviewedControls:
    properties:
      control-objective-selections:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ReferencedControlObjectives'
        type: array
      control-selections:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessedControls'
        type: array
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
    type: object
  oscalTypes_1_1_3.RevisionHistoryEntry:
    properties:
      last-modified:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      oscal-version:
        type: string
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      published:
        type: string
      remarks:
        type: string
      title:
        type: string
      version:
        type: string
    type: object
  oscalTypes_1_1_3.Risk:
    properties:
      characterizations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Characterization'
        type: array
      deadline:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      mitigating-factors:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.MitigatingFactor'
        type: array
      origins:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-observations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedObservation'
        type: array
      remediations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Response'
        type: array
      risk-log:
        $ref: '#/definitions/oscalTypes_1_1_3.RiskLog'
      statement:
        type: string
      status:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ThreatId'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.RiskLog:
    properties:
      entries:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RiskLogEntry'
        type: array
    type: object
  oscalTypes_1_1_3.RiskLogEntry:
    properties:
      description:
        type: string
      end:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      logged-by:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.LoggedBy'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-responses:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RiskResponseReference'
        type: array
      remarks:
        type: string
      start:
        type: string
      status-change:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.RiskResponseReference:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      related-tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedTask'
        type: array
      remarks:
        type: string
      response-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Role:
    properties:
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      short-name:
        type: string
      title:
        type: string
    type: object
  oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsibility-uuid:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.SecurityImpactLevel:
    properties:
      security-objective-availability:
        type: string
      security-objective-confidentiality:
        type: string
      security-objective-integrity:
        type: string
    type: object
  oscalTypes_1_1_3.SelectControlById:
    properties:
      matching:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Matching'
        type: array
      with-child-controls:
        type: string
      with-ids:
        items:
          type: string
        type: array
    type: object
  oscalTypes_1_1_3.SelectObjectiveById:
    properties:
      objective-id:
        type: string
    type: object
  oscalTypes_1_1_3.SelectSubjectById:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      subject-uuid:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.SetParameter:
    properties:
      param-id:
        type: string
      remarks:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  oscalTypes_1_1_3.Statement:
    properties:
      by-components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      statement-id:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Status:
    properties:
      remarks:
        type: string
      state:
        type: string
    type: object
  oscalTypes_1_1_3.Step:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      reviewed-controls:
        $ref: '#/definitions/oscalTypes_1_1_3.ReviewedControls'
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.SubjectReference:
    properties:
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      subject-uuid:
        type: string
      title:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.SystemCharacteristics:
    properties:
      authorization-boundary:
        $ref: '#/definitions/oscalTypes_1_1_3.AuthorizationBoundary'
      data-flow:
        $ref: '#/definitions/oscalTypes_1_1_3.DataFlow'
      date-authorized:
        type: string
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      network-architecture:
        $ref: '#/definitions/oscalTypes_1_1_3.NetworkArchitecture'
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
      security-impact-level:
        $ref: '#/definitions/oscalTypes_1_1_3.SecurityImpactLevel'
      security-sensitivity-level:
        type: string
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.Status'
      system-ids:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemId'
        type: array
      system-information:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemInformation'
      system-name:
        type: string
      system-name-short:
        type: string
    type: object
  oscalTypes_1_1_3.SystemComponent:
    properties:
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      protocols:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      status:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemComponentStatus'
      title:
        type: string
      type:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.SystemComponentStatus:
    properties:
      remarks:
        type: string
      state:
        type: string
    type: object
  oscalTypes_1_1_3.SystemId:
    properties:
      id:
        type: string
      identifier-type:
        type: string
    type: object
  oscalTypes_1_1_3.SystemImplementation:
    properties:
      components:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemComponent'
        type: array
      inventory-items:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
        type: array
      leveraged-authorizations:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.LeveragedAuthorization'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      users:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
        type: array
    type: object
  oscalTypes_1_1_3.SystemInformation:
    properties:
      information-types:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.InformationType'
        type: array
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
    type: object
  oscalTypes_1_1_3.SystemSecurityPlan:
    properties:
      back-matter:
        $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      control-implementation:
        $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementation'
      import-profile:
        $ref: '#/definitions/oscalTypes_1_1_3.ImportProfile'
      metadata:
        $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      system-characteristics:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemCharacteristics'
      system-implementation:
        $ref: '#/definitions/oscalTypes_1_1_3.SystemImplementation'
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.SystemUser:
    properties:
      authorized-privileges:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AuthorizedPrivilege'
        type: array
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      role-ids:
        items:
          type: string
        type: array
      short-name:
        type: string
      title:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.Task:
    properties:
      associated-activities:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssociatedActivity'
        type: array
      dependencies:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.TaskDependency'
        type: array
      description:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleRole'
        type: array
      subjects:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
        type: array
      tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
        type: array
      timing:
        $ref: '#/definitions/oscalTypes_1_1_3.EventTiming'
      title:
        type: string
      type:
        type: string
      uuid:
        type: string
    type: object
  oscalTypes_1_1_3.TaskDependency:
    properties:
      remarks:
        type: string
      task-uuid:
        type: string
    type: object
  oscalTypes_1_1_3.TelephoneNumber:
    properties:
      number:
        type: string
      type:
        type: string
    type: object
  oscalTypes_1_1_3.ThreatId:
    properties:
      href:
        type: string
      id:
        type: string
      system:
        type: string
    type: object
  oscalTypes_1_1_3.UsesComponent:
    properties:
      component-uuid:
        type: string
      links:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.Property'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.ResponsibleParty'
        type: array
    type: object
  poam.PoamItemControlLink:
    properties:
      catalogId:
        type: string
      controlId:
        type: string
      createdAt:
        type: string
      poamItemId:
        type: string
    type: object
  poam.PoamItemEvidenceLink:
    properties:
      createdAt:
        type: string
      evidenceId:
        type: string
      poamItemId:
        type: string
    type: object
  poam.PoamItemFindingLink:
    properties:
      createdAt:
        type: string
      findingId:
        type: string
      poamItemId:
        type: string
    type: object
  poam.PoamItemRiskLink:
    properties:
      createdAt:
        type: string
      poamItemId:
        type: string
      riskId:
        type: string
    type: object
  policyeval.ErrorResponse:
    properties:
      errors:
        items:
          $ref: '#/definitions/policyeval.EvalError'
        type: array
    type: object
  policyeval.EvalError:
    properties:
      code:
        type: string
      col:
        type: integer
      file:
        type: string
      message:
        type: string
      row:
        type: integer
    type: object
  policyeval.EvaluateRequest:
    properties:
      data:
        additionalProperties: {}
        description: Data is merged into data.* exactly as the agent merges policy
          data.
        type: object
      evaluatedAt:
        description: EvaluatedAt pins time.now_ns(). Defaults to now.
        type: string
      input:
        description: Input is bound to `input`. Any JSON value.
      modules:
        additionalProperties:
          type: string
        description: Modules holds extra Rego modules the policy imports, keyed by
          file name.
        type: object
      policy:
        description: Policy is the Rego source of the policy under test, stored as
          module policy.rego.
        type: string
    type: object
  policyeval.EvaluateResponse:
    properties:
      durationMs:
        type: integer
      prints:
        items:
          type: string
        type: array
      results:
        items:
          $ref: '#/definitions/policyeval.EvaluateResult'
        type: array
    type: object
  policyeval.EvaluateResult:
    properties:
      additionalVariables:
        additionalProperties: {}
        type: object
      description:
        type: string
      error:
        description: Error explains why the agent would not turn this result into
          evidence.
        type: string
      file:
        type: string
      labels:
        additionalProperties:
          type: string
        type: object
      package:
        type: string
      raw:
        additionalProperties: {}
        type: object
      remarks:
        type: string
      skipReason:
        type: string
      status:
        type: string
      title:
        type: string
      violations:
        items:
          $ref: '#/definitions/policyeval.Violation'
        type: array
    type: object
  policyeval.RuleLocation:
    properties:
      endLine:
        type: integer
      file:
        type: string
      startLine:
        type: integer
    type: object
  policyeval.Violation:
    properties:
      description:
        type: string
      id:
        type: string
      remarks:
        type: string
      title:
        type: string
    type: object
  relational.Action:
    properties:
      date:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      metadata-id:
        description: Actions only exist on a metadata object. We'll link them straight
          there with a BelongsTo relationship
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsibleParties:
        items:
          $ref: '#/definitions/relational.ResponsibleParty'
        type: array
      system:
        description: required
        type: string
      type:
        description: required
        type: string
    type: object
  relational.Activity:
    properties:
      description:
        description: required
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      related-controls:
        $ref: '#/definitions/relational.ReviewedControls'
      relatedControlsID:
        type: string
      remarks:
        description: required
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      steps:
        items:
          $ref: '#/definitions/relational.Step'
        type: array
      title:
        type: string
    type: object
  relational.Addition:
    properties:
      alterationID:
        type: string
      by-id:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/relational.Parameter'
        type: array
      parts:
        items:
          $ref: '#/definitions/relational.Part'
        type: array
      position:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      title:
        type: string
    type: object
  relational.Address:
    properties:
      city:
        type: string
      country:
        type: string
      lines:
        items:
          type: string
        type: array
      postal-code:
        type: string
      state:
        type: string
      type:
        $ref: '#/definitions/relational.AddressType'
    type: object
  relational.AddressType:
    enum:
    - work
    - home
    type: string
    x-enum-varnames:
    - AddressTypeWork
    - AddressTypeHome
  relational.Alteration:
    properties:
      adds:
        items:
          $ref: '#/definitions/relational.Addition'
        type: array
      control-id:
        description: required
        type: string
      id:
        type: string
      modify-id:
        type: string
      removes:
        items:
          $ref: '#/definitions/relational.Removal'
        type: array
    type: object
  relational.AssessedControlsSelectControlById:
    properties:
      control:
        $ref: '#/definitions/relational.Control'
      controlID:
        type: string
      id:
        type: string
      statements:
        items:
          $ref: '#/definitions/relational.Statement'
        type: array
    type: object
  relational.AssessmentSubject:
    properties:
      description:
        type: string
      evidence:
        items:
          $ref: '#/definitions/relational.Evidence'
        type: array
      excludeSubjects:
        items:
          $ref: '#/definitions/relational.SelectSubjectById'
        type: array
      id:
        type: string
      includeAll:
        $ref: '#/definitions/datatypes.JSONType-relational_IncludeAll'
      includeSubjects:
        items:
          $ref: '#/definitions/relational.SelectSubjectById'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      sspId:
        type: string
      type:
        description: |-
          Type represents a component, party, location, user, or inventory item.
          It will likely be updated once we can map it correctly
        type: string
    type: object
  relational.AuthorizationBoundary:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/relational.Diagram'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      systemCharacteristicsId:
        type: string
    type: object
  relational.AuthorizedPrivilege:
    properties:
      description:
        type: string
      functions-performed:
        items:
          type: string
        type: array
      id:
        type: string
      systemUserId:
        type: string
      title:
        type: string
    type: object
  relational.BackMatter:
    properties:
      id:
        type: string
      parentID:
        type: string
      parentType:
        type: string
      resources:
        items:
          $ref: '#/definitions/relational.BackMatterResource'
        type: array
    type: object
  relational.BackMatterResource:
    properties:
      backMatterID:
        type: string
      base64:
        $ref: '#/definitions/datatypes.JSONType-relational_Base64'
      citation:
        $ref: '#/definitions/datatypes.JSONType-relational_Citation'
      description:
        type: string
      document-ids:
        items:
          $ref: '#/definitions/relational.DocumentID'
        type: array
      id:
        description: required
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      rlinks:
        items:
          $ref: '#/definitions/relational.ResourceLink'
        type: array
      title:
        type: string
    type: object
  relational.ByComponent:
    properties:
      component-uuid:
        type: string
      description:
        type: string
      export:
        $ref: '#/definitions/relational.Export'
      id:
        type: string
      implementation-status:
        $ref: '#/definitions/datatypes.JSONType-relational_ImplementationStatus'
      inherited-control-implementations:
        items:
          $ref: '#/definitions/relational.InheritedControlImplementation'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      parentID:
        description: |-
          As ByComponent can be found in Implemented Requirements & Statements, using GORM polymorphism to tell us where to attach.
          (parent_id, parent_type) is the lookup key for every by-component resolution — the
          resolveByComponentFor* walkers, findOrCreateByComponent, and the shared-responsibility
          rollup all filter on it — so it carries a composite index rather than being an
          unindexed scan.
        type: string
      parentType:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      satisfied:
        items:
          $ref: '#/definitions/relational.SatisfiedControlImplementationResponsibility'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/relational.SetParameter'
        type: array
    type: object
  relational.CCFRoleAssignment:
    properties:
      assigneeId:
        description: AssigneeID is the user email or the group name, normalized to
          lower-case.
        type: string
      assigneeType:
        description: AssigneeType is RoleAssigneeTypeUser or RoleAssigneeTypeGroup.
        type: string
      createdAt:
        type: string
      id:
        type: string
      roleName:
        description: |-
          RoleName is a manifest role (admin/viewer/auditor/contributor/agent or an operator role).
          The handler validates it against the authz manifest before insert so a typo is rejected
          rather than silently granting nothing.
        type: string
      source:
        description: |-
          Source is RoleAssignmentSourceConfig (immutable, owned by BCH-1334) or
          RoleAssignmentSourceManual (admin-owned, deletable). Defaults to manual so an API insert
          that omits it is an ad-hoc grant.
        type: string
      updatedAt:
        type: string
    type: object
  relational.Capability:
    properties:
      componentDefinition:
        $ref: '#/definitions/relational.ComponentDefinition'
      componentDefinitionId:
        type: string
      control-implementations:
        items:
          $ref: '#/definitions/relational.ControlImplementationSet'
        type: array
      description:
        description: required
        type: string
      id:
        type: string
      incorporates-components:
        items:
          $ref: '#/definitions/relational.IncorporatesComponents'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      name:
        description: required
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
    type: object
  relational.ComponentDefinition:
    properties:
      back-matter:
        $ref: '#/definitions/relational.BackMatter'
      capabilities:
        items:
          $ref: '#/definitions/relational.Capability'
        type: array
      components:
        items:
          $ref: '#/definitions/relational.DefinedComponent'
        type: array
      id:
        type: string
      import-component-definitions:
        items:
          $ref: '#/definitions/relational.ImportComponentDefinition'
        type: array
      metadata:
        allOf:
        - $ref: '#/definitions/relational.Metadata'
        description: required
    type: object
  relational.Control:
    properties:
      catalogID:
        type: string
      class:
        type: string
      controls:
        items:
          $ref: '#/definitions/relational.Control'
        type: array
      filters:
        items:
          $ref: '#/definitions/relational.Filter'
        type: array
      id:
        description: required
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      params:
        items:
          $ref: '#/definitions/relational.Parameter'
        type: array
      parentID:
        type: string
      parentType:
        type: string
      parts:
        items:
          $ref: '#/definitions/relational.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      title:
        description: required
        type: string
    type: object
  relational.ControlImplementation:
    properties:
      description:
        type: string
      id:
        type: string
      implemented-requirements:
        items:
          $ref: '#/definitions/relational.ImplementedRequirement'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/relational.SetParameter'
        type: array
      systemSecurityPlanId:
        type: string
    type: object
  relational.ControlImplementationResponsibility:
    properties:
      description:
        description: required
        type: string
      exportId:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      provided-uuid:
        description: |-
          ProvidedUuid is explicitly typed uuid (unlike its historical default, aligned by
          migrateAlignProvidedUuidColumnType for pre-existing databases): BCH-1339's
          filter_responsibilities → ssp_leverage_links resolution arm
          (risk_evidence_worker.go) joins this column directly against
          ssp_leverage_links.provided_uuid, which is uuid.
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
    type: object
  relational.ControlImplementationSet:
    properties:
      definedComponent:
        $ref: '#/definitions/relational.DefinedComponent'
      definedComponentID:
        type: string
      description:
        description: required
        type: string
      id:
        type: string
      implemented-requirements:
        description: required
        items:
          $ref: '#/definitions/relational.ImplementedRequirementControlImplementation'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/relational.SetParameter'
        type: array
      source:
        description: required
        type: string
    type: object
  relational.ControlLink:
    properties:
      createdAt:
        type: string
      createdById:
        type: string
      relationshipType:
        type: string
      sourceCatalogId:
        type: string
      sourceControlId:
        type: string
      targetCatalogId:
        type: string
      targetControlId:
        type: string
    type: object
  relational.ControlObjectiveSelection:
    properties:
      description:
        type: string
      excludeObjectives:
        items:
          $ref: '#/definitions/relational.SelectObjectiveById'
        type: array
      id:
        type: string
      includeAll:
        $ref: '#/definitions/datatypes.JSONType-relational_IncludeAll'
      includeObjectives:
        items:
          $ref: '#/definitions/relational.SelectObjectiveById'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      reviewedControlsID:
        type: string
    type: object
  relational.ControlSelection:
    properties:
      description:
        type: string
      excludeControls:
        items:
          $ref: '#/definitions/relational.AssessedControlsSelectControlById'
        type: array
      id:
        type: string
      includeAll:
        $ref: '#/definitions/datatypes.JSONType-relational_IncludeAll'
      includeControls:
        items:
          $ref: '#/definitions/relational.AssessedControlsSelectControlById'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      reviewedControlsID:
        type: string
    type: object
  relational.ControlStatementImplementation:
    properties:
      description:
        description: required
        type: string
      id:
        type: string
      implementedRequirementControlImplementationId:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      statement-id:
        description: required
        type: string
    type: object
  relational.DataFlow:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/relational.Diagram'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      systemCharacteristicsId:
        type: string
    type: object
  relational.DefinedComponent:
    properties:
      componentDefinition:
        $ref: '#/definitions/relational.ComponentDefinition'
      componentDefinitionID:
        type: string
      control-implementations:
        items:
          $ref: '#/definitions/relational.ControlImplementationSet'
        type: array
      description:
        description: required
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      protocols:
        items:
          $ref: '#/definitions/relational.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      title:
        description: required
        type: string
      type:
        description: required
        type: string
    type: object
  relational.Diagram:
    properties:
      caption:
        type: string
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      parentID:
        type: string
      parentType:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
    type: object
  relational.DocumentID:
    properties:
      identifier:
        type: string
      scheme:
        $ref: '#/definitions/relational.DocumentIDScheme'
    type: object
  relational.DocumentIDScheme:
    enum:
    - http://www.doi.org/
    type: string
    x-enum-varnames:
    - DocumentIDSchemeDoi
  relational.Evidence:
    properties:
      activities:
        description: What steps did we take to create this evidence
        items:
          $ref: '#/definitions/relational.Activity'
        type: array
      back-matter:
        $ref: '#/definitions/relational.BackMatter'
      components:
        description: Which components of the subject are being observed. A tool, user,
          policy etc.
        items:
          $ref: '#/definitions/relational.SystemComponent'
        type: array
      description:
        type: string
      end:
        type: string
      expires:
        type: string
      id:
        type: string
      inventory-items:
        items:
          $ref: '#/definitions/relational.InventoryItem'
        type: array
      labels:
        description: Assigning labels to Evidence makes it searchable and easily usable
          in the UI
        items:
          $ref: '#/definitions/relational.Labels'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      origins:
        description: Who or What is generating this evidence
        items:
          $ref: '#/definitions/relational.Origin'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      signature:
        $ref: '#/definitions/datatypes.JSONType-relational_EvidenceSignature'
      start:
        description: When did we start collecting the evidence, and when did the process
          end, and how long is it valid for ?
        type: string
      status:
        allOf:
        - $ref: '#/definitions/datatypes.JSONType-oscalTypes_1_1_3_ObjectiveStatus'
        description: Did we satisfy what was being tested for, or did we fail ?
      subject-references:
        description: |-
          SubjectReferences are the evidence's subjects as OSCAL subject references: derived from
          subject templates, declared, or legacy plugin identifiers.
        items:
          $ref: '#/definitions/relational.EvidenceSubjectReference'
        type: array
      subjects:
        description: Who or What are we providing evidence for. What's under test.
        items:
          $ref: '#/definitions/relational.AssessmentSubject'
        type: array
      title:
        type: string
      uuid:
        description: |-
          UUID needs to remain consistent when automation runs again, but unique for each subject.
          It represents the "stream" of the same observation being made over time.
        type: string
    type: object
  relational.EvidenceSignature:
    properties:
      claims:
        $ref: '#/definitions/relational.EvidenceSignatureClaims'
      content_hash:
        $ref: '#/definitions/relational.Hash'
      jws:
        type: string
      signature_algorithm:
        type: string
      signed_at:
        type: string
      signer:
        $ref: '#/definitions/relational.EvidenceSignatureSigner'
      version:
        type: string
    type: object
  relational.EvidenceSignatureClaims:
    properties:
      agent_id:
        type: string
      auth_method:
        type: string
      credential_id:
        type: string
      expires_at:
        type: string
      family_name:
        type: string
      given_name:
        type: string
      issued_at:
        type: string
      issuer:
        type: string
      not_before:
        type: string
      subject:
        type: string
      token_kind:
        type: string
    type: object
  relational.EvidenceSignatureSigner:
    properties:
      credential_id:
        type: string
      email:
        type: string
      id:
        type: string
      name:
        type: string
      type:
        type: string
    type: object
  relational.EvidenceSubjectReference:
    properties:
      evidenceId:
        description: |-
          EvidenceID is indexed on its own so an evidence's subjects load without the
          (subject_uuid, evidence_id) index, which serves lookups by subject.
        type: string
      group:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      priority:
        description: 'Priority is the template''s display priority: higher subjects
          are shown first.'
        type: integer
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      source:
        description: Source is one of the EvidenceSubjectSource* values.
        type: string
      subjectUuid:
        type: string
      templateId:
        description: TemplateID is the subject template a template-derived subject
          came from.
        type: string
      title:
        type: string
      type:
        description: Type is the OSCAL subject type, e.g. component.
        type: string
    type: object
  relational.Export:
    properties:
      byComponentId:
        type: string
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      provided:
        items:
          $ref: '#/definitions/relational.ProvidedControlImplementation'
        type: array
      remarks:
        type: string
      responsibilities:
        items:
          $ref: '#/definitions/relational.ControlImplementationResponsibility'
        type: array
    type: object
  relational.Filter:
    properties:
      components:
        items:
          $ref: '#/definitions/relational.SystemComponent'
        type: array
      controls:
        items:
          $ref: '#/definitions/relational.Control'
        type: array
      filter:
        $ref: '#/definitions/datatypes.JSONType-labelfilter_Filter'
      id:
        type: string
      name:
        type: string
      sspId:
        type: string
    type: object
  relational.FilterResponsibility:
    properties:
      controlId:
        description: |-
          Provenance of the filter→control association this attachment created. Attaching a
          filter to a responsibility also links it to the responsibility's control (so the
          existing control-level compliance surfaces include it); detaching must undo ONLY a
          link the responsibility machinery itself created, never one a user made
          independently via POST/PUT /api/filters. Semantics:
            - attach, link absent            → append filter_controls, ControlLinkCreated=true
            - attach, link present and some existing row on (filter_id, control_id) has
              ControlLinkCreated=true        → the link is responsibility-owned; the new row
              co-owns it (true), so the last detacher removes it
            - attach, link present otherwise → independently created, ControlLinkCreated=false
            - detach                         → remove the filter_controls row iff this row had
              ControlLinkCreated=true AND no other filter_responsibilities row on the same
              (filter_id, control_id) remains
          Control's primary key is composite (catalog_id, id) — both parts are recorded so
          detach can delete the exact association row.

          Rows are create/delete-only. Never Save()/Updates() this model: with a composite
          primary key GORM's upsert semantics on partial keys are a footgun.
        type: string
      controlLinkCreated:
        description: |-
          ControlLinkCreated reports whether this attachment created (or co-owns) the
          filter→control link — see the provenance comment above.
        type: boolean
      filterId:
        type: string
      responsibilityUuid:
        description: |-
          ResponsibilityUUID and SSPID also carry idx_filter_responsibilities_ssp_lookup, a
          composite index leading with ssp_id — the (filter_id, responsibility_uuid, ssp_id)
          primary key leads with filter_id, which doesn't serve ResponsibilityPosture's
          "WHERE ssp_id = ? AND responsibility_uuid IN ?" lookup (profile_compliance.go).
        type: string
      sspId:
        type: string
    type: object
  relational.Hash:
    properties:
      algorithm:
        allOf:
        - $ref: '#/definitions/relational.HashAlgorithm'
        description: required
      value:
        description: required
        type: string
    type: object
  relational.HashAlgorithm:
    enum:
    - SHA-224
    - SHA-256
    - SHA-384
    - SHA-512
    - SHA3-224
    - SHA3-256
    - SHA3-384
    - SHA3-512
    type: string
    x-enum-varnames:
    - HashAlgorithmSHA_224
    - HashAlgorithmSHA_256
    - HashAlgorithmSHA_384
    - HashAlgorithmSHA_512
    - HashAlgorithmSHA3_224
    - HashAlgorithmSHA3_256
    - HashAlgorithmSHA3_384
    - HashAlgorithmSHA3_512
  relational.ImplementedComponent:
    properties:
      component:
        $ref: '#/definitions/relational.DefinedComponent'
      component-uuid:
        type: string
      id:
        type: string
      inventoryItemId:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/relational.ResponsibleParty'
        type: array
    type: object
  relational.ImplementedRequirement:
    properties:
      by-components:
        items:
          $ref: '#/definitions/relational.ByComponent'
        type: array
      control-id:
        type: string
      controlImplementationId:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/relational.SetParameter'
        type: array
      statements:
        items:
          $ref: '#/definitions/relational.Statement'
        type: array
    type: object
  relational.ImplementedRequirementControlImplementation:
    properties:
      control-id:
        description: required
        type: string
      controlImplementationSetID:
        type: string
      description:
        description: required
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        description: required
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      set-parameters:
        items:
          $ref: '#/definitions/relational.SetParameter'
        type: array
      statements:
        items:
          $ref: '#/definitions/relational.ControlStatementImplementation'
        type: array
    type: object
  relational.Import:
    properties:
      exclude-controls:
        items:
          $ref: '#/definitions/relational.SelectControlById'
        type: array
      href:
        description: |-
          Href as per the OSCAL docs can be an absolute network path (potentially remote), relative or a URI fragment
          for the moment to make the system's life easier, it should be a URI fragment to back-matter and try and resolve
          back to an ingested catalog.
        type: string
      id:
        type: string
      include-all:
        $ref: '#/definitions/datatypes.JSONType-relational_IncludeAll'
      include-controls:
        items:
          $ref: '#/definitions/relational.SelectControlById'
        type: array
      profileID:
        type: string
    type: object
  relational.ImportComponentDefinition:
    properties:
      href:
        type: string
    type: object
  relational.IncorporatesComponents:
    properties:
      component-uuid:
        type: string
      description:
        type: string
    type: object
  relational.InheritedControlImplementation:
    properties:
      byComponentId:
        type: string
      description:
        description: required
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      provided-uuid:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
    type: object
  relational.InventoryItem:
    properties:
      description:
        type: string
      evidence:
        items:
          $ref: '#/definitions/relational.Evidence'
        type: array
      id:
        type: string
      implemented-components:
        items:
          $ref: '#/definitions/relational.ImplementedComponent'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/relational.ResponsibleParty'
        type: array
      systemImplementationId:
        type: string
    type: object
  relational.Labels:
    properties:
      name:
        type: string
      value:
        type: string
    type: object
  relational.LeveragedAuthorization:
    properties:
      date-authorized:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      party-uuid:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      systemImplementationId:
        type: string
      title:
        type: string
    type: object
  relational.Link:
    properties:
      href:
        type: string
      media-type:
        type: string
      rel:
        type: string
      resource-fragment:
        type: string
      text:
        type: string
    type: object
  relational.Location:
    properties:
      address:
        $ref: '#/definitions/datatypes.JSONType-relational_Address'
      email-addresses:
        items:
          type: string
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      telephone-numbers:
        items:
          $ref: '#/definitions/relational.TelephoneNumber'
        type: array
      title:
        type: string
      urls:
        items:
          type: string
        type: array
    type: object
  relational.Matching:
    properties:
      pattern:
        type: string
    type: object
  relational.Merge:
    properties:
      as-is:
        type: boolean
      combine:
        $ref: '#/definitions/datatypes.JSONType-relational_CombinationRule'
      flat:
        $ref: '#/definitions/datatypes.JSONType-relational_FlatWithoutGrouping'
      id:
        type: string
      profileID:
        type: string
    type: object
  relational.Metadata:
    properties:
      actions:
        items:
          $ref: '#/definitions/relational.Action'
        type: array
      document-ids:
        description: -> DocumentID
        items:
          $ref: '#/definitions/relational.DocumentID'
        type: array
      id:
        type: string
      last-modified:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      locations:
        items:
          $ref: '#/definitions/relational.Location'
        type: array
      oscal-version:
        type: string
      parentID:
        description: Metadata is shared across many resources, and so it mapped using
          a polymorphic relationship
        type: string
      parentType:
        type: string
      parties:
        items:
          $ref: '#/definitions/relational.Party'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      published:
        type: string
      remarks:
        type: string
      responsibleParties:
        items:
          $ref: '#/definitions/relational.ResponsibleParty'
        type: array
      revisions:
        items:
          $ref: '#/definitions/relational.Revision'
        type: array
      roles:
        items:
          $ref: '#/definitions/relational.Role'
        type: array
      title:
        type: string
      version:
        type: string
    type: object
  relational.Modify:
    properties:
      alters:
        items:
          $ref: '#/definitions/relational.Alteration'
        type: array
      id:
        type: string
      profileID:
        type: string
      set-parameters:
        items:
          $ref: '#/definitions/relational.ParameterSetting'
        type: array
    type: object
  relational.NetworkArchitecture:
    properties:
      description:
        type: string
      diagrams:
        items:
          $ref: '#/definitions/relational.Diagram'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      systemCharacteristicsId:
        type: string
    type: object
  relational.Origin:
    properties:
      actors:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.OriginActor'
        type: array
      related-tasks:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.RelatedTask'
        type: array
    type: object
  relational.Parameter:
    properties:
      class:
        type: string
      constraints:
        items:
          $ref: '#/definitions/relational.ParameterConstraint'
        type: array
      guidelines:
        items:
          $ref: '#/definitions/relational.ParameterGuideline'
        type: array
      id:
        type: string
      label:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      select:
        $ref: '#/definitions/datatypes.JSONType-relational_ParameterSelection'
      usage:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  relational.ParameterConstraint:
    properties:
      description:
        type: string
      tests:
        items:
          $ref: '#/definitions/relational.ParameterConstraintTest'
        type: array
    type: object
  relational.ParameterConstraintTest:
    properties:
      expression:
        type: string
      remarks:
        type: string
    type: object
  relational.ParameterGuideline:
    properties:
      prose:
        type: string
    type: object
  relational.ParameterSetting:
    properties:
      class:
        type: string
      constraints:
        items:
          $ref: '#/definitions/relational.ParameterConstraint'
        type: array
      depends-on:
        type: string
      guidelines:
        items:
          $ref: '#/definitions/relational.ParameterGuideline'
        type: array
      id:
        type: string
      label:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      modifyID:
        type: string
      param-id:
        description: required
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      select:
        $ref: '#/definitions/datatypes.JSONType-relational_ParameterSelection'
      values:
        items:
          type: string
        type: array
    type: object
  relational.Part:
    properties:
      class:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      name:
        type: string
      ns:
        type: string
      part_id:
        type: string
      parts:
        description: -> Part
        items:
          $ref: '#/definitions/relational.Part'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      prose:
        type: string
      title:
        type: string
    type: object
  relational.Party:
    properties:
      addresses:
        items:
          $ref: '#/definitions/relational.Address'
        type: array
      email-addresses:
        items:
          type: string
        type: array
      external-ids:
        items:
          $ref: '#/definitions/relational.PartyExternalID'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      locations:
        items:
          $ref: '#/definitions/relational.Location'
        type: array
      member-of-organizations:
        description: -> Party
        items:
          $ref: '#/definitions/relational.Party'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      short-name:
        type: string
      telephone-numbers:
        items:
          $ref: '#/definitions/relational.TelephoneNumber'
        type: array
      type:
        $ref: '#/definitions/relational.PartyType'
    type: object
  relational.PartyExternalID:
    properties:
      id:
        type: string
      scheme:
        $ref: '#/definitions/relational.PartyExternalIDScheme'
    type: object
  relational.PartyExternalIDScheme:
    enum:
    - http://orcid.org/
    type: string
    x-enum-varnames:
    - PartyExternalIDSchemeOrchid
  relational.PartyType:
    enum:
    - person
    - organization
    type: string
    x-enum-varnames:
    - PartyTypePerson
    - PartyTypeOrganization
  relational.Profile:
    properties:
      back-matter:
        $ref: '#/definitions/relational.BackMatter'
      controls:
        items:
          $ref: '#/definitions/relational.Control'
        type: array
      id:
        type: string
      imports:
        items:
          $ref: '#/definitions/relational.Import'
        type: array
      merge:
        $ref: '#/definitions/relational.Merge'
      metadata:
        $ref: '#/definitions/relational.Metadata'
      modify:
        $ref: '#/definitions/relational.Modify'
    type: object
  relational.Prop:
    properties:
      class:
        type: string
      group:
        type: string
      name:
        type: string
      ns:
        type: string
      remarks:
        type: string
      uuid:
        type: string
      value:
        type: string
    type: object
  relational.Protocol:
    properties:
      name:
        type: string
      port-ranges:
        items:
          $ref: '#/definitions/oscalTypes_1_1_3.PortRange'
        type: array
      title:
        type: string
      uuid:
        type: string
    type: object
  relational.ProvidedControlImplementation:
    properties:
      description:
        type: string
      exportId:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
    type: object
  relational.Removal:
    properties:
      by-class:
        type: string
      by-id:
        type: string
      by-item-name:
        type: string
      by-name:
        type: string
      by-ns:
        type: string
    type: object
  relational.ResourceLink:
    properties:
      hashes:
        items:
          $ref: '#/definitions/relational.Hash'
        type: array
      href:
        description: required
        type: string
      media-type:
        type: string
    type: object
  relational.ResponsibleParty:
    properties:
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      parentID:
        description: Polymorphic relationship - allows ResponsibleParty to belong
          to different parent types
        type: string
      parentType:
        type: string
      parties:
        items:
          $ref: '#/definitions/relational.ResponsiblePartyParties'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      role:
        $ref: '#/definitions/relational.Role'
      role-id:
        description: required
        type: string
    type: object
  relational.ResponsiblePartyParties:
    properties:
      partyID:
        type: string
      responsiblePartyID:
        type: string
    type: object
  relational.ResponsibleRole:
    properties:
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      parentID:
        type: string
      parentType:
        type: string
      parties:
        items:
          $ref: '#/definitions/relational.Party'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      role:
        $ref: '#/definitions/relational.Role'
      role-id:
        description: required
        type: string
    type: object
  relational.ReviewedControls:
    properties:
      controlObjectiveSelections:
        items:
          $ref: '#/definitions/relational.ControlObjectiveSelection'
        type: array
      controlSelections:
        description: required
        items:
          $ref: '#/definitions/relational.ControlSelection'
        type: array
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
    type: object
  relational.Revision:
    properties:
      id:
        type: string
      last-modified:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      metadata-id:
        description: Revision only exist on a metadata object. We'll link them straight
          there with a BelongsTo relationship
        type: string
      oscal-version:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      published:
        type: string
      remarks:
        type: string
      title:
        type: string
      version:
        description: required
        type: string
    type: object
  relational.Role:
    properties:
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      short-name:
        type: string
      title:
        type: string
    type: object
  relational.SSOGroupMapping:
    properties:
      createdAt:
        type: string
      externalGroup:
        type: string
      group:
        $ref: '#/definitions/relational.UserGroup'
      groupId:
        type: string
      id:
        type: string
      provider:
        type: string
      source:
        description: |-
          Source records who owns the mapping: MappingSourceConfig (declared in a provider's
          group_mapping and reconciled by boot provisioning) or MappingSourceManual (added at runtime via
          the admin API). It defaults to config so pre-attribution rows — all of which came from config
          provisioning — are reconciled declaratively: provisioning prunes config rows the config no
          longer declares, while manual rows are never auto-removed.
        type: string
      updatedAt:
        type: string
    type: object
  relational.SSPExportOffering:
    properties:
      contentHash:
        type: string
      createdAt:
        type: string
      createdById:
        type: string
      description:
        type: string
      id:
        type: string
      items:
        items:
          $ref: '#/definitions/relational.SSPExportOfferingItem'
        type: array
      publishedAt:
        type: string
      sspId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPExportOfferingStatus'
      title:
        type: string
      updatedAt:
        type: string
      version:
        type: integer
    type: object
  relational.SSPExportOfferingAllowedDownstream:
    properties:
      downstreamSspId:
        type: string
      offeringId:
        type: string
    type: object
  relational.SSPExportOfferingItem:
    properties:
      componentUuid:
        type: string
      controlId:
        type: string
      id:
        type: string
      offeringId:
        type: string
      providedUuid:
        type: string
      statementId:
        type: string
    type: object
  relational.SSPExportOfferingStatus:
    enum:
    - draft
    - published
    - deprecated
    - revoked
    type: string
    x-enum-varnames:
    - SSPExportOfferingStatusDraft
    - SSPExportOfferingStatusPublished
    - SSPExportOfferingStatusDeprecated
    - SSPExportOfferingStatusRevoked
  relational.SSPLeverageLink:
    properties:
      attestedAt:
        type: string
      attestedById:
        type: string
      controlId:
        type: string
      createdAt:
        type: string
      downstreamSspId:
        type: string
      id:
        type: string
      inheritedUuid:
        type: string
      leveragedAuthUuid:
        type: string
      offeringId:
        type: string
      offeringVersion:
        type: integer
      providedUuid:
        type: string
      satisfaction:
        $ref: '#/definitions/relational.SSPLeverageSatisfaction'
      statementId:
        type: string
      status:
        $ref: '#/definitions/relational.SSPLeverageStatus'
      updatedAt:
        type: string
      upstreamSspId:
        type: string
    type: object
  relational.SSPLeverageSatisfaction:
    enum:
    - full
    - partial
    type: string
    x-enum-varnames:
    - SSPLeverageSatisfactionFull
    - SSPLeverageSatisfactionPartial
  relational.SSPLeverageStatus:
    enum:
    - active
    - drifted
    - revoked
    - superseded
    type: string
    x-enum-varnames:
    - SSPLeverageStatusActive
    - SSPLeverageStatusDrifted
    - SSPLeverageStatusRevoked
    - SSPLeverageStatusSuperseded
  relational.SatisfiedControlImplementationResponsibility:
    properties:
      by-component-id:
        type: string
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsibility-uuid:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
    type: object
  relational.SelectControlById:
    properties:
      id:
        type: string
      matching:
        items:
          $ref: '#/definitions/relational.Matching'
        type: array
      parentID:
        type: string
      parentType:
        type: string
      with-child-controls:
        type: string
      with-ids:
        items:
          type: string
        type: array
    type: object
  relational.SelectObjectiveById:
    properties:
      id:
        type: string
      objective:
        description: required
        type: string
      parentID:
        type: string
      parentType:
        type: string
    type: object
  relational.SelectSubjectById:
    properties:
      assessmentSubjectID:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      subjectUUID:
        description: |-
          SubjectUUID technically represents a UUID of a component, party, location, user, or inventory item.
          It will likely be updated once we can map it correctly
        type: string
    type: object
  relational.SetParameter:
    properties:
      param-id:
        type: string
      remarks:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  relational.Statement:
    properties:
      by-components:
        items:
          $ref: '#/definitions/relational.ByComponent'
        type: array
      id:
        type: string
      implementedRequirementId:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      statement-id:
        type: string
    type: object
  relational.Step:
    properties:
      activityID:
        type: string
      description:
        description: required
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      reviewed-controls:
        $ref: '#/definitions/relational.ReviewedControls'
      reviewedControlsID:
        type: string
      title:
        type: string
    type: object
  relational.SystemCharacteristics:
    properties:
      authorization-boundary:
        $ref: '#/definitions/relational.AuthorizationBoundary'
      dataFlow:
        $ref: '#/definitions/relational.DataFlow'
      date-authorized:
        type: string
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      networkArchitecture:
        $ref: '#/definitions/relational.NetworkArchitecture'
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      responsible-parties:
        items:
          $ref: '#/definitions/relational.ResponsibleParty'
        type: array
      security-impact-level:
        $ref: '#/definitions/datatypes.JSONType-relational_SecurityImpactLevel'
      security-sensitivity-level:
        type: string
      status:
        $ref: '#/definitions/datatypes.JSONType-relational_Status'
      system-ids:
        items:
          $ref: '#/definitions/relational.SystemId'
        type: array
      system-information:
        $ref: '#/definitions/datatypes.JSONType-relational_SystemInformation'
      system-name:
        type: string
      system-name-short:
        type: string
      systemSecurityPlanId:
        type: string
    type: object
  relational.SystemComponent:
    properties:
      definedComponentId:
        type: string
      description:
        type: string
      evidence:
        items:
          $ref: '#/definitions/relational.Evidence'
        type: array
      filters:
        items:
          $ref: '#/definitions/relational.Filter'
        type: array
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      protocols:
        items:
          $ref: '#/definitions/relational.Protocol'
        type: array
      purpose:
        type: string
      remarks:
        type: string
      responsible-roles:
        items:
          $ref: '#/definitions/relational.ResponsibleRole'
        type: array
      status:
        $ref: '#/definitions/datatypes.JSONType-relational_SystemComponentStatus'
      systemImplementationId:
        type: string
      title:
        type: string
      type:
        type: string
    type: object
  relational.SystemComponentSuggestion:
    properties:
      componentDefinitionId:
        type: string
      definedComponentId:
        type: string
      description:
        type: string
      name:
        type: string
      purpose:
        type: string
      type:
        type: string
    type: object
  relational.SystemId:
    properties:
      id:
        type: string
      identifier-type:
        type: string
    type: object
  relational.SystemImplementation:
    properties:
      components:
        items:
          $ref: '#/definitions/relational.SystemComponent'
        type: array
      id:
        type: string
      inventory-items:
        items:
          $ref: '#/definitions/relational.InventoryItem'
        type: array
      leveraged-authorizations:
        items:
          $ref: '#/definitions/relational.LeveragedAuthorization'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      systemSecurityPlanId:
        type: string
      users:
        items:
          $ref: '#/definitions/relational.SystemUser'
        type: array
    type: object
  relational.SystemSecurityPlan:
    properties:
      back-matter:
        $ref: '#/definitions/relational.BackMatter'
      control-implementation:
        $ref: '#/definitions/relational.ControlImplementation'
      id:
        type: string
      import-profile:
        $ref: '#/definitions/datatypes.JSONType-relational_ImportProfile'
      metadata:
        $ref: '#/definitions/relational.Metadata'
      profile:
        $ref: '#/definitions/relational.Profile'
      profileID:
        description: |-
          Deprecated: Use Profiles (M:M via ssp_profiles) instead.
          Kept for backward-compatible migration; will be dropped in a future release.
        type: string
      profiles:
        description: Profiles holds the many-to-many relationship via the ssp_profiles
          join table.
        items:
          $ref: '#/definitions/relational.Profile'
        type: array
      system-characteristics:
        $ref: '#/definitions/relational.SystemCharacteristics'
      system-implementation:
        $ref: '#/definitions/relational.SystemImplementation'
    type: object
  relational.SystemUser:
    properties:
      authorized-privileges:
        items:
          $ref: '#/definitions/relational.AuthorizedPrivilege'
        type: array
      description:
        type: string
      id:
        type: string
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      remarks:
        type: string
      role-ids:
        items:
          type: string
        type: array
      short-name:
        type: string
      systemImplementationId:
        type: string
      title:
        type: string
    type: object
  relational.TelephoneNumber:
    properties:
      number:
        type: string
      type:
        $ref: '#/definitions/relational.TelephoneNumberType'
    type: object
  relational.TelephoneNumberType:
    enum:
    - home
    - office
    - mobile
    type: string
    x-enum-varnames:
    - TelephoneNumberTypeHome
    - TelephoneNumberTypeOffice
    - TelephoneNumberTypeMobile
  relational.User:
    properties:
      authMethod:
        type: string
      createdAt:
        type: string
      deletedAt:
        allOf:
        - $ref: '#/definitions/gorm.DeletedAt'
        description: Soft delete
      email:
        type: string
      failedLogins:
        type: integer
      firstName:
        type: string
      id:
        type: string
      isActive:
        type: boolean
      isLocked:
        type: boolean
      lastLogin:
        type: string
      lastName:
        type: string
      updatedAt:
        type: string
      userAttributes:
        type: string
    type: object
  relational.UserGroup:
    properties:
      createdAt:
        type: string
      deletedAt:
        $ref: '#/definitions/gorm.DeletedAt'
      description:
        type: string
      id:
        type: string
      name:
        description: |-
          Name is the group's policy-facing identifier — the token that appears in
          subject.groups and that role-assignment config matches on. Unique among live groups.
        type: string
      source:
        description: |-
          Source records how the group came to exist: GroupSourceManual (an admin created it via the API)
          or GroupSourceSSO (SSO provisioning materialized it from a group_mapping value). It defaults to
          manual so admin-created and pre-attribution groups are never auto-removed. Only sso groups that
          have become fully unreferenced are cleaned up at boot (CleanupOrphanedSSOGroups); the source is
          set only when the group is first created, so an admin group that later appears in SSO config
          stays manual.
        type: string
      updatedAt:
        type: string
    type: object
  risks.RiskComponentLink:
    properties:
      componentId:
        type: string
      createdAt:
        type: string
      createdById:
        type: string
      riskId:
        type: string
    type: object
  risks.RiskControlLink:
    properties:
      catalogId:
        type: string
      controlId:
        type: string
      createdAt:
        type: string
      createdById:
        type: string
      riskId:
        type: string
    type: object
  risks.RiskEvent:
    properties:
      actorUserId:
        type: string
      createdAt:
        type: string
      details:
        type: string
      eventType:
        type: string
      id:
        type: string
      occurredAt:
        type: string
      payload:
        $ref: '#/definitions/datatypes.JSONMap'
      riskId:
        type: string
      riskSnapshot:
        $ref: '#/definitions/datatypes.JSONMap'
    type: object
  risks.RiskEvidenceLink:
    properties:
      createdAt:
        type: string
      createdById:
        type: string
      evidenceId:
        description: EvidenceID stores the evidence stream UUID (evidences.uuid),
          not a single evidence row ID.
        type: string
      riskId:
        type: string
    type: object
  risks.RiskReview:
    properties:
      createdAt:
        type: string
      decision:
        type: string
      id:
        type: string
      nextReviewDeadline:
        type: string
      reassessedImpact:
        type: string
      reassessedLikelihood:
        type: string
      reviewJustification:
        type: string
      reviewedAt:
        type: string
      reviewedByUserId:
        type: string
      riskId:
        type: string
      riskSnapshot:
        $ref: '#/definitions/datatypes.JSONMap'
    type: object
  risks.RiskSubjectLink:
    properties:
      createdAt:
        type: string
      createdById:
        type: string
      riskId:
        type: string
      subjectId:
        type: string
    type: object
  service.ListResponse-handler_LineageLeverageRow:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.LineageLeverageRow'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_LineageNode:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.LineageNode'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_LineageSSPRow:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.LineageSSPRow'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_PublicEvidenceResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.PublicEvidenceResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_agentConfigRevisionResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.agentConfigRevisionResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_riskResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.riskResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_riskScoreResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.riskScoreResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-handler_threatIDResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/handler.threatIDResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-relational_ControlLink:
    properties:
      data:
        items:
          $ref: '#/definitions/relational.ControlLink'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-risks_RiskComponentLink:
    properties:
      data:
        items:
          $ref: '#/definitions/risks.RiskComponentLink'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-risks_RiskControlLink:
    properties:
      data:
        items:
          $ref: '#/definitions/risks.RiskControlLink'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-risks_RiskEvent:
    properties:
      data:
        items:
          $ref: '#/definitions/risks.RiskEvent'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-risks_RiskReview:
    properties:
      data:
        items:
          $ref: '#/definitions/risks.RiskReview'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-risks_RiskSubjectLink:
    properties:
      data:
        items:
          $ref: '#/definitions/risks.RiskSubjectLink'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-subjects_Summary:
    properties:
      data:
        items:
          $ref: '#/definitions/subjects.Summary'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-templates_riskTemplateResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/templates.riskTemplateResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-templates_subjectTemplateResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/templates.subjectTemplateResponse'
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  service.ListResponse-uuid_UUID:
    properties:
      data:
        items:
          type: string
        type: array
      limit:
        type: integer
      page:
        type: integer
      total:
        type: integer
      totalPages:
        type: integer
    type: object
  subjects.IdentityLabel:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  subjects.Kind:
    enum:
    - defined-component
    - system-component
    - party
    - user
    type: string
    x-enum-varnames:
    - KindDefinedComponent
    - KindSystemComponent
    - KindParty
    - KindUser
  subjects.LinkedSSP:
    properties:
      component-id:
        type: string
      component-title:
        type: string
      ssp-id:
        type: string
      ssp-title:
        type: string
    type: object
  subjects.Summary:
    properties:
      context:
        description: |-
          Context is what the subject belongs to: a defined component's component definition, or
          a system component's SSP.
        type: string
      identity:
        description: 'Identity is a defined component''s identity labels: the evidence
          labels that identify it.'
        items:
          $ref: '#/definitions/subjects.IdentityLabel'
        type: array
      kind:
        $ref: '#/definitions/subjects.Kind'
      linked-ssps:
        description: LinkedSSPs are the SSP system components a defined component
          is linked to.
        items:
          $ref: '#/definitions/subjects.LinkedSSP'
        type: array
      subject-uuid:
        type: string
      title:
        type: string
      type:
        description: 'Type is the OSCAL subject type: component, party or user.'
        type: string
    type: object
  suggestions.DashboardSuggestion:
    properties:
      acceptedFilterId:
        type: string
      addedByUser:
        description: AddedByUser marks rows created during a group edit (no AI baseline).
        type: boolean
      confidence:
        type: number
      controlCatalogId:
        type: string
      controlId:
        type: string
      decidedAt:
        type: string
      decidedByUserId:
        type: string
      editedAt:
        type: string
      editedByUserId:
        type: string
      id:
        type: string
      isGeneralization:
        description: |-
          IsGeneralization marks rows produced by the deterministic filter-merge
          detector (Part 2). Such a row proposes the generalized label set G that
          merges several near-duplicate SSP filters that differ by one generalizable
          label. Accepting it moves controls onto G and off the source filters.
        type: boolean
      isUserEdited:
        type: boolean
      labelSet:
        $ref: '#/definitions/datatypes.JSONMap'
      labelSetHash:
        type: string
      originalProposedFilterLabelSet:
        allOf:
        - $ref: '#/definitions/datatypes.JSONMap'
        description: |-
          AI baseline captured at first user edit (set-once) so the UI can render a
          diff of what the user changed. Nil on AI-generated, never-edited rows and
          on rows the user added during an edit (AddedByUser).
      originalProposedFilterName:
        type: string
      proposedFilterLabelSet:
        $ref: '#/definitions/datatypes.JSONMap'
      proposedFilterName:
        type: string
      reasoning:
        type: string
      rejectReason:
        type: string
      removedControlIds:
        description: |-
          RemovedControlIds mirrors, onto every surviving group row, the control IDs
          removed from the group during edits, so the card can show them struck-out.
        items:
          type: string
        type: array
      runId:
        type: string
      sourceFilterIds:
        description: |-
          SourceFilterIDs are the SSP filters this generalization merges, recorded so
          the UI can explain the merge and the accept path can detach controls from
          them. Nil on ordinary (non-generalization) rows.
        items:
          type: string
        type: array
      sspId:
        type: string
      status:
        type: string
      targetFilterId:
        type: string
    type: object
  suggestions.DashboardSuggestionRunCell:
    properties:
      cacheCreationInputTokens:
        type: integer
      cacheReadInputTokens:
        type: integer
      cellIndex:
        type: integer
      completedAt:
        type: string
      controlKeys:
        items:
          type: string
        type: array
      error:
        type: string
      inputTokens:
        type: integer
      labelSetHashes:
        items:
          type: string
        type: array
      mappingsRejected:
        type: integer
      mappingsReturned:
        type: integer
      outputTokens:
        type: integer
      rateLimitedCount:
        type: integer
      runId:
        type: string
      status:
        type: string
    type: object
  suggestions.LabelKeyInput:
    properties:
      key:
        type: string
      values:
        items:
          type: string
        type: array
    type: object
  suggestions.LabelSetInput:
    properties:
      evidence_count:
        type: integer
      hash:
        type: string
      labels:
        additionalProperties:
          type: string
        type: object
      sample_titles:
        items:
          type: string
        type: array
    type: object
  templates.batchRiskTemplateItem:
    properties:
      dedupe-label-keys:
        items:
          type: string
        type: array
      id:
        type: string
      impact-hint:
        type: string
      is-active:
        type: boolean
      label-schema:
        items:
          $ref: '#/definitions/templates.labelSchemaFieldRequest'
        type: array
      likelihood-hint:
        type: string
      name:
        type: string
      remediation-template:
        $ref: '#/definitions/templates.remediationTemplateRequest'
      statement:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/templates.threatIDRequest'
        type: array
      title:
        type: string
      violation-ids:
        items:
          type: string
        type: array
    type: object
  templates.batchSubjectTemplateItem:
    properties:
      component-type:
        type: string
      description-template:
        type: string
      display-priority:
        type: integer
      id:
        type: string
      identity-label-keys:
        items:
          type: string
        type: array
      label-schema:
        items:
          $ref: '#/definitions/templates.subjectTemplateLabelSchemaFieldRequest'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      purpose-template:
        type: string
      remarks-template:
        type: string
      selector-labels:
        items:
          $ref: '#/definitions/templates.subjectTemplateSelectorLabelRequest'
        type: array
      source-mode:
        type: string
      title-template:
        type: string
      type:
        type: string
    type: object
  templates.batchUpsertRiskTemplatesData:
    properties:
      created:
        items:
          $ref: '#/definitions/templates.riskTemplateResponse'
        type: array
      deleted:
        items:
          type: string
        type: array
      unchanged:
        items:
          type: string
        type: array
      updated:
        items:
          $ref: '#/definitions/templates.riskTemplateResponse'
        type: array
    type: object
  templates.batchUpsertRiskTemplatesRequest:
    properties:
      plugin-id:
        type: string
      policy-package:
        type: string
      templates:
        items:
          $ref: '#/definitions/templates.batchRiskTemplateItem'
        type: array
    required:
    - plugin-id
    - policy-package
    type: object
  templates.batchUpsertRiskTemplatesResponse:
    properties:
      data:
        $ref: '#/definitions/templates.batchUpsertRiskTemplatesData'
    type: object
  templates.batchUpsertSubjectTemplatesData:
    properties:
      created:
        items:
          $ref: '#/definitions/templates.subjectTemplateResponse'
        type: array
      deleted:
        items:
          type: string
        type: array
      unchanged:
        items:
          type: string
        type: array
      updated:
        items:
          $ref: '#/definitions/templates.subjectTemplateResponse'
        type: array
      warnings:
        description: |-
          Warnings lists non-component templates, which are accepted but produce no evidence
          subjects.
        items:
          type: string
        type: array
    type: object
  templates.batchUpsertSubjectTemplatesRequest:
    properties:
      plugin-id:
        type: string
      templates:
        items:
          $ref: '#/definitions/templates.batchSubjectTemplateItem'
        type: array
    required:
    - plugin-id
    type: object
  templates.batchUpsertSubjectTemplatesResponse:
    properties:
      data:
        $ref: '#/definitions/templates.batchUpsertSubjectTemplatesData'
    type: object
  templates.labelSchemaFieldRequest:
    properties:
      description:
        type: string
      key:
        type: string
    type: object
  templates.labelSchemaFieldResponse:
    properties:
      description:
        type: string
      key:
        type: string
    type: object
  templates.remediationTaskRequest:
    properties:
      order-index:
        type: integer
      title:
        type: string
    type: object
  templates.remediationTaskResponse:
    properties:
      id:
        type: string
      order-index:
        type: integer
      title:
        type: string
    type: object
  templates.remediationTemplateRequest:
    properties:
      description:
        type: string
      tasks:
        items:
          $ref: '#/definitions/templates.remediationTaskRequest'
        type: array
      title:
        type: string
    type: object
  templates.remediationTemplateResponse:
    properties:
      description:
        type: string
      id:
        type: string
      tasks:
        items:
          $ref: '#/definitions/templates.remediationTaskResponse'
        type: array
      title:
        type: string
    type: object
  templates.riskTemplateDataResponse:
    properties:
      data:
        $ref: '#/definitions/templates.riskTemplateResponse'
    type: object
  templates.riskTemplateResponse:
    properties:
      created-at:
        type: string
      dedupe-label-keys:
        items:
          type: string
        type: array
      id:
        type: string
      impact-hint:
        type: string
      is-active:
        type: boolean
      label-schema:
        items:
          $ref: '#/definitions/templates.labelSchemaFieldResponse'
        type: array
      likelihood-hint:
        type: string
      name:
        type: string
      plugin-id:
        type: string
      policy-package:
        type: string
      remediation-template:
        $ref: '#/definitions/templates.remediationTemplateResponse'
      statement:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/templates.threatIDResponse'
        type: array
      title:
        type: string
      updated-at:
        type: string
      violation-ids:
        items:
          type: string
        type: array
    type: object
  templates.subjectTemplateDataResponse:
    properties:
      data:
        $ref: '#/definitions/templates.subjectTemplateResponse'
    type: object
  templates.subjectTemplateLabelSchemaFieldRequest:
    properties:
      description:
        type: string
      key:
        type: string
    type: object
  templates.subjectTemplateLabelSchemaFieldResponse:
    properties:
      description:
        type: string
      key:
        type: string
    type: object
  templates.subjectTemplateResponse:
    properties:
      component-type:
        type: string
      createdAt:
        type: string
      description-template:
        type: string
      display-priority:
        type: integer
      id:
        type: string
      identity-label-keys:
        items:
          type: string
        type: array
      label-schema:
        items:
          $ref: '#/definitions/templates.subjectTemplateLabelSchemaFieldResponse'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      purpose-template:
        type: string
      remarks-template:
        type: string
      selector-labels:
        items:
          $ref: '#/definitions/templates.subjectTemplateSelectorLabelResponse'
        type: array
      source-mode:
        type: string
      title-template:
        type: string
      type:
        type: string
      updatedAt:
        type: string
    type: object
  templates.subjectTemplateSelectorLabelRequest:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  templates.subjectTemplateSelectorLabelResponse:
    properties:
      key:
        type: string
      value:
        type: string
    type: object
  templates.threatIDRequest:
    properties:
      id:
        type: string
      system:
        type: string
      title:
        type: string
      url:
        type: string
    type: object
  templates.threatIDResponse:
    properties:
      id:
        type: string
      system:
        type: string
      title:
        type: string
      url:
        type: string
    type: object
  templates.upsertRiskTemplateRequest:
    properties:
      dedupe-label-keys:
        items:
          type: string
        type: array
      impact-hint:
        type: string
      is-active:
        type: boolean
      label-schema:
        items:
          $ref: '#/definitions/templates.labelSchemaFieldRequest'
        type: array
      likelihood-hint:
        type: string
      name:
        type: string
      plugin-id:
        type: string
      policy-package:
        type: string
      remediation-template:
        $ref: '#/definitions/templates.remediationTemplateRequest'
      statement:
        type: string
      threat-ids:
        items:
          $ref: '#/definitions/templates.threatIDRequest'
        type: array
      title:
        type: string
      violation-ids:
        items:
          type: string
        type: array
    type: object
  templates.upsertSubjectTemplateRequest:
    properties:
      component-type:
        type: string
      description-template:
        type: string
      display-priority:
        type: integer
      identity-label-keys:
        items:
          type: string
        type: array
      label-schema:
        items:
          $ref: '#/definitions/templates.subjectTemplateLabelSchemaFieldRequest'
        type: array
      links:
        items:
          $ref: '#/definitions/relational.Link'
        type: array
      name:
        type: string
      props:
        items:
          $ref: '#/definitions/relational.Prop'
        type: array
      purpose-template:
        type: string
      remarks-template:
        type: string
      selector-labels:
        items:
          $ref: '#/definitions/templates.subjectTemplateSelectorLabelRequest'
        type: array
      source-mode:
        type: string
      title-template:
        type: string
      type:
        type: string
    required:
    - identity-label-keys
    - label-schema
    - name
    - selector-labels
    - source-mode
    - type
    type: object
  time.Duration:
    enum:
    - -9223372036854775808
    - 9223372036854775807
    - 1
    - 1000
    - 1000000
    - 1000000000
    - 60000000000
    - 3600000000000
    format: int64
    type: integer
    x-enum-varnames:
    - minDuration
    - maxDuration
    - Nanosecond
    - Microsecond
    - Millisecond
    - Second
    - Minute
    - Hour
  workflow.EvidenceSubmission:
    properties:
      description:
        type: string
      evidence-id:
        type: string
      evidence-type:
        type: string
      file-content:
        description: Base64 encoded file content
        type: string
      file-hash:
        type: string
      file-path:
        type: string
      file-size:
        type: integer
      media-type:
        description: MIME type (e.g., "application/pdf", "image/png")
        type: string
      metadata:
        type: string
      name:
        type: string
    type: object
  workflow.ExecutionMetrics:
    properties:
      averageStepDuration:
        $ref: '#/definitions/time.Duration'
      duration:
        $ref: '#/definitions/time.Duration'
      executionId:
        type: string
      longestStepDuration:
        $ref: '#/definitions/time.Duration'
      stepMetrics:
        items:
          $ref: '#/definitions/workflow.StepMetric'
        type: array
      totalSteps:
        type: integer
    type: object
  workflow.ExecutionStatus:
    properties:
      blockedSteps:
        type: integer
      cancelledSteps:
        type: integer
      completedAt:
        type: string
      completedSteps:
        type: integer
      executionID:
        type: string
      failedAt:
        type: string
      failedSteps:
        type: integer
      failureReason:
        type: string
      inProgressSteps:
        type: integer
      overdueSteps:
        type: integer
      pendingSteps:
        type: integer
      startedAt:
        type: string
      status:
        type: string
      totalSteps:
        type: integer
    type: object
  workflow.StepMetric:
    properties:
      completedAt:
        format: date-time
        type: string
      durationMinutes:
        type: number
      startedAt:
        format: date-time
        type: string
      stepDefinitionId:
        format: uuid
        type: string
      stepName:
        type: string
    type: object
  workflows.BulkReassignRoleResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.BulkReassignRoleResponseData'
    type: object
  workflows.BulkReassignRoleResponseData:
    properties:
      execution-id:
        type: string
      reassigned-count:
        type: integer
      reassigned-step-execution-ids:
        items:
          type: string
        type: array
      role-name:
        type: string
    type: object
  workflows.CancelWorkflowExecutionRequest:
    properties:
      reason:
        type: string
    type: object
  workflows.ControlRelationship:
    properties:
      catalog_id:
        description: Link to catalog if available
        type: string
      control_id:
        description: Control Information
        type: string
      control_source:
        description: e.g., "NIST 800-53 Rev 5", "ISO 27001"
        type: string
      created-at:
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      id:
        type: string
      is_active:
        type: boolean
      relationship_type:
        description: Relationship Information
        type: string
      strength:
        description: primary, secondary, supporting
        type: string
      updated-at:
        type: string
      workflow_definition:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowDefinition'
        description: Relationships
      workflow_definition_id:
        description: Foreign Keys
        type: string
    type: object
  workflows.ControlRelationshipListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.ControlRelationship'
        type: array
    type: object
  workflows.ControlRelationshipResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.ControlRelationship'
    type: object
  workflows.CreateControlRelationshipRequest:
    properties:
      catalog-id:
        type: string
      control-id:
        type: string
      description:
        type: string
      is-active:
        type: boolean
      relationship-type:
        description: If not provided - 'satisfies' is used
        type: string
      strength:
        description: If not provided - 'primary' is used
        type: string
      workflow-definition-id:
        type: string
    required:
    - catalog-id
    - control-id
    - workflow-definition-id
    type: object
  workflows.CreateRoleAssignmentRequest:
    properties:
      assigned-to-id:
        type: string
      assigned-to-type:
        type: string
      is-active:
        type: boolean
      role-name:
        type: string
      workflow-instance-id:
        type: string
    required:
    - assigned-to-id
    - assigned-to-type
    - role-name
    - workflow-instance-id
    type: object
  workflows.CreateWorkflowDefinitionRequest:
    properties:
      description:
        type: string
      grace-period-days:
        type: integer
      name:
        type: string
      suggested-cadence:
        type: string
      version:
        type: string
    required:
    - name
    type: object
  workflows.CreateWorkflowInstanceRequest:
    properties:
      cadence:
        type: string
      description:
        type: string
      grace-period-days:
        type: integer
      is-active:
        type: boolean
      name:
        type: string
      system-id:
        type: string
      workflow-definition-id:
        type: string
    required:
    - name
    - system-id
    - workflow-definition-id
    type: object
  workflows.CreateWorkflowStepDefinitionRequest:
    properties:
      depends-on:
        description: Array of step IDs this step depends on
        items:
          type: string
        type: array
      description:
        type: string
      estimated-duration:
        type: integer
      evidence-required:
        items:
          $ref: '#/definitions/workflows.EvidenceRequirement'
        type: array
      grace-period-days:
        type: integer
      name:
        type: string
      responsible-role:
        type: string
      workflow-definition-id:
        type: string
    required:
    - name
    - responsible-role
    - workflow-definition-id
    type: object
  workflows.EvidenceRequirement:
    properties:
      description:
        type: string
      required:
        type: boolean
      type:
        type: string
    type: object
  workflows.FailStepRequest:
    properties:
      reason:
        type: string
    required:
    - reason
    type: object
  workflows.MyAssignmentsResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.StepExecution'
        type: array
      has-more:
        type: boolean
      limit:
        type: integer
      offset:
        type: integer
      total:
        type: integer
    type: object
  workflows.ReassignRoleRequest:
    properties:
      new-assigned-to-id:
        type: string
      new-assigned-to-type:
        enum:
        - user
        - group
        - email
        type: string
      reason:
        type: string
      role-name:
        type: string
    required:
    - new-assigned-to-id
    - new-assigned-to-type
    - role-name
    type: object
  workflows.ReassignStepRequest:
    properties:
      assigned-to-id:
        type: string
      assigned-to-type:
        enum:
        - user
        - group
        - email
        type: string
      reason:
        type: string
    required:
    - assigned-to-id
    - assigned-to-type
    type: object
  workflows.RoleAssignment:
    properties:
      assigned_to_id:
        description: User ID, group ID, or email
        type: string
      assigned_to_type:
        description: user, group, email
        type: string
      id:
        type: string
      is_active:
        type: boolean
      role_name:
        type: string
      workflow_instance:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowInstance'
        description: Relationships
      workflow_instance_id:
        type: string
    type: object
  workflows.RoleAssignmentListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.RoleAssignment'
        type: array
    type: object
  workflows.RoleAssignmentResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.RoleAssignment'
    type: object
  workflows.SeedSummary:
    properties:
      control_relationships:
        type: integer
      definitions_created:
        type: integer
      definitions_updated:
        type: integer
      dependencies:
        type: integer
      failed:
        type: integer
      instances:
        type: integer
      role_assignments:
        type: integer
      skipped:
        type: integer
      steps:
        type: integer
    type: object
  workflows.StartWorkflowExecutionRequest:
    properties:
      triggered-by:
        type: string
      triggered-by-id:
        type: string
      workflow-instance-id:
        type: string
    required:
    - triggered-by
    - workflow-instance-id
    type: object
  workflows.StepDependency:
    properties:
      depends_on_step:
        $ref: '#/definitions/workflows.WorkflowStepDefinition'
      depends_on_step_id:
        type: string
      id:
        type: string
      workflow_step_definition:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowStepDefinition'
        description: Relationships
      workflow_step_definition_id:
        type: string
    type: object
  workflows.StepEvidence:
    properties:
      created-at:
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      description:
        type: string
      evidence:
        $ref: '#/definitions/relational.Evidence'
      evidence_id:
        description: Link to main evidence table
        type: string
      evidence_type:
        description: document, attestation, screenshot, log
        type: string
      file-size:
        description: File size in bytes
        type: integer
      file_hash:
        description: SHA-256 hash of file
        type: string
      file_path:
        description: Path to stored file
        type: string
      id:
        type: string
      metadata:
        description: JSON metadata
        type: string
      name:
        description: Evidence Information
        type: string
      step_execution:
        allOf:
        - $ref: '#/definitions/workflows.StepExecution'
        description: Relationships
      step_execution_id:
        description: Foreign Keys
        type: string
      updated-at:
        type: string
    type: object
  workflows.StepExecution:
    properties:
      assigned-at:
        type: string
      assigned_to_id:
        description: User ID, group ID, or email
        type: string
      assigned_to_type:
        description: Assignment Information
        type: string
      completed-at:
        type: string
      created-at:
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      due_date:
        type: string
      failed-at:
        type: string
      failure_reason:
        type: string
      id:
        type: string
      overdue-at:
        type: string
      reassignment_history:
        items:
          $ref: '#/definitions/workflows.StepReassignmentHistory'
        type: array
      started-at:
        type: string
      status:
        description: Execution Information
        type: string
      step_evidence:
        items:
          $ref: '#/definitions/workflows.StepEvidence'
        type: array
      updated-at:
        type: string
      workflow_execution:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowExecution'
        description: Relationships
      workflow_execution_id:
        description: Foreign Keys
        type: string
      workflow_step_definition:
        $ref: '#/definitions/workflows.WorkflowStepDefinition'
      workflow_step_definition_id:
        type: string
    type: object
  workflows.StepExecutionListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.StepExecution'
        type: array
    type: object
  workflows.StepExecutionResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.StepExecution'
    type: object
  workflows.StepReassignmentHistory:
    properties:
      created-at:
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      id:
        type: string
      new_assigned_to_id:
        type: string
      new_assigned_to_type:
        type: string
      previous_assigned_to_id:
        type: string
      previous_assigned_to_type:
        type: string
      reason:
        type: string
      reassigned_by_email:
        type: string
      reassigned_by_user_id:
        type: string
      step_execution:
        $ref: '#/definitions/workflows.StepExecution'
      step_execution_id:
        type: string
      updated-at:
        type: string
      workflow_execution_id:
        type: string
    type: object
  workflows.StepTrigger:
    properties:
      id:
        type: string
      is_active:
        type: boolean
      trigger_condition:
        description: JSON condition expression
        type: string
      trigger_type:
        description: evidence_stream, time_based, external_event
        type: string
      workflow_step_definition:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowStepDefinition'
        description: Relationships
      workflow_step_definition_id:
        type: string
    type: object
  workflows.TransitionStepRequest:
    properties:
      evidence:
        items:
          $ref: '#/definitions/workflow.EvidenceSubmission'
        type: array
      notes:
        type: string
      status:
        enum:
        - in_progress
        - completed
        type: string
      user-id:
        type: string
      user-type:
        enum:
        - user
        - group
        - email
        type: string
    required:
    - status
    type: object
  workflows.UpdateControlRelationshipRequest:
    properties:
      description:
        type: string
      relationship-type:
        type: string
      strength:
        type: string
    type: object
  workflows.UpdateRoleAssignmentRequest:
    properties:
      assigned-to-id:
        type: string
      assigned-to-type:
        type: string
    type: object
  workflows.UpdateWorkflowDefinitionRequest:
    properties:
      description:
        type: string
      grace-period-days:
        type: integer
      name:
        type: string
      suggested-cadence:
        type: string
      version:
        type: string
    type: object
  workflows.UpdateWorkflowInstanceRequest:
    properties:
      cadence:
        type: string
      description:
        type: string
      grace-period-days:
        type: integer
      is-active:
        type: boolean
      name:
        type: string
    type: object
  workflows.UpdateWorkflowStepDefinitionRequest:
    properties:
      depends-on:
        items:
          type: string
        type: array
      description:
        type: string
      estimated-duration:
        type: integer
      evidence-required:
        items:
          $ref: '#/definitions/workflows.EvidenceRequirement'
        type: array
      grace-period-days:
        type: integer
      name:
        type: string
      responsible-role:
        type: string
    type: object
  workflows.WorkflowDefinition:
    properties:
      control_relationships:
        items:
          $ref: '#/definitions/workflows.ControlRelationship'
        type: array
      created-at:
        type: string
      created_by_id:
        description: Audit Fields
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      description:
        type: string
      grace-period-days:
        description: Override global default if set
        type: integer
      id:
        type: string
      instances:
        items:
          $ref: '#/definitions/workflows.WorkflowInstance'
        type: array
      name:
        description: Basic Information
        type: string
      step_count:
        description: Computed field (not persisted)
        minimum: 0
        type: integer
      steps:
        description: Relationships
        items:
          $ref: '#/definitions/workflows.WorkflowStepDefinition'
        type: array
      suggested_cadence:
        description: Workflow Configuration
        type: string
      updated-at:
        type: string
      updated_by_id:
        type: string
      version:
        type: string
    type: object
  workflows.WorkflowDefinitionListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.WorkflowDefinition'
        type: array
    type: object
  workflows.WorkflowDefinitionResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.WorkflowDefinition'
    type: object
  workflows.WorkflowExecution:
    properties:
      completed-at:
        type: string
      created-at:
        type: string
      created_by_id:
        description: Audit Fields
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      due_date:
        type: string
      execution_stream_uuid:
        description: Computed field (not persisted)
        format: uuid
        readOnly: true
        type: string
      failed-at:
        type: string
      failure_reason:
        type: string
      id:
        type: string
      overdue-at:
        type: string
      period_label:
        description: Scheduling Context
        type: string
      started-at:
        type: string
      status:
        description: Execution Information
        type: string
      step_executions:
        items:
          $ref: '#/definitions/workflows.StepExecution'
        type: array
      triggered_by:
        description: Execution Context
        type: string
      triggered_by_id:
        description: User ID or system identifier
        type: string
      updated-at:
        type: string
      updated_by_id:
        type: string
      workflow_instance:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowInstance'
        description: Relationships
      workflow_instance_id:
        description: Foreign Keys
        type: string
    type: object
  workflows.WorkflowExecutionListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.WorkflowExecution'
        type: array
    type: object
  workflows.WorkflowExecutionMetricsResponse:
    properties:
      data:
        $ref: '#/definitions/workflow.ExecutionMetrics'
    type: object
  workflows.WorkflowExecutionResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.WorkflowExecution'
    type: object
  workflows.WorkflowExecutionStatusResponse:
    properties:
      data:
        $ref: '#/definitions/workflow.ExecutionStatus'
    type: object
  workflows.WorkflowImportDataResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.WorkflowImportResponse'
    type: object
  workflows.WorkflowImportFileResult:
    properties:
      filename:
        type: string
      message:
        type: string
      success:
        type: boolean
      summary:
        $ref: '#/definitions/workflows.SeedSummary'
    type: object
  workflows.WorkflowImportResponse:
    properties:
      failed_files:
        type: integer
      results:
        items:
          $ref: '#/definitions/workflows.WorkflowImportFileResult'
        type: array
      successful_files:
        type: integer
      summary:
        $ref: '#/definitions/workflows.SeedSummary'
      total_files:
        type: integer
    type: object
  workflows.WorkflowInstance:
    properties:
      cadence:
        description: Instance Configuration
        type: string
      created-at:
        type: string
      created_by_id:
        description: Audit Fields
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      description:
        type: string
      executions:
        items:
          $ref: '#/definitions/workflows.WorkflowExecution'
        type: array
      grace-period-days:
        description: Override definition/global default if set
        type: integer
      id:
        type: string
      is_active:
        type: boolean
      last-executed-at:
        type: string
      name:
        description: Basic Information
        type: string
      next-scheduled-at:
        description: Scheduling
        type: string
      role_assignments:
        items:
          $ref: '#/definitions/workflows.RoleAssignment'
        type: array
      system_id:
        type: string
      system_security_plan:
        allOf:
        - $ref: '#/definitions/relational.SystemSecurityPlan'
        description: Relationships
      updated-at:
        type: string
      updated_by_id:
        type: string
      workflow_definition:
        $ref: '#/definitions/workflows.WorkflowDefinition'
      workflow_definition_id:
        description: Foreign Keys
        type: string
    type: object
  workflows.WorkflowInstanceListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.WorkflowInstance'
        type: array
    type: object
  workflows.WorkflowInstanceResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.WorkflowInstance'
    type: object
  workflows.WorkflowStepDefinition:
    properties:
      created-at:
        type: string
      deleted_at:
        $ref: '#/definitions/gorm.DeletedAt'
      dependent_steps:
        items:
          $ref: '#/definitions/workflows.StepDependency'
        type: array
      depends_on:
        items:
          $ref: '#/definitions/workflows.StepDependency'
        type: array
      description:
        type: string
      estimated_duration:
        description: Estimated duration in minutes
        type: integer
      evidence_required:
        description: JSON array of required evidence types
        items:
          $ref: '#/definitions/workflows.EvidenceRequirement'
        type: array
      grace-period-days:
        description: Override default grace for this specific step
        type: integer
      id:
        type: string
      name:
        description: Basic Information
        type: string
      order:
        description: Step Configuration
        type: integer
      responsible_role:
        description: Role responsible for this step
        type: string
      step_executions:
        items:
          $ref: '#/definitions/workflows.StepExecution'
        type: array
      triggers:
        items:
          $ref: '#/definitions/workflows.StepTrigger'
        type: array
      updated-at:
        type: string
      workflow_definition:
        allOf:
        - $ref: '#/definitions/workflows.WorkflowDefinition'
        description: Relationships
      workflow_definition_id:
        description: Foreign Keys
        type: string
    type: object
  workflows.WorkflowStepDefinitionListResponse:
    properties:
      data:
        items:
          $ref: '#/definitions/workflows.WorkflowStepDefinition'
        type: array
    type: object
  workflows.WorkflowStepDefinitionResponse:
    properties:
      data:
        $ref: '#/definitions/workflows.WorkflowStepDefinition'
    type: object
externalDocs:
  description: OpenAPI
  url: https://swagger.io/resources/open-api/
host: localhost:8080
info:
  contact: {}
  description: This is the API for the Continuous Compliance Framework.
  title: Continuous Compliance Framework API
  version: "1"
paths:
  /admin/agents/{id}/config:
    get:
      description: Returns the current configuration revision (overlay as an RFC 7396
        merge patch, snake_case). Revision 0 means no overlay. The ETag is the plain
        revision number; send it as If-Match when saving. The overlay is verbatim
        for callers that also hold agent:configure; for every other caller it is redacted
        like an instance report (secret-like keys and values become ••••), and it
        is redacted whenever that check cannot be evaluated. Prefer ${env:NAME} placeholders
        to literal secrets.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get an agent's configuration overlay
      tags:
      - Agent Configuration
    put:
      consumes:
      - application/json
      description: 'Creates the next configuration revision. Requires If-Match with
        the current revision ("0" for the first save): missing is 428, stale is 409
        with current-revision. A semantically unchanged overlay returns 200 with the
        current revision and creates nothing. The overlay is validated on its own,
        and the merged config is validated against every fresh apply-mode instance''s
        reported base (or the latest reported one); only errors the overlay introduces
        block (errors already present in the instance''s own file are ignored, R59).
        Errors are a 422 with overlay and instances (errors plus non-blocking warnings)
        lists. Needs agent:configure.'
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Current revision, e.g. \
        in: header
        name: If-Match
        required: true
        type: string
      - description: Overlay and optional comment
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.agentConfigPutRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "415":
          description: Unsupported Media Type
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "428":
          description: Precondition Required
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Save an agent's configuration overlay
      tags:
      - Agent Configuration
  /admin/agents/{id}/config/preview:
    post:
      consumes:
      - application/json
      description: Validates a candidate overlay without saving it and shows, per
        reporting instance (fresh and stale), the redacted effective config, its diff
        against the instance's current effective config, the classified changes and
        whether the agent would apply it. validated marks the instances a save validates
        against; only their errors block a save. errors are the problems the overlay
        introduces; warnings are problems already in the instance's own file (present
        in Merge(base, {})), which never block a save or force invalid-config (R59).
        Validation problems are returned in the 200 body; when the overlay itself
        is invalid (overlay-errors), instances is empty. At most 50 instances and
        16 MiB of reported config are previewed (validated instances first, then newest
        first); omitted-instances counts the rest. A save still validates against
        every validated instance. Needs agent:configure.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Candidate overlay
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.agentConfigPreviewRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_configPreviewResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "415":
          description: Unsupported Media Type
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Preview an agent configuration overlay
      tags:
      - Agent Configuration
  /admin/agents/{id}/config/revisions:
    get:
      description: Revisions newest first, without overlays.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Page (default 1)
        in: query
        name: page
        type: integer
      - description: Page size (default 50, max 100)
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_agentConfigRevisionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List an agent's configuration revisions
      tags:
      - Agent Configuration
  /admin/agents/{id}/config/revisions/{rev}:
    get:
      description: The overlay is verbatim for callers that also hold agent:configure
        and redacted (secret-like keys and values become ••••) for every other caller,
        as on GET config.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Revision number
        in: path
        name: rev
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get one configuration revision
      tags:
      - Agent Configuration
  /admin/agents/{id}/config/revisions/{rev}/revert:
    post:
      consumes:
      - application/json
      description: Creates the next revision with the overlay of revision :rev (revert-of
        records it). Same If-Match, validation and authorization rules as PUT. The
        body is optional.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Revision to restore
        in: path
        name: rev
        required: true
        type: integer
      - description: Current revision, e.g. \
        in: header
        name: If-Match
        required: true
        type: string
      - description: Optional comment
        in: body
        name: body
        schema:
          $ref: '#/definitions/handler.agentConfigRevertRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentConfigRevisionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "415":
          description: Unsupported Media Type
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "428":
          description: Precondition Required
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Revert an agent's configuration to an earlier revision
      tags:
      - Agent Configuration
  /admin/agents/{id}/instances:
    get:
      description: One page of summaries of the instances that reported or heartbeated
        with a config digest, most recently seen first, with the derived status (pending
        and unknown are server-derived), sync status and staleness. meta.counts and
        meta.desired-revision cover all of the agent's instances, not just the page;
        meta.page, meta.limit, meta.total and meta.total-pages describe the page.
        A limit above 25 is capped at 25, since one instance's summary can reach about
        3 MiB once encoded. Base/effective configs are on the instance detail route.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Page (default 1)
        in: query
        name: page
        type: integer
      - description: Page size (default 25, max 25)
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            allOf:
            - $ref: '#/definitions/handler.GenericDataListResponse-handler_agentInstanceSummary'
            - properties:
                meta:
                  $ref: '#/definitions/handler.agentInstancesMeta'
              type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List an agent's instances
      tags:
      - Agent Configuration
  /admin/agents/{id}/instances/{instanceId}:
    get:
      description: The instance's summary plus its redacted base and effective configs
        (snake_case). instanceId is the agent-side instance UUID.
      parameters:
      - description: Agent ID
        in: path
        name: id
        required: true
        type: string
      - description: Instance ID
        in: path
        name: instanceId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_agentInstanceDetail'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get one agent instance
      tags:
      - Agent Configuration
  /admin/ai-diagnostics/runs:
    get:
      description: Lists dashboard suggestion runs across all SSPs, newest first,
        with optional status and SSP filters.
      parameters:
      - description: Run status
        enum:
        - pending
        - running
        - completed
        - failed
        in: query
        name: status
        type: string
      - description: System Security Plan ID
        in: query
        name: sspId
        type: string
      - description: Page size, default 25, max 100
        in: query
        maximum: 100
        minimum: 1
        name: limit
        type: integer
      - description: Opaque pagination cursor
        in: query
        name: cursor
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_AiDiagnosticsRun'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List AI diagnostic runs
      tags:
      - AI Diagnostics
  /admin/ai-diagnostics/runs/{runId}:
    get:
      description: Returns one dashboard suggestion run with cells and events.
      parameters:
      - description: Dashboard suggestion run ID
        in: path
        name: runId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_AiDiagnosticsRunDetail'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get AI diagnostic run detail
      tags:
      - AI Diagnostics
  /admin/ai-diagnostics/summary:
    get:
      description: Returns cross-SSP dashboard suggestion totals, suggestion queue
        stats, and health checks for admins.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_AiDiagnosticsSummary'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get AI diagnostics summary
      tags:
      - AI Diagnostics
  /admin/digest/preview:
    get:
      description: Returns the current evidence summary that would be included in
        a digest email
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-digest_EvidenceSummary'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Preview evidence digest
      tags:
      - Digest
  /admin/digest/trigger:
    post:
      description: Manually triggers the evidence digest job to send emails to all
        users
      parameters:
      - description: 'Job name to trigger (default: global-evidence-digest)'
        in: query
        name: job
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties:
              type: string
            type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Trigger evidence digest
      tags:
      - Digest
  /admin/groups:
    get:
      description: Lists all native CCF user groups with their member counts
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_groupResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List user groups
      tags:
      - Groups
    post:
      consumes:
      - application/json
      description: Creates a native CCF user group
      parameters:
      - description: Group details
        in: body
        name: group
        required: true
        schema:
          $ref: '#/definitions/handler.GroupsHandler'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_UserGroup'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a user group
      tags:
      - Groups
  /admin/groups/{id}:
    delete:
      description: Soft-deletes an empty native CCF user group and removes its SSO
        mappings. Returns 409 if the group still has members.
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a user group
      tags:
      - Groups
    get:
      description: Get a native CCF user group by ID
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_groupResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a user group
      tags:
      - Groups
    put:
      consumes:
      - application/json
      description: Updates a native CCF user group's name or description
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      - description: Group details
        in: body
        name: group
        required: true
        schema:
          $ref: '#/definitions/handler.GroupsHandler'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_UserGroup'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a user group
      tags:
      - Groups
  /admin/groups/{id}/members:
    get:
      description: Lists the users that belong to a native CCF user group
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_groupMemberResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List group members
      tags:
      - Groups
    post:
      consumes:
      - application/json
      description: Adds a user to a native CCF user group (idempotent)
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      - description: Member to add
        in: body
        name: member
        required: true
        schema:
          $ref: '#/definitions/handler.GroupsHandler'
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a group member
      tags:
      - Groups
  /admin/groups/{id}/members/{userId}:
    delete:
      description: Removes a manually-added user from a native CCF user group. Returns
        403 for SSO-synced memberships, which are managed by the identity provider.
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      - description: User ID
        in: path
        name: userId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Remove a group member
      tags:
      - Groups
  /admin/groups/{id}/roles:
    get:
      description: Returns the roles assigned directly to a native CCF group.
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_CCFRoleAssignment'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a group's roles
      tags:
      - RoleAssignments
  /admin/groups/{id}/sso-mappings:
    get:
      description: Lists the external IdP groups mapped to a native CCF user group
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SSOGroupMapping'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List SSO group mappings
      tags:
      - Groups
    post:
      consumes:
      - application/json
      description: Maps an external IdP group (provider + group name) onto a native
        CCF user group
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      - description: SSO mapping
        in: body
        name: mapping
        required: true
        schema:
          $ref: '#/definitions/handler.GroupsHandler'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSOGroupMapping'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Map an SSO group to a user group
      tags:
      - Groups
  /admin/groups/{id}/sso-mappings/{mappingId}:
    delete:
      description: Removes an external IdP group mapping from a native CCF user group
      parameters:
      - description: Group ID
        in: path
        name: id
        required: true
        type: string
      - description: Mapping ID
        in: path
        name: mappingId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Remove an SSO group mapping
      tags:
      - Groups
  /admin/notifications:
    get:
      description: Returns system notification destination configurations for admin
        management
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_systemNotificationResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List system notification destinations
      tags:
      - Notifications
  /admin/notifications/{notificationName}/destinations:
    delete:
      consumes:
      - application/json
      description: Deletes a stored system notification destination configuration
        for an admin-managed notification
      parameters:
      - description: Notification name
        in: path
        name: notificationName
        required: true
        type: string
      - description: Destination details
        in: body
        name: destination
        required: true
        schema:
          $ref: '#/definitions/handler.createSystemNotificationDestinationRequest'
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete system notification destination
      tags:
      - Notifications
    post:
      consumes:
      - application/json
      description: Creates a new system notification destination configuration for
        an admin-managed notification
      parameters:
      - description: Notification name
        in: path
        name: notificationName
        required: true
        type: string
      - description: Destination details
        in: body
        name: destination
        required: true
        schema:
          $ref: '#/definitions/handler.createSystemNotificationDestinationRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_configuredSystemDestinationResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create system notification destination
      tags:
      - Notifications
  /admin/notifications/{notificationName}/diagnostics:
    get:
      description: Runs read-only diagnostics for evidence digest, workflow, risk,
        or POAM notifications
      parameters:
      - description: Notification name or family
        in: path
        name: notificationName
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-notificationtroubleshooting_DiagnosticsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get notification diagnostics
      tags:
      - Notifications
  /admin/notifications/health:
    get:
      description: Returns provider, worker, queue, subscriber, destination, and schedule
        health for admin notification troubleshooting
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-notificationtroubleshooting_HealthResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get notification troubleshooting health
      tags:
      - Notifications
  /admin/notifications/jobs:
    get:
      description: Lists recent notification-related River jobs with sanitized notification
        metadata
      parameters:
      - collectionFormat: csv
        description: Queue filter; repeat or comma-separate values
        in: query
        items:
          type: string
        name: queue
        type: array
      - description: 'Provider filter: email or slack'
        enum:
        - email
        - slack
        in: query
        name: provider
        type: string
      - description: Notification kind filter
        in: query
        name: notificationKind
        type: string
      - collectionFormat: csv
        description: River state filter; repeat or comma-separate values
        in: query
        items:
          enum:
          - available
          - cancelled
          - completed
          - discarded
          - pending
          - retryable
          - running
          - scheduled
          type: string
        name: state
        type: array
      - description: RFC3339 lower bound for job creation time
        format: date-time
        in: query
        name: since
        type: string
      - description: Page size, default 50, max 200
        in: query
        maximum: 200
        minimum: 1
        name: limit
        type: integer
      - description: Opaque pagination cursor
        in: query
        name: cursor
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/notificationtroubleshooting.JobsListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List notification River jobs
      tags:
      - Notifications
  /admin/notifications/jobs/{id}:
    get:
      description: Returns one sanitized notification-related River job with attempt
        errors
      parameters:
      - description: River job ID
        in: path
        name: id
        required: true
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-notificationtroubleshooting_JobDetail'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get notification River job detail
      tags:
      - Notifications
  /admin/notifications/providers:
    get:
      description: Returns notification providers registered in the backend
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_availableNotificationProviderResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List available notification providers
      tags:
      - Notifications
  /admin/notifications/test:
    post:
      consumes:
      - application/json
      description: Enqueues a fixed server-side test notification to a validated admin-supplied
        destination
      parameters:
      - description: Test destination
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/handler.testNotificationRequest'
      produces:
      - application/json
      responses:
        "202":
          description: Accepted
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_testNotificationResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
        "503":
          description: Service Unavailable
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Enqueue fixed test notification
      tags:
      - Notifications
  /admin/risk-templates:
    get:
      description: List risk templates with optional filters and pagination.
      parameters:
      - description: Plugin ID
        in: query
        name: plugin-id
        type: string
      - description: Policy package
        in: query
        name: policy-package
        type: string
      - description: Active flag
        in: query
        name: is-active
        type: boolean
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-templates_riskTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk templates
      tags:
      - Risk Templates
    post:
      consumes:
      - application/json
      description: Create a risk template with threat references and remediation template/tasks.
      parameters:
      - description: Risk template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/templates.upsertRiskTemplateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/templates.riskTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create risk template
      tags:
      - Risk Templates
  /admin/risk-templates/{id}:
    delete:
      description: Delete a risk template and its associated threat references and
        remediation data.
      parameters:
      - description: Risk Template ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk template
      tags:
      - Risk Templates
    get:
      description: Get a risk template by ID.
      parameters:
      - description: Risk Template ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.riskTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk template
      tags:
      - Risk Templates
    put:
      consumes:
      - application/json
      description: Update a risk template and atomically replace threat refs and remediation
        tasks.
      parameters:
      - description: Risk Template ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/templates.upsertRiskTemplateRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.riskTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update risk template
      tags:
      - Risk Templates
  /admin/role-assignments:
    get:
      description: Lists system-level role assignments, optionally filtered by assignee
        (type and/or id) or role.
      parameters:
      - description: Filter by assignee type (user|group)
        in: query
        name: assigneeType
        type: string
      - description: Filter by assignee id (email or group name)
        in: query
        name: assigneeId
        type: string
      - description: Filter by role name
        in: query
        name: roleName
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_CCFRoleAssignment'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List role assignments
      tags:
      - RoleAssignments
    post:
      consumes:
      - application/json
      description: 'Grants a manifest role to a user (by email) or group (by name),
        system-wide. The grant is source=manual and becomes the PDP''s source of truth
        for that subject''s role. The assignee is not required to exist: a user may
        be granted ahead of signup, and a group grant is matched by name and stays
        inert until a group with that name exists (a rename orphans it) — consistent
        with the prior file-based model.'
      parameters:
      - description: Role assignment
        in: body
        name: assignment
        required: true
        schema:
          $ref: '#/definitions/handler.createRoleAssignmentRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_CCFRoleAssignment'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a role assignment
      tags:
      - RoleAssignments
  /admin/role-assignments/{id}:
    delete:
      description: Deletes a manual role assignment. Config-sourced grants (managed
        by the boot reconcile) cannot be deleted and return 409.
      parameters:
      - description: Role assignment ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a role assignment
      tags:
      - RoleAssignments
  /admin/subject-templates:
    get:
      description: List subject templates with optional filters and pagination.
      parameters:
      - description: Subject type
        in: query
        name: type
        type: string
      - description: Source mode
        in: query
        name: source-mode
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-templates_subjectTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List subject templates
      tags:
      - Subject Templates
    post:
      consumes:
      - application/json
      description: Create a subject template with selector labels and label schema.
      parameters:
      - description: Subject template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/templates.upsertSubjectTemplateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/templates.subjectTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create subject template
      tags:
      - Subject Templates
  /admin/subject-templates/{id}:
    get:
      description: Get a subject template by ID.
      parameters:
      - description: Subject Template ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.subjectTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get subject template
      tags:
      - Subject Templates
    put:
      consumes:
      - application/json
      description: Update a subject template and atomically replace selector labels
        and label schema.
      parameters:
      - description: Subject Template ID
        in: path
        name: id
        required: true
        type: string
      - description: Subject template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/templates.upsertSubjectTemplateRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.subjectTemplateDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update subject template
      tags:
      - Subject Templates
  /admin/users:
    get:
      description: Lists all users in the system
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_User'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List all users
      tags:
      - Users
    post:
      consumes:
      - application/json
      description: Creates a new user in the system
      parameters:
      - description: User details
        in: body
        name: user
        required: true
        schema:
          $ref: '#/definitions/handler.UserHandler'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_User'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new user
      tags:
      - Users
  /admin/users/{id}:
    delete:
      description: Deletes a user from the system
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a user
      tags:
      - Users
    get:
      description: Get user details by user ID
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_User'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get user by ID
      tags:
      - Users
    put:
      consumes:
      - application/json
      description: Updates the details of an existing user
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      - description: User details
        in: body
        name: user
        required: true
        schema:
          $ref: '#/definitions/handler.UserHandler'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_User'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update user details
      tags:
      - Users
  /admin/users/{id}/groups:
    get:
      description: Returns the native CCF groups a user belongs to, flagging memberships
        inherited from an SSO IdP (read-only) vs assigned natively.
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_userGroupMembershipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List a user's native group memberships
      tags:
      - Users
  /admin/users/{id}/roles:
    get:
      description: 'Returns a user''s effective roles: direct grants plus roles inherited
        from the user''s native groups (each inherited entry names the granting group).
        Matches what the PDP enforces.'
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_effectiveRole'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a user's effective roles
      tags:
      - RoleAssignments
  /agent/artifacts:
    post:
      consumes:
      - application/json
      - application/vnd.ccf.policy-bundle.v1+tar
      description: Stores the request body as an immutable artifact and returns its
        digest. The API converts the body to its canonical form first, so equal content
        always gets one digest. Content-Type application/json accepts any JSON value;
        application/vnd.ccf.policy-bundle.v1+tar accepts a policy bundle as a tar
        or gzipped tar. Uploading content that is already stored returns 200 and changes
        nothing. Needs an agent token, or none while public agent endpoints are allowed.
      produces:
      - application/json
      responses:
        "200":
          description: Already stored
          schema:
            $ref: '#/definitions/artifact.Info'
        "201":
          description: Stored
          schema:
            $ref: '#/definitions/artifact.Info'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "429":
          description: Too Many Requests
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Upload an artifact
      tags:
      - Artifacts
  /agent/config:
    get:
      description: Returns the authenticated agent's current remote-configuration
        overlay (an RFC 7396 merge patch over its local config file, snake_case) with
        an opaque ETag. Send the raw ETag back as If-None-Match to get a 304 when
        nothing changed; never construct one. Revision 0 means no overlay. Agent JWT
        only; a 404 means the API predates remote configuration.
      parameters:
      - description: ETag of the overlay the agent already has
        in: header
        name: If-None-Match
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-agentconfig_OverlayDocument'
        "304":
          description: Not Modified
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get this agent's configuration overlay
      tags:
      - Agents
  /agent/heartbeat:
    post:
      consumes:
      - application/json
      description: 'Creates a new heartbeat record for monitoring. An authenticated
        agent heartbeat also refreshes the instance''s last-seen time; with config_digest
        (new agents, mode != off) it records config_revision/config_digest and registers
        the instance if needed. That registration is authorized by heartbeat:ingest,
        not agent:sync: removing sync from an agent''s role stops overlay fetches
        and config reports, not instance registration by heartbeats.'
      parameters:
      - description: Heartbeat payload
        in: body
        name: heartbeat
        required: true
        schema:
          $ref: '#/definitions/handler.HeartbeatCreateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create Heartbeat
      tags:
      - Heartbeat
  /agent/heartbeat/over-time:
    get:
      description: Retrieves heartbeat counts aggregated by 2-minute intervals.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_OverTime_HeartbeatInterval'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get Heartbeat Metrics Over Time
      tags:
      - Heartbeat
  /agent/instances/{instanceId}/config-report:
    put:
      consumes:
      - application/json
      description: 'Stores the authenticated agent instance''s config report: mode,
        applied/attempted revision, status (applied, rejected, failed or not-applicable;
        the server derives pending and unknown), the redacted base and effective configs
        (snake_case), the effective digest, plugins (with their agent-library version),
        unsafe changes, warnings and the normalized local remote_config block. The
        server re-redacts base and effective as a best effort, replaces error, warning
        messages, plugin sources, unsafe change values and remote-config strings that
        contain a secret with ••••, and stores effective-digest as sent. Long warning
        messages, unsafe lists and remote-config are truncated (truncated=true); a
        remote-config list entry over the length cap is dropped, not cut. A NUL character
        anywhere is a 400. Body limit 4 MiB. A 409 means the per-agent instance cap
        is reached; back off.'
      parameters:
      - description: Agent instance ID (UUID)
        in: path
        name: instanceId
        required: true
        type: string
      - description: Config report
        in: body
        name: report
        required: true
        schema:
          $ref: '#/definitions/agentconfig.Report'
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "415":
          description: Unsupported Media Type
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Report this instance's effective configuration
      tags:
      - Agents
  /agent/risk-templates/batch:
    post:
      consumes:
      - application/json
      description: |-
        Reconcile the full set of risk templates for a (plugin-id, policy-package) scope.
        Creates, updates, and deletes templates atomically. Templates not present in the payload are always deleted.
      parameters:
      - description: Batch upsert payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/templates.batchUpsertRiskTemplatesRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.batchUpsertRiskTemplatesResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Batch upsert risk templates
      tags:
      - Risk Templates
  /agent/subject-templates/batch:
    post:
      consumes:
      - application/json
      description: |-
        Reconcile the full set of subject templates for a plugin (scoped via selector-label key="_plugin").
        Creates, updates, and deletes templates atomically. Templates not present in the payload are always deleted.
      parameters:
      - description: Batch upsert payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/templates.batchUpsertSubjectTemplatesRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/templates.batchUpsertSubjectTemplatesResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Batch upsert subject templates
      tags:
      - Subject Templates
  /artifacts/{digest}:
    get:
      description: Returns the canonical bytes of the artifact with the digest, with
        its media type. Any logged-in user or agent may read artifacts.
      parameters:
      - description: Artifact digest, sha256:<64 hex>
        in: path
        name: digest
        required: true
        type: string
      produces:
      - application/json
      - application/vnd.ccf.policy-bundle.v1+tar
      responses:
        "200":
          description: OK
          schema:
            type: file
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Download an artifact
      tags:
      - Artifacts
  /auth/forgot-password:
    post:
      consumes:
      - application/json
      description: Sends a password reset email to users with authMethod=password
      parameters:
      - description: Email
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.AuthHandler'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-string'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Forgot password
      tags:
      - Auth
  /auth/login:
    post:
      consumes:
      - application/json
      description: Login user and returns a JWT token and sets a cookie with the token
      parameters:
      - description: Login Data
        in: body
        name: loginRequest
        required: true
        schema:
          $ref: '#/definitions/auth.AuthHandler'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-auth_AuthHandler'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-auth_AuthHandler'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Login user
      tags:
      - Auth
  /auth/password-reset:
    post:
      consumes:
      - application/json
      description: Resets password using a valid JWT token
      parameters:
      - description: Reset data
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.AuthHandler'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-string'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Reset password
      tags:
      - Auth
  /auth/publickey:
    get:
      consumes:
      - application/json
      description: Get JSON Web Key (JWK) representation of the JWT public key
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/authn.JWK'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get JWK
      tags:
      - Auth
  /auth/token:
    post:
      consumes:
      - application/x-www-form-urlencoded
      description: Get OAuth2 token using username and password
      parameters:
      - description: Username (email)
        in: formData
        name: username
        required: true
        type: string
      - description: Password
        in: formData
        name: password
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/auth.AuthHandler'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get OAuth2 token
      tags:
      - Auth
  /control-links:
    delete:
      description: Deletes the control link identified by its full composite key (all
        query params required).
      parameters:
      - description: Source catalog id
        in: query
        name: sourceCatalogId
        required: true
        type: string
      - description: Source control id
        in: query
        name: sourceControlId
        required: true
        type: string
      - description: Target catalog id
        in: query
        name: targetCatalogId
        required: true
        type: string
      - description: Target control id
        in: query
        name: targetControlId
        required: true
        type: string
      - description: Relationship type
        in: query
        name: relationshipType
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a control link
      tags:
      - ControlLink
    get:
      description: Lists typed control-to-control links, filterable by either endpoint,
        paginated.
      parameters:
      - description: Filter by source catalog id
        in: query
        name: sourceCatalogId
        type: string
      - description: Filter by source control id
        in: query
        name: sourceControlId
        type: string
      - description: Filter by target catalog id
        in: query
        name: targetCatalogId
        type: string
      - description: Filter by target control id
        in: query
        name: targetControlId
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-relational_ControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List control links
      tags:
      - ControlLink
    post:
      consumes:
      - application/json
      description: Creates one typed control-to-control link after validating endpoint
        existence, the relationship vocabulary matrix, and acyclicity.
      parameters:
      - description: Control link
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.createControlLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_ControlLink'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a control link
      tags:
      - ControlLink
  /control-links/bulk:
    post:
      consumes:
      - application/json
      description: Idempotently upserts many control links (ON CONFLICT DO NOTHING).
        Invalid vocabulary/existence rejects the batch; cycles and duplicates are
        skipped.
      parameters:
      - description: Control links
        in: body
        name: links
        required: true
        schema:
          $ref: '#/definitions/handler.bulkControlLinkRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_bulkControlLinkResponse'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Bulk create control links
      tags:
      - ControlLink
  /control-links/catalog:
    delete:
      description: 'Deletes the whole fan-out set for a catalog-level link: every
        control_links row matching (source catalog, target control, relationship).
        All query params required.'
      parameters:
      - description: Source catalog id
        in: query
        name: sourceCatalogId
        required: true
        type: string
      - description: Target catalog id
        in: query
        name: targetCatalogId
        required: true
        type: string
      - description: Target control id
        in: query
        name: targetControlId
        required: true
        type: string
      - description: Relationship type
        in: query
        name: relationshipType
        required: true
        type: string
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_catalogLinkResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a catalog-level control link
      tags:
      - ControlLink
    get:
      description: 'Aggregates control_links into catalog-level links: one entry per
        (source catalog, target control, relationship) with the number of underlying
        control rows. Filterable by source/target catalog.'
      parameters:
      - description: Filter by source catalog id
        in: query
        name: sourceCatalogId
        type: string
      - description: Filter by target catalog id
        in: query
        name: targetCatalogId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-array_handler_catalogLinkSummary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List catalog-level control links
      tags:
      - ControlLink
    post:
      consumes:
      - application/json
      description: 'Fans a source catalog out to a single target control: creates
        one control_links row per control in the source catalog (implements/documents).
        Validates the relationship vocabulary against the catalog types once; skips
        cycles and existing rows (idempotent). 422 on a vocabulary/existence violation.'
      parameters:
      - description: Catalog-level link
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.catalogLinkRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_catalogLinkResponse'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a catalog-level control link
      tags:
      - ControlLink
    put:
      consumes:
      - application/json
      description: 'Idempotently refreshes a catalog-level link to the source catalog''s
        CURRENT controls: deletes the existing fan-out set for (source catalog, target
        control, relationship) and recreates it over every current control. Use after
        adding/removing controls in the source catalog.'
      parameters:
      - description: Catalog-level link
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.catalogLinkRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_catalogLinkResponse'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Re-sync a catalog-level control link
      tags:
      - ControlLink
  /dashboard-suggestions/config:
    get:
      description: Returns whether AI dashboard suggestions are enabled.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_dashboardSuggestionConfigResponse'
      summary: Get dashboard suggestions feature configuration
      tags:
      - Dashboard Suggestions
  /evidence:
    post:
      consumes:
      - application/json
      description: Creates a new Evidence record including activities, inventory items,
        components, and subjects.
      parameters:
      - description: Evidence create request
        in: body
        name: evidence
        required: true
        schema:
          $ref: '#/definitions/handler.EvidenceCreateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_CreatedEvidenceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create new Evidence
      tags:
      - Evidence
  /evidence/{id}:
    get:
      description: Retrieves a single Evidence record by its unique ID, including
        associated activities, inventory items, components, subjects, and labels.
      parameters:
      - description: Evidence ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_PublicEvidenceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get Evidence by ID
      tags:
      - Evidence
  /evidence/{id}/playback:
    get:
      description: Loads the policy bundle, input and policy data stored for the evidence,
        replays the evaluation in the playback sandbox at the evidence's end time,
        and compares the result with what the evidence recorded. JSON documents are
        returned as pretty-printed strings; inputs over 1 MiB are truncated (the full
        input is the input artifact). Evidence recorded without artifacts returns
        available false. Needs any user or agent token.
      parameters:
      - description: Evidence ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_EvidencePlaybackResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "429":
          description: Too Many Requests
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Play back an evidence's policy evaluation
      tags:
      - Playback
  /evidence/{id}/risks:
    get:
      description: Retrieves every risk register entry linked to the evidence record's
        stream, across all System Security Plans.
      parameters:
      - description: Evidence ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_EvidenceRiskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Risks linked to an Evidence stream
      tags:
      - Evidence
  /evidence/{id}/signature:
    get:
      description: Retrieves the stored signature envelope for a single Evidence record.
      parameters:
      - description: Evidence ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.EvidenceSignatureResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Evidence signature by ID
      tags:
      - Evidence
  /evidence/{id}/verify:
    post:
      description: Recomputes the current evidence content hash and verifies the stored
        signed payload.
      parameters:
      - description: Evidence ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.EvidenceSignatureVerificationResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Verify Evidence signature by ID
      tags:
      - Evidence
  /evidence/compliance-by-control/{id}:
    get:
      description: Retrieves the count of evidence statuses for filters associated
        with a specific Control ID.
      parameters:
      - description: Control ID
        in: path
        name: id
        required: true
        type: string
      - description: System Security Plan ID; limits filters to global + same-SSP
        in: query
        name: sspId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-evidence_StatusCount'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get compliance counts by control
      tags:
      - Evidence
  /evidence/compliance-by-filter/{id}:
    get:
      description: Retrieves the count of evidence statuses for a specific filter/dashboard.
      parameters:
      - description: Filter/Dashboard ID (UUID)
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-evidence_StatusCount'
        "400":
          description: Invalid UUID
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get compliance status counts by filter/dashboard ID
      tags:
      - Evidence
  /evidence/config:
    get:
      description: Reports whether evidence submitted by a user must name a subject
        (CCF_MANUAL_EVIDENCE_REQUIRE_SUBJECT).
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_evidenceConfigResponse'
      summary: Get evidence submission config
      tags:
      - Evidence
  /evidence/for-control/{id}:
    get:
      description: Retrieves Evidence records associated with a specific Control ID,
        including related activities, inventory items, components, subjects, and labels.
      parameters:
      - description: Control ID
        in: path
        name: id
        required: true
        type: string
      - description: System Security Plan ID; limits filters to global + same-SSP
        in: query
        name: sspId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.ForControl.EvidenceDataListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: List Evidence for a Control
      tags:
      - Evidence
  /evidence/history/{id}:
    get:
      description: Retrieves a the history for a Evidence record by its UUID, including
        associated activities, inventory items, components, subjects, and labels.
      parameters:
      - description: Evidence UUID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_PublicEvidenceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get Evidence history by UUID
      tags:
      - Evidence
  /evidence/latest/{id}:
    get:
      description: Retrieves the most recent Evidence record for a given UUID stream,
        including associated activities, inventory items, components, subjects, and
        labels.
      parameters:
      - description: Evidence UUID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_PublicEvidenceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get latest Evidence by UUID
      tags:
      - Evidence
  /evidence/search:
    post:
      consumes:
      - application/json
      description: Searches Evidence records by label filters.
      parameters:
      - description: Evidence search request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/handler.filteredSearchRequest'
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      - description: 'Sort field: lastSeenAt, name, status'
        in: query
        name: sortBy
        type: string
      - description: 'Sort direction: asc, desc'
        in: query
        name: sortDirection
        type: string
      - description: Case-insensitive evidence name search
        in: query
        name: name
        type: string
      - description: Only evidence with this subject
        in: query
        name: subjectUuid
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_PublicEvidenceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Search Evidence
      tags:
      - Evidence
  /evidence/status-over-time:
    post:
      consumes:
      - application/json
      description: Retrieves counts of evidence statuses at various time intervals
        based on a label filter.
      parameters:
      - description: Label filter
        in: body
        name: filter
        required: true
        schema:
          $ref: '#/definitions/labelfilter.Filter'
      - description: Comma-separated list of duration intervals (e.g., '10m,1h,24h')
        in: query
        name: intervals
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_StatusInterval'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Evidence status metrics over intervals
      tags:
      - Evidence
  /evidence/status-over-time/{id}:
    get:
      description: Retrieves counts of evidence statuses at various time intervals
        for a specific evidence stream identified by UUID.
      parameters:
      - description: Evidence UUID
        in: path
        name: id
        required: true
        type: string
      - description: Comma-separated list of duration intervals (e.g., '10m,1h,24h')
        in: query
        name: intervals
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_StatusInterval'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Evidence status metrics over intervals by UUID
      tags:
      - Evidence
  /filters:
    get:
      description: Retrieves filters, optionally filtered by controlId, componentId,
        sspId, or global scope.
      parameters:
      - description: Control ID
        in: query
        name: controlId
        type: string
      - description: Component ID
        in: query
        name: componentId
        type: string
      - description: System Security Plan ID; returns global + same-SSP filters
        in: query
        name: sspId
        type: string
      - description: Filter scope. Use 'global' for global filters only
        in: query
        name: scope
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_FilterWithAssociations'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: List filters
      tags:
      - Filters
    post:
      consumes:
      - application/json
      description: Creates a new filter.
      parameters:
      - description: Filter to add
        in: body
        name: filter
        required: true
        schema:
          $ref: '#/definitions/handler.createFilterRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_Filter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new filter
      tags:
      - Filters
  /filters/{id}:
    delete:
      description: Deletes a filter.
      parameters:
      - description: Filter ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a filter
      tags:
      - Filters
    get:
      description: Retrieves a single filter by its unique ID.
      parameters:
      - description: Filter ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_FilterWithAssociations'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get a filter
      tags:
      - Filters
    put:
      consumes:
      - application/json
      description: Updates an existing filter.
      parameters:
      - description: Filter ID
        in: path
        name: id
        required: true
        type: string
      - description: Filter to update
        in: body
        name: filter
        required: true
        schema:
          $ref: '#/definitions/handler.createFilterRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_Filter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a filter
      tags:
      - Filters
  /filters/{id}/responsibilities:
    post:
      consumes:
      - application/json
      description: |-
        Associates this filter with an upstream responsibility the given downstream
        SSP inherits (BCH-1339's filter_responsibilities), so the responsibility's
        posture is computed live from the filter's evidence. When controlId is given,
        the filter is also linked to that control (so control-level compliance
        surfaces include it) with provenance recorded: detaching removes the control
        link only if this attach created it.
      parameters:
      - description: Filter ID
        in: path
        name: id
        required: true
        type: string
      - description: Responsibility to attach
        in: body
        name: attachment
        required: true
        schema:
          $ref: '#/definitions/handler.attachFilterResponsibilityRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_FilterResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Attach a filter to an inherited responsibility
      tags:
      - Filters
  /filters/import:
    post:
      consumes:
      - multipart/form-data
      description: Import multiple dashboard filter JSON files
      parameters:
      - description: Dashboard filter JSON files to import
        in: formData
        name: files
        required: true
        type: file
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_FilterImportResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Import dashboard filters
      tags:
      - Filters
  /lineage/nodes/{key}/children:
    get:
      description: Returns one level of children for a node. Key is a composite like
        catalog:<uuid>, group:<catalogId>/<groupId>, control:<catalogId>/<controlId>,
        linkcat:<childCatalogId>/<relationship>/<parentCatalogId>/<parentControlId>,
        risk:<riskId>, evidence:<streamUuid>. A control expands to synthetic linkcat
        catalog nodes (its implementing/documenting controls grouped by their catalog)
        plus its directly-linked risks; a linkcat node expands to that group's controls;
        a risk expands to its latest evidence per linked stream; evidence is a leaf.
      parameters:
      - description: URL-encoded node key
        in: path
        name: key
        required: true
        type: string
      - description: Scope metrics to a System Security Plan
        in: query
        name: sspId
        type: string
      - description: Scope metrics to a system component
        in: query
        name: componentId
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size (default 100)
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_LineageNode'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List lineage node children
      tags:
      - Lineage
  /lineage/nodes/{key}/leverage:
    get:
      description: |-
        Returns, for a control node, one row per downstream System Security Plan that
        inherits the control from an upstream offering: every leverage link with its
        upstream origin (SSP + offering titles), full and outstanding responsibilities,
        live per-responsibility posture, and any open drift risk. Powers the lineage
        drawer's inherited-capability panel. Only control keys
        (control:<catalogId>/<controlId>) are supported; other node kinds return 400.
        Optional sspId filters to a single downstream SSP.
      parameters:
      - description: URL-encoded control node key
        in: path
        name: key
        required: true
        type: string
      - description: Filter to a single downstream SSP
        in: query
        name: sspId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_LineageLeverageRow'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Per-SSP inherited leverage detail for a control node
      tags:
      - Lineage
  /lineage/nodes/{key}/ssps:
    get:
      description: 'Returns, for a control node, one row per System Security Plan:
        whether the control is in that plan''s profile and its rolled-up posture,
        evidence status and declared implementation status there. Powers the drawer''s
        plan-by-plan table. Only control keys (control:<catalogId>/<controlId>) are
        supported; other node kinds return 400.'
      parameters:
      - description: URL-encoded control node key
        in: path
        name: key
        required: true
        type: string
      - description: Scope evidence to a system component
        in: query
        name: componentId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_LineageSSPRow'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Per-SSP status for a control node
      tags:
      - Lineage
  /lineage/roots:
    get:
      description: 'Returns active catalog roots (standard/policy/procedure) with
        full-subtree compliance and risk rollups. Rootness is catalog_type, never
        link presence; inactive catalogs are omitted from roots but still appear as
        children when a control-link points into them. NOTE: with sspId omitted but
        SSPs present, compliance.totalControls counts in-scope (control x SSP) cells,
        not distinct controls (a control tracked by N SSPs counts up to N).'
      parameters:
      - description: Scope metrics to a System Security Plan
        in: query
        name: sspId
        type: string
      - description: Scope metrics to a system component
        in: query
        name: componentId
        type: string
      - description: Comma-separated catalog types to include (standard,policy,procedure,internal,other)
        in: query
        name: types
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_LineageNode'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List lineage roots
      tags:
      - Lineage
  /notifications/providers:
    get:
      description: Returns notification provider availability for authenticated users
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_notificationProviderStatusResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List notification provider status
      tags:
      - Notifications
  /oscal/activities:
    post:
      consumes:
      - application/json
      description: Creates a new activity for us in other resources.
      parameters:
      - description: Activity object
        in: body
        name: activity
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Activity'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Activity'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an Activity
      tags:
      - Activities
  /oscal/activities/{id}:
    delete:
      description: Deletes an activity
      parameters:
      - description: Activity ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete Activity
      tags:
      - Activities
    get:
      consumes:
      - application/json
      description: Retrieves an Activity by its unique ID.
      parameters:
      - description: Activity ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Activity'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Retrieve an Activity
      tags:
      - Activities
    put:
      consumes:
      - application/json
      description: Updates properties of an existing Activity by its ID.
      parameters:
      - description: Activity ID
        in: path
        name: id
        required: true
        type: string
      - description: Activity object
        in: body
        name: activity
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Activity'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Activity'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an Activity
      tags:
      - Activities
  /oscal/assessment-plans:
    get:
      description: Retrieves all Assessment Plans.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_AssessmentPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Assessment Plans
      tags:
      - Assessment Plans
    post:
      consumes:
      - application/json
      description: Creates a new OSCAL Assessment Plan with comprehensive validation.
      parameters:
      - description: 'Assessment Plan object with required fields: UUID, metadata
          (title, version), import-ssp'
        in: body
        name: plan
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlan'
      produces:
      - application/json
      responses:
        "201":
          description: Successfully created assessment plan
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlan'
        "400":
          description: Bad request - validation errors or malformed input
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized - invalid or missing JWT token
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal server error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an Assessment Plan
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}:
    delete:
      description: Deletes an Assessment Plan by its unique ID.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an Assessment Plan
      tags:
      - Assessment Plans
    get:
      description: Retrieves a single Assessment Plan by its unique ID.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get an Assessment Plan
      tags:
      - Assessment Plans
    put:
      consumes:
      - application/json
      description: Updates an existing Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Plan object
        in: body
        name: plan
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentPlan'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an Assessment Plan
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/assessment-assets:
    get:
      description: Retrieves all assessment assets for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-array_oscalTypes_1_1_3_AssessmentAssets'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Assets
      tags:
      - Assessment Plans
    post:
      consumes:
      - application/json
      description: Creates a new assessment asset for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Asset object
        in: body
        name: asset
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentAssets'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create Assessment Plan Asset
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/assessment-assets/{assetId}:
    delete:
      description: Deletes an assessment asset from an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Asset ID
        in: path
        name: assetId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete Assessment Plan Asset
      tags:
      - Assessment Plans
    put:
      consumes:
      - application/json
      description: Updates an existing assessment asset for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Asset ID
        in: path
        name: assetId
        required: true
        type: string
      - description: Assessment Asset object
        in: body
        name: asset
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentAssets'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentAssets'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Plan Asset
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/assessment-subjects:
    get:
      description: Retrieves all assessment subjects for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-array_oscalTypes_1_1_3_AssessmentSubject'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Subjects
      tags:
      - Assessment Plans
    post:
      consumes:
      - application/json
      description: Creates a new assessment subject for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Subject object
        in: body
        name: subject
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentSubject'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create Assessment Plan Subject
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/assessment-subjects/{subjectId}:
    delete:
      description: Deletes an assessment subject from an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Subject ID
        in: path
        name: subjectId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete Assessment Plan Subject
      tags:
      - Assessment Plans
    put:
      consumes:
      - application/json
      description: Updates an existing assessment subject for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Assessment Subject ID
        in: path
        name: subjectId
        required: true
        type: string
      - description: Assessment Subject object
        in: body
        name: subject
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentSubject'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentSubject'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Plan Subject
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/back-matter:
    get:
      description: Retrieves back matter for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Back Matter
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/full:
    get:
      description: Retrieves a single Assessment Plan by its unique ID with all related
        data preloaded.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a full Assessment Plan
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/import-ssp:
    get:
      description: Retrieves import SSP information for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportSsp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Import SSP
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/local-definitions:
    get:
      description: Retrieves local definitions for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_LocalDefinitions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Local Definitions
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/metadata:
    get:
      description: Retrieves metadata for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Metadata
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/tasks:
    get:
      description: Retrieves all tasks for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-array_oscalTypes_1_1_3_Task'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Tasks
      tags:
      - Assessment Plans
    post:
      consumes:
      - application/json
      description: Creates a new task for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task object
        in: body
        name: task
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Task'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create Assessment Plan Task
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/tasks/{taskId}:
    delete:
      description: Deletes a task from an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task ID
        in: path
        name: taskId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete Assessment Plan Task
      tags:
      - Assessment Plans
    put:
      consumes:
      - application/json
      description: Updates an existing task for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task ID
        in: path
        name: taskId
        required: true
        type: string
      - description: Task object
        in: body
        name: task
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Task'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Task'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Plan Task
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/tasks/{taskId}/associated-activities:
    get:
      description: Retrieves all Activities associated with a specific Task in an
        Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task ID
        in: path
        name: taskId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_AssociatedActivity'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Associated Activities for a Task
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/tasks/{taskId}/associated-activities/{activityId}:
    delete:
      description: Removes an association of an Activity from a Task within an Assessment
        Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task ID
        in: path
        name: taskId
        required: true
        type: string
      - description: Activity ID
        in: path
        name: activityId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Disassociate an Activity from a Task
      tags:
      - Assessment Plans
    post:
      description: Associates an existing Activity to a Task within an Assessment
        Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Task ID
        in: path
        name: taskId
        required: true
        type: string
      - description: Activity ID
        in: path
        name: activityId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Associate an Activity with a Task
      tags:
      - Assessment Plans
  /oscal/assessment-plans/{id}/terms-and-conditions:
    get:
      description: Retrieves terms and conditions for an Assessment Plan.
      parameters:
      - description: Assessment Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentPlanTermsAndConditions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Plan Terms and Conditions
      tags:
      - Assessment Plans
  /oscal/assessment-results:
    get:
      description: Retrieves all Assessment Results.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_AssessmentResults'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Assessment Results
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates an Assessment Results from input.
      parameters:
      - description: Assessment Results data
        in: body
        name: ar
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentResults'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentResults'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an Assessment Results
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}:
    delete:
      description: Deletes an Assessment Results by its ID.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an Assessment Results
      tags:
      - Assessment Results
    get:
      description: Retrieves a single Assessment Results by its unique ID.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentResults'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get an Assessment Results
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates an existing Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated Assessment Results object
        in: body
        name: ar
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AssessmentResults'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentResults'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an Assessment Results
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/available-controls:
    get:
      description: Retrieves controls that can be referenced in findings
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-array_oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get available controls for findings
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/back-matter:
    delete:
      description: Deletes the back matter for an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete back matter
      tags:
      - Assessment Results
    get:
      description: Retrieves the back matter for an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get back matter
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates or replaces the back matter for an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Back Matter
        in: body
        name: backMatter
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create back matter
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates the back matter for an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Back Matter
        in: body
        name: backMatter
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update back matter
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/back-matter/resources:
    get:
      description: Retrieves all resources from the back matter for an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get back matter resources
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new resource in the back matter for an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create back matter resource
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/back-matter/resources/{resourceId}:
    delete:
      description: Deletes a specific resource from the back matter for an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete back matter resource
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific resource in the back matter for an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      - description: Resource
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update back matter resource
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/control/{controlId}:
    get:
      description: Retrieves a control with all its parts for reference in findings
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ID
        in: path
        name: controlId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get control details with statements and objectives
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/findings:
    get:
      description: Retrieves all findings in the system that can be associated with
        results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List all findings available for association
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/full:
    get:
      description: Retrieves a complete Assessment Results by its ID, including all
        metadata and related objects.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AssessmentResults'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a complete Assessment Results
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/import-ap:
    get:
      description: Retrieves import-ap for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportAp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Results import-ap
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates import-ap for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Import AP data
        in: body
        name: importAp
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportAp'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportAp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Results import-ap
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/local-definitions:
    get:
      description: Retrieves local-definitions for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_LocalDefinitions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Results local-definitions
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates local-definitions for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Local definitions data
        in: body
        name: localDefinitions
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.LocalDefinitions'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_LocalDefinitions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Results local-definitions
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/metadata:
    get:
      description: Retrieves metadata for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Assessment Results metadata
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates metadata for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Metadata data
        in: body
        name: metadata
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Assessment Results metadata
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/observations:
    get:
      description: Retrieves all observations in the system that can be associated
        with results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List all observations available for association
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results:
    get:
      description: Retrieves all results for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Result'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get results for an Assessment Results
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new result for a given Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result data
        in: body
        name: result
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Result'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Result'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a result for an Assessment Results
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}:
    delete:
      description: Deletes a specific result from an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a result
      tags:
      - Assessment Results
    get:
      description: Retrieves a specific result from an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Result'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a specific result
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific result in an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Result data
        in: body
        name: result
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Result'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Result'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-findings:
    get:
      description: Retrieves all Findings associated with a specific Result in an
        Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Associated Findings for a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-findings/{findingId}:
    delete:
      description: Removes an association of a Finding from a Result within an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Disassociate a Finding from a Result
      tags:
      - Assessment Results
    post:
      description: Associates an existing Finding to a Result within an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Associate a Finding with a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-observations:
    get:
      description: Retrieves all Observations associated with a specific Result in
        an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Associated Observations for a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-observations/{observationId}:
    delete:
      description: Removes an association of an Observation from a Result within an
        Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Observation ID
        in: path
        name: observationId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Disassociate an Observation from a Result
      tags:
      - Assessment Results
    post:
      description: Associates an existing Observation to a Result within an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Observation ID
        in: path
        name: observationId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Associate an Observation with a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-risks:
    get:
      description: Retrieves all Risks associated with a specific Result in an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Associated Risks for a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/associated-risks/{riskId}:
    delete:
      description: Removes an association of a Risk from a Result within an Assessment
        Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Disassociate a Risk from a Result
      tags:
      - Assessment Results
    post:
      description: Associates an existing Risk to a Result within an Assessment Results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Associate a Risk with a Result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/attestations:
    get:
      description: Retrieves all attestations for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_AttestationStatements'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get attestations for a result
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new attestation for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Attestation data
        in: body
        name: attestation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AttestationStatements'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AttestationStatements'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an attestation for a result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/attestations/{attestationId}:
    delete:
      description: Deletes a specific attestation from a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Attestation ID
        in: path
        name: attestationId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an attestation
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific attestation in a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Attestation ID
        in: path
        name: attestationId
        required: true
        type: string
      - description: Attestation data
        in: body
        name: attestation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.AttestationStatements'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AttestationStatements'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an attestation
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/findings:
    get:
      description: Retrieves all findings for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get findings for a result
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new finding for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Finding data
        in: body
        name: finding
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a finding for a result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/findings/{findingId}:
    delete:
      description: Deletes a specific finding from a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a finding
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific finding in a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      - description: Finding data
        in: body
        name: finding
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a finding
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/observations:
    get:
      description: Retrieves all observations for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get observations for a result
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new observation for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Observation data
        in: body
        name: observation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an observation for a result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/observations/{obsId}:
    delete:
      description: Deletes a specific observation from a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Observation ID
        in: path
        name: obsId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an observation
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific observation in a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Observation ID
        in: path
        name: obsId
        required: true
        type: string
      - description: Observation data
        in: body
        name: observation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an observation
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/risks:
    get:
      description: Retrieves all risks for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risks for a result
      tags:
      - Assessment Results
    post:
      consumes:
      - application/json
      description: Creates a new risk for a given result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Risk data
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a risk for a result
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/results/{resultId}/risks/{riskId}:
    delete:
      description: Deletes a specific risk from a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a risk
      tags:
      - Assessment Results
    put:
      consumes:
      - application/json
      description: Updates a specific risk in a result.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      - description: Result ID
        in: path
        name: resultId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      - description: Risk data
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a risk
      tags:
      - Assessment Results
  /oscal/assessment-results/{id}/risks:
    get:
      description: Retrieves all risks in the system that can be associated with results.
      parameters:
      - description: Assessment Results ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List all risks available for association
      tags:
      - Assessment Results
  /oscal/catalogs:
    get:
      description: Retrieves all catalogs, optionally filtered by catalog type.
      parameters:
      - description: Filter by catalog type (standard|policy|procedure)
        in: query
        name: type
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List catalogs
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Creates a new OSCAL Catalog. The catalog type may be supplied via
        the ?type= query param or a catalog-type metadata prop; it defaults to standard.
      parameters:
      - description: Catalog object
        in: body
        name: catalog
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Catalog'
      - description: Catalog type (standard|policy|procedure); overrides any metadata
          prop
        in: query
        name: type
        type: string
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}:
    delete:
      description: Deletes a Catalog and cascades to related groups/controls, metadata
        and back-matter.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a Catalog (cascade)
      tags:
      - Catalog
    get:
      description: Retrieves a single Catalog by its unique ID.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a Catalog
      tags:
      - Catalog
    put:
      consumes:
      - application/json
      description: Updates an existing OSCAL Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated Catalog object
        in: body
        name: catalog
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Catalog'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/active:
    put:
      consumes:
      - application/json
      description: Marks a catalog active or inactive. Inactive catalogs are hidden
        from the lineage /roots listing but remain reachable as control-link children.
        This is the reliable way to toggle the flag (a struct-based Update leaves
        it untouched).
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Active state
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.SetCatalogActiveRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Set a Catalog's active state
      tags:
      - Catalog
  /oscal/catalogs/{id}/all-controls:
    get:
      description: Retrieves the top-level controls for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List controls for a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/back-matter:
    get:
      description: Retrieves the back-matter for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get back-matter for a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/controls:
    get:
      description: Retrieves the top-level controls for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List controls for a Catalog
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Adds a top-level control under the specified Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Control object
        in: body
        name: control
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Control for a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/controls/{control}:
    delete:
      description: Deletes a Control and cascades to nested children; clears filter
        associations.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ID
        in: path
        name: control
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a Control (cascade)
      tags:
      - Catalog
    get:
      description: Retrieves a single Control by its ID for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ID
        in: path
        name: control
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a specific Control within a Catalog
      tags:
      - Catalog
    put:
      consumes:
      - application/json
      description: Updates the properties of an existing Control under the specified
        Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ID
        in: path
        name: control
        required: true
        type: string
      - description: Updated Control object
        in: body
        name: control
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a Control within a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/controls/{control}/controls:
    get:
      description: Retrieves the controls directly under a specific Control in a given
        Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ID
        in: path
        name: control
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List child controls for a Control within a Catalog
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Adds a child control under the specified Catalog Control.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Parent Control ID
        in: path
        name: control
        required: true
        type: string
      - description: Control object
        in: body
        name: control
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Sub-Control for a Control within a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/groups:
    get:
      description: Retrieves the top-level groups for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List groups for a Catalog
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Adds a top-level group under the specified Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group object
        in: body
        name: group
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Group for a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/groups/{group}:
    delete:
      description: Deletes a Group and cascades to nested groups and controls.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group ID
        in: path
        name: group
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a Group (cascade)
      tags:
      - Catalog
    get:
      description: Retrieves a single Group by its ID for a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group ID
        in: path
        name: group
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a specific Group within a Catalog
      tags:
      - Catalog
    put:
      consumes:
      - application/json
      description: Updates the properties of an existing Group under the specified
        Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group ID
        in: path
        name: group
        required: true
        type: string
      - description: Updated Group object
        in: body
        name: group
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a Group within a Catalog
      tags:
      - Catalog
  /oscal/catalogs/{id}/groups/{group}/controls:
    get:
      description: Retrieves the controls directly under a specific Group in a given
        Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group ID
        in: path
        name: group
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List controls for a Group within a Catalog
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Adds a control under the specified Catalog and Group.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Parent Group ID
        in: path
        name: group
        required: true
        type: string
      - description: Control object
        in: body
        name: control
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Control'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Control'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Control for a Catalog Group
      tags:
      - Catalog
  /oscal/catalogs/{id}/groups/{group}/groups:
    get:
      description: Retrieves the sub-groups of a specific Group in a given Catalog.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Group ID
        in: path
        name: group
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List sub-groups for a Group within a Catalog
      tags:
      - Catalog
    post:
      consumes:
      - application/json
      description: Adds a sub-group under the specified Catalog and Group.
      parameters:
      - description: Catalog ID
        in: path
        name: id
        required: true
        type: string
      - description: Parent Group ID
        in: path
        name: group
        required: true
        type: string
      - description: Group object
        in: body
        name: group
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Group'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Group'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new Sub-Group for a Catalog Group
      tags:
      - Catalog
  /oscal/component-definitions:
    get:
      description: Retrieves all component definitions.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List component definitions
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates a new component definition.
      parameters:
      - description: Component Definition
        in: body
        name: componentDefinition
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ComponentDefinition'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}:
    get:
      description: Retrieves a single component definition by its unique ID.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a component definition
      tags:
      - Component Definitions
    put:
      consumes:
      - application/json
      description: Updates an existing component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated Component Definition object
        in: body
        name: componentDefinition
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ComponentDefinition'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/back-matter:
    get:
      description: Retrieves the back-matter for a given Component Definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get back-matter for a Component Definition
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates new back-matter for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Back Matter
        in: body
        name: back-matter
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create back-matter for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/capabilities:
    get:
      description: Retrieves all capabilities for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Capability'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get capabilities for a component definition
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates new capabilities for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Capabilities
        in: body
        name: capabilities
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.Capability'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Capability'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create capabilities for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/capabilities/{capability}:
    put:
      consumes:
      - application/json
      description: Updates a single capability for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Capability ID (UUID)
        in: path
        name: capability
        required: true
        type: string
      - description: Capability to update
        in: body
        name: capability
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Capability'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Capability'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a capability for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/capabilities/incorporates-components:
    get:
      description: Retrieves all incorporates components for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_IncorporatesComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get incorporates components for a component definition
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates new incorporates components for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Incorporates Components
        in: body
        name: incorporates-components
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.IncorporatesComponent'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_IncorporatesComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create incorporates components for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components:
    get:
      description: Retrieves all components for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get components for a component definition
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates new components for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Components to create
        in: body
        name: components
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create components for a component definition
      tags:
      - Component Definitions
    put:
      consumes:
      - application/json
      description: Updates the components for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Components to update
        in: body
        name: components
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update components for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components/{defined-component}:
    get:
      description: Retrieves a defined component for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a defined component for a component definition
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates a new defined component for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component to create
        in: body
        name: defined-component
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a defined component for a component definition
      tags:
      - Component Definitions
    put:
      consumes:
      - application/json
      description: Updates a defined component for a given component definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      - description: Defined Component to update
        in: body
        name: defined-component
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.DefinedComponent'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_DefinedComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a defined component for a component definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components/{defined-component}/control-implementations:
    get:
      description: Retrieves all control implementations for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationSet'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get control implementations for a defined component
      tags:
      - Component Definitions
    post:
      consumes:
      - application/json
      description: Creates new control implementations for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      - description: Control Implementations
        in: body
        name: control-implementations
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationSet'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create control implementations for a defined component
      tags:
      - Component Definitions
    put:
      consumes:
      - application/json
      description: Updates control implementations for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      - description: Control Implementations
        in: body
        name: control-implementations
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationSet'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update control implementations for a defined component
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components/{defined-component}/control-implementations/{control-implementation}:
    put:
      consumes:
      - application/json
      description: Updates a specific control implementation for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      - description: Control Implementation ID
        in: path
        name: control-implementation
        required: true
        type: string
      - description: Control Implementation
        in: body
        name: control-implementation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationSet'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationSet'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a single control implementation for a defined component
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components/{defined-component}/control-implementations/implemented-requirements:
    get:
      description: Retrieves all implemented requirements for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ImplementedRequirementControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get implemented requirements for a defined component
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/components/{defined-component}/control-implementations/implemented-requirements/statements:
    get:
      description: Retrieves all statements for a given defined component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlStatementImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get statements for a defined component
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/full:
    get:
      description: Retrieves a complete Component Definition by its ID, including
        all metadata and revisions.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a complete Component Definition
      tags:
      - Component Definitions
  /oscal/component-definitions/{id}/import-component-definitions:
    get:
      description: Retrieves all import component definitions for a given defined
        component.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Defined Component ID
        in: path
        name: defined-component
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ImportComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get import component definitions for a defined component
      tags:
      - Component Definitions
    post:
      description: Creates new import component definitions for a given component
        definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Import Component Definitions
        in: body
        name: import-component-definitions
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.ImportComponentDefinition'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ImportComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create import component definitions for a component definition
      tags:
      - Component Definitions
    put:
      description: Updates the import component definitions for a given component
        definition.
      parameters:
      - description: Component Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Import Component Definitions
        in: body
        name: import-component-definitions
        required: true
        schema:
          items:
            $ref: '#/definitions/oscalTypes_1_1_3.ImportComponentDefinition'
          type: array
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ImportComponentDefinition'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update import component definitions for a component definition
      tags:
      - Component Definitions
  /oscal/import:
    post:
      consumes:
      - multipart/form-data
      description: Import multiple OSCAL JSON files (catalogs, profiles, SSPs, etc.)
      parameters:
      - description: OSCAL JSON files to import
        in: formData
        name: files
        required: true
        type: file
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_ImportResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Import OSCAL files
      tags:
      - OSCAL
  /oscal/inventory:
    get:
      description: Retrieves all inventory items from all sources (SSP, Evidence,
        POAM, AP, AR)
      parameters:
      - description: Include items from System Security Plans
        in: query
        name: include_ssp
        type: string
      - description: Include items from Evidence
        in: query
        name: include_evidence
        type: string
      - description: Include items from Plan of Action and Milestones
        in: query
        name: include_poam
        type: string
      - description: Include items from Assessment Plans
        in: query
        name: include_ap
        type: string
      - description: Include items from Assessment Results
        in: query
        name: include_ar
        type: string
      - description: Filter by item type (e.g., operating-system, database, web-server)
        in: query
        name: item_type
        type: string
      - description: Filter by SSP attachment status
        in: query
        name: attached_to_ssp
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_InventoryItemWithSource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get All Inventory Items
      tags:
      - Inventory
    post:
      consumes:
      - application/json
      description: Creates a new inventory item with optional attachment to SSP or
        POAM
      parameters:
      - description: Create Inventory Item Request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.CreateInventoryItemRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_InventoryItemWithSource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create Inventory Item
      tags:
      - Inventory
  /oscal/inventory/{id}:
    get:
      description: Retrieves a specific inventory item by its ID
      parameters:
      - description: Inventory Item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_InventoryItemWithSource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Inventory Item by ID
      tags:
      - Inventory
  /oscal/parties:
    get:
      description: Retrieves all parties.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Party'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List parties
      tags:
      - Oscal
  /oscal/parties/{id}:
    get:
      description: Retrieves a single Party by its unique ID.
      parameters:
      - description: Party ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Party'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a Party
      tags:
      - Oscal
  /oscal/plan-of-action-and-milestones:
    get:
      description: Retrieves all Plan of Action and Milestones.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: List POA&Ms
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new Plan of Action and Milestones.
      parameters:
      - description: POA&M data
        in: body
        name: poam
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestones'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}:
    delete:
      description: Deletes an existing Plan of Action and Milestones and all its related
        data.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a POA&M
      tags:
      - Plan Of Action and Milestones
    get:
      description: Retrieves a single Plan of Action and Milestones by its unique
        ID.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing Plan of Action and Milestones.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: POA&M data
        in: body
        name: poam
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestones'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/back-matter:
    get:
      description: Retrieves back-matter for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M back-matter
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/back-matter/resources:
    get:
      description: Retrieves all back-matter resources for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get back-matter resources for a POA&M
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new back-matter resource for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource data
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new back-matter resource for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/back-matter/resources/{resourceId}:
    delete:
      description: Deletes an existing back-matter resource for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a back-matter resource from a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing back-matter resource for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      - description: Resource data
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a back-matter resource for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/findings:
    get:
      description: Retrieves all findings for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get findings for a POA&M
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new finding for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Finding data
        in: body
        name: finding
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new finding for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/findings/{findingId}:
    delete:
      description: Deletes an existing finding for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a finding from a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing finding for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      - description: Finding data
        in: body
        name: finding
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Finding'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Finding'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a finding for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/full:
    get:
      description: Retrieves a complete POA&M by its ID, including all metadata and
        related objects.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestones'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get a complete POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/import-ssp:
    get:
      description: Retrieves import-ssp for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportSsp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M import-ssp
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates import-ssp for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Import SSP data
        in: body
        name: importSsp
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportSsp'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportSsp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create import-ssp for a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates import-ssp for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Import SSP data
        in: body
        name: importSsp
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportSsp'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportSsp'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update import-ssp for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/local-definitions:
    get:
      description: Retrieves local definitions for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestonesLocalDefinitions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M local definitions
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: |-
        Updates local-definitions for a given POA&M with special handling of array and object fields.
        - Components and inventory-items arrays are treated as full replacements: the existing values on the POA&M are overwritten by the arrays provided in the request body (no per-element merge is performed).
        - Sending an empty array [] for components or inventory-items clears that specific field (resulting in an empty array on the POA&M).
        - Omitting a field in the request body leaves the existing value for that field unchanged.
        - Sending an empty JSON object {} as the payload deletes the entire local-definitions object for the POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Local definitions data
        in: body
        name: local-definitions
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.PlanOfActionAndMilestonesLocalDefinitions'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PlanOfActionAndMilestonesLocalDefinitions'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update POA&M local-definitions
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/metadata:
    get:
      description: Retrieves metadata for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M metadata
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates metadata for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Metadata data
        in: body
        name: metadata
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update POA&M metadata
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/observations:
    get:
      description: Retrieves all observations for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get observations for a POA&M
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new observation for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Observation data
        in: body
        name: observation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new observation for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/observations/{obsId}:
    delete:
      description: Deletes an existing observation for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Observation ID
        in: path
        name: obsId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete an observation from a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing observation for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Observation ID
        in: path
        name: obsId
        required: true
        type: string
      - description: Observation data
        in: body
        name: observation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Observation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Observation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update an observation for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/poam-items:
    get:
      description: Retrieves all POA&M items for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_PoamItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M items
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new POAM item for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: POAM Item data
        in: body
        name: poam-item
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.PoamItem'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PoamItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new POAM item for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/poam-items/{itemId}:
    delete:
      description: Deletes an existing POAM item for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: POAM Item ID
        in: path
        name: itemId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a POAM item from a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing POAM item for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: POAM Item ID
        in: path
        name: itemId
        required: true
        type: string
      - description: POAM Item data
        in: body
        name: poam-item
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.PoamItem'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_PoamItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a POAM item for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/risks:
    get:
      description: Retrieves all risks for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get risks for a POA&M
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates a new risk for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk data
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new risk for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/risks/{riskId}:
    delete:
      description: Deletes an existing risk for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a risk from a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates an existing risk for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      - description: Risk data
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Risk'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Risk'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a risk for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/plan-of-action-and-milestones/{id}/system-id:
    get:
      description: Retrieves system-id for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemId'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get POA&M system-id
      tags:
      - Plan Of Action and Milestones
    post:
      consumes:
      - application/json
      description: Creates system-id for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: System ID data
        in: body
        name: systemId
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemId'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemId'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create system-id for a POA&M
      tags:
      - Plan Of Action and Milestones
    put:
      consumes:
      - application/json
      description: Updates system-id for a given POA&M.
      parameters:
      - description: POA&M ID
        in: path
        name: id
        required: true
        type: string
      - description: System ID data
        in: body
        name: systemId
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemId'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemId'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update system-id for a POA&M
      tags:
      - Plan Of Action and Milestones
  /oscal/profiles:
    get:
      description: Retrieves all OSCAL profiles
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_ProfileHandler'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Profiles
      tags:
      - Profile
    post:
      consumes:
      - application/json
      description: Creates a new OSCAL Profile.
      parameters:
      - description: Profile object
        in: body
        name: profile
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Profile'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Profile'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a new OSCAL Profile
      tags:
      - Profile
  /oscal/profiles/{id}:
    get:
      description: Get an OSCAL profile with the uuid provided
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_ProfileHandler'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Profile
      tags:
      - Profile
  /oscal/profiles/{id}/back-matter:
    get:
      description: Get the BackMatter for a specific profile
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Backmatter
      tags:
      - Profile
  /oscal/profiles/{id}/compliance-progress:
    get:
      description: |-
        Returns aggregated compliance progress for controls in a Profile, including summary, optional per-control rows, and group rollups.
        When sspId is supplied, controls inherited from an upstream leverage link (all links active, all live-derived full, no decisive downstream evidence, in scope) are credited to a distinct "inherited" bucket and carry a leverage badge payload. Inherited counts as compliant in compliancePercent and as assessed in assessedPercent; evidence always wins over inherited credit. Without sspId, inherited is 0 and no leverage payloads are emitted.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      - description: Include per-control breakdown (default true)
        in: query
        name: includeControls
        type: boolean
      - description: System Security Plan ID for implementation coverage
        in: query
        name: sspId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_ProfileComplianceProgress'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get compliance progress for a Profile
      tags:
      - Profile
  /oscal/profiles/{id}/full:
    get:
      description: Retrieves the full OSCAL Profile, including all nested content.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Profile'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get full Profile
      tags:
      - Profile
  /oscal/profiles/{id}/imports:
    get:
      description: List imports for a specific profile
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Import'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Imports
      tags:
      - Profile
  /oscal/profiles/{id}/imports/{href}:
    delete:
      description: Deletes an import from a profile by its href
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      - description: Import Href
        in: path
        name: href
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: Import deleted successfully
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete Import from Profile
      tags:
      - Profile
    get:
      description: Retrieves a specific import from a profile by its backmatter href
      parameters:
      - description: Profile UUID
        in: path
        name: id
        required: true
        type: string
      - description: Import Href
        in: path
        name: href
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Import'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Import from Profile by Backmatter Href
      tags:
      - Profile
    put:
      consumes:
      - application/json
      description: Updates an existing import in a profile by its href
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      - description: Import Href
        in: path
        name: href
        required: true
        type: string
      - description: Import data to update
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Import'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Import'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Import in Profile
      tags:
      - Profile
  /oscal/profiles/{id}/imports/add:
    post:
      consumes:
      - application/json
      description: Adds an import to a profile by its UUID and type (catalog/profile).
        Only catalogs are currently supported currently
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      - description: Request data
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.ProfileHandler'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Import'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add Import to Profile
      tags:
      - Profile
  /oscal/profiles/{id}/merge:
    get:
      description: Retrieves the merge section for a specific profile.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Merge'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get merge section
      tags:
      - Profile
    put:
      consumes:
      - application/json
      description: Updates the merge information for a specific profile
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      - description: Merge data to update
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Merge'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Merge'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update Merge
      tags:
      - Profile
  /oscal/profiles/{id}/modify:
    get:
      description: Retrieves the modify section for a specific profile.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Modify'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get modify section
      tags:
      - Profile
  /oscal/profiles/{id}/resolve:
    post:
      description: Resolves a Profiled identified by the "profile ID" param and stores
        a new catalog in the database
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_ProfileHandler'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Resolves a Profile as a stored catalog
      tags:
      - Profile
  /oscal/profiles/{id}/resolved:
    get:
      description: Returns a resolved OSCAL catalog based on a given Profile ID, applying
        all imports and modifications.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Catalog'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Resolved Profile
      tags:
      - Profile
  /oscal/profiles/{id}/resolved-with-catalogs:
    get:
      description: Returns a simplified flat list of controls from a resolved profile
        with control-id, catalog-id, title, and class.
      parameters:
      - description: Profile ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_resolvedWithCatalogsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Resolved Profile with Catalog IDs
      tags:
      - Profile
  /oscal/profiles/build-props:
    post:
      consumes:
      - application/json
      description: Generates a Profile selecting controls from a catalog based on
        prop matching rules. Returns the created Profile and the matched control IDs.
      parameters:
      - description: Prop matching request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.BuildByPropsRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_BuildByPropsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Build Profile by Control Props
      tags:
      - Profile
  /oscal/roles:
    get:
      description: Retrieves all roles.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Role'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List roles
      tags:
      - Oscal
  /oscal/roles/{id}:
    get:
      description: Retrieves a single Role by its unique ID.
      parameters:
      - description: Party ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Role'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a Role
      tags:
      - Oscal
  /oscal/ssp-export-offerings:
    get:
      description: Retrieves published export offerings across all system security
        plans. Draft/deprecated/revoked offerings are only visible via the SSP-nested
        curation routes.
      parameters:
      - description: Max number of offerings to return (default 100, max 1000)
        in: query
        name: limit
        type: integer
      - description: Number of offerings to skip
        in: query
        name: offset
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_catalogOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List export offerings
      tags:
      - SSP Export Offerings
  /oscal/ssp-export-offerings/{id}:
    get:
      description: Retrieves a single published export offering by its own ID (no
        parent SSP scoping). Draft/deprecated/revoked offerings are only visible via
        the SSP-nested curation routes.
      parameters:
      - description: Offering ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_catalogOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get an export offering
      tags:
      - SSP Export Offerings
  /oscal/ssp-export-offerings/{id}/subscribe:
    post:
      consumes:
      - application/json
      description: |-
        Records, on the downstream SSP named in the request body, an OSCAL
        inherited-control-implementation and (optionally) satisfied-responsibility
        entries per chosen offering item — all in a single atomic write. Never checks
        ssp:read on the upstream SSP: the trust boundary is that subscribing to a
        published offering only requires ssp-export-offering:subscribe on the offering
        and ssp:update on the downstream SSP.

        No leveraged-authorization is created: sharing is decoupled from an Authority
        to Operate. A Leveraged Authorization is an independent, human-authored record
        of the downstream's real ATO and never gates importing.

        Every subscribed item must be statement-anchored: a legacy offering item with
        no statement-id is rejected with 422. The materialized downstream tree is
        always requirement -> statement -> by-component -> inherited + satisfied, and is
        reported back in meta.created (each row flagged created:true when inserted,
        false when an existing row was reused) so the caller can render newly-created
        requirements without re-walking the SSP. The data payload is unchanged.
      parameters:
      - description: Offering ID
        in: path
        name: id
        required: true
        type: string
      - description: Subscribe request
        in: body
        name: subscribe
        required: true
        schema:
          $ref: '#/definitions/oscal.subscribeRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SSPLeverageLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Subscribe to a published export offering
      tags:
      - SSP Export Offerings
  /oscal/ssp-export-offerings/by-control/{controlId}:
    get:
      description: |-
        Cross-SSP catalog of what is exported for a control, by whom, and against
        which statement — every published offering item whose control-id matches
        (case-insensitively), with the offering, upstream SSP, component, provided
        capability and responsibility set all resolved server-side. Honours the same
        trust boundary as the flat catalog: gated by ssp-export-offering:read only,
        never ssp:read on the upstream SSP. Pass downstreamSspId to narrow the result
        to offerings that SSP is actually allow-listed to subscribe to (BCH-1342).

        downstreamSspId is a CONVENIENCE FILTER, not an authorization boundary: no
        permission is evaluated against the SSP it names — unlike Subscribe, which
        evaluates ssp:update on the downstream precisely because that id arrives in the
        payload rather than the URL. The filter cannot surface an offering the caller
        could not already list; it only removes rows. It does mean a catalog reader can
        infer an offering's allow-list membership by diffing the filtered and unfiltered
        responses. That is an accepted trade-off, decided rather than inherited by
        omission: allow-list membership (who may leverage whom) is treated as
        non-confidential topology, and a per-request PDP round-trip on a read path is not
        worth paying to hide it. If it ever must be confidential, evaluate ssp:read on
        downstreamSspId here the way Subscribe does.
      parameters:
      - description: Control ID (e.g. AC-2)
        in: path
        name: controlId
        required: true
        type: string
      - description: Only return offerings this downstream SSP may subscribe to
        in: query
        name: downstreamSspId
        type: string
      - description: Max items to return (default 100, max 1000)
        in: query
        name: limit
        type: integer
      - description: Items to skip
        in: query
        name: offset
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_ControlExportOffer'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List every published export offering for one control
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans:
    get:
      description: Retrieves all System Security Plans.
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_SystemSecurityPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List System Security Plans
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a System Security Plan from input.
      parameters:
      - description: SSP data
        in: body
        name: ssp
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemSecurityPlan'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemSecurityPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a System Security Plan
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}:
    delete:
      description: Deletes an existing System Security Plan and all its related data.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a System Security Plan
      tags:
      - System Security Plans
    get:
      description: Retrieves a single System Security Plan by its unique ID.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemSecurityPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a System Security Plan
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing System Security Plan.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: SSP data
        in: body
        name: ssp
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemSecurityPlan'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemSecurityPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a System Security Plan
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/back-matter:
    get:
      description: Retrieves back-matter for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get SSP back-matter
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates back-matter for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Back Matter data
        in: body
        name: back-matter
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.BackMatter'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_BackMatter'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update SSP back-matter
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/back-matter/resources:
    get:
      description: Retrieves all back-matter resources for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get back-matter resources for a SSP
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new back-matter resource for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource data
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new back-matter resource for a SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/back-matter/resources/{resourceId}:
    delete:
      description: Deletes an existing back-matter resource for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a back-matter resource from a SSP
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing back-matter resource for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Resource ID
        in: path
        name: resourceId
        required: true
        type: string
      - description: Resource data
        in: body
        name: resource
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Resource'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Resource'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a back-matter resource for a SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/bulk-apply-component-suggestions:
    post:
      description: For each ImplementedRequirement, creates SystemComponents from
        matching DefinedComponents and links them via ByComponent.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Bulk apply component suggestions for all implemented requirements in
        an SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation:
    get:
      description: Retrieves the Control Implementation for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Control Implementation
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates the Control Implementation for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated Control Implementation object
        in: body
        name: control-implementation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update Control Implementation
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements:
    get:
      description: Retrieves all implemented requirements for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ImplementedRequirement'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get implemented requirements for a SSP
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new implemented requirement for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement data
        in: body
        name: requirement
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirement'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImplementedRequirement'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new implemented requirement for a SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}:
    delete:
      description: |-
        Deletes an existing implemented requirement for a given SSP.

        Cascades through every by-component beneath the requirement, so it returns 409
        if any inherited entry under it is owned by a leverage subscription.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete an implemented requirement from a SSP
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing implemented requirement for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Implemented Requirement data
        in: body
        name: requirement
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImplementedRequirement'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImplementedRequirement'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update an implemented requirement for a SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/apply-suggestion:
    post:
      consumes:
      - application/json
      description: Creates or reuses a SystemComponent from the provided DefinedComponent
        and links it via ByComponent.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Suggestion to apply
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.ApplySuggestionRequest'
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Apply a specific component suggestion for an implemented requirement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}:
    delete:
      deprecated: true
      description: |-
        Deprecated: requirement-anchored by-components are legacy. This delete exists
        purely so legacy and orphaned requirement-anchored rows can be wound down —
        there is deliberately no requirement-level POST to create new ones.

        Cascades exactly like the statement-level delete: the by-component's own
        responsible-roles, its inherited and satisfied entries (each with their
        responsible-roles), and its export with nested provided/responsibilities are all
        removed, along with the responsible_role_parties join rows.

        Returns 409 if any of the by-component's inherited entries is owned by a
        leverage subscription — deleting the parent must not be a way around the same
        guard the inherited sub-resource DELETE enforces. Unsubscribe first.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a by-component within an implemented requirement
      tags:
      - System Security Plans
    get:
      deprecated: true
      description: |-
        Deprecated: requirement-anchored by-components are legacy — read-only here so
        the UI can display and wind them down. New by-components must be created
        against a statement.

        Returns the by-component with its export (including provided and
        responsibilities), inherited and satisfied entries, responsible-roles and
        implementation-status.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a by-component within an implemented requirement
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Deprecated: requirement-anchored by-components are legacy — the statement is
        the canonical anchor for shared responsibility. Use
        PUT .../statements/{stmtId}/by-components/{byComponentId} instead. This route
        remains so existing requirement-anchored rows can be edited and wound down;
        there is no requirement-level POST.

        Updates metadata only — description, props, links, set-parameters, remarks,
        implementation-status and responsible-roles. Any export, inherited or
        satisfied entries in the body are IGNORED (they have their own sub-resource
        routes); component-uuid is immutable. Previously this blind-Saved a struct
        rebuilt from the request body, which zeroed every omitted field and upserted
        nested associations with no cascade cleanup.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: By-Component data
        in: body
        name: by-component
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a by-component within an implemented requirement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}/export:
    delete:
      deprecated: true
      description: |-
        Deletes the Export (and its Provided/Responsibilities entries) for a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete the export for a control-level by-component
      tags:
      - System Security Plans
    get:
      deprecated: true
      description: |-
        Retrieves the Export (with nested Provided and Responsibilities) for a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get the export for a control-level by-component
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Creates the Export for a by-component within an implemented requirement. A by-component may have at most one Export.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Export data
        in: body
        name: export
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Export'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create the export for a control-level by-component
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Updates the scalar fields of an existing Export for a by-component within an implemented requirement. Provided and Responsibilities entries are managed via their own routes.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Export data
        in: body
        name: export
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Export'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update the export for a control-level by-component
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}/export/provided
  : get:
      deprecated: true
      description: 'Deprecated: use the statement-level equivalent. Requirement-anchored
        exports are legacy.'
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the provided entries on a control-level by-component's export
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Creates a ProvidedControlImplementation entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided data
        in: body
        name: provided
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a provided entry on a control-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}/export/provided/{providedId}
  : delete:
      deprecated: true
      description: |-
        Deletes an existing ProvidedControlImplementation entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided entry ID
        in: path
        name: providedId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a provided entry on a control-level by-component's export
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Replaces an existing ProvidedControlImplementation entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided entry ID
        in: path
        name: providedId
        required: true
        type: string
      - description: Provided data
        in: body
        name: provided
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a provided entry on a control-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}/export/responsibilities
  : get:
      deprecated: true
      description: 'Deprecated: use the statement-level equivalent. Requirement-anchored
        exports are legacy.'
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the responsibility entries on a control-level by-component's export
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Creates a ControlImplementationResponsibility entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility data
        in: body
        name: responsibility
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a responsibility entry on a control-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/by-components/{byComponentId}/export/responsibilities/{responsibilityId}
  : delete:
      deprecated: true
      description: |-
        Deletes an existing ControlImplementationResponsibility entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility entry ID
        in: path
        name: responsibilityId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a responsibility entry on a control-level by-component's export
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      deprecated: true
      description: |-
        Replaces an existing ControlImplementationResponsibility entry under the Export of a by-component within an implemented requirement.

        Deprecated: requirement-anchored exports are legacy. Shared responsibility is
        tracked per statement — use the statement-level equivalent under
        .../statements/{stmtId}/by-components/{byComponentId}/export. This route stays so
        existing requirement-anchored exports can be read and wound down.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility entry ID
        in: path
        name: responsibilityId
        required: true
        type: string
      - description: Responsibility data
        in: body
        name: responsibility
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a responsibility entry on a control-level by-component's export
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements:
    post:
      consumes:
      - application/json
      description: Creates a new statement within an implemented requirement for a
        given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement data
        in: body
        name: statement
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Statement'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Statement'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new statement within an implemented requirement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}:
    put:
      consumes:
      - application/json
      description: Updates an existing statement within an implemented requirement
        for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: Statement data
        in: body
        name: statement
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Statement'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Statement'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a statement within an implemented requirement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/apply-suggestion:
    post:
      consumes:
      - application/json
      description: Creates or reuses a SystemComponent from the provided DefinedComponent
        and links it via ByComponent to the statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: Suggestion to apply
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.ApplySuggestionRequest'
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Apply a specific component suggestion for a statement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/apply-suggestions:
    post:
      description: Creates SystemComponents from all matching DefinedComponents and
        links them via ByComponent to the statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Apply all component suggestions for a statement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components:
    get:
      description: |-
        Returns every by-component attached to the statement, each with its export
        (including provided and responsibilities), inherited and satisfied entries,
        responsible-roles and implementation-status.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the by-components on a statement
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Create a by-component within an existing statement within an implemented
        requirement for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component data
        in: body
        name: by-component
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a by-component within a statement (within an implemented requirement)
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}
  : delete:
      consumes:
      - application/json
      description: |-
        Deletes a by-component within an existing statement within an implemented requirement for a given SSP.

        Returns 409 if any of the by-component's inherited entries is owned by a
        leverage subscription — deleting the parent must not be a way around the same
        guard the inherited sub-resource DELETE enforces. Unsubscribe first.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a by-component within a statement (within an implemented requirement)
      tags:
      - System Security Plans
    get:
      description: |-
        Returns the by-component with its export (including provided and
        responsibilities), inherited and satisfied entries, responsible-roles and
        implementation-status — everything needed to refetch one by-component after
        editing any of its sub-resources.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a by-component within a statement
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: |-
        Updates metadata only — description, props, links, set-parameters, remarks,
        implementation-status and responsible-roles. Any export, inherited or
        satisfied entries in the body are IGNORED: those subtrees are managed through
        their own sub-resource routes, which enforce the leverage bookkeeping this
        route cannot. component-uuid is immutable. Previously this blind-Saved a
        struct rebuilt from the request body, which zeroed every omitted field and
        upserted nested associations with no cascade cleanup.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: By-Component data
        in: body
        name: by-component
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ByComponent'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ByComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a by-component within a statement (within an implemented requirement)
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/export
  : delete:
      description: Deletes the Export (and its Provided/Responsibilities entries)
        for a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete the export for a statement-level by-component
      tags:
      - System Security Plans
    get:
      description: Retrieves the Export (with nested Provided and Responsibilities)
        for a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get the export for a statement-level by-component
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates the Export for a by-component within a statement. A by-component
        may have at most one Export.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Export data
        in: body
        name: export
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Export'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create the export for a statement-level by-component
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates the scalar fields of an existing Export for a by-component
        within a statement. Provided and Responsibilities entries are managed via
        their own routes.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Export data
        in: body
        name: export
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Export'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Export'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update the export for a statement-level by-component
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/export/provided
  : get:
      description: Retrieves every ProvidedControlImplementation under the Export
        of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the provided entries on a statement-level by-component's export
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a ProvidedControlImplementation entry under the Export
        of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided data
        in: body
        name: provided
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a provided entry on a statement-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/export/provided/{providedId}
  : delete:
      description: Deletes an existing ProvidedControlImplementation entry under the
        Export of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided entry ID
        in: path
        name: providedId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a provided entry on a statement-level by-component's export
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Replaces an existing ProvidedControlImplementation entry under
        the Export of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Provided entry ID
        in: path
        name: providedId
        required: true
        type: string
      - description: Provided data
        in: body
        name: provided
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ProvidedControlImplementation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ProvidedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a provided entry on a statement-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/export/responsibilities
  : get:
      description: Retrieves every ControlImplementationResponsibility under the Export
        of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the responsibility entries on a statement-level by-component's
        export
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a ControlImplementationResponsibility entry under the Export
        of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility data
        in: body
        name: responsibility
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a responsibility entry on a statement-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/export/responsibilities/{responsibilityId}
  : delete:
      description: Deletes an existing ControlImplementationResponsibility entry under
        the Export of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility entry ID
        in: path
        name: responsibilityId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a responsibility entry on a statement-level by-component's export
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Replaces an existing ControlImplementationResponsibility entry
        under the Export of a by-component within a statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Responsibility entry ID
        in: path
        name: responsibilityId
        required: true
        type: string
      - description: Responsibility data
        in: body
        name: responsibility
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a responsibility entry on a statement-level by-component's export
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/inherited
  : get:
      description: Retrieves what this system consumes from an upstream under this
        statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_InheritedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the inherited control implementations on a statement-level by-component
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: |-
        Records that this system consumes an upstream's provided capability under this
        statement. Hand-authored entries carry no leverage link; entries created by
        Subscribe do, and are protected from deletion (409) while that subscription lives.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Inherited data
        in: body
        name: inherited
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.InheritedControlImplementation'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_InheritedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an inherited control implementation on a statement-level by-component
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/inherited/{inheritedId}
  : delete:
      description: |-
        Hand-authored entries delete freely. An entry created by a subscription is owned
        by that subscription — an SSPLeverageLink still references it, and both drift
        detection and notifications read through that reference — so deleting it returns
        409; unsubscribe instead.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Inherited ID
        in: path
        name: inheritedId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an inherited control implementation on a statement-level by-component
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: |-
        Metadata only — description, props, links and responsible-roles. provided-uuid
        is immutable and a body attempting to change it is rejected with 400: it is the
        identity the leverage link and the drift detector join on.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Inherited ID
        in: path
        name: inheritedId
        required: true
        type: string
      - description: Inherited data
        in: body
        name: inherited
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.InheritedControlImplementation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_InheritedControlImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an inherited control implementation on a statement-level by-component
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/satisfied
  : get:
      description: Retrieves how this system discharges its upstream's responsibilities
        under this statement.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_SatisfiedControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List the satisfied responsibilities on a statement-level by-component
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: |-
        Records that this system discharges one of its upstream's responsibilities. The
        responsibility-uuid must resolve to a ControlImplementationResponsibility on an
        Export this by-component actually inherits from (400 otherwise). If the owning
        SSPLeverageLink exists, its cached Satisfaction is re-derived in the same
        transaction, so partial can flip to full atomically with the write that causes it.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Satisfied data
        in: body
        name: satisfied
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SatisfiedControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a satisfied responsibility on a statement-level by-component
      tags:
      - System Security Plans
  ? /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/by-components/{byComponentId}/satisfied/{satisfiedId}
  : delete:
      description: |-
        Removes the entry and, in the same transaction, re-derives the owning
        SSPLeverageLink's cached Satisfaction — so dropping the last satisfied entry
        flips full back to partial atomically rather than leaving the link's bookkeeping
        stale for the drift detector to read.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Satisfied ID
        in: path
        name: satisfiedId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a satisfied responsibility on a statement-level by-component
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: |-
        Metadata only — description, remarks, props, links and responsible-roles.
        responsibility-uuid is immutable and a body attempting to change it is rejected
        with 400: it is what deriveSatisfaction and the drift detector match on. Because
        the identity can't change, the owning link's Satisfaction cannot change either,
        so no re-derivation is needed here.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      - description: By-Component ID
        in: path
        name: byComponentId
        required: true
        type: string
      - description: Satisfied ID
        in: path
        name: satisfiedId
        required: true
        type: string
      - description: Satisfied data
        in: body
        name: satisfied
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SatisfiedControlImplementationResponsibility'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SatisfiedControlImplementationResponsibility'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a satisfied responsibility on a statement-level by-component
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/statements/{stmtId}/suggest-components:
    post:
      description: Returns DefinedComponents that implement the statement's parent
        control and are not yet present in the SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      - description: Statement ID
        in: path
        name: stmtId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SystemComponentSuggestion'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Suggest system components for a statement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/control-implementation/implemented-requirements/{reqId}/suggest-components:
    post:
      description: Returns DefinedComponents that implement the same control and are
        not yet present in the SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Implemented Requirement ID
        in: path
        name: reqId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SystemComponentSuggestion'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Suggest system components for an implemented requirement
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/dashboard-suggestion-runs/{runId}:
    get:
      description: Returns a dashboard suggestion run with cell progress.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Dashboard suggestion run ID
        in: path
        name: runId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_dashboardSuggestionRunResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a dashboard suggestion run
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestion-runs/latest:
    get:
      description: Returns the latest dashboard suggestion run with cell progress.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_dashboardSuggestionRunResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get latest dashboard suggestion run for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions:
    get:
      description: Lists dashboard suggestions joined with control title and target
        filter name.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Suggestion status (default pending)
        in: query
        name: status
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_dashboardSuggestionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List dashboard suggestions for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/{suggestionId}/events:
    get:
      description: Returns audit events for one dashboard suggestion.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Dashboard suggestion ID
        in: path
        name: suggestionId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_dashboardSuggestionEventResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List dashboard suggestion events
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/accept:
    post:
      consumes:
      - application/json
      description: Accepts pending dashboard suggestions and creates or extends SSP-bound
        filters.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Suggestion IDs
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.dashboardSuggestionDecisionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_acceptDashboardSuggestionsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Accept dashboard suggestions
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/control-results:
    get:
      description: Returns the latest dashboard-suggestion evaluation outcome per
        evaluated control.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_controlSuggestionResultResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List dashboard suggestion control results for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/edit-group:
    post:
      consumes:
      - application/json
      description: Edits the title, proposed filter labels, and control membership
        of a pending suggestion group. User-provided labels are stored verbatim (the
        evidence-subset rule is bypassed) and the rows are flagged as user-edited.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Group edit
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.editDashboardSuggestionGroupRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_dashboardSuggestionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Edit a group of pending dashboard suggestions
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/generalize:
    post:
      description: Runs the deterministic filter-merge detector for this SSP and creates
        pending generalization suggestions for near-duplicate filters that differ
        only by one generalizable label. No LLM is involved.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_generalizeDashboardSuggestionsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Suggest filter merges for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/generate:
    post:
      consumes:
      - application/json
      description: Creates a dashboard suggestion run, snapshots the resolved scope,
        creates run cells, and enqueues cell processing.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Generation request
        in: body
        name: request
        schema:
          $ref: '#/definitions/oscal.generateDashboardSuggestionsRequest'
      produces:
      - application/json
      responses:
        "202":
          description: Accepted
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_dashboardSuggestionRunResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
        "503":
          description: Service Unavailable
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Generate dashboard suggestions for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/label-keys:
    get:
      description: Returns distinct evidence label keys with their distinct values,
        for building an evidence-scoping filter without loading every label set.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-suggestions_LabelKeyInput'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List distinct evidence label keys and values
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/label-sets:
    get:
      description: Returns canonical evidence label sets for dashboard suggestion
        scope selection.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-suggestions_LabelSetInput'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List dashboard suggestion label sets
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/label-values:
    get:
      description: Returns distinct evidence label values for a given label key, optionally
        matching a substring query. Searched server-side so high-cardinality values
        are reachable.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Label key
        in: query
        name: key
        required: true
        type: string
      - description: Substring to match against values
        in: query
        name: query
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-string'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Search evidence label values for a key
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/preview:
    post:
      consumes:
      - application/json
      description: Resolves the requested dashboard suggestion scope and returns planned
        call counts without creating runs or enqueueing work.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Preview request
        in: body
        name: request
        schema:
          $ref: '#/definitions/oscal.generateDashboardSuggestionsRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_dashboardSuggestionPreviewResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Preview dashboard suggestion generation for an SSP
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/dashboard-suggestions/reject:
    post:
      consumes:
      - application/json
      description: Rejects pending dashboard suggestions.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Suggestion IDs and reason
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.dashboardSuggestionDecisionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_dashboardSuggestionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Reject dashboard suggestions
      tags:
      - Dashboard Suggestions
  /oscal/system-security-plans/{id}/export-offerings:
    get:
      description: Retrieves every export offering curated for a given system security
        plan.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List export offerings for an SSP
      tags:
      - SSP Export Offerings
    post:
      consumes:
      - application/json
      description: Creates a new draft export offering for an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering data
        in: body
        name: offering
        required: true
        schema:
          $ref: '#/definitions/oscal.createExportOfferingRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an export offering
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}:
    delete:
      description: Deletes an export offering and its items.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an export offering
      tags:
      - SSP Export Offerings
    get:
      description: Retrieves a single export offering (with its items) curated for
        an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get an export offering
      tags:
      - SSP Export Offerings
    put:
      consumes:
      - application/json
      description: Updates the title/description of an export offering. Does not change
        items, status, version or content_hash.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Offering data
        in: body
        name: offering
        required: true
        schema:
          $ref: '#/definitions/oscal.createExportOfferingRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an export offering
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/allowed-downstreams:
    get:
      description: |-
        Returns every downstream SSP allow-listed to subscribe to this offering
        (BCH-1342). An empty list means the offering has no allow-list set — any
        downstream may subscribe (subject to the existing ssp:update and
        contributor-role checks), the type-level default.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-relational_SSPExportOfferingAllowedDownstream'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List an export offering's downstream-SSP allow-list
      tags:
      - SSP Export Offerings
    post:
      consumes:
      - application/json
      description: |-
        Once an offering has at least one allow-list entry, only listed downstream
        SSPs may subscribe to it (BCH-1342) — enforced by a handler-level check in
        Subscribe, not by the PDP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Downstream SSP to allow
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/oscal.allowedDownstreamRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOfferingAllowedDownstream'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a downstream SSP to an export offering's allow-list
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/allowed-downstreams/{downstreamSspId}:
    delete:
      description: |-
        If this removes the offering's last allow-list entry, the offering
        reverts to the type-level default (any downstream may subscribe,
        subject to the existing ssp:update and contributor-role checks).
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Downstream SSP ID
        in: path
        name: downstreamSspId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Remove a downstream SSP from an export offering's allow-list
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/items:
    post:
      consumes:
      - application/json
      description: Adds one offered capability (a control, optionally scoped to a
        statement, implemented by a component) to a draft export offering.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Item data
        in: body
        name: item
        required: true
        schema:
          $ref: '#/definitions/oscal.createExportOfferingItemRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOfferingItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add an item to an export offering
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/items/{itemId}:
    delete:
      description: Removes one item from an export offering.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Item ID
        in: path
        name: itemId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an export offering item
      tags:
      - SSP Export Offerings
    put:
      consumes:
      - application/json
      description: Updates one item of an export offering.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: Item ID
        in: path
        name: itemId
        required: true
        type: string
      - description: Item data
        in: body
        name: item
        required: true
        schema:
          $ref: '#/definitions/oscal.createExportOfferingItemRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOfferingItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an export offering item
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/publish:
    post:
      description: |-
        Transitions a draft export offering to published (or republishes a
        published one), recomputing content_hash via SyncExportOffering and
        bumping version only if the content actually changed since the last publish.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Publish an export offering
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/export-offerings/{offeringId}/status:
    patch:
      consumes:
      - application/json
      description: |-
        Transitions a published export offering to deprecated or revoked,
        which — independent of any content change — drifts every active
        leverage link pointing at it (BCH-1341 Phase 5).
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Offering ID
        in: path
        name: offeringId
        required: true
        type: string
      - description: New status
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/oscal.updateOfferingStatusRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_SSPExportOffering'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Deprecate or revoke an export offering
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/import-profile:
    get:
      description: Retrieves import-profile for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportProfile'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get SSP import-profile
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates import-profile for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Import Profile data
        in: body
        name: import-profile
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.ImportProfile'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_ImportProfile'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update SSP import-profile
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/leveraged-controls:
    get:
      description: |-
        Read-only view over the downstream SSP's own inherited/satisfied entries
        joined to ssp_leverage_links + the upstream offering. Per control/statement,
        returns which offering it was inherited from, whether satisfaction is full
        or partial (recomputed live from the current satisfied-responsibility rows,
        not trusted from the link's stored value), any outstanding
        responsibilities, and live evidence-backed posture per responsibility uuid
        (satisfied/not-satisfied/unknown, via filter_responsibilities). Writes
        nothing; never touches profile_controls/controls.
      parameters:
      - description: Downstream SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_leveragedControlResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Project a downstream SSP's leveraged controls
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/metadata:
    get:
      description: Retrieves metadata for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Get SSP metadata
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates metadata for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Metadata data
        in: body
        name: metadata
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Metadata'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Metadata'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update SSP metadata
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/profile:
    get:
      description: Retrieves the Profile attached to the specified System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Profile'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Profile for a System Security Plan
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Associates a given Profile with a System Security Plan.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Profile binding request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.addProfileRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemSecurityPlan'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Attach a Profile to a System Security Plan
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/profiles:
    get:
      description: Returns all profiles associated with a System Security Plan via
        the ssp_profiles join table.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_profileSummary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List Profiles bound to an SSP
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Associates an additional Profile with a System Security Plan. Creates
        ImplementedRequirements for any new controls.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Profile binding request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/oscal.addProfileRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_profileSummary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a Profile binding to an SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/profiles/{profileId}:
    delete:
      description: Removes a profile association from a System Security Plan. Enqueues
        orphaned risk cleanup.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Profile ID to remove
        in: path
        name: profileId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_profileSummary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Remove a Profile binding from an SSP
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/responsibility-filters:
    get:
      description: |-
        Every filter attached to an upstream responsibility this SSP inherits
        (BCH-1339's filter_responsibilities), with filter names resolved — one call
        for the whole SSP so per-responsibility evidence bars need no N+1. Writes
        are on the filters API (POST/DELETE /filters/:id/responsibilities).
      parameters:
      - description: Downstream SSP ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscal_responsibilityFilterResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List a downstream SSP's filter↔responsibility attachments
      tags:
      - SSP Export Offerings
  /oscal/system-security-plans/{id}/shared-responsibility:
    get:
      description: |-
        A flat, statement-keyed projection of this SSP's shared-responsibility posture:
        what it exports (with the provided capabilities and the responsibilities it
        pushes onto consumers, and whether each is offered on a *published* offering —
        a draft/deprecated/revoked one does not count, since no downstream can reach
        it), what it inherits
        from upstreams (with live-recomputed satisfaction and link status), how it
        discharges upstream responsibilities, and any legacy requirement-anchored
        by-components still to be migrated.

        The inherits arm reuses the same batched projection GET /leveraged-controls
        serves, so the two can never disagree about satisfaction. Optionally filter the
        whole rollup to one control with controlId.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Only include rows for this control
        in: query
        name: controlId
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscal_SharedResponsibilityRollup'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Roll up everything one SSP provides, inherits and satisfies
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics:
    get:
      description: Retrieves the System Characteristics for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemCharacteristics'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get System Characteristics
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates the System Characteristics for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated System Characteristics object
        in: body
        name: characteristics
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemCharacteristics'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemCharacteristics'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update System Characteristics
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/authorization-boundary:
    get:
      description: Retrieves the Authorization Boundary for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_AuthorizationBoundary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Authorization Boundary
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/authorization-boundary/diagrams:
    post:
      consumes:
      - application/json
      description: Creates a new Diagram under the Authorization Boundary of a System
        Security Plan. Creates the Authorization Boundary grouping if it does not
        exist yet.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram object to create
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create an Authorization Boundary Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/authorization-boundary/diagrams/{diagram}:
    delete:
      description: Deletes a specific Diagram under the Authorization Boundary of
        a System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an Authorization Boundary Diagram
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates a specific Diagram under the Authorization Boundary of
        a System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      - description: Updated Diagram object
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update an Authorization Boundary Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/data-flow:
    get:
      description: Retrieves the Data Flow for a given System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_DataFlow'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Data Flow
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/data-flow/diagrams:
    post:
      consumes:
      - application/json
      description: Creates a new Diagram under the Data Flow of a System Security
        Plan. Creates the Data Flow grouping if it does not exist yet.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram object to create
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a Data Flow Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/data-flow/diagrams/{diagram}:
    delete:
      description: Deletes a specific Diagram under the Data Flow of a System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a Data Flow Diagram
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates a specific Diagram under the Data Flow of a System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      - description: Updated Diagram object
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a Data Flow Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/network-architecture:
    get:
      description: Retrieves the Network Architecture for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_NetworkArchitecture'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get Network Architecture
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/network-architecture/diagrams:
    post:
      consumes:
      - application/json
      description: Creates a new Diagram under the Network Architecture of a System
        Security Plan. Creates the Network Architecture grouping if it does not exist
        yet.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram object to create
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a Network Architecture Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-characteristics/network-architecture/diagrams/{diagram}:
    delete:
      description: Deletes a specific Diagram under the Network Architecture of a
        System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a Network Architecture Diagram
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates a specific Diagram under the Network Architecture of a
        System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Diagram ID
        in: path
        name: diagram
        required: true
        type: string
      - description: Updated Diagram object
        in: body
        name: diagram
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.Diagram'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_Diagram'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a Network Architecture Diagram
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation:
    get:
      description: Retrieves the System Implementation for a given System Security
        Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get System Implementation
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates the System Implementation for a given System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated System Implementation object
        in: body
        name: system-implementation
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemImplementation'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemImplementation'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update System Implementation
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/components:
    get:
      description: Retrieves components in the System Implementation for a given System
        Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_SystemComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List System Implementation Components
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new system component for a given SSP. Accepts an optional
        definedComponentId field to link to a DefinedComponent.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: System Component data with optional definedComponentId field
        in: body
        name: component
        required: true
        schema:
          $ref: '#/definitions/oscal.SystemComponentRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new system component
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/components/{componentId}:
    delete:
      description: Deletes an existing system component for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Component ID
        in: path
        name: componentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a system component
      tags:
      - System Security Plans
    get:
      description: Retrieves component in the System Implementation for a given System
        Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      - description: Component ID
        in: path
        name: componentId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get System Implementation Component
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing system component for a given SSP. Accepts an
        optional definedComponentId field to link to a DefinedComponent.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Component ID
        in: path
        name: componentId
        required: true
        type: string
      - description: System Component data with optional definedComponentId field
        in: body
        name: component
        required: true
        schema:
          $ref: '#/definitions/oscal.SystemComponentRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemComponent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a system component
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/inventory-items:
    get:
      description: Retrieves inventory items in the System Implementation for a given
        System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_InventoryItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List System Implementation Inventory Items
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new inventory item for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Inventory Item data
        in: body
        name: item
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_InventoryItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new inventory item
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/inventory-items/{itemId}:
    delete:
      description: Deletes an existing inventory item for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Item ID
        in: path
        name: itemId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete an inventory item
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing inventory item for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Item ID
        in: path
        name: itemId
        required: true
        type: string
      - description: Inventory Item data
        in: body
        name: item
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.InventoryItem'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_InventoryItem'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update an inventory item
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/leveraged-authorizations:
    get:
      description: Retrieves leveraged authorizations in the System Implementation
        for a given System Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_LeveragedAuthorization'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List System Implementation Leveraged Authorizations
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new leveraged authorization for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Leveraged Authorization data
        in: body
        name: auth
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.LeveragedAuthorization'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_LeveragedAuthorization'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new leveraged authorization
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/leveraged-authorizations/{authId}:
    delete:
      description: Deletes an existing leveraged authorization for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Authorization ID
        in: path
        name: authId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a leveraged authorization
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing leveraged authorization for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: Authorization ID
        in: path
        name: authId
        required: true
        type: string
      - description: Leveraged Authorization data
        in: body
        name: auth
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.LeveragedAuthorization'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_LeveragedAuthorization'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a leveraged authorization
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/users:
    get:
      description: Retrieves users in the System Implementation for a given System
        Security Plan.
      parameters:
      - description: System Security Plan ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-oscalTypes_1_1_3_SystemUser'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List System Implementation Users
      tags:
      - System Security Plans
    post:
      consumes:
      - application/json
      description: Creates a new system user for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: System User data
        in: body
        name: user
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemUser'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Create a new system user
      tags:
      - System Security Plans
  /oscal/system-security-plans/{id}/system-implementation/users/{userId}:
    delete:
      description: Deletes an existing system user for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: User ID
        in: path
        name: userId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Delete a system user
      tags:
      - System Security Plans
    put:
      consumes:
      - application/json
      description: Updates an existing system user for a given SSP.
      parameters:
      - description: SSP ID
        in: path
        name: id
        required: true
        type: string
      - description: User ID
        in: path
        name: userId
        required: true
        type: string
      - description: System User data
        in: body
        name: user
        required: true
        schema:
          $ref: '#/definitions/oscalTypes_1_1_3.SystemUser'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-oscalTypes_1_1_3_SystemUser'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      summary: Update a system user
      tags:
      - System Security Plans
  /oscal/system-security-plans/{sspId}/risks:
    get:
      description: Lists risk register entries scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk status
        in: query
        name: status
        type: string
      - description: Risk likelihood
        in: query
        name: likelihood
        type: string
      - description: Risk impact
        in: query
        name: impact
        type: string
      - description: Control ID
        in: query
        name: controlId
        type: string
      - description: Component ID
        in: query
        name: componentId
        type: string
      - description: Evidence ID
        in: query
        name: evidenceId
        type: string
      - description: Owner kind
        in: query
        name: ownerKind
        type: string
      - description: Owner reference
        in: query
        name: ownerRef
        type: string
      - description: Review deadline upper bound (RFC3339)
        in: query
        name: reviewDeadlineBefore
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      - description: Sort field
        in: query
        name: sort
        type: string
      - description: Sort order (asc|desc)
        in: query
        name: order
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risks for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Creates a risk register entry scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk payload
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/handler.createRiskRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}:
    delete:
      description: Deletes a risk register entry by ID scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk for SSP
      tags:
      - Risks
    get:
      description: Retrieves a risk register entry by ID scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk for SSP
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Updates a risk register entry by ID scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk payload
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/handler.updateRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/accept:
    post:
      consumes:
      - application/json
      description: Accepts a risk by ID scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Accept payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.acceptRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Accept risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/components:
    get:
      description: Lists components linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskComponentLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk component links for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links a component to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Component link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addComponentLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskComponentLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link component to risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/components/{componentId}:
    delete:
      description: Deletes the link between a risk and component scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Component ID
        in: path
        name: componentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk component link for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/controls:
    get:
      description: Lists controls linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk control links for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links a control to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Control link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addControlLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link control to risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/controls/{catalogId}/{controlId}:
    delete:
      description: Deletes the link between a risk and control scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Catalog ID
        in: path
        name: catalogId
        required: true
        type: string
      - description: Control ID
        in: path
        name: controlId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk control link for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/events:
    get:
      description: Lists events for a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskEvent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk events for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/evidence:
    get:
      description: Lists evidence IDs linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-uuid_UUID'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk evidence links for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links an evidence item to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addEvidenceLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskEvidenceLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link evidence to risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/evidence/{evidenceId}:
    delete:
      description: Deletes the link between a risk and evidence item scoped to an
        SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence ID
        in: path
        name: evidenceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk evidence link for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/promote-to-poam:
    post:
      consumes:
      - application/json
      description: Promotes an investigating risk to a POAM item, scoped to a specific
        SSP. The risk must belong to the given SSP and be in investigating status.
        On success, the risk transitions to mitigating-planned.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Promotion payload
        in: body
        name: body
        schema:
          $ref: '#/definitions/handler.promoteToPoamRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Promote risk to POAM item (SSP-scoped)
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/remediation-template:
    delete:
      description: Deletes the remediation template linked to a risk scoped to an
        SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk remediation template for SSP
      tags:
      - Risks
    get:
      description: Gets the remediation template linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk remediation template for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Creates a remediation template for a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Remediation template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/handler.remediationTemplateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create risk remediation template for SSP
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Replaces or creates the remediation template for a risk scoped
        to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Remediation template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/handler.remediationTemplateRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Upsert risk remediation template for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/review:
    post:
      consumes:
      - application/json
      description: Records a risk review by ID scoped to an SSP. For decision=extend,
        nextReviewDeadline is required and risk must be risk-accepted. For decision=reopen,
        nextReviewDeadline must be omitted and risk must be risk-accepted. For decision=reassess,
        likelihood and impact are required, nextReviewDeadline must be omitted, and
        risk must be open/investigating/mitigating-implemented.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Review payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.reviewRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Review risk for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/reviews:
    get:
      description: Lists risk reviews (audit trail) for a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskReview'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk audit trail for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/score-history:
    get:
      description: Lists score snapshots for a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_riskScoreResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk score history for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/threat-ids:
    get:
      description: Lists threat references linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk threat references for SSP
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Adds a threat reference to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference payload
        in: body
        name: threat
        required: true
        schema:
          $ref: '#/definitions/handler.threatIDRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add risk threat reference for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/{id}/threat-ids/{threatRefId}:
    delete:
      description: Deletes a threat reference linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk threat reference for SSP
      tags:
      - Risks
    get:
      description: Gets a threat reference linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk threat reference for SSP
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Updates a threat reference linked to a risk scoped to an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      - description: Threat reference payload
        in: body
        name: threat
        required: true
        schema:
          $ref: '#/definitions/handler.threatIDRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update risk threat reference for SSP
      tags:
      - Risks
  /oscal/system-security-plans/{sspId}/risks/score-timeseries:
    get:
      description: Returns aggregate open baseline and residual score time series
        for an SSP.
      parameters:
      - description: SSP ID
        in: path
        name: sspId
        required: true
        type: string
      - description: Start timestamp (RFC3339)
        in: query
        name: from
        type: string
      - description: End timestamp (RFC3339)
        in: query
        name: to
        type: string
      - description: Bucket size; only day is supported
        in: query
        name: bucket
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk score timeseries for SSP
      tags:
      - Risks
  /playback/evaluate:
    post:
      consumes:
      - application/json
      description: Evaluates Rego policy source against JSON input in a sandbox and
        returns the raw outcome plus the pass/fail interpretation the agent would
        record. Open to users, agents and anonymous callers where public agent endpoints
        are allowed. Nothing is persisted.
      parameters:
      - description: Policy, optional helper modules, input, optional policy data
          and evaluation time
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/policyeval.EvaluateRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/policyeval.EvaluateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/policyeval.ErrorResponse'
        "429":
          description: Too Many Requests
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Evaluate a Rego policy
      tags:
      - Playback
  /poam-items:
    get:
      parameters:
      - description: Filter by status (open|in-progress|completed|overdue)
        in: query
        name: status
        type: string
      - description: Filter by SSP UUID
        in: query
        name: sspId
        type: string
      - description: Filter by linked risk UUID
        in: query
        name: riskId
        type: string
      - description: Filter by planned_completion_date before (RFC3339)
        in: query
        name: deadlineBefore
        type: string
      - description: Return only overdue items
        in: query
        name: overdueOnly
        type: boolean
      - description: Filter by primary_owner_user_id UUID
        in: query
        name: ownerRef
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List POAM items
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.createPoamItemRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create a POAM item
      tags:
      - POAM Items
  /poam-items/{id}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a POAM item
      tags:
      - POAM Items
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get a POAM item
      tags:
      - POAM Items
    put:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Update payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.updatePoamItemRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a POAM item
      tags:
      - POAM Items
  /poam-items/{id}/controls:
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-poam_PoamItemControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List linked controls
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Control ref payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.poamControlRefRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-poam_PoamItemControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a control link
      tags:
      - POAM Items
  /poam-items/{id}/controls/{catalogId}/{controlId}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Catalog ID
        in: path
        name: catalogId
        required: true
        type: string
      - description: Control ID
        in: path
        name: controlId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a control link
      tags:
      - POAM Items
  /poam-items/{id}/evidence:
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-poam_PoamItemEvidenceLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List linked evidence
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence ID payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.addLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-poam_PoamItemEvidenceLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add an evidence link
      tags:
      - POAM Items
  /poam-items/{id}/evidence/{evidenceId}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence ID
        in: path
        name: evidenceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete an evidence link
      tags:
      - POAM Items
  /poam-items/{id}/findings:
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-poam_PoamItemFindingLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List linked findings
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Finding ID payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.addLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-poam_PoamItemFindingLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a finding link
      tags:
      - POAM Items
  /poam-items/{id}/findings/{findingId}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Finding ID
        in: path
        name: findingId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a finding link
      tags:
      - POAM Items
  /poam-items/{id}/milestones:
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_milestoneResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List milestones for a POAM item
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Milestone payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.createMilestoneRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_milestoneResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a milestone to a POAM item
      tags:
      - POAM Items
  /poam-items/{id}/milestones/{milestoneId}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Milestone ID
        in: path
        name: milestoneId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a milestone
      tags:
      - POAM Items
    put:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Milestone ID
        in: path
        name: milestoneId
        required: true
        type: string
      - description: Milestone update payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.updateMilestoneRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_milestoneResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update a milestone
      tags:
      - POAM Items
  /poam-items/{id}/risks:
    get:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-poam_PoamItemRiskLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List linked risks
      tags:
      - POAM Items
    post:
      consumes:
      - application/json
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk ID payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.addLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-poam_PoamItemRiskLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add a risk link
      tags:
      - POAM Items
  /poam-items/{id}/risks/{riskId}:
    delete:
      parameters:
      - description: POAM item ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk ID
        in: path
        name: riskId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete a risk link
      tags:
      - POAM Items
  /risks:
    get:
      description: Lists risk register entries with filtering, sorting, and pagination.
      parameters:
      - description: Risk status
        in: query
        name: status
        type: string
      - description: Risk likelihood
        in: query
        name: likelihood
        type: string
      - description: Risk impact
        in: query
        name: impact
        type: string
      - description: SSP ID
        in: query
        name: sspId
        type: string
      - description: Control ID
        in: query
        name: controlId
        type: string
      - description: Component ID
        in: query
        name: componentId
        type: string
      - description: Evidence ID
        in: query
        name: evidenceId
        type: string
      - description: Owner kind
        in: query
        name: ownerKind
        type: string
      - description: Owner reference
        in: query
        name: ownerRef
        type: string
      - description: Review deadline upper bound (RFC3339)
        in: query
        name: reviewDeadlineBefore
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      - description: Sort field
        in: query
        name: sort
        type: string
      - description: Sort order (asc|desc)
        in: query
        name: order
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risks
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Creates a risk register entry.
      parameters:
      - description: Risk payload
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/handler.createRiskRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create risk
      tags:
      - Risks
  /risks/{id}:
    delete:
      description: Deletes a risk register entry and link rows by ID.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk
      tags:
      - Risks
    get:
      description: Retrieves a risk register entry by ID.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Updates a risk register entry by ID.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Risk payload
        in: body
        name: risk
        required: true
        schema:
          $ref: '#/definitions/handler.updateRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update risk
      tags:
      - Risks
  /risks/{id}/accept:
    post:
      consumes:
      - application/json
      description: Accepts a risk with required justification and a future review
        deadline.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Accept payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.acceptRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Accept risk
      tags:
      - Risks
  /risks/{id}/components:
    get:
      description: Lists components linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskComponentLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk component links
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links a component to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Component link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addComponentLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskComponentLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link component to risk
      tags:
      - Risks
  /risks/{id}/components/{componentId}:
    delete:
      description: Deletes the link between a risk and component.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Component ID
        in: path
        name: componentId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk component link
      tags:
      - Risks
  /risks/{id}/controls:
    get:
      description: Lists controls linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk control links
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links a control to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Control link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addControlLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskControlLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link control to risk
      tags:
      - Risks
  /risks/{id}/controls/{catalogId}/{controlId}:
    delete:
      description: Deletes the link between a risk and control.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Catalog ID
        in: path
        name: catalogId
        required: true
        type: string
      - description: Control ID
        in: path
        name: controlId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk control link
      tags:
      - Risks
  /risks/{id}/events:
    get:
      description: Lists events for a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskEvent'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk events
      tags:
      - Risks
  /risks/{id}/evidence:
    get:
      description: Lists evidence IDs linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-uuid_UUID'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk evidence links
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links an evidence item to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addEvidenceLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskEvidenceLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link evidence to risk
      tags:
      - Risks
  /risks/{id}/evidence/{evidenceId}:
    delete:
      description: Deletes the link between a risk and evidence item.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Evidence ID
        in: path
        name: evidenceId
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk evidence link
      tags:
      - Risks
  /risks/{id}/promote-to-poam:
    post:
      consumes:
      - application/json
      description: Promotes an investigating risk to a POAM item and transitions the
        risk to mitigating-planned. The risk must be in investigating status (risk-accepted
        risks cannot be promoted — they have been formally accepted as tolerable).
        The POAM item is pre-populated from the risk's data and any RemediationTemplate
        tasks. The entire operation is transactional.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Promotion payload
        in: body
        name: body
        schema:
          $ref: '#/definitions/handler.promoteToPoamRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_poamItemResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "422":
          description: Unprocessable Entity
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Promote risk to POAM item
      tags:
      - Risks
  /risks/{id}/remediation-template:
    delete:
      description: Deletes the remediation template linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk remediation template
      tags:
      - Risks
    get:
      description: Gets the remediation template linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk remediation template
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Creates a remediation template for a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Remediation template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/handler.remediationTemplateRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create risk remediation template
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Replaces or creates the remediation template for a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Remediation template payload
        in: body
        name: template
        required: true
        schema:
          $ref: '#/definitions/handler.remediationTemplateRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_remediationTemplateResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Upsert risk remediation template
      tags:
      - Risks
  /risks/{id}/review:
    post:
      consumes:
      - application/json
      description: Records a structured review. For decision=extend, nextReviewDeadline
        is required and risk must be risk-accepted. For decision=reopen, nextReviewDeadline
        must be omitted and risk must be risk-accepted. For decision=reassess, likelihood
        and impact are required, nextReviewDeadline must be omitted, and risk must
        be open/investigating/mitigating-implemented. For decision=implement, nextReviewDeadline
        must be omitted and risk must be mitigating-planned.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Review payload
        in: body
        name: body
        required: true
        schema:
          $ref: '#/definitions/handler.reviewRiskRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_riskResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Review risk
      tags:
      - Risks
  /risks/{id}/reviews:
    get:
      description: Lists risk reviews (audit trail) for a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskReview'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk audit trail
      tags:
      - Risks
  /risks/{id}/score-history:
    get:
      description: Lists score snapshots for a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_riskScoreResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk score history
      tags:
      - Risks
  /risks/{id}/subjects:
    get:
      description: Lists subjects linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-risks_RiskSubjectLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk subject links
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Idempotently links a subject to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Subject link payload
        in: body
        name: link
        required: true
        schema:
          $ref: '#/definitions/handler.addSubjectLinkRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-risks_RiskSubjectLink'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Link subject to risk
      tags:
      - Risks
  /risks/{id}/threat-ids:
    get:
      description: Lists threat references linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List risk threat references
      tags:
      - Risks
    post:
      consumes:
      - application/json
      description: Adds a threat reference to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference payload
        in: body
        name: threat
        required: true
        schema:
          $ref: '#/definitions/handler.threatIDRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Add risk threat reference
      tags:
      - Risks
  /risks/{id}/threat-ids/{threatRefId}:
    delete:
      description: Deletes a threat reference linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete risk threat reference
      tags:
      - Risks
    get:
      description: Gets a threat reference linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk threat reference
      tags:
      - Risks
    put:
      consumes:
      - application/json
      description: Updates a threat reference linked to a risk.
      parameters:
      - description: Risk ID
        in: path
        name: id
        required: true
        type: string
      - description: Threat reference ID
        in: path
        name: threatRefId
        required: true
        type: string
      - description: Threat reference payload
        in: body
        name: threat
        required: true
        schema:
          $ref: '#/definitions/handler.threatIDRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_threatIDResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update risk threat reference
      tags:
      - Risks
  /risks/score-timeseries:
    get:
      description: Returns aggregate open baseline and residual score time series.
      parameters:
      - description: SSP ID
        in: query
        name: sspId
        type: string
      - description: Start timestamp (RFC3339)
        in: query
        name: from
        type: string
      - description: End timestamp (RFC3339)
        in: query
        name: to
        type: string
      - description: Bucket size; only day is supported
        in: query
        name: bucket
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get risk score timeseries
      tags:
      - Risks
  /subjects:
    get:
      description: 'Lists the entities evidence can name as its subject: defined components,
        SSP system components, parties and users. Used to pick and filter evidence
        subjects.'
      parameters:
      - description: Case-insensitive title search
        in: query
        name: search
        type: string
      - description: 'Comma-separated kinds: defined-component, system-component,
          party, user'
        in: query
        name: kind
        type: string
      - description: Only system components of this SSP
        in: query
        name: ssp
        type: string
      - description: Comma-separated subject UUIDs to look up (at most 100)
        in: query
        name: ids
        type: string
      - description: Page number
        in: query
        name: page
        type: integer
      - description: Page size
        in: query
        name: limit
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/service.ListResponse-subjects_Summary'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List subjects
      tags:
      - Subjects
  /users/{id}:
    get:
      description: Get minimal user details by user ID
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_publicUserResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get public user details by ID
      tags:
      - Users
  /users/{id}/change-password:
    post:
      consumes:
      - application/json
      description: Changes the password for a user by ID
      parameters:
      - description: User ID
        in: path
        name: id
        required: true
        type: string
      - description: Change Password Request
        in: body
        name: changePasswordRequest
        required: true
        schema:
          $ref: '#/definitions/handler.UserHandler'
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Change password for a specific user
      tags:
      - Users
  /users/me:
    get:
      description: Retrieves the details of the currently logged-in user
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-relational_User'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get logged-in user details
      tags:
      - Users
  /users/me/change-password:
    post:
      consumes:
      - application/json
      description: Changes the password for the currently logged-in user
      parameters:
      - description: Change Password Request
        in: body
        name: changePasswordRequest
        required: true
        schema:
          $ref: '#/definitions/handler.UserHandler'
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Change password for logged-in user
      tags:
      - Users
  /users/me/subscriptions:
    get:
      description: Gets the current user's notification delivery preferences
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_SubscriptionsResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get notification preferences
      tags:
      - Users
    put:
      consumes:
      - application/json
      description: Updates the current user's notification delivery preferences
      parameters:
      - description: Notification preferences
        in: body
        name: subscription
        required: true
        schema:
          $ref: '#/definitions/handler.UpdateSubscriptionsRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataResponse-handler_SubscriptionsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update notification preferences
      tags:
      - Users
  /users/select:
    get:
      description: Lists users with only id and display name for selection controls
      parameters:
      - description: Filter users by name
        in: query
        name: search
        type: string
      - description: Maximum users to return
        in: query
        name: limit
        type: integer
      - description: Number of users to skip
        in: query
        name: offset
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/handler.GenericDataListResponse-handler_selectableUserResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List selectable users
      tags:
      - Users
  /workflows/control-relationships:
    get:
      description: List all control relationships, optionally filtered by workflow
        definition
      parameters:
      - description: Workflow Definition ID
        in: query
        name: workflow_definition_id
        type: string
      - description: Control ID
        in: query
        name: control_id
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List control relationships
      tags:
      - Control Relationships
    post:
      consumes:
      - application/json
      description: Create a new control relationship for a workflow
      parameters:
      - description: Control relationship details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CreateControlRelationshipRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create control relationship
      tags:
      - Control Relationships
  /workflows/control-relationships/{id}:
    delete:
      description: Delete a control relationship
      parameters:
      - description: Control Relationship ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete control relationship
      tags:
      - Control Relationships
    get:
      description: Get control relationship by ID
      parameters:
      - description: Control Relationship ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get control relationship
      tags:
      - Control Relationships
    put:
      consumes:
      - application/json
      description: Update an existing control relationship
      parameters:
      - description: Control Relationship ID
        in: path
        name: id
        required: true
        type: string
      - description: Update details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.UpdateControlRelationshipRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update control relationship
      tags:
      - Control Relationships
  /workflows/control-relationships/{id}/activate:
    put:
      description: Activate a control relationship
      parameters:
      - description: Control Relationship ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Activate control relationship
      tags:
      - Control Relationships
  /workflows/control-relationships/{id}/deactivate:
    put:
      description: Deactivate a control relationship
      parameters:
      - description: Control Relationship ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.ControlRelationshipResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Deactivate control relationship
      tags:
      - Control Relationships
  /workflows/definitions:
    get:
      description: List all workflow definition templates
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowDefinitionListResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List workflow definitions
      tags:
      - Workflow Definitions
    post:
      consumes:
      - application/json
      description: Create a new workflow definition template
      parameters:
      - description: Workflow definition details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CreateWorkflowDefinitionRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.WorkflowDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create workflow definition
      tags:
      - Workflow Definitions
  /workflows/definitions/{id}:
    delete:
      description: Delete workflow definition by ID
      parameters:
      - description: Workflow Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete workflow definition
      tags:
      - Workflow Definitions
    get:
      description: Get workflow definition by ID
      parameters:
      - description: Workflow Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow definition
      tags:
      - Workflow Definitions
    put:
      consumes:
      - application/json
      description: Update workflow definition by ID
      parameters:
      - description: Workflow Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated workflow definition details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.UpdateWorkflowDefinitionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update workflow definition
      tags:
      - Workflow Definitions
  /workflows/executions:
    get:
      description: List all executions for a workflow instance
      parameters:
      - description: Workflow Instance ID
        in: query
        name: workflow_instance_id
        required: true
        type: string
      - description: Limit
        in: query
        name: limit
        type: integer
      - description: Offset
        in: query
        name: offset
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List workflow executions
      tags:
      - Workflow Executions
    post:
      consumes:
      - application/json
      description: Start a new execution of a workflow instance
      parameters:
      - description: Execution details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.StartWorkflowExecutionRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Start workflow execution
      tags:
      - Workflow Executions
  /workflows/executions/{id}:
    get:
      description: Get workflow execution by ID
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow execution
      tags:
      - Workflow Executions
  /workflows/executions/{id}/cancel:
    put:
      consumes:
      - application/json
      description: Cancel a running workflow execution
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: Cancel details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CancelWorkflowExecutionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Cancel workflow execution
      tags:
      - Workflow Executions
  /workflows/executions/{id}/metrics:
    get:
      description: Get performance metrics for a workflow execution
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionMetricsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow execution metrics
      tags:
      - Workflow Executions
  /workflows/executions/{id}/reassign-role:
    put:
      consumes:
      - application/json
      description: Reassign eligible steps in an execution for a given role
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: Bulk reassignment details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.ReassignRoleRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.BulkReassignRoleResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Bulk reassign steps by role
      tags:
      - Workflow Executions
  /workflows/executions/{id}/retry:
    post:
      description: Create a new execution to retry a failed workflow
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Retry workflow execution
      tags:
      - Workflow Executions
  /workflows/executions/{id}/status:
    get:
      description: Get detailed status of a workflow execution including step counts
      parameters:
      - description: Workflow Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowExecutionStatusResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow execution status
      tags:
      - Workflow Executions
  /workflows/import:
    post:
      consumes:
      - multipart/form-data
      description: Import one or more SOC 2 CCF workflow seed JSON files
      parameters:
      - description: Workflow seed JSON files to import. Upload multiple files by
          including multiple multipart form-data parts with the same field name, files.
        in: formData
        name: files
        required: true
        type: file
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowImportDataResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "413":
          description: Request Entity Too Large
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Import workflow seed definitions
      tags:
      - Workflows
  /workflows/instances:
    get:
      description: List all workflow instances with optional filtering
      parameters:
      - description: Filter by Workflow Definition ID
        in: query
        name: workflow_definition_id
        type: string
      - description: Filter by System Security Plan ID
        in: query
        name: system_security_plan_id
        type: string
      - description: Filter by Active Status
        in: query
        name: is_active
        type: boolean
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceListResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List workflow instances
      tags:
      - Workflow Instances
    post:
      consumes:
      - application/json
      description: Create a new workflow instance for a specific system
      parameters:
      - description: Workflow instance details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CreateWorkflowInstanceRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create workflow instance
      tags:
      - Workflow Instances
  /workflows/instances/{id}:
    delete:
      description: Delete workflow instance by ID
      parameters:
      - description: Workflow Instance ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete workflow instance
      tags:
      - Workflow Instances
    get:
      description: Get workflow instance by ID
      parameters:
      - description: Workflow Instance ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow instance
      tags:
      - Workflow Instances
    put:
      consumes:
      - application/json
      description: Update workflow instance by ID
      parameters:
      - description: Workflow Instance ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated workflow instance details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.UpdateWorkflowInstanceRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update workflow instance
      tags:
      - Workflow Instances
  /workflows/instances/{id}/activate:
    put:
      description: Activate a workflow instance to enable scheduled executions
      parameters:
      - description: Workflow Instance ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Activate workflow instance
      tags:
      - Workflow Instances
  /workflows/instances/{id}/deactivate:
    put:
      description: Deactivate a workflow instance to disable scheduled executions
      parameters:
      - description: Workflow Instance ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowInstanceResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Deactivate workflow instance
      tags:
      - Workflow Instances
  /workflows/role-assignments:
    get:
      description: List all role assignments, optionally filtered by workflow instance
      parameters:
      - description: Workflow Instance ID
        in: query
        name: workflow_instance_id
        type: string
      - description: Role Name
        in: query
        name: role_name
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List role assignments
      tags:
      - Role Assignments
    post:
      consumes:
      - application/json
      description: Create a new role assignment for a workflow instance
      parameters:
      - description: Role assignment details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CreateRoleAssignmentRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create role assignment
      tags:
      - Role Assignments
  /workflows/role-assignments/{id}:
    delete:
      description: Delete a role assignment
      parameters:
      - description: Role Assignment ID
        in: path
        name: id
        required: true
        type: string
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete role assignment
      tags:
      - Role Assignments
    get:
      description: Get role assignment by ID
      parameters:
      - description: Role Assignment ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get role assignment
      tags:
      - Role Assignments
    put:
      consumes:
      - application/json
      description: Update an existing role assignment
      parameters:
      - description: Role Assignment ID
        in: path
        name: id
        required: true
        type: string
      - description: Update details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.UpdateRoleAssignmentRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update role assignment
      tags:
      - Role Assignments
  /workflows/role-assignments/{id}/activate:
    put:
      description: Activate a role assignment
      parameters:
      - description: Role Assignment ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Activate role assignment
      tags:
      - Role Assignments
  /workflows/role-assignments/{id}/deactivate:
    put:
      description: Deactivate a role assignment
      parameters:
      - description: Role Assignment ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.RoleAssignmentResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Deactivate role assignment
      tags:
      - Role Assignments
  /workflows/step-executions:
    get:
      description: List all step executions for a workflow execution
      parameters:
      - description: Workflow Execution ID
        in: query
        name: workflow_execution_id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.StepExecutionListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List step executions
      tags:
      - Step Executions
  /workflows/step-executions/{id}:
    get:
      description: Get step execution by ID
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.StepExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get step execution
      tags:
      - Step Executions
  /workflows/step-executions/{id}/can-transition:
    get:
      description: Check if a user has permission to transition a step execution
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: User ID
        in: query
        name: user_id
        required: true
        type: string
      - description: User Type (user, group, email)
        in: query
        name: user_type
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Check if user can transition step
      tags:
      - Step Executions
  /workflows/step-executions/{id}/evidence-requirements:
    get:
      description: Get the evidence requirements for a step execution
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties: true
            type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get evidence requirements for step
      tags:
      - Step Executions
  /workflows/step-executions/{id}/fail:
    put:
      consumes:
      - application/json
      description: Mark a step execution as failed with a reason
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: Failure details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.FailStepRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.StepExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Fail step execution
      tags:
      - Step Executions
  /workflows/step-executions/{id}/reassign:
    put:
      consumes:
      - application/json
      description: Reassign a step execution to a new assignee
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: Reassignment details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.ReassignStepRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.StepExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Reassign step execution
      tags:
      - Step Executions
  /workflows/step-executions/{id}/transition:
    put:
      consumes:
      - application/json
      description: Transition a step execution status with role verification and evidence
        validation
      parameters:
      - description: Step Execution ID
        in: path
        name: id
        required: true
        type: string
      - description: Transition request
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.TransitionStepRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.StepExecutionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "403":
          description: Forbidden
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Transition step execution status
      tags:
      - Step Executions
  /workflows/step-executions/my:
    get:
      description: List all step executions assigned to the current user with optional
        filters and pagination
      parameters:
      - description: Filter by status (pending, in_progress, blocked)
        in: query
        name: status
        type: string
      - description: Filter by due date before (RFC3339 format)
        in: query
        name: due_before
        type: string
      - description: Filter by due date after (RFC3339 format)
        in: query
        name: due_after
        type: string
      - description: Filter by workflow definition ID
        in: query
        name: workflow_definition_id
        type: string
      - description: Limit (default 20, max 100)
        in: query
        name: limit
        type: integer
      - description: Offset (default 0)
        in: query
        name: offset
        type: integer
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.MyAssignmentsResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List my step assignments
      tags:
      - Step Executions
  /workflows/steps:
    get:
      description: List all step definitions for a workflow definition
      parameters:
      - description: Workflow Definition ID
        in: query
        name: workflow_definition_id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowStepDefinitionListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: List workflow step definitions
      tags:
      - Workflow Step Definitions
    post:
      consumes:
      - application/json
      description: Create a new step definition for a workflow
      parameters:
      - description: Step definition details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.CreateWorkflowStepDefinitionRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/workflows.WorkflowStepDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Create workflow step definition
      tags:
      - Workflow Step Definitions
  /workflows/steps/{id}:
    delete:
      description: Delete workflow step definition by ID
      parameters:
      - description: Step Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "204":
          description: No Content
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Delete workflow step definition
      tags:
      - Workflow Step Definitions
    get:
      description: Get workflow step definition by ID
      parameters:
      - description: Step Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowStepDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get workflow step definition
      tags:
      - Workflow Step Definitions
    put:
      consumes:
      - application/json
      description: Update workflow step definition by ID
      parameters:
      - description: Step Definition ID
        in: path
        name: id
        required: true
        type: string
      - description: Updated step definition details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/workflows.UpdateWorkflowStepDefinitionRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowStepDefinitionResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Update workflow step definition
      tags:
      - Workflow Step Definitions
  /workflows/steps/{id}/dependencies:
    get:
      description: Get all dependencies for a workflow step definition
      parameters:
      - description: Step Definition ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/workflows.WorkflowStepDefinitionListResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/api.Error'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/api.Error'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/api.Error'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/api.Error'
      security:
      - OAuth2Password: []
      summary: Get step dependencies
      tags:
      - Workflow Step Definitions
produces:
- application/json
securityDefinitions:
  OAuth2Password:
    flow: password
    tokenUrl: /api/auth/token
    type: oauth2
swagger: "2.0"