openapi: "3.0.3"
info:
  title: "Qibdo Cloud"
  version: "0.0.1"
paths:
  /compute/v1/operations:
    get:
      tags:
      - "ComputeOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of operations, optionally\
        \ filtered by resource."
      operationId: "ComputeOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListOperations` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=VirtualMachine\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.ListComputeOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/operations/{id}:
    get:
      tags:
      - "ComputeOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single operation by its unique ID."
      operationId: "ComputeOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms:
    get:
      tags:
      - "QibdoVirtualMachineService"
      summary: "List Virtual Machine"
      description: "List\n\n Returns a page Virtual Machines (VM) filtered by a page\
        \ size and optional parameters"
      operationId: "QibdoVirtualMachineService_ListQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of virtual machines to return. The service\
          \ may return fewer than\n this value.\n If unspecified, at most 20 virtual\
          \ machines will be returned.\n The maximum value is 100; values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoVirtualMachine`\
          \ call.\n Provide this to retrieve the subsequent page.\n When paginating,\
          \ all other parameters provided to `ListQibdoVirtualMachine` must match\n\
          \ the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "A filter expression allows you to filter the virtual machines\
          \ listed in the response.\n At qibdo, we use the [AIP-160](https://google.aip.dev/160)\
          \ proposal, that means that your expression should include:\n field name,\
          \ an operator, and the value you wish to filter by.\n The value can be a\
          \ **string**, **number**, or **boolean**, and the operator must be one of\
          \ the following: **=, !=, >, <, <=, >=,** or **:**\n You can group multiple\
          \ expressions using parentheses and the logical operators **AND** and **OR**.\n\
          \ Examples:\n `name = \"my-vm\"` -> Filter by the name of the virtual machine\n\
          \ `(name = \"my-vm\") AND (status = \"QIBDO_VM_STATUS_RUNNING\")` -> Filter\
          \ by the name and status of the virtual machine\n `numa:*` -> Returns virtual\
          \ machines with NUMA configuration"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "The order in which to sort the results. If not specified, the\
          \ results will be sorted by name in ascending order.\n At qibdo, we use\
          \ the [AIP-132](https://google.aip.dev/132) proposal, that means:\n Values\
          \ should be a comma separated list of fields. For example: `\"foo,bar\"\
          `.\n The default sort order is ascending. To specify descending order, a\
          \ suffix `\" desc\"` should be added. For example: `\"foo desc,bar\"`.\n\
          \ Redundant space characters in the syntax are insignificant."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ListQibdoVirtualMachineResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Create Virtual Machine"
      description: "Create\n\n Creates a new Virtual Machine (VM) in a specific workspace\
        \ and zone"
      operationId: "QibdoVirtualMachineService_CreateQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QibdoVirtualMachine"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:
    get:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Get Virtual Machine"
      description: "Get\n\n Returns a Virtual Machine (VM) by unique ID"
      operationId: "QibdoVirtualMachineService_GetQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QibdoVirtualMachine"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Delete Virtual Machine"
      description: "Delete\n\n Deletes a Virtual Machine (VM) by unique ID"
      operationId: "QibdoVirtualMachineService_DeleteQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Update Virtual Machine"
      description: "Update\n\n Updates a Virtual Machine (VM)"
      operationId: "QibdoVirtualMachineService_UpdateQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QibdoVirtualMachine"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:reset:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Reset Virtual Machine"
      description: "Reset\n\n Forcefully reset the virtual machine's state, similar\
        \ to pressing\n the reset button on a physical machine"
      operationId: "QibdoVirtualMachineService_ResetQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ResetQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:restart:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Restart Virtual Machine"
      description: "Restart\n\n Restarts/reboot gracefully the guest operating system\
        \ within a virtual machine"
      operationId: "QibdoVirtualMachineService_RestartQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.RestartQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:resume:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Resume Virtual Machine"
      description: "Resume\n\n Resumes a virtual machine that was suspended"
      operationId: "QibdoVirtualMachineService_ResumeQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ResumeQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:start:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Start Virtual Machine"
      description: "Start\n\n Starts/boots a virtual machine that was previously stopped\n\
        \n Custom methods use `body: \"*\"` per AIP-136. Path parameters (workspace,\
        \ zone, id) are\n extracted from the URL; any future non-path fields are deserialized\
        \ from the HTTP body.\n Follows industry practice from GCP, AWS, and Azure."
      operationId: "QibdoVirtualMachineService_StartQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.StartQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:stop:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Stop Virtual Machine"
      description: "Stop\n\n Stops a running virtual machine, shutting it down cleanly"
      operationId: "QibdoVirtualMachineService_StopQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.StopQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /compute/v1/workspaces/{workspace}/engines/qibdo/vms/{id}:suspend:
    post:
      tags:
      - "QibdoVirtualMachineService"
      summary: "Suspend Virtual Machine"
      description: "Suspend\n\n This method suspends a running virtual machine, saving\
        \ its state to persistent storage,\n and allows you to resume the instance\
        \ at a later time"
      operationId: "QibdoVirtualMachineService_SuspendQibdoVirtualMachine"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the virtual machine\
          \ belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the virtual machine to retrieve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.SuspendQibdoVirtualMachineRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/bindings:
    get:
      tags:
      - "IamBindingService"
      summary: "List IAM Bindings"
      description: "ListIamBindings\n\n Returns a paginated list of IAM bindings"
      operationId: "IamBindingService_ListIamBindings"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of bindings to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 bindings will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListIamBindings` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListIamBindings` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'principal_id = \"uuid\" AND\
          \ scope_type = \"WORKSPACE\"'"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListIamBindingsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "IamBindingService"
      summary: "Create IAM Binding"
      description: "CreateIamBinding\n\n Creates a new IAM binding"
      operationId: "IamBindingService_CreateIamBinding"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamBinding"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/bindings/{id}:
    get:
      tags:
      - "IamBindingService"
      summary: "Get IAM Binding"
      description: "GetIamBinding\n\n Returns an IAM binding by unique ID"
      operationId: "IamBindingService_GetIamBinding"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the IAM binding to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamBinding"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "IamBindingService"
      summary: "Delete IAM Binding"
      description: "DeleteIamBinding\n\n Deletes an IAM binding by unique ID"
      operationId: "IamBindingService_DeleteIamBinding"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the IAM binding to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/operations:
    get:
      tags:
      - "IamOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of operations, optionally\
        \ filtered by resource."
      operationId: "IamOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListOperations` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=User\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListIamOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/operations/{id}:
    get:
      tags:
      - "IamOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single operation by its unique ID."
      operationId: "IamOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/permissions:
    get:
      tags:
      - "PermissionService"
      summary: "List Permissions"
      description: "ListPermissions\n\n Returns a paginated list of all available\
        \ permissions"
      operationId: "PermissionService_ListPermissions"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of permissions to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 permissions\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListPermissions` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListPermissions` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'service = \"compute\"'"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPermissionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/permissions/{id}:
    get:
      tags:
      - "PermissionService"
      summary: "Get Permission"
      description: "GetPermission\n\n Returns a permission by its natural key (e.g.\
        \ \"compute.vm.create\")"
      operationId: "PermissionService_GetPermission"
      parameters:
      - name: "id"
        in: "path"
        description: "The natural key of the permission to retrieve (e.g. \"compute.vm.create\"\
          )"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Permission"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/principals:
    get:
      tags:
      - "PrincipalService"
      summary: "List Principals"
      description: "ListPrincipals\n\n Returns a paginated directory of principals,\
        \ filtered to the kinds the\n caller is permitted to read."
      operationId: "PrincipalService_ListPrincipals"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of principals to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 principals\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListPrincipals` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'status = \"ACTIVE\"'."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created asc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPrincipalsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/principals/{id}:
    get:
      tags:
      - "PrincipalService"
      summary: "Get Principal"
      description: "GetPrincipal\n\n Returns a single principal by unique ID."
      operationId: "PrincipalService_GetPrincipal"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the principal to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Principal"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/roles:
    get:
      tags:
      - "RoleService"
      summary: "List Roles"
      description: "ListRoles\n\n Returns a paginated list of roles"
      operationId: "RoleService_ListRoles"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of roles to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 roles will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListRoles` call.\n Provide\
          \ this to retrieve the subsequent page. When paginating,\n all other parameters\
          \ provided to `ListRoles` must match the call\n that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'role_type = \"CUSTOM\"'"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListRolesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "RoleService"
      summary: "Create Role"
      description: "CreateRole\n\n Creates a new role"
      operationId: "RoleService_CreateRole"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Role"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/roles/{id}:
    get:
      tags:
      - "RoleService"
      summary: "Get Role"
      description: "GetRole\n\n Returns a role by unique ID"
      operationId: "RoleService_GetRole"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Role"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "RoleService"
      summary: "Delete Role"
      description: "DeleteRole\n\n Deletes a role by unique ID"
      operationId: "RoleService_DeleteRole"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "RoleService"
      summary: "Update Role"
      description: "UpdateRole\n\n Updates an existing role"
      operationId: "RoleService_UpdateRole"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Role"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/roles/{role}/permissions:
    get:
      tags:
      - "RoleService"
      summary: "List Role Permissions"
      description: "ListRolePermissions\n\n Returns a paginated list of permissions\
        \ assigned to a role"
      operationId: "RoleService_ListRolePermissions"
      parameters:
      - name: "role"
        in: "path"
        description: "The role to list permissions for"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of role permissions to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 role permissions\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListRolePermissions`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListRolePermissions` must match the\
          \ call\n that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'permission asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListRolePermissionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "RoleService"
      summary: "Add Role Permission"
      description: "AddRolePermission\n\n Adds a permission to a role"
      operationId: "RoleService_AddRolePermission"
      parameters:
      - name: "role"
        in: "path"
        description: "The role to add the permission to"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.AddRolePermissionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/roles/{role}/permissions/{permission}:
    delete:
      tags:
      - "RoleService"
      summary: "Remove Role Permission"
      description: "RemoveRolePermission\n\n Removes a permission from a role"
      operationId: "RoleService_RemoveRolePermission"
      parameters:
      - name: "role"
        in: "path"
        description: "The role to remove the permission from"
        required: true
        schema:
          type: "string"
      - name: "permission"
        in: "path"
        description: "The permission to remove (e.g. \"compute.vm.create\")"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/scopes/{scope_type}/{scope_id}/access:
    get:
      tags:
      - "PrincipalService"
      summary: "List Scope Access"
      description: "ListScopeAccess\n\n Returns every principal with effective access\
        \ at a scope, each role tagged\n direct or inherited (rolled down from ancestor\
        \ scopes)."
      operationId: "PrincipalService_ListScopeAccess"
      parameters:
      - name: "scope_type"
        in: "path"
        description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        required: true
        schema:
          type: "string"
      - name: "scope_id"
        in: "path"
        description: "The unique identifier of the scope."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of entries to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 entries will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListScopeAccess` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListScopeAccessResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/scopes/{scope_type}/{scope_id}/access:grant:
    post:
      tags:
      - "PrincipalService"
      summary: "Grant Access"
      description: "Grant\n\n Grants a role to an existing principal at a scope. Idempotent\
        \ — re-issuing\n an existing grant is a no-op success."
      operationId: "PrincipalService_Grant"
      parameters:
      - name: "scope_type"
        in: "path"
        description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        required: true
        schema:
          type: "string"
      - name: "scope_id"
        in: "path"
        description: "The unique identifier of the scope."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.GrantRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/scopes/{scope_type}/{scope_id}/access:invite:
    post:
      tags:
      - "PrincipalService"
      summary: "Invite Principal"
      description: "InvitePrincipal\n\n Atomically creates an invited user and their\
        \ first scoped binding in one\n transaction."
      operationId: "PrincipalService_InvitePrincipal"
      parameters:
      - name: "scope_type"
        in: "path"
        description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        required: true
        schema:
          type: "string"
      - name: "scope_id"
        in: "path"
        description: "The unique identifier of the scope."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.InvitePrincipalRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/scopes/{scope_type}/{scope_id}/access:revoke:
    post:
      tags:
      - "PrincipalService"
      summary: "Revoke Access"
      description: "Revoke\n\n Revokes a directly-granted role from a principal at\
        \ a scope. Idempotent —\n revoking an absent grant is a no-op success; an\
        \ inherited role is rejected."
      operationId: "PrincipalService_Revoke"
      parameters:
      - name: "scope_type"
        in: "path"
        description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        required: true
        schema:
          type: "string"
      - name: "scope_id"
        in: "path"
        description: "The unique identifier of the scope."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.RevokeRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/tokens:
    get:
      tags:
      - "TokenService"
      summary: "List Tokens"
      description: "ListTokens\n\n Returns a paginated list of the authenticated user's\
        \ active session tokens."
      operationId: "TokenService_ListTokens"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of tokens to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 tokens will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListTokens` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListTokens` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListTokensResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/tokens:refresh:
    post:
      tags:
      - "TokenService"
      summary: "Refresh Access Token"
      description: "RefreshAccessToken\n\n Exchanges a valid refresh token for a new\
        \ access token and refresh token pair.\n The old refresh token is consumed\
        \ (deleted) and cannot be reused.\n This RPC does not require Bearer authentication\
        \ — the refresh token itself is the credential."
      operationId: "TokenService_RefreshAccessToken"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.RefreshTokenRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.RefreshTokenResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/tokens:revoke:
    post:
      tags:
      - "TokenService"
      summary: "Revoke Token"
      description: "RevokeToken\n\n Revokes a session token, immediately terminating\
        \ the session and any\n sibling tokens in the same family (cascade via family_id).\n\
        \n Empty `token_hash` → revoke the bearer credential extracted from the\n\
        \ `Authorization` header (the common \"log me out\" case).\n Non-empty `token_hash`\
        \ → revoke the named session. Caller must own the\n session OR hold platform-scoped\
        \ `iam.token.revoke`.\n\n Returns NOT_FOUND if the hash does not exist OR\
        \ if the caller is not\n permitted to see it (existence-leak suppression)."
      operationId: "TokenService_RevokeToken"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.RevokeTokenRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users:
    get:
      tags:
      - "UserService"
      summary: "List Users"
      description: "ListUsers\n\n Returns a paginated list of users"
      operationId: "UserService_ListUsers"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of users to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 users will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListUsers` call.\n Provide\
          \ this to retrieve the subsequent page. When paginating,\n all other parameters\
          \ provided to `ListUsers` must match the call\n that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'is_active = true'"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'email asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListUsersResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:
    get:
      tags:
      - "UserService"
      summary: "Get User"
      description: "GetUser\n\n Returns a user by unique ID"
      operationId: "UserService_GetUser"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.User"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "UserService"
      summary: "Delete User"
      description: "DeleteUser\n\n Deletes a user by unique ID"
      operationId: "UserService_DeleteUser"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "UserService"
      summary: "Update User"
      description: "UpdateUser\n\n Updates an existing user"
      operationId: "UserService_UpdateUser"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.User"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:activate:
    post:
      tags:
      - "UserService"
      summary: "Activate User"
      description: "Activate\n\n Self-service activation of an invited user — sets\
        \ the first password and\n transitions the account from INVITED to ACTIVE."
      operationId: "UserService_Activate"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to activate"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ActivateUserRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:changePassword:
    post:
      tags:
      - "UserService"
      summary: "Change Password"
      description: "ChangePassword\n\n Changes the password for an existing user account.\n\
        \ Requires the current password for verification."
      operationId: "UserService_ChangePassword"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user whose password to change"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ChangePasswordRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:clearAvatar:
    post:
      tags:
      - "UserService"
      summary: "Clear User Avatar"
      description: "ClearUserAvatar\n\n Clears a user's avatar — removes the reference\
        \ and deletes the stored\n object on a best-effort basis."
      operationId: "UserService_ClearUserAvatar"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user whose avatar to clear"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:deactivate:
    post:
      tags:
      - "UserService"
      summary: "Deactivate User"
      description: "Deactivate\n\n Deactivates a user account. A deactivated user\
        \ cannot authenticate; their\n bindings are retained for later reactivation."
      operationId: "UserService_Deactivate"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to deactivate"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:reactivate:
    post:
      tags:
      - "UserService"
      summary: "Reactivate User"
      description: "Reactivate\n\n Reactivates a deactivated user, restoring access\
        \ via their retained\n bindings (DEACTIVATED to ACTIVE)."
      operationId: "UserService_Reactivate"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user to reactivate"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users/{id}:uploadAvatar:
    post:
      tags:
      - "UserService"
      summary: "Upload User Avatar"
      description: "UploadUserAvatar\n\n Uploads an avatar image for a user. The caller\
        \ streams raw image bytes\n (with Content-Type) to this single endpoint; the\
        \ server validates the\n image (type allowlist + size cap + content sniffing),\
        \ stores it privately\n in the platform system bucket via the storage service,\
        \ and sets the user's\n avatar reference. The caller never names a bucket\
        \ or handles a presigned URL."
      operationId: "UserService_UploadUserAvatar"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the user whose avatar to set"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              type: "string"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/users:authenticate:
    post:
      tags:
      - "UserService"
      summary: "Authenticate"
      description: "Authenticate\n\n Authenticates a user with email and password,\
        \ returning a session token"
      operationId: "UserService_Authenticate"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.AuthenticateRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.AuthenticateResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/workspaces/{workspace}/policies:
    get:
      tags:
      - "PolicyService"
      summary: "List Policies"
      description: "ListPolicies\n\n Returns a paginated list of policies within a\
        \ workspace"
      operationId: "PolicyService_ListPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to list policies for"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of policies to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 policies will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListPolicies` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListPolicies` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "PolicyService"
      summary: "Create Policy"
      description: "CreatePolicy\n\n Creates a new policy within a workspace"
      operationId: "PolicyService_CreatePolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the policy in"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Policy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /iam/v1/workspaces/{workspace}/policies/{id}:
    get:
      tags:
      - "PolicyService"
      summary: "Get Policy"
      description: "GetPolicy\n\n Returns a policy by unique ID within a workspace"
      operationId: "PolicyService_GetPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the policy belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the policy to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Policy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "PolicyService"
      summary: "Delete Policy"
      description: "DeletePolicy\n\n Deletes a policy by unique ID within a workspace"
      operationId: "PolicyService_DeletePolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the policy belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the policy to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "PolicyService"
      summary: "Update Policy"
      description: "UpdatePolicy\n\n Updates an existing policy within a workspace"
      operationId: "PolicyService_UpdatePolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the policy belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the policy to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Policy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/operations:
    get:
      tags:
      - "NetworkOperationService"
      summary: "List Network Operations"
      description: "ListNetworkOperations\n\n Returns a paginated list of operations,\
        \ optionally filtered by resource."
      operationId: "NetworkOperationService_ListNetworkOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListNetworkOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListNetworkOperations` must match\n\
          \ the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=com.qibdo.cloud.network:vpc\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.ListNetworkOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/operations/{id}:
    get:
      tags:
      - "NetworkOperationService"
      summary: "Get Network Operation"
      description: "GetNetworkOperation\n\n Returns a single operation by its unique\
        \ ID."
      operationId: "NetworkOperationService_GetNetworkOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/quota-definitions:
    get:
      tags:
      - "QuotaDefinitionService"
      summary: "List Quota Definitions"
      description: "ListQuotaDefinitions\n\n Returns a paginated list of quota definitions\
        \ for the network service."
      operationId: "QuotaDefinitionService_ListQuotaDefinitions"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of quota definitions to return.\
          \ The service may return\n fewer than this value. If unspecified, at most\
          \ 20 definitions will be\n returned. The maximum value is 100; values above\
          \ 100 will be coerced\n to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListQuotaDefinitions`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListQuotaDefinitions` must match\n the\
          \ call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"container_type=WORKSPACE\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression, e.g. 'metric asc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.ListQuotaDefinitionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/quota-definitions/{id}:
    get:
      tags:
      - "QuotaDefinitionService"
      summary: "Get Quota Definition"
      description: "GetQuotaDefinition\n\n Returns a single quota definition by its\
        \ unique ID."
      operationId: "QuotaDefinitionService_GetQuotaDefinition"
      parameters:
      - name: "id"
        in: "path"
        description: "Quota Definition ID\n\n The unique identifier of the quota definition\
          \ to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaDefinition"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/quota-definitions/{quota_definition}/limits:
    get:
      tags:
      - "QuotaLimitService"
      summary: "List Quota Limits"
      description: "ListQuotaLimits\n\n Returns a paginated list of quota limits for\
        \ a quota definition."
      operationId: "QuotaLimitService_ListQuotaLimits"
      parameters:
      - name: "quota_definition"
        in: "path"
        description: "The quota definition to list limits for."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of quota limits to return. The\
          \ service may return\n fewer than this value. If unspecified, at most 20\
          \ limits will be\n returned. The maximum value is 100; values above 100\
          \ will be coerced\n to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListQuotaLimits`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListQuotaLimits` must match\n the call\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"container_id=uuid\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.ListQuotaLimitsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QuotaLimitService"
      summary: "Create Quota Limit"
      description: "CreateQuotaLimit\n\n Creates a new quota limit override for a\
        \ quota definition."
      operationId: "QuotaLimitService_CreateQuotaLimit"
      parameters:
      - name: "quota_definition"
        in: "path"
        description: "The quota definition to create the limit override for."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaLimit"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/quota-definitions/{quota_definition}/limits/{id}:
    get:
      tags:
      - "QuotaLimitService"
      summary: "Get Quota Limit"
      description: "GetQuotaLimit\n\n Returns a quota limit by unique ID."
      operationId: "QuotaLimitService_GetQuotaLimit"
      parameters:
      - name: "quota_definition"
        in: "path"
        description: "The quota definition the limit belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the quota limit to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaLimit"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QuotaLimitService"
      summary: "Delete Quota Limit"
      description: "DeleteQuotaLimit\n\n Deletes a quota limit by unique ID. After\
        \ deletion, the quota definition's\n default_limit applies for the previously\
        \ overridden container and dimensions."
      operationId: "QuotaLimitService_DeleteQuotaLimit"
      parameters:
      - name: "quota_definition"
        in: "path"
        description: "The quota definition the limit belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the quota limit to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QuotaLimitService"
      summary: "Update Quota Limit"
      description: "UpdateQuotaLimit\n\n Updates an existing quota limit. Adjustments\
        \ take effect immediately."
      operationId: "QuotaLimitService_UpdateQuotaLimit"
      parameters:
      - name: "quota_definition"
        in: "path"
        description: "The quota definition the limit belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the quota limit to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaLimit"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/logical-ports:
    get:
      tags:
      - "QibdoLogicalPortService"
      summary: "List Logical Ports"
      description: "ListQibdoLogicalPorts\n\n Returns a paginated list of network\
        \ ports within a workspace."
      operationId: "QibdoLogicalPortService_ListQibdoLogicalPorts"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of ports to return. The service may return\
          \ fewer than\n this value. If unspecified, at most 20 ports will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoLogicalPortsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/logical-ports/{id}:
    get:
      tags:
      - "QibdoLogicalPortService"
      summary: "Get Logical Port"
      description: "GetQibdoLogicalPort\n\n Returns a network port by unique ID."
      operationId: "QibdoLogicalPortService_GetQibdoLogicalPort"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoLogicalPort"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs:
    get:
      tags:
      - "QibdoVpcService"
      summary: "List VPCs"
      description: "ListQibdoVpcs\n\n Returns a paginated list of VPCs within a workspace."
      operationId: "QibdoVpcService_ListQibdoVpcs"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to list VPCs for."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n The maximum number of VPCs to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 VPCs will\
          \ be returned.\n The maximum value is 100; values above 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListQibdoVpcs`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListQibdoVpcs` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression, e.g. 'location_id = \"\
          uuid\"'."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 order_by expression, e.g. 'name asc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoVpcsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoVpcService"
      summary: "Create VPC"
      description: "CreateQibdoVpc\n\n Creates a new VPC within a workspace."
      operationId: "QibdoVpcService_CreateQibdoVpc"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the VPC in."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoVpc"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{id}:
    get:
      tags:
      - "QibdoVpcService"
      summary: "Get VPC"
      description: "GetQibdoVpc\n\n Returns a VPC by unique ID within a workspace."
      operationId: "QibdoVpcService_GetQibdoVpc"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the VPC belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the VPC to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoVpc"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoVpcService"
      summary: "Delete VPC"
      description: "DeleteQibdoVpc\n\n Deletes a VPC by unique ID. Fails if the VPC\
        \ still has subnets or\n firewall policies (cascading precondition check)."
      operationId: "QibdoVpcService_DeleteQibdoVpc"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the VPC belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the VPC to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoVpcService"
      summary: "Update VPC"
      description: "UpdateQibdoVpc\n\n Updates an existing VPC. CIDR is immutable\
        \ after creation."
      operationId: "QibdoVpcService_UpdateQibdoVpc"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the VPC belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the VPC to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoVpc"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies:
    get:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "List Firewall Policies"
      description: "List\n\n Returns a paginated list of firewall policies under the\
        \ parent VPC.\n Supports AIP-160 filtering and AIP-132 ordering."
      operationId: "QibdoFirewallPolicyService_ListQibdoFirewallPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policies belong\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of firewall policies to return. The service\
          \ may return\n fewer than this value. If unspecified, at most 20 policies\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoFirewallPolicies`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoFirewallPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Create Firewall Policy"
      description: "Create\n\n Creates a new firewall policy under the parent VPC."
      operationId: "QibdoFirewallPolicyService_CreateQibdoFirewallPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:
    get:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Get Firewall Policy"
      description: "Get\n\n Returns a firewall policy by unique ID under the parent\
        \ VPC."
      operationId: "QibdoFirewallPolicyService_GetQibdoFirewallPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the firewall policy to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Delete Firewall Policy"
      description: "Delete\n\n Deletes a firewall policy by unique ID. Detaches all\
        \ of its rules in the\n same transaction."
      operationId: "QibdoFirewallPolicyService_DeleteQibdoFirewallPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the firewall policy to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Update Firewall Policy"
      description: "Update\n\n Updates an existing firewall policy (AIP-134 partial\
        \ update)."
      operationId: "QibdoFirewallPolicyService_UpdateQibdoFirewallPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the firewall policy to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:addRule:
    post:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Add Firewall Policy Rule"
      description: "AddRule\n\n Adds a new rule to the firewall policy. Custom method\
        \ per AIP-136 — the\n rule is appended to the policy's ordered rule list."
      operationId: "QibdoFirewallPolicyService_AddQibdoFirewallPolicyRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the parent firewall policy"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.AddQibdoFirewallPolicyRuleRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:getRule:
    get:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Get Firewall Policy Rule"
      description: "GetRule\n\n Returns a single firewall rule by unique ID under\
        \ the parent policy."
      operationId: "QibdoFirewallPolicyService_GetQibdoFirewallPolicyRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the parent firewall policy"
        required: true
        schema:
          type: "string"
      - name: "rule_id"
        in: "query"
        description: "The unique identifier of the firewall rule to retrieve"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:listRules:
    get:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "List Firewall Policy Rules"
      description: "ListRules\n\n Returns a paginated list of firewall rules under\
        \ the parent policy.\n Supports AIP-160 filtering and AIP-132 ordering."
      operationId: "QibdoFirewallPolicyService_ListQibdoFirewallPolicyRules"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the parent firewall policy"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of firewall rules to return. The service\
          \ may return\n fewer than this value. If unspecified, at most 20 rules will\
          \ be returned.\n The maximum value is 100; values above 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoFirewallPolicyRules`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoFirewallPolicyRulesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:patchRule:
    post:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Update Firewall Policy Rule"
      description: "UpdateRule\n\n Updates an existing rule on a firewall policy (AIP-134\
        \ partial update via\n an AIP-136 custom method)."
      operationId: "QibdoFirewallPolicyService_UpdateQibdoFirewallPolicyRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the parent firewall policy"
        required: true
        schema:
          type: "string"
      - name: "rule_id"
        in: "query"
        description: "The unique identifier of the firewall rule to update"
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/firewall-policies/{id}:removeRule:
    post:
      tags:
      - "QibdoFirewallPolicyService"
      summary: "Remove Firewall Policy Rule"
      description: "RemoveRule\n\n Removes a rule from a firewall policy. Custom method\
        \ per AIP-136."
      operationId: "QibdoFirewallPolicyService_RemoveQibdoFirewallPolicyRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the policy belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        description: "The unique identifier of the parent VPC"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the parent firewall policy"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.RemoveQibdoFirewallPolicyRuleRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/subnets:
    get:
      tags:
      - "QibdoSubnetService"
      summary: "List Subnets"
      description: "ListQibdoSubnets\n\n Returns a paginated list of subnets within\
        \ a VPC."
      operationId: "QibdoSubnetService_ListQibdoSubnets"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of subnets to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 subnets will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoSubnetsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoSubnetService"
      summary: "Create Subnet"
      description: "CreateQibdoSubnet\n\n Creates a new subnet within a VPC."
      operationId: "QibdoSubnetService_CreateQibdoSubnet"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoSubnet"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /network/v1/workspaces/{workspace}/engines/qibdo/vpcs/{vpc}/subnets/{id}:
    get:
      tags:
      - "QibdoSubnetService"
      summary: "Get Subnet"
      description: "GetQibdoSubnet\n\n Returns a subnet by unique ID within a VPC."
      operationId: "QibdoSubnetService_GetQibdoSubnet"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoSubnet"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoSubnetService"
      summary: "Delete Subnet"
      description: "DeleteQibdoSubnet\n\n Deletes a subnet by unique ID."
      operationId: "QibdoSubnetService_DeleteQibdoSubnet"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoSubnetService"
      summary: "Update Subnet"
      description: "UpdateQibdoSubnet\n\n Updates an existing subnet. CIDR and gateway\
        \ IP are immutable after creation."
      operationId: "QibdoSubnetService_UpdateQibdoSubnet"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "vpc"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoSubnet"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/activities:
    get:
      tags:
      - "ActivityService"
      summary: "List Activities"
      description: "List Activities\n\n Returns a page of activity records filtered\
        \ by AIP-160 expression and\n ordered per AIP-132."
      operationId: "ActivityService_ListActivities"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of activities to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 activities\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListActivities` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListActivitiesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/activities/{id}:
    get:
      tags:
      - "ActivityService"
      summary: "Get Activity"
      description: "Get Activity\n\n Returns a single activity record by its unique\
        \ ID."
      operationId: "ActivityService_GetActivity"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the activity to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ActivityRecord"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/operations:
    get:
      tags:
      - "ObservabilityOperationService"
      summary: "List Operations"
      description: "List Operations\n\n Returns a page of operations filtered by an\
        \ AIP-160 expression and ordered per AIP-132."
      operationId: "ObservabilityOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of operations to return. The service may\
          \ return fewer than this value.\n If unspecified, at most 20 operations\
          \ will be returned. The maximum value is 100; values\n above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListOperations` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListObservabilityOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/operations/{id}:
    get:
      tags:
      - "ObservabilityOperationService"
      summary: "Get Operation"
      description: "Get Operation\n\n Returns a single operation by its unique id."
      operationId: "ObservabilityOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/alert-rules:
    get:
      tags:
      - "AlertRuleService"
      summary: "List Alert Rules"
      description: "List Alert Rules\n\n Returns a paginated list of alert rules.\
        \ A specific provider filters to that provider; `-` lists\n across all providers."
      operationId: "AlertRuleService_ListAlertRules"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose alert rules to list."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to list across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of rules to return. The service may return\
          \ fewer than this value.\n If unspecified, at most 20 items will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListAlertRules` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created desc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListAlertRulesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "AlertRuleService"
      summary: "Create Alert Rule"
      description: "Create Alert Rule\n\n Creates an alert or recording rule in the\
        \ workspace on the given provider. A specific provider is required."
      operationId: "AlertRuleService_CreateAlertRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the alert rule in."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for create)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.AlertRule"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/alert-rules/{id}:
    get:
      tags:
      - "AlertRuleService"
      summary: "Get Alert Rule"
      description: "Get Alert Rule\n\n Returns an alert rule by unique id. Use `-`\
        \ to look it up regardless of provider."
      operationId: "AlertRuleService_GetAlertRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the alert rule belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to look up across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the alert rule to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.AlertRule"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "AlertRuleService"
      summary: "Delete Alert Rule"
      description: "Delete Alert Rule\n\n Deletes an alert rule. A specific provider\
        \ is required."
      operationId: "AlertRuleService_DeleteAlertRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the alert rule belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for delete)."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the alert rule to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "AlertRuleService"
      summary: "Update Alert Rule"
      description: "Update Alert Rule\n\n Updates an alert rule's expression, timing,\
        \ labels, and route. The workspace, location, name,\n kind, signal, and provider\
        \ are immutable."
      operationId: "AlertRuleService_UpdateAlertRule"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the alert rule belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to target across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the alert rule to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten (AIP-134)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.AlertRule"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/ingestion-configs:
    get:
      tags:
      - "IngestionConfigService"
      summary: "List Ingestion Configs"
      description: "List Ingestion Configs\n\n Returns a paginated list of ingestion\
        \ configs. A specific provider filters to that provider;\n `-` lists across\
        \ all providers."
      operationId: "IngestionConfigService_ListIngestionConfigs"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose ingestion configs to list."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to list across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of configs to return. The service may return\
          \ fewer than this value.\n If unspecified, at most 20 items will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListIngestionConfigs` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created desc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListIngestionConfigsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "IngestionConfigService"
      summary: "Create Ingestion Config"
      description: "Create Ingestion Config\n\n Creates the workspace's ingestion\
        \ config on the given provider. A specific provider is required."
      operationId: "IngestionConfigService_CreateIngestionConfig"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the ingestion config in."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for create)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.IngestionConfig"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/ingestion-configs/{id}:
    get:
      tags:
      - "IngestionConfigService"
      summary: "Get Ingestion Config"
      description: "Get Ingestion Config\n\n Returns an ingestion config by unique\
        \ id. Use `-` to look it up regardless of provider."
      operationId: "IngestionConfigService_GetIngestionConfig"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the ingestion config belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to look up across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the ingestion config to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.IngestionConfig"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "IngestionConfigService"
      summary: "Update Ingestion Config"
      description: "Update Ingestion Config\n\n Updates an ingestion config's sampling\
        \ and enabled sources. The workspace, location, and provider\n are immutable."
      operationId: "IngestionConfigService_UpdateIngestionConfig"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the ingestion config belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to target across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the ingestion config to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten (AIP-134)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.IngestionConfig"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/log-sinks:
    get:
      tags:
      - "LogSinkService"
      summary: "List Log Sinks"
      description: "List Log Sinks\n\n Returns a paginated list of log sinks. A specific\
        \ provider filters to that provider; `-` lists\n across all providers."
      operationId: "LogSinkService_ListLogSinks"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose log sinks to list."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to list across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of sinks to return. The service may return\
          \ fewer than this value.\n If unspecified, at most 20 items will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListLogSinks` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created desc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListLogSinksResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "LogSinkService"
      summary: "Create Log Sink"
      description: "Create Log Sink\n\n Creates a log sink in the workspace on the\
        \ given provider. A specific provider is required."
      operationId: "LogSinkService_CreateLogSink"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the log sink in."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for create)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogSink"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/log-sinks/{id}:
    get:
      tags:
      - "LogSinkService"
      summary: "Get Log Sink"
      description: "Get Log Sink\n\n Returns a log sink by unique id. Use `-` to look\
        \ it up regardless of provider."
      operationId: "LogSinkService_GetLogSink"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the log sink belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to look up across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the log sink to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogSink"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "LogSinkService"
      summary: "Delete Log Sink"
      description: "Delete Log Sink\n\n Deletes a log sink. A specific provider is\
        \ required."
      operationId: "LogSinkService_DeleteLogSink"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the log sink belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for delete)."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the log sink to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "LogSinkService"
      summary: "Update Log Sink"
      description: "Update Log Sink\n\n Updates a log sink's destination and filters.\
        \ The workspace, location, name, and provider are immutable."
      operationId: "LogSinkService_UpdateLogSink"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the log sink belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to target across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the log sink to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten (AIP-134)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogSink"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/logs/streams:
    get:
      tags:
      - "LogService"
      summary: "List Log Streams"
      description: "List Log Streams\n\n Lists the distinct log streams (label dimensions)\
        \ visible to the workspace."
      operationId: "LogService_ListLogStreams"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is inspected."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to default to\
          \ qibdo."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum items per page. The service may return fewer than this\
          \ value.\n If unspecified, at most 20 items will be returned.\n The maximum\
          \ value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListLogStreamsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/logs:query:
    post:
      tags:
      - "LogService"
      summary: "Query Logs"
      description: "Query Logs\n\n Runs a bounded log query scoped to the workspace\
        \ and returns one page of lines."
      operationId: "LogService_QueryLogs"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
          \ query across\n every workspace under `organisation` the caller may read\
          \ (AIP-159; read-only)."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryLogsRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryLogsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/logs:tail:
    post:
      tags:
      - "LogService"
      summary: "Tail Logs"
      description: "Tail Logs\n\n Live-tails matching log lines as a server stream\
        \ until the client cancels."
      operationId: "LogService_TailLogs"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is tailed. Live tail is single-workspace\
          \ only: the\n organisation-wide '-' wildcard is rejected (cross-workspace\
          \ access is read-only)."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (the wildcard '-' is\
          \ not allowed for tail)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.TailLogsRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.TailLogsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/metrics/descriptors:
    get:
      tags:
      - "MetricService"
      summary: "List Metric Descriptors"
      description: "List Metric Descriptors\n\n Lists the metric names visible to\
        \ the workspace."
      operationId: "MetricService_ListMetricDescriptors"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is inspected."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to default to\
          \ qibdo."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum items per page. The service may return fewer than this\
          \ value.\n If unspecified, at most 20 items will be returned.\n The maximum\
          \ value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListMetricDescriptorsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/metrics/labels:
    get:
      tags:
      - "MetricService"
      summary: "List Metric Labels"
      description: "List Metric Labels\n\n Lists the label names visible to the workspace."
      operationId: "MetricService_ListMetricLabels"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is inspected."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to default to\
          \ qibdo."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum items per page. The service may return fewer than this\
          \ value.\n If unspecified, at most 20 items will be returned.\n The maximum\
          \ value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListMetricLabelsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/metrics:query:
    post:
      tags:
      - "MetricService"
      summary: "Query Metrics"
      description: "Query Metrics\n\n Evaluates a metric expression at a single instant."
      operationId: "MetricService_QueryMetrics"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
          \ query across\n every workspace under `organisation` the caller may read\
          \ (AIP-159; read-only)."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/metrics:queryRange:
    post:
      tags:
      - "MetricService"
      summary: "Query Metrics Range"
      description: "Query Metrics Range\n\n Evaluates a metric expression across a\
        \ window at a fixed step."
      operationId: "MetricService_QueryMetricsRange"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
          \ query across\n every workspace under `organisation` the caller may read\
          \ (AIP-159; read-only)."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsRangeRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/retention-policies:
    get:
      tags:
      - "RetentionPolicyService"
      summary: "List Retention Policies"
      description: "List Retention Policies\n\n Returns a paginated list of retention\
        \ policies. A specific provider filters to that\n provider; `-` lists across\
        \ all providers."
      operationId: "RetentionPolicyService_ListRetentionPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose retention policies to list."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to list across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of policies to return. The service may return\
          \ fewer than this value.\n If unspecified, at most 20 items will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListRetentionPolicies` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created desc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListRetentionPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "RetentionPolicyService"
      summary: "Create Retention Policy"
      description: "Create Retention Policy\n\n Creates the workspace's retention\
        \ policy on the given provider. A specific provider is required."
      operationId: "RetentionPolicyService_CreateRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the retention policy in."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure (a specific provider\
          \ is required for create)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RetentionPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/retention-policies/{id}:
    get:
      tags:
      - "RetentionPolicyService"
      summary: "Get Retention Policy"
      description: "Get Retention Policy\n\n Returns a retention policy by unique\
        \ id. Use `-` to look it up regardless of provider."
      operationId: "RetentionPolicyService_GetRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the retention policy belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to look up across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the retention policy to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RetentionPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "RetentionPolicyService"
      summary: "Update Retention Policy"
      description: "Update Retention Policy\n\n Updates a retention policy's per-pillar\
        \ windows. The workspace, location, and provider are immutable."
      operationId: "RetentionPolicyService_UpdateRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the retention policy belongs to."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure, or '-' to target across\
          \ all providers."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the retention policy to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten (AIP-134)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RetentionPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/service-graph:
    get:
      tags:
      - "TraceService"
      summary: "Get Service Graph"
      description: "Get Service Graph\n\n Returns the RED service-dependency graph\
        \ derived from trace data over a window."
      operationId: "TraceService_GetServiceGraph"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      - name: "start"
        in: "query"
        description: "Start of the window (inclusive)."
        schema:
          type: "string"
          format: "date-time"
      - name: "end"
        in: "query"
        description: "End of the window (exclusive)."
        schema:
          type: "string"
          format: "date-time"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.GetServiceGraphResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/traces/{id}:
    get:
      tags:
      - "TraceService"
      summary: "Get Trace"
      description: "Get Trace\n\n Retrieves a single full trace (all spans) by id."
      operationId: "TraceService_GetTrace"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The trace id to retrieve — a hexadecimal trace identifier of\
          \ up to 128 characters."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.GetTraceResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/engines/{engine}/traces:search:
    post:
      tags:
      - "TraceService"
      summary: "Search Traces"
      description: "Search Traces\n\n Searches for traces matching an expression within\
        \ a window."
      operationId: "TraceService_SearchTraces"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
          \ query across\n every workspace under `organisation` the caller may read\
          \ (AIP-159; read-only)."
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The provider: qibdo, aws, gcp, or azure."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.SearchTracesRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.SearchTracesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/silences:
    get:
      tags:
      - "SilenceService"
      summary: "List Silences"
      description: "List Silences\n\n Returns a paginated list of silences (AIP-160\
        \ filter, AIP-132 order_by)."
      operationId: "SilenceService_ListSilences"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose silences to list."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of silences to return. The service may return\
          \ fewer than this value.\n If unspecified, at most 20 items will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListSilences` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created desc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListSilencesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "SilenceService"
      summary: "Create Silence"
      description: "Create Silence\n\n Creates a workspace-scoped silence that suppresses\
        \ matching alerts for its window."
      operationId: "SilenceService_CreateSilence"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the silence in."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Silence"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /observability/v1/workspaces/{workspace}/silences/{id}:
    get:
      tags:
      - "SilenceService"
      summary: "Get Silence"
      description: "Get Silence\n\n Returns a single silence by its unique id."
      operationId: "SilenceService_GetSilence"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the silence belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the silence to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Silence"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "SilenceService"
      summary: "Delete Silence"
      description: "Delete Silence\n\n Deletes a silence by its unique id, ending\
        \ the suppression immediately."
      operationId: "SilenceService_DeleteSilence"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the silence belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the silence to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/audit-entries:
    get:
      tags:
      - "AuditLogService"
      summary: "List Audit Entries"
      description: "List\n\n Returns a page of audit entries filtered by AIP-160 expression\
        \ (e.g.\n actor, target, action, time range) and ordered per AIP-132."
      operationId: "AuditLogService_ListAuditEntries"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of audit entries to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 audit entries\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListAuditEntries` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListAuditEntriesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/operations:
    get:
      tags:
      - "RegistryOperationService"
      summary: "List Operations"
      description: "List\n\n Returns a page of operations filtered by AIP-160 expression\
        \ and ordered\n per AIP-132."
      operationId: "RegistryOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of operations to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListOperations` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRegistryOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/operations/{id}:
    get:
      tags:
      - "RegistryOperationService"
      summary: "Get Operation"
      description: "Get\n\n Returns a single operation by its unique ID."
      operationId: "RegistryOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the operation to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces:
    get:
      tags:
      - "QibdoNamespaceService"
      summary: "List Namespaces"
      description: "List\n\n Returns a page of namespaces in a workspace, filtered\
        \ by AIP-160 expression\n and ordered per AIP-132."
      operationId: "QibdoNamespaceService_ListQibdoNamespaces"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the parent workspace"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of namespaces to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 namespaces\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoNamespaces`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.qibdo.ListQibdoNamespacesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoNamespaceService"
      summary: "Create Namespace"
      description: "Create\n\n Creates a new namespace inside a workspace."
      operationId: "QibdoNamespaceService_CreateQibdoNamespace"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the parent workspace"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoNamespace"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{id}:
    get:
      tags:
      - "QibdoNamespaceService"
      summary: "Get Namespace"
      description: "Get\n\n Returns a namespace by unique ID."
      operationId: "QibdoNamespaceService_GetQibdoNamespace"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the parent workspace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the namespace to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoNamespace"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoNamespaceService"
      summary: "Delete Namespace"
      description: "Delete\n\n Deletes a namespace and all of its repositories. Blocked\
        \ when any\n repository still holds artifacts pinned by an active deployment\
        \ lock."
      operationId: "QibdoNamespaceService_DeleteQibdoNamespace"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the parent workspace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the namespace to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoNamespaceService"
      summary: "Update Namespace"
      description: "Update\n\n Updates the description, quotas, or default visibility\
        \ of a namespace."
      operationId: "QibdoNamespaceService_UpdateQibdoNamespace"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the parent workspace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the namespace to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoNamespace"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories:
    get:
      tags:
      - "QibdoImageRepositoryService"
      summary: "List Image Repositories"
      description: "List\n\n Returns a page of image repositories in a namespace,\
        \ filtered by AIP-160\n expression and ordered per AIP-132."
      operationId: "QibdoImageRepositoryService_ListQibdoImageRepositories"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the parent namespace"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of repositories to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 repositories\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoImageRepositories`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.qibdo.ListQibdoImageRepositoriesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoImageRepositoryService"
      summary: "Create Image Repository"
      description: "Create\n\n Creates a new image repository inside a namespace."
      operationId: "QibdoImageRepositoryService_CreateQibdoImageRepository"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the parent namespace"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoImageRepository"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories/{id}:
    get:
      tags:
      - "QibdoImageRepositoryService"
      summary: "Get Image Repository"
      description: "Get\n\n Returns an image repository by unique ID."
      operationId: "QibdoImageRepositoryService_GetQibdoImageRepository"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the parent namespace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the image repository to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoImageRepository"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoImageRepositoryService"
      summary: "Delete Image Repository"
      description: "Delete\n\n Deletes an image repository and all of its artifacts.\
        \ Blocked when any\n artifact is pinned by an active deployment lock."
      operationId: "QibdoImageRepositoryService_DeleteQibdoImageRepository"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the parent namespace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the image repository to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoImageRepositoryService"
      summary: "Update Image Repository"
      description: "Update\n\n Updates the visibility, description, or labels of an\
        \ image repository."
      operationId: "QibdoImageRepositoryService_UpdateQibdoImageRepository"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the parent namespace"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the image repository to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoImageRepository"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories/{repository}/artifacts:
    get:
      tags:
      - "ArtifactService"
      summary: "List Artifacts"
      description: "List\n\n Returns a page of artifacts under one repository, with\
        \ inline tags so the\n caller can render the standard \"image with N tags\"\
        \ view in one round-trip.\n Supports AIP-160 filtering and AIP-132 ordering."
      operationId: "ArtifactService_ListArtifacts"
      parameters:
      - name: "workspace"
        in: "path"
        description: "Workspace UUID — must match the authorized scope."
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "Parent namespace UUID."
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "Parent repository UUID."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of artifacts to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 artifacts will be\
          \ returned.\n The maximum value is 100; values above 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListArtifacts` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListArtifactsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories/{repository}/artifacts/{reference}:
    get:
      tags:
      - "ArtifactService"
      summary: "Get Artifact"
      description: "Get\n\n Returns one artifact by digest or by tag name (the registry\
        \ resolves both).\n The returned Artifact includes the full set of tags inline."
      operationId: "ArtifactService_GetArtifact"
      parameters:
      - name: "workspace"
        in: "path"
        description: "Workspace UUID — must match the authorized scope."
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "Parent namespace UUID."
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "Parent repository UUID."
        required: true
        schema:
          type: "string"
      - name: "reference"
        in: "path"
        description: "Digest or tag identifying the artifact to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.Artifact"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "ArtifactService"
      summary: "Delete Artifact"
      description: "Delete\n\n Removes the manifest and detaches all of its tags.\
        \ Returns a\n RegistryOperation for audit. Blocked when an active deployment\
        \ lock pins\n the (repository, digest) pair."
      operationId: "ArtifactService_DeleteArtifact"
      parameters:
      - name: "workspace"
        in: "path"
        description: "Workspace UUID — must match the authorized scope."
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "Parent namespace UUID."
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "Parent repository UUID."
        required: true
        schema:
          type: "string"
      - name: "reference"
        in: "path"
        description: "Digest or tag identifying the artifact to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories/{repository}/artifacts/{reference}/scan:
    get:
      tags:
      - "ScanService"
      summary: "Get Scan Report"
      description: "GetScanReport\n\n Returns the merged vulnerability report (severity\
        \ counts + per-CVE\n findings) for the most recent successful scan of an artifact."
      operationId: "ScanService_GetScanReport"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "reference"
        in: "path"
        description: "Digest or tag identifying the artifact whose report to return"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ArtifactScanReport"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "ScanService"
      summary: "Trigger Scan"
      description: "TriggerScan\n\n Asks the configured scanner to begin a vulnerability\
        \ scan against an\n artifact. The call returns immediately with a RegistryOperation;\
        \ the\n report becomes available asynchronously and is fetched via GetScanReport\n\
        \ once the scan completes.\n\n Custom methods use `body: \"*\"` per AIP-136.\
        \ Path parameters (workspace,\n namespace, repository, reference) are extracted\
        \ from the URL; any future\n non-path fields are deserialized from the HTTP\
        \ body.\n Follows industry practice from GCP, AWS, and Azure."
      operationId: "ScanService_TriggerScan"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "reference"
        in: "path"
        description: "Digest or tag identifying the artifact to scan"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.TriggerScanRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  ? /registry/v1/workspaces/{workspace}/engines/qibdo/namespaces/{namespace}/repositories/{repository}/artifacts/{reference}/tags/{tag}
  : delete:
      tags:
      - "ArtifactService"
      summary: "Delete Tag"
      description: "DeleteTag\n\n Removes a single tag from an artifact (detag). The\
        \ manifest survives if\n any other tag still references it or if it is referenced\
        \ by digest. The\n URL is scoped under the parent artifact reference."
      operationId: "ArtifactService_DeleteTag"
      parameters:
      - name: "workspace"
        in: "path"
        description: "Workspace UUID — must match the authorized scope."
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "Parent namespace UUID."
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "Parent repository UUID."
        required: true
        schema:
          type: "string"
      - name: "reference"
        in: "path"
        description: "Digest or tag identifying the parent artifact."
        required: true
        schema:
          type: "string"
      - name: "tag"
        in: "path"
        description: "The tag name to detach from the artifact."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/access-policies:
    get:
      tags:
      - "AccessPolicyService"
      summary: "List Namespace Access Policies"
      description: "List namespace-scoped access policies\n\n Returns a page of access\
        \ policies bound to the given Namespace, filtered\n by AIP-160 expression\
        \ and ordered per AIP-132."
      operationId: "AccessPolicyService_ListNamespaceAccessPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace whose policies are listed"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of access policies to return. The service\
          \ may return fewer than\n this value.\n If unspecified, at most 20 access\
          \ policies will be returned.\n The maximum value is 100; values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListNamespaceAccessPolicies`\
          \ call.\n Provide this to retrieve the subsequent page.\n When paginating,\
          \ all other parameters provided to `ListNamespaceAccessPolicies` must match\n\
          \ the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "A filter expression allows you to filter the access policies\
          \ listed in the response.\n At qibdo, we use the [AIP-160](https://google.aip.dev/160)\
          \ proposal, that means that your expression should include:\n field name,\
          \ an operator, and the value you wish to filter by.\n The value can be a\
          \ **string**, **number**, or **boolean**, and the operator must be one of\
          \ the following: **=, !=, >, <, <=, >=,** or **:**\n You can group multiple\
          \ expressions using parentheses and the logical operators **AND** and **OR**.\n\
          \ Examples:\n `principal_id = \"abc-123\"` -> Filter by the principal that\
          \ the policy is granted to\n `(action = \"PUSH\") AND (principal_type =\
          \ \"USER\")` -> Filter by action and principal type\n `expires_at:*` ->\
          \ Returns policies that have an expiry set"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "The order in which to sort the results. If not specified, the\
          \ results will be sorted by created in descending order.\n At qibdo, we\
          \ use the [AIP-132](https://google.aip.dev/132) proposal, that means:\n\
          \ Values should be a comma separated list of fields. For example: `\"foo,bar\"\
          `.\n The default sort order is ascending. To specify descending order, a\
          \ suffix `\" desc\"` should be added. For example: `\"foo desc,bar\"`.\n\
          \ Redundant space characters in the syntax are insignificant."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListNamespaceAccessPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "AccessPolicyService"
      summary: "Create Namespace Access Policy"
      description: "Create namespace-scoped access policy\n\n Creates an access policy\
        \ bound to the given Namespace. The policy grants\n the principal one or more\
        \ registry actions on every repository and tag\n inside the namespace."
      operationId: "AccessPolicyService_CreateNamespaceAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace the policy is bound to"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/access-policies/{id}:
    get:
      tags:
      - "AccessPolicyService"
      summary: "Get Namespace Access Policy"
      description: "Get namespace-scoped access policy\n\n Returns a namespace-scoped\
        \ access policy by unique ID."
      operationId: "AccessPolicyService_GetNamespaceAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace the policy is bound to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "AccessPolicyService"
      summary: "Delete Namespace Access Policy"
      description: "Delete namespace-scoped access policy\n\n Deletes a namespace-scoped\
        \ access policy by unique ID; takes effect\n immediately."
      operationId: "AccessPolicyService_DeleteNamespaceAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace the policy is bound to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "AccessPolicyService"
      summary: "Update Namespace Access Policy"
      description: "Update namespace-scoped access policy\n\n Updates the principal\
        \ or actions of a namespace-scoped access policy. The\n scope is immutable\
        \ — to move a binding from a namespace to a repository,\n delete the existing\
        \ policy and create a new one."
      operationId: "AccessPolicyService_UpdateNamespaceAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace the policy is bound to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields).\n\
          \ Use `*` for full replacement (PUT semantics). The scope_type and scope_id\n\
          \ fields are immutable and ignored regardless of mask."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/credentials:
    get:
      tags:
      - "CredentialService"
      summary: "Get Registry Credentials"
      description: "Get\n\n Issues a short-lived registry credential for a namespace,\
        \ scoped to the\n caller's IAM permissions."
      operationId: "CredentialService_GetRegistryCredentials"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the namespace belongs\
          \ to."
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace whose credentials are\
          \ issued."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryCredential"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/cross-namespace-grants:
    get:
      tags:
      - "CrossNamespaceGrantService"
      summary: "List Cross Namespace Grants"
      description: "List cross-namespace grants\n\n Returns a page of grants whose\
        \ source is the namespace in the URL path."
      operationId: "CrossNamespaceGrantService_ListCrossNamespaceGrants"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of cross-namespace grants to return. The\
          \ service\n may return fewer than this value. If unspecified, at most 20\
          \ grants\n will be returned. The maximum value is 100; values above 100\
          \ will be\n coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListCrossNamespaceGrantsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "CrossNamespaceGrantService"
      summary: "Create Cross Namespace Grant"
      description: "Create cross-namespace grant\n\n Issues a new grant from the namespace\
        \ identified by the URL path\n (the source) to the target namespace carried\
        \ in the body."
      operationId: "CrossNamespaceGrantService_CreateCrossNamespaceGrant"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The source namespace — the granter. Derived from the URL path."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.CrossNamespaceGrant"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/cross-namespace-grants/{id}:
    get:
      tags:
      - "CrossNamespaceGrantService"
      summary: "Get Cross Namespace Grant"
      description: "Get cross-namespace grant\n\n Returns a cross-namespace grant\
        \ by unique ID under the parent (workspace,\n source namespace)."
      operationId: "CrossNamespaceGrantService_GetCrossNamespaceGrant"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.CrossNamespaceGrant"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "CrossNamespaceGrantService"
      summary: "Delete Cross Namespace Grant"
      description: "Delete cross-namespace grant\n\n Deletes a cross-namespace grant\
        \ by unique ID; revokes the delegated pull\n permission immediately."
      operationId: "CrossNamespaceGrantService_DeleteCrossNamespaceGrant"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "CrossNamespaceGrantService"
      summary: "Update Cross Namespace Grant"
      description: "Update cross-namespace grant\n\n Updates the tag pattern of an\
        \ existing grant. The source and target\n namespaces are immutable — to retarget\
        \ a grant, delete and recreate."
      operationId: "CrossNamespaceGrantService_UpdateCrossNamespaceGrant"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.CrossNamespaceGrant"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/access-policies:
    get:
      tags:
      - "AccessPolicyService"
      summary: "List Repository Access Policies"
      description: "List repository-scoped access policies\n\n Returns a page of access\
        \ policies bound to the given Image Repository,\n filtered by AIP-160 expression\
        \ and ordered per AIP-132."
      operationId: "AccessPolicyService_ListRepositoryAccessPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the repository whose policies are listed"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of access policies to return. The service\
          \ may return fewer than\n this value.\n If unspecified, at most 20 access\
          \ policies will be returned.\n The maximum value is 100; values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListRepositoryAccessPolicies`\
          \ call.\n Provide this to retrieve the subsequent page.\n When paginating,\
          \ all other parameters provided to `ListRepositoryAccessPolicies` must match\n\
          \ the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "A filter expression allows you to filter the access policies\
          \ listed in the response.\n At qibdo, we use the [AIP-160](https://google.aip.dev/160)\
          \ proposal, that means that your expression should include:\n field name,\
          \ an operator, and the value you wish to filter by.\n The value can be a\
          \ **string**, **number**, or **boolean**, and the operator must be one of\
          \ the following: **=, !=, >, <, <=, >=,** or **:**\n You can group multiple\
          \ expressions using parentheses and the logical operators **AND** and **OR**.\n\
          \ Examples:\n `principal_id = \"abc-123\"` -> Filter by the principal that\
          \ the policy is granted to\n `(action = \"PUSH\") AND (principal_type =\
          \ \"USER\")` -> Filter by action and principal type\n `expires_at:*` ->\
          \ Returns policies that have an expiry set"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "The order in which to sort the results. If not specified, the\
          \ results will be sorted by created in descending order.\n At qibdo, we\
          \ use the [AIP-132](https://google.aip.dev/132) proposal, that means:\n\
          \ Values should be a comma separated list of fields. For example: `\"foo,bar\"\
          `.\n The default sort order is ascending. To specify descending order, a\
          \ suffix `\" desc\"` should be added. For example: `\"foo desc,bar\"`.\n\
          \ Redundant space characters in the syntax are insignificant."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRepositoryAccessPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "AccessPolicyService"
      summary: "Create Repository Access Policy"
      description: "Create repository-scoped access policy\n\n Creates an access policy\
        \ bound to the given Image Repository. The policy\n grants the principal one\
        \ or more registry actions on every tag inside that\n repository."
      operationId: "AccessPolicyService_CreateRepositoryAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the repository the policy is bound\
          \ to"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/access-policies/{id}:
    get:
      tags:
      - "AccessPolicyService"
      summary: "Get Repository Access Policy"
      description: "Get repository-scoped access policy\n\n Returns a repository-scoped\
        \ access policy by unique ID."
      operationId: "AccessPolicyService_GetRepositoryAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the repository the policy is bound\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "AccessPolicyService"
      summary: "Delete Repository Access Policy"
      description: "Delete repository-scoped access policy\n\n Deletes a repository-scoped\
        \ access policy by unique ID; takes effect\n immediately."
      operationId: "AccessPolicyService_DeleteRepositoryAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the repository the policy is bound\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "AccessPolicyService"
      summary: "Update Repository Access Policy"
      description: "Update repository-scoped access policy\n\n Updates the principal\
        \ or actions of a repository-scoped access policy. The\n scope is immutable\
        \ — to move a binding to a different repository or up to\n a namespace, delete\
        \ the existing policy and create a new one."
      operationId: "AccessPolicyService_UpdateRepositoryAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the repository the policy is bound\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields).\n\
          \ Use `*` for full replacement (PUT semantics). The scope_type and scope_id\n\
          \ fields are immutable and ignored regardless of mask."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/deployment-locks:
    get:
      tags:
      - "DeploymentLockService"
      summary: "List Deployment Locks"
      description: "List\n\n Returns a page of deployment locks under a repository,\
        \ filtered by AIP-160\n expression and ordered per AIP-132."
      operationId: "DeploymentLockService_ListDeploymentLocks"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of deployment locks to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 deployment\
          \ locks will be returned.\n The maximum value is 100; values above 100 will\
          \ be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListDeploymentLocks`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListDeploymentLocksResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "DeploymentLockService"
      summary: "Create Deployment Lock"
      description: "Create\n\n Pins a (repository, digest) pair so the artifact cannot\
        \ be deleted,\n retagged, or garbage-collected while the lock is held."
      operationId: "DeploymentLockService_CreateDeploymentLock"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.DeploymentLock"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/deployment-locks/{id}:
    get:
      tags:
      - "DeploymentLockService"
      summary: "Get Deployment Lock"
      description: "Get\n\n Returns a deployment lock by unique ID."
      operationId: "DeploymentLockService_GetDeploymentLock"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment lock to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.DeploymentLock"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "DeploymentLockService"
      summary: "Delete Deployment Lock"
      description: "Delete\n\n Releases a deployment lock; the underlying artifact\
        \ becomes eligible for\n deletion and garbage-collection again."
      operationId: "DeploymentLockService_DeleteDeploymentLock"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment lock to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "DeploymentLockService"
      summary: "Update Deployment Lock"
      description: "Update\n\n Updates the holder or expiry of a deployment lock."
      operationId: "DeploymentLockService_UpdateDeploymentLock"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment lock to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.DeploymentLock"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/retention-policies:
    get:
      tags:
      - "RetentionPolicyService"
      summary: "List Retention Policies"
      description: "List\n\n Returns a page of retention policies for a repository,\
        \ filtered by\n AIP-160 expression and ordered per AIP-132."
      operationId: "RetentionPolicyService_ListRetentionPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of retention policies to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 retention\
          \ policies will be returned.\n The maximum value is 100; values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListRetentionPolicies`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRetentionPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "RetentionPolicyService"
      summary: "Create Retention Policy"
      description: "Create\n\n Creates a retention policy on a repository."
      operationId: "RetentionPolicyService_CreateRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/retention-policies/{id}:
    get:
      tags:
      - "RetentionPolicyService"
      summary: "Get Retention Policy"
      description: "Get\n\n Returns a retention policy by unique ID."
      operationId: "RetentionPolicyService_GetRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the retention policy to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "RetentionPolicyService"
      summary: "Delete Retention Policy"
      description: "Delete\n\n Deletes a retention policy; existing artifacts are\
        \ unaffected."
      operationId: "RetentionPolicyService_DeleteRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the retention policy to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "RetentionPolicyService"
      summary: "Update Retention Policy"
      description: "Update\n\n Updates the rules of a retention policy."
      operationId: "RetentionPolicyService_UpdateRetentionPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The unique identifier of the workspace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        description: "The unique identifier of the namespace that the repository belongs\
          \ to"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        description: "The unique identifier of the parent repository"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the retention policy to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for the implied mask (all populated fields)."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/scan-policies:
    get:
      tags:
      - "ScanPolicyService"
      summary: "List Repository Scan Policies"
      description: "List repository-scoped scan policies\n\n Returns a page of scan\
        \ policies bound to the given Image Repository,\n filtered by AIP-160 expression\
        \ and ordered per AIP-132."
      operationId: "ScanPolicyService_ListRepositoryScanPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of scan policies to return. The service may\n\
          \ return fewer than this value. If unspecified, at most 20 scan\n policies\
          \ will be returned. The maximum value is 100; values above\n 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRepositoryScanPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "ScanPolicyService"
      summary: "Create Repository Scan Policy"
      description: "Create repository-scoped scan policy\n\n Creates a scan policy\
        \ bound to the given Image Repository. The policy\n applies to every tag inside\
        \ that repository."
      operationId: "ScanPolicyService_CreateRepositoryScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/repositories/{repository}/scan-policies/{id}:
    get:
      tags:
      - "ScanPolicyService"
      summary: "Get Repository Scan Policy"
      description: "Get repository-scoped scan policy\n\n Returns a repository-scoped\
        \ scan policy by unique ID."
      operationId: "ScanPolicyService_GetRepositoryScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "ScanPolicyService"
      summary: "Delete Repository Scan Policy"
      description: "Delete repository-scoped scan policy\n\n Deletes a repository-scoped\
        \ scan policy; future operations are no longer\n subject to it."
      operationId: "ScanPolicyService_DeleteRepositoryScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "ScanPolicyService"
      summary: "Update Repository Scan Policy"
      description: "Update repository-scoped scan policy\n\n Updates the trigger,\
        \ severity threshold, or block-on-fail behaviour of a\n repository-scoped\
        \ scan policy."
      operationId: "ScanPolicyService_UpdateRepositoryScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "repository"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/scan-policies:
    get:
      tags:
      - "ScanPolicyService"
      summary: "List Namespace Scan Policies"
      description: "List namespace-scoped scan policies\n\n Returns a page of scan\
        \ policies bound to the given Namespace, filtered by\n AIP-160 expression\
        \ and ordered per AIP-132."
      operationId: "ScanPolicyService_ListNamespaceScanPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of scan policies to return. The service may\n\
          \ return fewer than this value. If unspecified, at most 20 scan\n policies\
          \ will be returned. The maximum value is 100; values above\n 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListNamespaceScanPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "ScanPolicyService"
      summary: "Create Namespace Scan Policy"
      description: "Create namespace-scoped scan policy\n\n Creates a scan policy\
        \ bound to the given Namespace. The policy applies\n to every repository and\
        \ tag inside the namespace."
      operationId: "ScanPolicyService_CreateNamespaceScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /registry/v1/workspaces/{workspace}/namespaces/{namespace}/scan-policies/{id}:
    get:
      tags:
      - "ScanPolicyService"
      summary: "Get Namespace Scan Policy"
      description: "Get namespace-scoped scan policy\n\n Returns a namespace-scoped\
        \ scan policy by unique ID."
      operationId: "ScanPolicyService_GetNamespaceScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "ScanPolicyService"
      summary: "Delete Namespace Scan Policy"
      description: "Delete namespace-scoped scan policy\n\n Deletes a namespace-scoped\
        \ scan policy; future operations are no longer\n subject to it."
      operationId: "ScanPolicyService_DeleteNamespaceScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "ScanPolicyService"
      summary: "Update Namespace Scan Policy"
      description: "Update namespace-scoped scan policy\n\n Updates the trigger, severity\
        \ threshold, or block-on-fail behaviour of a\n namespace-scoped scan policy."
      operationId: "ScanPolicyService_UpdateNamespaceScanPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "namespace"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/engines/qibdo/storage-classes/{storage_class}/instances:
    get:
      tags:
      - "QibdoStorageClassInstanceService"
      summary: "List Storage Class Instances"
      description: "List Storage Class Instances\n\n Returns a paginated list of instances\
        \ for a storage class (or all classes with `-`),\n filterable by location\
        \ and status."
      operationId: "QibdoStorageClassInstanceService_ListQibdoStorageClassInstances"
      parameters:
      - name: "storage_class"
        in: "path"
        description: "The parent storage class id, or `-` for the cross-class matrix\
          \ (AIP-159)."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of instances to return. If unspecified, at\
          \ most 20 instances will be\n returned. The maximum value is 100; values\
          \ above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous ListQibdoStorageClassInstances\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression (location_id, status)."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'created asc'."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.qibdo.ListQibdoStorageClassInstancesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/engines/qibdo/storage-classes/{storage_class}/instances/{id}:
    get:
      tags:
      - "QibdoStorageClassInstanceService"
      summary: "Get Storage Class Instance"
      description: "Get Storage Class Instance\n\n Returns a single instance by unique\
        \ ID under its parent storage class (or `-`)."
      operationId: "QibdoStorageClassInstanceService_GetQibdoStorageClassInstance"
      parameters:
      - name: "storage_class"
        in: "path"
        description: "The parent storage class id, or `-` to look up regardless of\
          \ class (AIP-159)."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the instance to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.qibdo.QibdoStorageClassInstance"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/engines/qibdo/storage-classes/{storage_class}/instances:instantiate:
    post:
      tags:
      - "QibdoStorageClassInstanceService"
      summary: "Instantiate Storage Class"
      description: "Instantiate Storage Class\n\n Forces or retries provisioning of\
        \ a storage class tier into a region on demand. The storage\n class is the\
        \ path parent; the target region is supplied in the body."
      operationId: "QibdoStorageClassInstanceService_InstantiateQibdoStorageClass"
      parameters:
      - name: "storage_class"
        in: "path"
        description: "The storage class tier to instantiate (UUID, concrete — no wildcard)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.qibdo.InstantiateQibdoStorageClassRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/engines/{engine}/storage-classes:
    get:
      tags:
      - "StorageClassService"
      summary: "List Storage Classes"
      description: "List Storage Classes\n\n Returns a paginated list of storage classes\
        \ within a region. A specific provider filters to\n that provider; `-` lists\
        \ storage classes across all providers."
      operationId: "StorageClassService_ListStorageClasses"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to list\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of storage classes to return. The service\
          \ may return fewer than this\n value. If unspecified, at most 20 storage\
          \ classes will be returned. The maximum value is 100;\n values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListStorageClasses`\
          \ call. Provide this to retrieve\n the subsequent page. When paginating,\
          \ all other parameters must match the call that provided\n the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListStorageClassesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "StorageClassService"
      summary: "Create Storage Class"
      description: "Create Storage Class\n\n Creates a new storage class on the given\
        \ cloud provider. A specific provider is required.\n Storage class names must\
        \ match ^[A-Z][A-Z0-9_]{0,63}$ and be unique within the region for\n that\
        \ provider."
      operationId: "StorageClassService_CreateStorageClass"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to create the storage class on: qibdo, aws,\
          \ gcp, or azure"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageClass"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/engines/{engine}/storage-classes/{id}:
    get:
      tags:
      - "StorageClassService"
      summary: "Get Storage Class"
      description: "Get Storage Class\n\n Returns a storage class by unique ID. Use\
        \ `-` to look it up regardless of provider."
      operationId: "StorageClassService_GetStorageClass"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to look\
          \ up across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the storage class to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageClass"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "StorageClassService"
      summary: "Delete Storage Class"
      description: "Delete Storage Class\n\n Deletes a storage class. Returns FAILED_PRECONDITION\
        \ if buckets still reference it."
      operationId: "StorageClassService_DeleteStorageClass"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to target\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the storage class to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "StorageClassService"
      summary: "Update Storage Class"
      description: "Update Storage Class\n\n Updates storage class properties (description,\
        \ data pool, compression, default flag)."
      operationId: "StorageClassService_UpdateStorageClass"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to target\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the storage class to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten. See AIP-134\n for field mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageClass"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/operations:
    get:
      tags:
      - "StorageOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of operations, optionally\
        \ filtered by resource."
      operationId: "StorageOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListOperations` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=Bucket\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListStorageOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/operations/{id}:
    get:
      tags:
      - "StorageOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single operation by its unique ID."
      operationId: "StorageOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets:
    get:
      tags:
      - "BucketService"
      summary: "List Buckets"
      description: "List Buckets\n\n Returns a paginated list of buckets within a\
        \ workspace. A specific provider filters to that\n provider; `-` lists buckets\
        \ across all providers."
      operationId: "BucketService_ListBuckets"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to list buckets for"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to list\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of buckets to return. The service may return\
          \ fewer than this value. If\n unspecified, at most 20 buckets will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListBuckets` call. Provide\
          \ this to retrieve the\n subsequent page. When paginating, all other parameters\
          \ must match the call that provided\n the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListBucketsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "BucketService"
      summary: "Create Bucket"
      description: "Create Bucket\n\n Creates a new bucket on the given cloud provider.\
        \ A specific provider is required.\n Bucket names must match ^[a-z0-9][a-z0-9\\\
        -]{1,24}[a-z0-9]$ and be unique within the\n workspace for that provider."
      operationId: "BucketService_CreateBucket"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the bucket in"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider to create the bucket on: qibdo, aws, gcp,\
          \ or azure"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.Bucket"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/multipart-uploads:
    get:
      tags:
      - "MultipartUploadService"
      summary: "List Multipart Uploads"
      description: "List Multipart Uploads\n\n Lists in-progress multipart uploads\
        \ for a bucket."
      operationId: "MultipartUploadService_ListMultipartUploads"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to list\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket to list multipart uploads for"
        required: true
        schema:
          type: "string"
      - name: "prefix"
        in: "query"
        description: "Filter by object key prefix. Retained as a dedicated field because\
          \ key prefix matching is a\n fundamental server-side optimization that cannot\
          \ be expressed in AIP-160 filter syntax\n without losing performance."
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum uploads per page. The service may return fewer than\
          \ this value.\n If unspecified, at most 20 uploads will be returned.\n The\
          \ maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListMultipartUploads`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListMultipartUploads` must match the\
          \ call\n that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListMultipartUploadsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "MultipartUploadService"
      summary: "Initiate Multipart Upload"
      description: "Initiate Multipart Upload\n\n Starts a new multipart upload on\
        \ the given cloud provider and returns an upload ID."
      operationId: "MultipartUploadService_InitiateMultipartUpload"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider to initiate the upload on: qibdo, aws, gcp,\
          \ or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket to initiate the upload in"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.InitiateMultipartUploadRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.InitiateMultipartUploadResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/multipart-uploads/{upload_id}:
    delete:
      tags:
      - "MultipartUploadService"
      summary: "Abort Multipart Upload"
      description: "Abort Multipart Upload\n\n Aborts an in-progress multipart upload\
        \ and cleans up uploaded parts."
      operationId: "MultipartUploadService_AbortMultipartUpload"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the multipart upload"
        required: true
        schema:
          type: "string"
      - name: "upload_id"
        in: "path"
        description: "The multipart upload ID to abort"
        required: true
        schema:
          type: "string"
      - name: "object_key"
        in: "query"
        description: "The object key for the multipart upload"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/multipart-uploads/{upload_id}:complete:
    post:
      tags:
      - "MultipartUploadService"
      summary: "Complete Multipart Upload"
      description: "Complete Multipart Upload\n\n Completes a multipart upload by\
        \ assembling all parts into the final object."
      operationId: "MultipartUploadService_CompleteMultipartUpload"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the multipart upload"
        required: true
        schema:
          type: "string"
      - name: "upload_id"
        in: "path"
        description: "The multipart upload ID"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.CompleteMultipartUploadRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/multipart-uploads/{upload_id}:part-url:
    post:
      tags:
      - "MultipartUploadService"
      summary: "Generate Part Upload URL"
      description: "Generate Part Upload URL\n\n Generates a pre-signed URL for uploading\
        \ a single part directly to the storage data plane."
      operationId: "MultipartUploadService_GeneratePartUploadUrl"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the multipart upload"
        required: true
        schema:
          type: "string"
      - name: "upload_id"
        in: "path"
        description: "The multipart upload ID"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.GeneratePartUploadUrlRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.PresignedUrlResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/objects:
    get:
      tags:
      - "ObjectService"
      summary: "List Objects"
      description: "List Objects\n\n Lists objects in a bucket with optional prefix/delimiter\
        \ filtering.\n Supports prefix-based pseudo-directory listing when the delimiter\
        \ is \"/\"."
      operationId: "ObjectService_ListObjects"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to list\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket to list objects from"
        required: true
        schema:
          type: "string"
      - name: "prefix"
        in: "query"
        description: "Filter objects by key prefix. Retained as a dedicated field\
          \ because key prefix\n matching is a fundamental server-side optimization\
          \ that cannot be expressed in\n filter syntax without losing performance."
        schema:
          type: "string"
      - name: "delimiter"
        in: "query"
        description: "Delimiter for pseudo-directory listing (typically \"/\"). Retained\
          \ as a dedicated\n field because delimiter handling is a native server-side\
          \ optimization not\n expressible via filter strings."
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum keys per page. The service may return fewer than this\
          \ value.\n If unspecified, at most 20 objects will be returned.\n The maximum\
          \ value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListObjects` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters must match the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListObjectsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/objects/{object_key}:
    get:
      tags:
      - "ObjectService"
      summary: "Get Object"
      description: "Get Object\n\n Downloads an object from a bucket via server streaming.\
        \ The first response\n message carries metadata, and subsequent messages carry\
        \ data chunks."
      operationId: "ObjectService_GetObject"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the object"
        required: true
        schema:
          type: "string"
      - name: "object_key"
        in: "path"
        description: "The object key to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.GetObjectResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "ObjectService"
      summary: "Delete Object"
      description: "Delete Object\n\n Deletes an object from a bucket."
      operationId: "ObjectService_DeleteObject"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the object"
        required: true
        schema:
          type: "string"
      - name: "object_key"
        in: "path"
        description: "The object key to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/objects/{object_key}:metadata:
    get:
      tags:
      - "ObjectService"
      summary: "Head Object"
      description: "Head Object\n\n Returns object metadata without downloading the\
        \ object content."
      operationId: "ObjectService_HeadObject"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket containing the object"
        required: true
        schema:
          type: "string"
      - name: "object_key"
        in: "path"
        description: "The object key to get metadata for"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.ObjectMetadata"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/objects:copy:
    post:
      tags:
      - "ObjectService"
      summary: "Copy Object"
      description: "Copy Object\n\n Copies an object within the same workspace (server-side\
        \ copy on the storage\n engine). Source and destination buckets must belong\
        \ to the same workspace."
      operationId: "ObjectService_CopyObject"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace (both source and destination buckets must belong\
          \ to this workspace)"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "Source bucket (bound from the URL path)"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.CopyObjectRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/presigned-urls:download:
    post:
      tags:
      - "PresignedUrlService"
      summary: "Generate Download URL"
      description: "Generate Download URL\n\n Generates a pre-signed GET URL for downloading\
        \ an object directly from the storage data plane."
      operationId: "PresignedUrlService_GenerateDownloadUrl"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket to generate the download URL for"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.GenerateDownloadUrlRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.PresignedUrlResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{bucket}/presigned-urls:upload:
    post:
      tags:
      - "PresignedUrlService"
      summary: "Generate Upload URL"
      description: "Generate Upload URL\n\n Generates a pre-signed PUT URL for uploading\
        \ an object directly to the storage data plane."
      operationId: "PresignedUrlService_GenerateUploadUrl"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure"
        required: true
        schema:
          type: "string"
      - name: "bucket"
        in: "path"
        description: "The bucket to generate the upload URL for"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.GenerateUploadUrlRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.service.PresignedUrlResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /storage/v1/workspaces/{workspace}/engines/{engine}/buckets/{id}:
    get:
      tags:
      - "BucketService"
      summary: "Get Bucket"
      description: "Get Bucket\n\n Returns a bucket by unique ID. Use `-` to look\
        \ it up regardless of provider."
      operationId: "BucketService_GetBucket"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to look\
          \ up across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the bucket to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.Bucket"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "BucketService"
      summary: "Delete Bucket"
      description: "Delete Bucket\n\n Deletes an empty bucket. Returns FAILED_PRECONDITION\
        \ if the bucket still contains objects."
      operationId: "BucketService_DeleteBucket"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to target\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the bucket to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "BucketService"
      summary: "Update Bucket"
      description: "Update Bucket\n\n Updates bucket properties (description, versioning,\
        \ storage class)."
      operationId: "BucketService_UpdateBucket"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the bucket belongs to"
        required: true
        schema:
          type: "string"
      - name: "engine"
        in: "path"
        description: "The cloud provider: qibdo, aws, gcp, or azure, or '-' to target\
          \ across all providers"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the bucket to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten. See AIP-134\n for field mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.Bucket"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/operations:
    get:
      tags:
      - "TaxonomyOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of operations, optionally\
        \ filtered by resource."
      operationId: "TaxonomyOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListOperations` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=Group\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListTaxonomyOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/operations/{id}:
    get:
      tags:
      - "TaxonomyOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single operation by its unique ID."
      operationId: "TaxonomyOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations:
    get:
      tags:
      - "OrganisationService"
      summary: "List Organisations"
      description: "ListOrganisations\n\n Returns a paginated list of organisations"
      operationId: "OrganisationService_ListOrganisations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of organisations to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 organisations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListOrganisations` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListOrganisations` must match the call\n that\
          \ provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListOrganisationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "OrganisationService"
      summary: "Create Organisation"
      description: "CreateOrganisation\n\n Creates a new organisation"
      operationId: "OrganisationService_CreateOrganisation"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Organisation"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{id}:
    get:
      tags:
      - "OrganisationService"
      summary: "Get Organisation"
      description: "GetOrganisation\n\n Returns an organisation by unique ID"
      operationId: "OrganisationService_GetOrganisation"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the organisation to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Organisation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "OrganisationService"
      summary: "Delete Organisation"
      description: "DeleteOrganisation\n\n Deletes an organisation by unique ID"
      operationId: "OrganisationService_DeleteOrganisation"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the organisation to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "OrganisationService"
      summary: "Update Organisation"
      description: "UpdateOrganisation\n\n Updates an existing organisation"
      operationId: "OrganisationService_UpdateOrganisation"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the organisation to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Organisation"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/groups:
    get:
      tags:
      - "GroupService"
      summary: "List Groups"
      description: "ListGroups\n\n Returns a paginated list of groups within an organisation.\n\
        \ Supports parent_group_id filter to list direct children of a group."
      operationId: "GroupService_ListGroups"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation to list groups for"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of groups to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 groups will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListGroups` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListGroups` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'parent_group_id = \"uuid\"\
          ' to list\n direct children of a specific group"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListGroupsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "GroupService"
      summary: "Create Group"
      description: "CreateGroup\n\n Creates a new group (folder) within an organisation"
      operationId: "GroupService_CreateGroup"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation to create the group in"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Group"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/groups/{id}:
    get:
      tags:
      - "GroupService"
      summary: "Get Group"
      description: "GetGroup\n\n Returns a group by unique ID within an organisation"
      operationId: "GroupService_GetGroup"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the group belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the group to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Group"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "GroupService"
      summary: "Delete Group"
      description: "DeleteGroup\n\n Deletes a group by unique ID"
      operationId: "GroupService_DeleteGroup"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the group belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the group to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "GroupService"
      summary: "Update Group"
      description: "UpdateGroup\n\n Updates an existing group"
      operationId: "GroupService_UpdateGroup"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the group belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the group to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Group"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/groups/{id}:move:
    post:
      tags:
      - "GroupService"
      summary: "Move Group"
      description: "MoveGroup\n\n Reparents a group under another group, or makes\
        \ it a root-level group\n by setting parent_group_id to empty. Rejects if\
        \ a cycle would be created."
      operationId: "GroupService_MoveGroup"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the group belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the group to move"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.MoveGroupRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/workspaces:
    get:
      tags:
      - "WorkspaceService"
      summary: "List Workspaces"
      description: "ListWorkspaces\n\n Returns a paginated list of workspaces within\
        \ an organisation"
      operationId: "WorkspaceService_ListWorkspaces"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation to list workspaces for"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of workspaces to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 workspaces\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListWorkspaces` call.\n\
          \ Provide this to retrieve the subsequent page. When paginating,\n all other\
          \ parameters provided to `ListWorkspaces` must match the call\n that provided\
          \ the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. 'group_id = \"uuid\"' to list\n\
          \ workspaces in a specific folder"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. 'name asc'"
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListWorkspacesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "WorkspaceService"
      summary: "Create Workspace"
      description: "CreateWorkspace\n\n Creates a new workspace within an organisation"
      operationId: "WorkspaceService_CreateWorkspace"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation to create the workspace in"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Workspace"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/workspaces/{id}:
    get:
      tags:
      - "WorkspaceService"
      summary: "Get Workspace"
      description: "GetWorkspace\n\n Returns a workspace by unique ID within an organisation"
      operationId: "WorkspaceService_GetWorkspace"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the workspace belongs to, or \"-\" (AIP-159)\
          \ to read across organisations.\n Callers using \"-\" must have the required\
          \ permission at a scope covering the resolved\n workspace (typically WORKSPACE(id)\
          \ or higher)."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the workspace to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Workspace"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "WorkspaceService"
      summary: "Delete Workspace"
      description: "DeleteWorkspace\n\n Deletes a workspace by unique ID"
      operationId: "WorkspaceService_DeleteWorkspace"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the workspace belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the workspace to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "WorkspaceService"
      summary: "Update Workspace"
      description: "UpdateWorkspace\n\n Updates an existing workspace"
      operationId: "WorkspaceService_UpdateWorkspace"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the workspace belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the workspace to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Workspace"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /taxonomy/v1/organisations/{organisation}/workspaces/{id}:move:
    post:
      tags:
      - "WorkspaceService"
      summary: "Move Workspace"
      description: "MoveWorkspace\n\n Moves a workspace into a group (folder), or\
        \ removes it from any group\n by setting group_id to empty string"
      operationId: "WorkspaceService_MoveWorkspace"
      parameters:
      - name: "organisation"
        in: "path"
        description: "The organisation the workspace belongs to"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the workspace to move"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.MoveWorkspaceRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/locations:
    get:
      tags:
      - "LocationService"
      summary: "List Locations"
      description: "List Locations\n\n Returns a paginated list of all locations for\
        \ a provider (use `-` to span every provider). Filter\n by kind or status\
        \ with the AIP-160 `filter` field, e.g. `kind = \"zone\" AND status = \"active\"\
        `."
      operationId: "LocationService_ListLocations"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to list, or `-` for all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of locations to return. The service may return\
          \ fewer than this value. If\n unspecified, at most 20 locations will be\
          \ returned. The maximum value is 100; values above\n 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListLocations` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "An AIP-160 filter expression, e.g. `kind = \"zone\" AND status\
          \ = \"active\"`."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "An AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListLocationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/locations/{id}:
    get:
      tags:
      - "LocationService"
      summary: "Get Location"
      description: "Get Location\n\n Resolves a location reference to its kind and\
        \ usability status in one read. Use `-` to resolve a\n reference whose provider\
        \ the caller does not know."
      operationId: "LocationService_GetLocation"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the location to resolve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Location"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/locations/{id}:approve:
    post:
      tags:
      - "LocationService"
      summary: "Approve Location"
      description: "Approve Location\n\n Approves a pending location, confirming its\
        \ display name and moving it to active."
      operationId: "LocationService_ApproveLocation"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the location to approve"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ApproveLocationRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/locations/{id}:disable:
    post:
      tags:
      - "LocationService"
      summary: "Disable Location"
      description: "Disable Location\n\n Disables an active location, blocking new\
        \ placement without destroying existing resources."
      operationId: "LocationService_DisableLocation"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the location to disable"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.DisableLocationRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/locations/{id}:enable:
    post:
      tags:
      - "LocationService"
      summary: "Enable Location"
      description: "Enable Location\n\n Re-enables a disabled location, moving it\
        \ back to active."
      operationId: "LocationService_EnableLocation"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the location to enable"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.EnableLocationRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/multi-regions:
    get:
      tags:
      - "LocationService"
      summary: "List Multi-Regions"
      description: "List Multi-Regions\n\n Returns a paginated list of multi-regions\
        \ for a provider."
      operationId: "LocationService_ListMultiRegions"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to list, or `-` for all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of multi-regions to return. The service may\
          \ return fewer than this value. If\n unspecified, at most 20 multi-regions\
          \ will be returned. The maximum value is 100; values above\n 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListMultiRegions` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "An AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "An AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListMultiRegionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "LocationService"
      summary: "Create Multi-Region"
      description: "Create Multi-Region\n\n Creates a multi-region grouping over zero\
        \ or more regions. It starts pending administrator approval."
      operationId: "LocationService_CreateMultiRegion"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to create the multi-region on (a concrete\
          \ provider is required)"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MultiRegion"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/multi-regions/{id}:
    get:
      tags:
      - "LocationService"
      summary: "Get Multi-Region"
      description: "Get Multi-Region\n\n Returns a multi-region by its unique identifier,\
        \ including its member regions."
      operationId: "LocationService_GetMultiRegion"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the multi-region to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MultiRegion"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "LocationService"
      summary: "Delete Multi-Region"
      description: "Delete Multi-Region\n\n Deletes a multi-region, clearing the membership\
        \ of any member regions first."
      operationId: "LocationService_DeleteMultiRegion"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the multi-region to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "LocationService"
      summary: "Update Multi-Region"
      description: "Update Multi-Region\n\n Updates a multi-region's mutable fields\
        \ (display name, description)."
      operationId: "LocationService_UpdateMultiRegion"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the multi-region to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MultiRegion"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/regions:
    get:
      tags:
      - "LocationService"
      summary: "List Regions"
      description: "List Regions\n\n Returns a paginated list of regions for a provider.\
        \ Regions are read-only inventory built by the\n provider sync source."
      operationId: "LocationService_ListRegions"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to list, or `-` for all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of regions to return. The service may return\
          \ fewer than this value. If\n unspecified, at most 20 regions will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListRegions` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "An AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "An AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListRegionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/regions/{id}:
    get:
      tags:
      - "LocationService"
      summary: "Get Region"
      description: "Get Region\n\n Returns a region by its unique identifier, including\
        \ provider-specific detail."
      operationId: "LocationService_GetRegion"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the region to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Region"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/zones:
    get:
      tags:
      - "LocationService"
      summary: "List Zones"
      description: "List Zones\n\n Returns a paginated list of zones for a provider."
      operationId: "LocationService_ListZones"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to list, or `-` for all providers"
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of zones to return. The service may return\
          \ fewer than this value. If\n unspecified, at most 20 zones will be returned.\
          \ The maximum value is 100; values above\n 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token from a previous `ListZones` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "An AIP-160 filter expression, e.g. `region_id = \"...\" AND\
          \ status = \"active\"`."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "An AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListZonesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "LocationService"
      summary: "Create Zone"
      description: "Create Zone\n\n Creates a zone within a synced region. The zone\
        \ starts pending administrator approval."
      operationId: "LocationService_CreateZone"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider to create the zone on (a concrete provider\
          \ is required)"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Zone"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/engines/{engine}/zones/{id}:
    get:
      tags:
      - "LocationService"
      summary: "Get Zone"
      description: "Get Zone\n\n Returns a zone by its unique identifier."
      operationId: "LocationService_GetZone"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the zone to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Zone"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "LocationService"
      summary: "Delete Zone"
      description: "Delete Zone\n\n Deletes a zone by its unique identifier."
      operationId: "LocationService_DeleteZone"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the zone to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "LocationService"
      summary: "Update Zone"
      description: "Update Zone\n\n Updates a zone's mutable fields. Returns FAILED_PRECONDITION\
        \ if the zone is already enabled."
      operationId: "LocationService_UpdateZone"
      parameters:
      - name: "engine"
        in: "path"
        description: "The cloud provider, or `-` to resolve regardless of provider"
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the zone to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Zone"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/operations:
    get:
      tags:
      - "TopologyOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of operations, optionally\
        \ filtered by resource."
      operationId: "TopologyOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous `ListOperations`\
          \ call.\n Provide this to retrieve the subsequent page. When paginating,\n\
          \ all other parameters provided to `ListOperations` must match the call\n\
          \ that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., \"resource_type=Region\"\
          )."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListTopologyOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/operations/{id}:
    get:
      tags:
      - "TopologyOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single operation by its unique ID."
      operationId: "TopologyOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the operation to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/resource-pools:
    get:
      tags:
      - "ResourcePoolService"
      summary: "List Resource Pools"
      description: "List Resource Pools\n\n Returns a paginated list of resource pools.\
        \ Scope to a zone with `filter=zone_id=\"<uuid>\"`."
      operationId: "ResourcePoolService_ListResourcePools"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of resource pools to return. The service\
          \ may return fewer than\n this value.\n If unspecified, at most 20 resource\
          \ pools will be returned.\n The maximum value is 100; values above 100 will\
          \ be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListResourcePools` call.\n\
          \ Provide this to retrieve the subsequent page.\n When paginating, all other\
          \ parameters provided to `ListResourcePools` must match\n the call that\
          \ provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "A filter expression allows you to filter the resource pools\
          \ listed in the response.\n At qibdo, we use the [AIP-160](https://google.aip.dev/160)\
          \ proposal, that means that your expression should include:\n field name,\
          \ an operator, and the value you wish to filter by.\n The value can be a\
          \ **string**, **number**, or **boolean**, and the operator must be one of\
          \ the following: **=, !=, >, <, <=, >=,** or **:**\n You can group multiple\
          \ expressions using parentheses and the logical operators **AND** and **OR**.\n\
          \ Examples:\n `zone_id = \"...\"` -> Filter by parent zone   ·   `name =\
          \ \"pool-01\"` -> Filter by name"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "The order in which to sort the results. If not specified, the\
          \ results will be sorted by name in ascending order.\n At qibdo, we use\
          \ the [AIP-132](https://google.aip.dev/132) proposal, that means:\n Values\
          \ should be a comma separated list of fields. For example: `\"foo,bar\"\
          `.\n The default sort order is ascending. To specify descending order, a\
          \ suffix `\" desc\"` should be added. For example: `\"foo desc,bar\"`.\n\
          \ Redundant space characters in the syntax are insignificant."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListResourcePoolsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "ResourcePoolService"
      summary: "Create Resource Pool"
      description: "Create Resource Pool\n\n Creates a new resource pool. The parent\
        \ zone is supplied as `zone_id` on the resource body."
      operationId: "ResourcePoolService_CreateResourcePool"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.ResourcePool"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/resource-pools/{id}:
    get:
      tags:
      - "ResourcePoolService"
      summary: "Get Resource Pool"
      description: "Get Resource Pool\n\n Returns a resource pool by its unique identifier."
      operationId: "ResourcePoolService_GetResourcePool"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the resource pool to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.ResourcePool"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "ResourcePoolService"
      summary: "Delete Resource Pool"
      description: "Delete Resource Pool\n\n Deletes a resource pool by its unique\
        \ identifier."
      operationId: "ResourcePoolService_DeleteResourcePool"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the resource pool to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "ResourcePoolService"
      summary: "Update Resource Pool"
      description: "Update Resource Pool\n\n Updates an existing resource pool. The\
        \ parent zone (`zone_id`) is immutable."
      operationId: "ResourcePoolService_UpdateResourcePool"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the resource pool to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.ResourcePool"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/targets:
    get:
      tags:
      - "DeploymentTargetService"
      summary: "List Deployment Targets"
      description: "List Deployment Targets\n\n Returns a paginated list of deployment\
        \ targets filtered by optional parameters"
      operationId: "DeploymentTargetService_ListDeploymentTargets"
      parameters:
      - name: "page_size"
        in: "query"
        description: "The maximum number of deployment targets to return. The service\
          \ may return fewer than\n this value.\n If unspecified, at most 20 deployment\
          \ targets will be returned.\n The maximum value is 100; values above 100\
          \ will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListDeploymentTargets`\
          \ call.\n Provide this to retrieve the subsequent page.\n When paginating,\
          \ all other parameters provided to `ListDeploymentTargets` must match\n\
          \ the call that provided the page token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "A filter expression allows you to filter the deployment targets\
          \ listed in the response.\n At qibdo, we use the [AIP-160](https://google.aip.dev/160)\
          \ proposal, that means that your expression should include:\n field name,\
          \ an operator, and the value you wish to filter by.\n The value can be a\
          \ **string**, **number**, or **boolean**, and the operator must be one of\
          \ the following: **=, !=, >, <, <=, >=,** or **:**\n You can group multiple\
          \ expressions using parentheses and the logical operators **AND** and **OR**.\n\
          \ Examples:\n `name = \"host-01\"` -> Filter by deployment target name\n\
          \ `hostname = \"node1.qibdo.local\"` -> Filter by hostname\n `cpu_topology.architecture\
          \ = \"CPU_ARCHITECTURE_X86_64\"` -> Filter by CPU architecture"
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "The order in which to sort the results. If not specified, the\
          \ results will be sorted by name in ascending order.\n At qibdo, we use\
          \ the [AIP-132](https://google.aip.dev/132) proposal, that means:\n Values\
          \ should be a comma separated list of fields. For example: `\"foo,bar\"\
          `.\n The default sort order is ascending. To specify descending order, a\
          \ suffix `\" desc\"` should be added. For example: `\"foo desc,bar\"`.\n\
          \ Redundant space characters in the syntax are insignificant."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListDeploymentTargetsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "DeploymentTargetService"
      summary: "Register Deployment Target"
      description: "Register Deployment Target\n\n Registers a new physical host (deployment\
        \ target)"
      operationId: "DeploymentTargetService_RegisterDeploymentTarget"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.service.RegisterDeploymentTargetRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /topology/v1/targets/{id}:
    get:
      tags:
      - "DeploymentTargetService"
      summary: "Get Deployment Target"
      description: "Get Deployment Target\n\n Returns a deployment target by its unique\
        \ identifier"
      operationId: "DeploymentTargetService_GetDeploymentTarget"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment target to retrieve"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DeploymentTarget"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "DeploymentTargetService"
      summary: "Delete Deployment Target"
      description: "Delete Deployment Target\n\n Deletes a deployment target by its\
        \ unique identifier"
      operationId: "DeploymentTargetService_DeleteDeploymentTarget"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment target to delete"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "DeploymentTargetService"
      summary: "Update Deployment Target"
      description: "Update Deployment Target\n\n Updates an existing deployment target"
      operationId: "DeploymentTargetService_UpdateDeploymentTarget"
      parameters:
      - name: "id"
        in: "path"
        description: "The unique identifier of the deployment target to update"
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "The set of fields to update. If omitted, all mutable fields\
          \ are overwritten.\n See [AIP-134](https://google.aip.dev/134) for field\
          \ mask semantics."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DeploymentTarget"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/operations:
    get:
      tags:
      - "VaultOperationService"
      summary: "List Operations"
      description: "ListOperations\n\n Returns a paginated list of vault operations,\
        \ optionally filtered by\n resource type, workspace, principal, or operation\
        \ type via AIP-160\n filter. Platform-admin-only."
      operationId: "VaultOperationService_ListOperations"
      parameters:
      - name: "page_size"
        in: "query"
        description: "Page Size\n\n Maximum number of operations to return. The service\
          \ may return fewer\n than this value. If unspecified, at most 20 operations\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Page Token\n\n A page token, received from a previous ListOperations\
          \ call. Provide this\n to retrieve the subsequent page. When paginating,\
          \ all other parameters\n provided to ListOperations must match the call\
          \ that provided the page\n token."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "Filter\n\n AIP-160 filter expression (e.g., 'resource_type=\"\
          com.qibdo.cloud.vault:secret\"')."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "Order By\n\n AIP-132 ordering expression."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.ListVaultOperationsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/operations/{id}:
    get:
      tags:
      - "VaultOperationService"
      summary: "Get Operation"
      description: "GetOperation\n\n Returns a single vault operation by its unique\
        \ ID. Platform-admin-only."
      operationId: "VaultOperationService_GetOperation"
      parameters:
      - name: "id"
        in: "path"
        description: "Operation ID\n\n The unique identifier of the vault operation\
          \ to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/operations:restoreSnapshot:
    post:
      tags:
      - "VaultOperationService"
      summary: "Restore Snapshot"
      description: "RestoreSnapshot\n\n Restores the vault from a previously-taken\
        \ snapshot. The snapshot bytes\n are sent inline in the request body. Destructive\
        \ — overwrites the current\n vault state with the snapshot contents. Platform-admin-only."
      operationId: "VaultOperationService_RestoreSnapshot"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.RestoreSnapshotRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/operations:rotateRootKey:
    post:
      tags:
      - "VaultOperationService"
      summary: "Rotate Root Key"
      description: "RotateRootKey\n\n Rotates the underlying root encryption keyring\
        \ that wraps every other\n vault secret. Platform-admin-only."
      operationId: "VaultOperationService_RotateRootKey"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.RotateRootKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/operations:takeSnapshot:
    post:
      tags:
      - "VaultOperationService"
      summary: "Take Snapshot"
      description: "TakeSnapshot\n\n Triggers a Raft snapshot of the entire vault\
        \ and returns the resulting\n VaultOperation record. The snapshot bytes themselves\
        \ are not returned —\n they are persisted by the engine; the operation row\
        \ carries a SHA-512\n checksum so callers can audit integrity. Platform-admin-only."
      operationId: "VaultOperationService_TakeSnapshot"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.TakeSnapshotRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/accessPolicies:
    get:
      tags:
      - "QibdoAccessPolicyService"
      summary: "List Access Policies"
      description: "ListQibdoAccessPolicies\n\n Returns a paginated list of access\
        \ policies within a workspace."
      operationId: "QibdoAccessPolicyService_ListQibdoAccessPolicies"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose policies will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of policies to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 policies will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoAccessPolicies`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoAccessPoliciesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoAccessPolicyService"
      summary: "Create Access Policy"
      description: "CreateQibdoAccessPolicy\n\n Creates a new access policy under\
        \ a workspace. Name is unique within the\n workspace. Returns an operation\
        \ describing the create."
      operationId: "QibdoAccessPolicyService_CreateQibdoAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the access policy in."
        required: true
        schema:
          type: "string"
      - name: "location_id"
        in: "query"
        description: "Optional weak reference to a topology Location where the access\
          \ policy resides.\n Defaults to the global location when omitted; immutable\
          \ after creation.\n Only the global location is available in this release."
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoAccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/accessPolicies/{id}:
    get:
      tags:
      - "QibdoAccessPolicyService"
      summary: "Get Access Policy"
      description: "GetQibdoAccessPolicy\n\n Returns an access policy by ID, including\
        \ its active document and\n the full revision history."
      operationId: "QibdoAccessPolicyService_GetQibdoAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the access policy belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoAccessPolicy"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoAccessPolicyService"
      summary: "Delete Access Policy"
      description: "DeleteQibdoAccessPolicy\n\n Marks an access policy for deletion\
        \ and removes it from the store. No\n bindings that reference the policy are\
        \ cascaded — callers are expected to\n update any referencing IAM bindings\
        \ first."
      operationId: "QibdoAccessPolicyService_DeleteQibdoAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the access policy belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoAccessPolicyService"
      summary: "Update Access Policy"
      description: "UpdateQibdoAccessPolicy\n\n Replaces the active policy document\
        \ with a new one. The previous document\n is pushed onto the policy's version_history.\
        \ Per AIP-134, supply the\n resource fields to update alongside a FieldMask;\
        \ `*` requests full\n replacement semantics."
      operationId: "QibdoAccessPolicyService_UpdateQibdoAccessPolicy"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the access policy belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the access policy to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "AIP-134 FieldMask. Omit for implicit mask of populated fields;\
          \ `*` for\n full replacement."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoAccessPolicy"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials:
    get:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "List Application Credentials"
      description: "ListQibdoApplicationCredentials\n\n Returns a paginated list of\
        \ credentials within a workspace."
      operationId: "QibdoApplicationCredentialService_ListQibdoApplicationCredentials"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose credentials will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of credentials to return. The service may\
          \ return\n fewer than this value. If unspecified, at most 20 credentials\
          \ will be\n returned. The maximum value is 100; values above 100 will be\
          \ coerced\n to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoApplicationCredentials`\n\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoApplicationCredentialsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials/{id}:
    get:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "Get Application Credential"
      description: "GetQibdoApplicationCredential\n\n Returns a credential's metadata\
        \ by ID. Never returns the SecretID."
      operationId: "QibdoApplicationCredentialService_GetQibdoApplicationCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the credential belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the credential to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials/{id}:revoke:
    post:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "Revoke Application Credential"
      description: "RevokeQibdoApplicationCredential\n\n Marks the credential as revoked.\
        \ Subsequent Authenticate calls return\n PERMISSION_DENIED. Idempotent."
      operationId: "QibdoApplicationCredentialService_RevokeQibdoApplicationCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the credential belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The credential to revoke."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoApplicationCredentialRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials/{id}:rotateSecretId:
    post:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "Rotate Application Credential Secret ID"
      description: "RotateQibdoApplicationCredentialSecretId\n\n Mints a fresh SecretID,\
        \ replaces the persisted hash, and returns the new\n SecretID exactly once.\
        \ The RoleID is preserved."
      operationId: "QibdoApplicationCredentialService_RotateQibdoApplicationCredentialSecretId"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the credential belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The credential to rotate."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoApplicationCredentialSecretIdRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoApplicationCredentialSecretIdResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials:authenticate:
    post:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "Authenticate With Application Credential"
      description: "AuthenticateWithQibdoApplicationCredential\n\n Verifies the supplied\
        \ RoleID + SecretID and, on success, returns a\n short-lived access token\
        \ bound to the credential's principal. The\n SecretID itself is the auth proof,\
        \ so this RPC is workspace-public —\n gated only by SecretID verification,\
        \ never by vault permissions."
      operationId: "QibdoApplicationCredentialService_AuthenticateWithQibdoApplicationCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the credential belongs to."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AuthenticateWithQibdoApplicationCredentialRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AuthenticateWithQibdoApplicationCredentialResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/applicationcredentials:issue:
    post:
      tags:
      - "QibdoApplicationCredentialService"
      summary: "Issue Application Credential"
      description: "IssueQibdoApplicationCredential\n\n Creates a new credential with\
        \ a freshly-minted RoleID + SecretID. The\n SecretID is returned exactly once\
        \ in the response and is NEVER recoverable\n afterwards; only its SHA-512\
        \ hash is persisted server-side."
      operationId: "QibdoApplicationCredentialService_IssueQibdoApplicationCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the credential belongs to."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoApplicationCredentialRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoApplicationCredentialResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities:
    get:
      tags:
      - "QibdoCertificateAuthorityService"
      summary: "List Certificate Authorities"
      description: "ListQibdoCertificateAuthorities\n\n Returns a paginated list of\
        \ CAs in a workspace."
      operationId: "QibdoCertificateAuthorityService_ListQibdoCertificateAuthorities"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose CAs will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of CAs to return. The service may return\
          \ fewer than\n this value. If unspecified, at most 20 will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoCertificateAuthorities`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCertificateAuthoritiesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoCertificateAuthorityService"
      summary: "Create Certificate Authority"
      description: "CreateQibdoCertificateAuthority\n\n Provisions a new Root or Intermediate\
        \ CA inside the workspace's PKI mount.\n Returns a long-running operation\
        \ whose payload references the resulting\n QibdoCertificateAuthority."
      operationId: "QibdoCertificateAuthorityService_CreateQibdoCertificateAuthority"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA will be created under."
        required: true
        schema:
          type: "string"
      - name: "ttl"
        in: "query"
        description: "Initial validity duration for the CA. The engine will derive\
          \ `valid_until`\n from this when materialising the CA — `valid_from` defaults\
          \ to the engine's\n current time."
        schema:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Represents a a duration between -315,576,000,000s and 315,576,000,000s\
            \ (around 10000 years). Precision is in nanoseconds. 1 nanosecond is represented\
            \ as 0.000000001s"
      - name: "location_id"
        in: "query"
        description: "Optional weak reference to a topology Location where the CA\
          \ resides.\n Defaults to the global location when omitted; immutable after\
          \ creation.\n Only the global location is available in this release."
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificateAuthority"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/certificates:
    get:
      tags:
      - "QibdoCertificateService"
      summary: "List Certificates"
      description: "ListQibdoCertificates\n\n Returns a paginated list of certificates\
        \ issued by the given CA."
      operationId: "QibdoCertificateService_ListQibdoCertificates"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA whose certificates will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of certificates to return. The service may\
          \ return\n fewer than this value. If unspecified, at most 20 will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoCertificates`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"not_after desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCertificatesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoCertificateService"
      summary: "Issue Certificate"
      description: "IssueQibdoCertificate\n\n Issues a new leaf certificate under\
        \ the given CA / role. The CA must be\n active (not revoked). Returns a long-running\
        \ operation whose payload\n references the resulting QibdoCertificate."
      operationId: "QibdoCertificateService_IssueQibdoCertificate"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA that will issue the certificate."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoCertificateRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/certificates/{id}:
    get:
      tags:
      - "QibdoCertificateService"
      summary: "Get Certificate"
      description: "GetQibdoCertificate\n\n Returns the metadata of a single certificate."
      operationId: "QibdoCertificateService_GetQibdoCertificate"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA that issued the certificate."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the certificate (UUID)."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificate"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/certificates/{id}:revoke:
    post:
      tags:
      - "QibdoCertificateService"
      summary: "Revoke Certificate"
      description: "RevokeQibdoCertificate\n\n Marks a certificate as revoked with\
        \ an RFC 5280 reason. The CRL is\n refreshed at the engine. Idempotent on\
        \ already-revoked."
      operationId: "QibdoCertificateService_RevokeQibdoCertificate"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA that issued the certificate."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The certificate to revoke."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoCertificateRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/roles:
    get:
      tags:
      - "QibdoPkiRoleService"
      summary: "List PKI Roles"
      description: "ListQibdoPkiRoles\n\n Returns a paginated list of PKI roles within\
        \ a CA."
      operationId: "QibdoPkiRoleService_ListQibdoPkiRoles"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the roles belong to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA whose roles will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of roles to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 roles will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoPkiRoles` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoPkiRolesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/roles/{id}:
    get:
      tags:
      - "QibdoPkiRoleService"
      summary: "Get PKI Role"
      description: "GetQibdoPkiRole\n\n Returns a PKI role's metadata by ID."
      operationId: "QibdoPkiRoleService_GetQibdoPkiRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA the role is attached to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoPkiRoleService"
      summary: "Delete PKI Role"
      description: "DeleteQibdoPkiRole\n\n Deletes a PKI role and unbinds it from\
        \ the engine."
      operationId: "QibdoPkiRoleService_DeleteQibdoPkiRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA the role is attached to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoPkiRoleService"
      summary: "Update PKI Role"
      description: "UpdateQibdoPkiRole\n\n Updates a PKI role's allowed_domains, max_ttl,\
        \ allowed_key_types and/or\n allowed_extended_key_usages. Re-projects the\
        \ role to the engine."
      operationId: "QibdoPkiRoleService_UpdateQibdoPkiRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA the role is attached to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for implied mask (all populated fields).\n\
          \ Use `*` for full replacement of the mutable fields."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{certificate_authority}/roles:register:
    post:
      tags:
      - "QibdoPkiRoleService"
      summary: "Register PKI Role"
      description: "RegisterQibdoPkiRole\n\n Defines a new PKI role under a CA. The\
        \ role's constraints are validated\n by domain business rules (well-formed\
        \ name, non-empty allowed_domains\n with valid DNS patterns, positive max_ttl,\
        \ non-empty allowed_key_types,\n non-empty allowed_extended_key_usages). On\
        \ success the role is persisted\n and projected to the vault backend."
      operationId: "QibdoPkiRoleService_RegisterQibdoPkiRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "certificate_authority"
        in: "path"
        description: "The CA the role is attached to."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoPkiRoleRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoPkiRoleResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{id}:
    get:
      tags:
      - "QibdoCertificateAuthorityService"
      summary: "Get Certificate Authority"
      description: "GetQibdoCertificateAuthority\n\n Returns the metadata of a single\
        \ CA."
      operationId: "QibdoCertificateAuthorityService_GetQibdoCertificateAuthority"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the CA to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificateAuthority"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{id}/crl:
    get:
      tags:
      - "QibdoCertificateService"
      summary: "Get Certificate Revocation List"
      description: "GetQibdoCertificateRevocationList\n\n Returns the PEM-encoded\
        \ CRL published by the CA's mount. Custom verb on the\n CA itself (`{id}`\
        \ identifies the CA) — listed under QibdoCertificateService\n because the\
        \ CRL is the projection of issued certificates' revocation state."
      operationId: "QibdoCertificateService_GetQibdoCertificateRevocationList"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The CA whose CRL will be fetched (target resource per AIP-131)."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GetQibdoCertificateRevocationListResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/certificateAuthorities/{id}:revoke:
    post:
      tags:
      - "QibdoCertificateAuthorityService"
      summary: "Revoke Certificate Authority"
      description: "RevokeQibdoCertificateAuthority\n\n Marks the CA itself as revoked.\
        \ Existing certificates issued by this CA\n remain valid until their own expiry\
        \ or revocation, but no new certificates\n can be issued."
      operationId: "QibdoCertificateAuthorityService_RevokeQibdoCertificateAuthority"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the CA belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The CA to revoke."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoCertificateAuthorityRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/clouds/{cloud_provider}/{source_role}/credentials:
    post:
      tags:
      - "QibdoDynamicCredentialService"
      summary: "Generate Cloud Credential"
      description: "GenerateCloudQibdoCredential\n\n Generates a new ephemeral cloud-IAM\
        \ credential against AWS, GCP, or Azure\n for the given pre-configured role.\
        \ The response embeds both the credential\n payload (returned exactly once)\
        \ and the persistent lease handle.\n The credential's username/password fields\
        \ carry provider-specific material:\n   - AWS:   access_key / secret_key (STS\
        \ preferred, falls back to static IAM)\n   - GCP:   \"oauth2-access-token\"\
        \ / OAuth2 access token\n   - Azure: client_id / client_secret"
      operationId: "QibdoDynamicCredentialService_GenerateCloudQibdoCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to issue the credential under."
        required: true
        schema:
          type: "string"
      - name: "cloud_provider"
        in: "path"
        description: "The cloud provider whose IAM credentials are requested."
        required: true
        schema:
          enum:
          - "CLOUD_PROVIDER_UNSPECIFIED"
          - "CLOUD_PROVIDER_AWS"
          - "CLOUD_PROVIDER_GCP"
          - "CLOUD_PROVIDER_AZURE"
          type: "string"
          format: "enum"
      - name: "source_role"
        in: "path"
        description: "The pre-configured role to draw the credential from. Names map\
          \ to:\n   - AWS:   STS role (preferred) or static IAM role\n   - GCP:  \
          \ roleset\n   - Azure: role"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateCloudQibdoCredentialRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateCloudQibdoCredentialResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys:
    get:
      tags:
      - "QibdoCryptoKeyService"
      summary: "List Crypto Keys"
      description: "ListQibdoCryptoKeys\n\n Returns a paginated list of crypto keys\
        \ within a workspace."
      operationId: "QibdoCryptoKeyService_ListQibdoCryptoKeys"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose crypto keys will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of crypto keys to return. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 crypto keys\
          \ will be returned.\n The maximum value is 100; values above 100 will be\
          \ coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoCryptoKeys`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCryptoKeysResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Create Crypto Key"
      description: "CreateQibdoCryptoKey\n\n Creates a new crypto key under a workspace\
        \ and provisions the initial key\n version (v1) in the engine. Name is unique\
        \ within the workspace."
      operationId: "QibdoCryptoKeyService_CreateQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the crypto key in."
        required: true
        schema:
          type: "string"
      - name: "location_id"
        in: "query"
        description: "Optional weak reference to a topology Location where the crypto\
          \ key resides.\n Defaults to the global location when omitted; immutable\
          \ after creation.\n Only the global location is available in this release."
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKey"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{cryptokey}/versions:
    get:
      tags:
      - "QibdoCryptoKeyVersionService"
      summary: "List Crypto Key Versions"
      description: "ListQibdoCryptoKeyVersions\n\n Paginated metadata listing. Honours\
        \ AIP-160 `filter` (e.g. `state=\"ENABLED\"`)\n and AIP-132 `order_by` (e.g.\
        \ `version_number desc`)."
      operationId: "QibdoCryptoKeyVersionService_ListQibdoCryptoKeyVersions"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "cryptokey"
        in: "path"
        description: "The crypto key whose versions will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum number of versions to return per page. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 versions will\
          \ be returned.\n The maximum value is 100; values above 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Opaque page token returned by a previous list call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. `state=\"ENABLED\"`."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. `version_number desc`."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCryptoKeyVersionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{cryptokey}/versions/{id}:
    get:
      tags:
      - "QibdoCryptoKeyVersionService"
      summary: "Get Crypto Key Version"
      description: "GetQibdoCryptoKeyVersion\n\n Returns a version's metadata."
      operationId: "QibdoCryptoKeyVersionService_GetQibdoCryptoKeyVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "cryptokey"
        in: "path"
        description: "The parent crypto key."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKeyVersion"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{cryptokey}/versions/{id}:disable:
    post:
      tags:
      - "QibdoCryptoKeyVersionService"
      summary: "Disable Crypto Key Version"
      description: "DisableQibdoCryptoKeyVersion\n\n AIP-136 custom method on the\
        \ version. Disabled versions are no longer used\n for new operations; decryption\
        \ requires explicit version addressing."
      operationId: "QibdoCryptoKeyVersionService_DisableQibdoCryptoKeyVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "cryptokey"
        in: "path"
        description: "The parent crypto key."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to disable."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DisableQibdoCryptoKeyVersionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{cryptokey}/versions/{id}:scheduleDestroy:
    post:
      tags:
      - "QibdoCryptoKeyVersionService"
      summary: "Schedule Destroy Crypto Key Version"
      description: "ScheduleDestroyQibdoCryptoKeyVersion\n\n AIP-136 custom method\
        \ on the version. Schedules permanent destruction of\n key material; the engine\
        \ purges the version after the grace window elapses."
      operationId: "QibdoCryptoKeyVersionService_ScheduleDestroyQibdoCryptoKeyVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "cryptokey"
        in: "path"
        description: "The parent crypto key."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to schedule for destruction."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ScheduleDestroyQibdoCryptoKeyVersionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:
    get:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Get Crypto Key"
      description: "GetQibdoCryptoKey\n\n Returns a crypto key's metadata by ID."
      operationId: "QibdoCryptoKeyService_GetQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKey"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Delete Crypto Key"
      description: "DeleteQibdoCryptoKey\n\n Marks a crypto key for deletion. Its\
        \ versions are destroyed and key\n material is purged from the engine."
      operationId: "QibdoCryptoKeyService_DeleteQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Update Crypto Key"
      description: "UpdateQibdoCryptoKey\n\n Updates a crypto key's metadata (name,\
        \ rotation period, minimum decryptable\n version, tags) per AIP-134 FieldMask\
        \ semantics. Algorithm and purpose are\n immutable after creation."
      operationId: "QibdoCryptoKeyService_UpdateQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "AIP-134 FieldMask. Omit for implicit mask of populated fields;\
          \ `*` for full replacement."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKey"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:decrypt:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Decrypt With Crypto Key"
      description: "DecryptWithQibdoCryptoKey\n\n AIP-136 custom method. Decrypts\
        \ ciphertext produced by EncryptWithQibdoCryptoKey.\n The version number is\
        \ embedded in the ciphertext envelope."
      operationId: "QibdoCryptoKeyService_DecryptWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DecryptWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DecryptWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:encrypt:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Encrypt With Crypto Key"
      description: "EncryptWithQibdoCryptoKey\n\n AIP-136 custom method. Encrypts\
        \ plaintext under the key's latest ENABLED\n version (or `key_version` if\
        \ specified). Returns the ciphertext blob and\n the version number used."
      operationId: "QibdoCryptoKeyService_EncryptWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.EncryptWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.EncryptWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:generateDataEncryptionKey:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Generate Data Encryption Key"
      description: "GenerateDataEncryptionKey\n\n AIP-136 custom method. Generates\
        \ a data encryption key (DEK) wrapped under\n the named key. Optionally returns\
        \ the plaintext DEK in the same response\n for envelope encryption flows."
      operationId: "QibdoCryptoKeyService_GenerateDataEncryptionKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the wrapping crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the wrapping crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDataEncryptionKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDataEncryptionKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:hmac:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "HMAC With Crypto Key"
      description: "HmacWithQibdoCryptoKey\n\n AIP-136 custom method. Generates a\
        \ MAC tag under a MAC key. The tag bytes\n are returned as opaque bytes; clients\
        \ should compare via constant-time\n equality on the return path."
      operationId: "QibdoCryptoKeyService_HmacWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the MAC crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.HmacWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.HmacWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:reEncrypt:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Re-Encrypt With Crypto Key"
      description: "ReEncryptWithQibdoCryptoKey\n\n AIP-136 custom method. Re-encrypts\
        \ ciphertext under the key's latest\n ENABLED version without exposing plaintext\
        \ to the caller. Used to migrate\n ciphertexts forward after key rotation."
      operationId: "QibdoCryptoKeyService_ReEncryptWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ReEncryptWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ReEncryptWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:rotate:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Rotate Crypto Key"
      description: "RotateQibdoCryptoKey\n\n AIP-136 custom method on the parent crypto\
        \ key. Produces a new ENABLED\n version that becomes the default for new encrypt/sign/HMAC\
        \ operations."
      operationId: "QibdoCryptoKeyService_RotateQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the crypto key to rotate."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:sign:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Sign With Crypto Key"
      description: "SignWithQibdoCryptoKey\n\n AIP-136 custom method. Signs `message`\
        \ under a SIGN_VERIFY key. `prehashed`\n = true treats `message` as a pre-computed\
        \ digest (e.g., SHA-256 of payload)."
      operationId: "QibdoCryptoKeyService_SignWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the SIGN_VERIFY crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys/{id}:verify:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Verify With Crypto Key"
      description: "VerifyWithQibdoCryptoKey\n\n AIP-136 custom method. Verifies a\
        \ signature against a message under a\n SIGN_VERIFY key. Returns valid=true\
        \ iff the signature matches."
      operationId: "QibdoCryptoKeyService_VerifyWithQibdoCryptoKey"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the crypto key belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the SIGN_VERIFY crypto key."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.VerifyWithQibdoCryptoKeyRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.VerifyWithQibdoCryptoKeyResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/cryptoKeys:generateRandomBytes:
    post:
      tags:
      - "QibdoCryptoKeyService"
      summary: "Generate Random Bytes"
      description: "GenerateRandomBytes\n\n Workspace-scoped collective custom method\
        \ (AIP-136 verb on the parent\n collection). Returns `bytes` of cryptographically\
        \ strong random material."
      operationId: "QibdoCryptoKeyService_GenerateRandomBytes"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose namespace the random material is drawn from."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateRandomBytesRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateRandomBytesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/databaseroles:
    get:
      tags:
      - "QibdoDatabaseRoleService"
      summary: "List Database Roles"
      description: "ListQibdoDatabaseRoles\n\n Returns a paginated list of database\
        \ roles within a workspace."
      operationId: "QibdoDatabaseRoleService_ListQibdoDatabaseRoles"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose roles will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of roles to return. The service may return\
          \ fewer\n than this value. If unspecified, at most 20 roles will be returned.\n\
          \ The maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoDatabaseRoles`\
          \ call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoDatabaseRolesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/databaseroles/{id}:
    get:
      tags:
      - "QibdoDatabaseRoleService"
      summary: "Get Database Role"
      description: "GetQibdoDatabaseRole\n\n Returns a database role's metadata by\
        \ ID."
      operationId: "QibdoDatabaseRoleService_GetQibdoDatabaseRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoDatabaseRoleService"
      summary: "Delete Database Role"
      description: "DeleteQibdoDatabaseRole\n\n Deletes a database role. Refused with\
        \ FAILED_PRECONDITION when any\n active lease (status ACTIVE or RENEWED) references\
        \ the role."
      operationId: "QibdoDatabaseRoleService_DeleteQibdoDatabaseRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoDatabaseRoleService"
      summary: "Update Database Role"
      description: "UpdateQibdoDatabaseRole\n\n Updates a database role's statements\
        \ and/or TTLs. Re-runs the dry-run on\n every update — even unchanged statements\
        \ get re-validated to catch\n schema drift on the target database."
      operationId: "QibdoDatabaseRoleService_UpdateQibdoDatabaseRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the role to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "Fields to update. Omit for implied mask (all populated fields).\n\
          \ Use `*` for full replacement of the mutable fields."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/databaseroles:register:
    post:
      tags:
      - "QibdoDatabaseRoleService"
      summary: "Register Database Role"
      description: "RegisterQibdoDatabaseRole\n\n Creates a new database role. The\
        \ creation + revocation statements are\n first checked against the forbidden-keyword\
        \ allowlist (`DROP TABLE`,\n `GRANT ALL`, `ALTER SYSTEM`, etc.), then dry-run\
        \ executed against the\n target database in a transaction that always rolls\
        \ back. On success\n the role is persisted and projected to the vault backend."
      operationId: "QibdoDatabaseRoleService_RegisterQibdoDatabaseRole"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the role belongs to."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoDatabaseRoleRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoDatabaseRoleResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/databases/{source_role}/credentials:
    post:
      tags:
      - "QibdoDynamicCredentialService"
      summary: "Generate Database Credential"
      description: "GenerateDatabaseQibdoCredential\n\n Generates a new ephemeral\
        \ database credential against the given the vault backend\n database role\
        \ configured for the workspace. The response embeds both the\n credential\
        \ payload (returned exactly once) and the persistent lease handle."
      operationId: "QibdoDynamicCredentialService_GenerateDatabaseQibdoCredential"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to issue the credential under."
        required: true
        schema:
          type: "string"
      - name: "source_role"
        in: "path"
        description: "Legacy: free-form the vault backend database role name to draw\
          \ the credential from.\n Pre-configured out-of-band by a vault administrator.\
          \ Kept for the\n transition window — when both `source_role` and `database_role`\
          \ are\n supplied, `database_role` wins."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDatabaseQibdoCredentialRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDatabaseQibdoCredentialResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/kubernetes/{source_role}/tokens:
    post:
      tags:
      - "QibdoDynamicCredentialService"
      summary: "Generate Kubernetes Token"
      description: "GenerateKubernetesQibdoToken\n\n Issues a short-lived workload-identity\
        \ ServiceAccount token bound to the workspace\n workload-identity engine mount\
        \ and the supplied the vault backend role. The bound\n ServiceAccount, allowed\
        \ namespaces, and audience scopes are configured\n out-of-band by a vault\
        \ administrator. Bound to a `QibdoLease`."
      operationId: "QibdoDynamicCredentialService_GenerateKubernetesQibdoToken"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to issue the workload-identity ServiceAccount\
          \ token under."
        required: true
        schema:
          type: "string"
      - name: "source_role"
        in: "path"
        description: "The pre-configured workload-identity role that binds the ServiceAccount,\
          \ allowed\n namespaces, and audience scopes."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateKubernetesQibdoTokenRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateKubernetesQibdoTokenResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/leases:
    get:
      tags:
      - "QibdoLeaseService"
      summary: "List Leases"
      description: "ListQibdoLeases\n\n Returns a paginated list of leases within\
        \ a workspace."
      operationId: "QibdoLeaseService_ListQibdoLeases"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose leases will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of leases to return. The service may return\
          \ fewer than\n this value. If unspecified, at most 20 leases will be returned.\
          \ The\n maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoLeases` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"issued_at desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoLeasesResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/leases/{id}:
    get:
      tags:
      - "QibdoLeaseService"
      summary: "Get Lease"
      description: "GetQibdoLease\n\n Returns a lease's metadata by ID."
      operationId: "QibdoLeaseService_GetQibdoLease"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the lease belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the lease to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/leases/{id}:renew:
    post:
      tags:
      - "QibdoLeaseService"
      summary: "Renew Lease"
      description: "RenewQibdoLease\n\n Extends the expiry of a lease by `extension`,\
        \ capped at the lease's max TTL.\n Cascade-renew across child leases is not\
        \ yet supported."
      operationId: "QibdoLeaseService_RenewQibdoLease"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the lease belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The lease to renew."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RenewQibdoLeaseRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/leases/{id}:revoke:
    post:
      tags:
      - "QibdoLeaseService"
      summary: "Revoke Lease"
      description: "RevokeQibdoLease\n\n Revokes a single lease early. The credential\
        \ is invalidated at the engine\n and the lease row's status transitions to\
        \ REVOKED."
      operationId: "QibdoLeaseService_RevokeQibdoLease"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the lease belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The lease to revoke."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoLeaseRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/leases:bulkRevokeByPrefix:
    post:
      tags:
      - "QibdoLeaseService"
      summary: "Bulk Revoke Leases By Prefix"
      description: "BulkRevokeQibdoLeasesByPrefix\n\n Incident-response RPC. Revokes\
        \ every active lease whose `engine_lease_id`\n begins with the given prefix\
        \ in a single call. Idempotent — a second call\n with the same prefix is a\
        \ no-op."
      operationId: "QibdoLeaseService_BulkRevokeQibdoLeasesByPrefix"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose leases are subject to bulk revocation."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.BulkRevokeQibdoLeasesByPrefixRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets:
    get:
      tags:
      - "QibdoSecretService"
      summary: "List Secrets"
      description: "ListQibdoSecrets\n\n Returns a paginated list of secrets within\
        \ a workspace."
      operationId: "QibdoSecretService_ListQibdoSecrets"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace whose secrets will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "The maximum number of secrets to return. The service may return\
          \ fewer than\n this value. If unspecified, at most 20 secrets will be returned.\
          \ The\n maximum value is 100; values above 100 will be coerced to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "A page token, received from a previous `ListQibdoSecrets` call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. \"created desc\"."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoSecretsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    post:
      tags:
      - "QibdoSecretService"
      summary: "Create Secret"
      description: "CreateQibdoSecret\n\n Creates a new secret under a workspace.\
        \ Name is unique within the workspace.\n Returns an operation describing the\
        \ create."
      operationId: "QibdoSecretService_CreateQibdoSecret"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to create the secret in."
        required: true
        schema:
          type: "string"
      - name: "location_id"
        in: "query"
        description: "Optional weak reference to a topology Location where the secret\
          \ resides.\n Defaults to the global location when omitted; immutable after\
          \ creation.\n Only the global location is available in this release."
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecret"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{id}:
    get:
      tags:
      - "QibdoSecretService"
      summary: "Get Secret"
      description: "GetQibdoSecret\n\n Returns a secret's metadata by ID."
      operationId: "QibdoSecretService_GetQibdoSecret"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the secret to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecret"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    delete:
      tags:
      - "QibdoSecretService"
      summary: "Delete Secret"
      description: "DeleteQibdoSecret\n\n Marks a secret for deletion. Its versions\
        \ are destroyed and payloads are purged from the Qibdo vault engine."
      operationId: "QibdoSecretService_DeleteQibdoSecret"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the secret to delete."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
    patch:
      tags:
      - "QibdoSecretService"
      summary: "Update Secret"
      description: "UpdateQibdoSecret\n\n Updates a secret's metadata (name, rotation\
        \ period, tags) per AIP-134 FieldMask semantics."
      operationId: "QibdoSecretService_UpdateQibdoSecret"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The unique identifier of the secret to update."
        required: true
        schema:
          type: "string"
      - name: "update_mask"
        in: "query"
        description: "AIP-134 FieldMask. Omit for implicit mask of populated fields;\
          \ `*` for full replacement."
        schema:
          type: "string"
          format: "field-mask"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecret"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{secret}/versions:
    get:
      tags:
      - "QibdoSecretVersionService"
      summary: "List Secret Versions"
      description: "ListQibdoSecretVersions\n\n Paginated metadata listing. Honours\
        \ AIP-160 `filter` (e.g. `state=\"ENABLED\"`)\n and AIP-132 `order_by` (e.g.\
        \ `version_number desc`). Payloads are never returned\n by this RPC — clients\
        \ must call GetQibdoSecretVersion for each version whose\n payload they need."
      operationId: "QibdoSecretVersionService_ListQibdoSecretVersions"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "secret"
        in: "path"
        description: "The secret whose versions will be listed."
        required: true
        schema:
          type: "string"
      - name: "page_size"
        in: "query"
        description: "Maximum number of versions to return per page. The service may\
          \ return fewer\n than this value. If unspecified, at most 20 versions will\
          \ be returned.\n The maximum value is 100; values above 100 will be coerced\
          \ to 100."
        schema:
          type: "integer"
          format: "int32"
      - name: "page_token"
        in: "query"
        description: "Opaque page token returned by a previous list call."
        schema:
          type: "string"
      - name: "filter"
        in: "query"
        description: "AIP-160 filter expression, e.g. `state=\"ENABLED\"`."
        schema:
          type: "string"
      - name: "order_by"
        in: "query"
        description: "AIP-132 order_by expression, e.g. `version_number desc`."
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoSecretVersionsResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{secret}/versions/{id}:
    get:
      tags:
      - "QibdoSecretVersionService"
      summary: "Get Secret Version"
      description: "GetQibdoSecretVersion\n\n Returns a version's metadata and payload\
        \ bytes. Clients that only need\n metadata can filter on `state` via ListQibdoSecretVersions\
        \ instead."
      operationId: "QibdoSecretVersionService_GetQibdoSecretVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "secret"
        in: "path"
        description: "The parent secret."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to retrieve."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GetQibdoSecretVersionResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{secret}/versions/{id}:destroy:
    post:
      tags:
      - "QibdoSecretVersionService"
      summary: "Destroy Secret Version"
      description: "DestroyQibdoSecretVersion\n\n AIP-136 custom method on the version.\
        \ Terminal and irreversible — the payload\n is purged from the Qibdo vault\
        \ engine."
      operationId: "QibdoSecretVersionService_DestroyQibdoSecretVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "secret"
        in: "path"
        description: "The parent secret."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to destroy (irreversible)."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DestroyQibdoSecretVersionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{secret}/versions/{id}:disable:
    post:
      tags:
      - "QibdoSecretVersionService"
      summary: "Disable Secret Version"
      description: "DisableQibdoSecretVersion\n\n AIP-136 custom method on the version.\
        \ Disabled versions are readable only\n with an explicit version id and are\
        \ excluded from latest-resolution."
      operationId: "QibdoSecretVersionService_DisableQibdoSecretVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "secret"
        in: "path"
        description: "The parent secret."
        required: true
        schema:
          type: "string"
      - name: "id"
        in: "path"
        description: "The version id (UUID) to disable."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DisableQibdoSecretVersionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/secrets/{secret}:addVersion:
    post:
      tags:
      - "QibdoSecretService"
      summary: "Add Secret Version"
      description: "AddQibdoSecretVersion\n\n AIP-136 custom method on the parent\
        \ secret. Appends a new immutable payload\n version; version-scoped reads\
        \ and lifecycle (disable/destroy) are served by\n QibdoSecretVersionService."
      operationId: "QibdoSecretService_AddQibdoSecretVersion"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace the secret belongs to."
        required: true
        schema:
          type: "string"
      - name: "secret"
        in: "path"
        description: "The parent secret to append a new version to."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AddQibdoSecretVersionRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/ssh/{source_role}/certificates:sign:
    post:
      tags:
      - "QibdoDynamicCredentialService"
      summary: "Sign SSH Certificate"
      description: "SignSshQibdoCertificate\n\n Signs a client SSH public key with\
        \ the workspace SSH CA, returning a\n short-lived OpenSSH certificate (`ssh-rsa-cert-v01@openssh.com\
        \ ...` line).\n The signed certificate plus its serial number is returned\
        \ in the response;\n a `QibdoLease` is created so the certificate can be revoked\
        \ engine-side\n before its own validity window expires."
      operationId: "QibdoDynamicCredentialService_SignSshQibdoCertificate"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to issue the SSH certificate under."
        required: true
        schema:
          type: "string"
      - name: "source_role"
        in: "path"
        description: "The pre-configured SSH role bound to the workspace SSH CA."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignSshQibdoCertificateRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignSshQibdoCertificateResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/engines/qibdo/ssh/{source_role}/otp:
    post:
      tags:
      - "QibdoDynamicCredentialService"
      summary: "Issue SSH OTP"
      description: "IssueSshQibdoOtp\n\n Issues a one-time SSH password for a username\
        \ + target IP pair. Requires the\n target host to run the the vault backend\
        \ SSH OTP helper. Bound to a `QibdoLease`."
      operationId: "QibdoDynamicCredentialService_IssueSshQibdoOtp"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace to issue the OTP under."
        required: true
        schema:
          type: "string"
      - name: "source_role"
        in: "path"
        description: "The pre-configured OTP role."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueSshQibdoOtpRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueSshQibdoOtpResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/wrapping:unwrap:
    post:
      tags:
      - "QibdoResponseWrappingService"
      summary: "Unwrap Response"
      description: "UnwrapResponse\n\n Redeems a previously-wrapped token, returning\
        \ the original payload. Single-\n shot — a second call with the same token\
        \ returns FAILED_PRECONDITION."
      operationId: "QibdoResponseWrappingService_UnwrapResponse"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace under which the token was wrapped."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.UnwrapResponseRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.UnwrapResponseResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
  /vault/v1/workspaces/{workspace}/wrapping:wrap:
    post:
      tags:
      - "QibdoResponseWrappingService"
      summary: "Wrap Response"
      description: "WrapResponse\n\n Wraps an opaque payload in the vault backend\
        \ and returns a one-time bearer token. The\n token's TTL is set by the caller\
        \ (max 24h enforced engine-side per the vault backend\n defaults). The original\
        \ payload never crosses back to the caller — only the\n consumer that redeems\
        \ the token sees it again."
      operationId: "QibdoResponseWrappingService_WrapResponse"
      parameters:
      - name: "workspace"
        in: "path"
        description: "The workspace under which the payload is wrapped."
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.WrapResponseRequest"
        required: true
      responses:
        "200":
          description: "OK"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.WrapResponseResponse"
        default:
          description: "Default error response"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/google.rpc.Status"
components:
  schemas:
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize:
      required:
      - "size"
      - "unit"
      type: "object"
      properties:
        size:
          type: "number"
          description: "Size of the object\n\n Is the numerical size of an object"
          format: "double"
        unit:
          enum:
          - "DATA_UNIT_UNSPECIFIED"
          - "BYTES"
          - "KIB"
          - "MIB"
          - "GIB"
          - "TIB"
          - "PIB"
          - "EIB"
          - "KB"
          - "MB"
          - "GB"
          - "TB"
          - "PB"
          - "EB"
          type: "string"
          format: "enum"
      description: "Compute Data Size\n\n Represents the computational size of an\
        \ object in different information units."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate:
      type: "object"
      properties:
        value:
          type: "number"
          format: "double"
        unit:
          enum:
          - "DATA_TRANSFER_RATE_UNIT_UNSPECIFIED"
          - "BPS"
          - "KBPS"
          - "MBPS"
          - "GBPS"
          - "BYTES_PER_SEC"
          - "KBYTES_PER_SEC"
          - "MBYTES_PER_SEC"
          - "GBYTES_PER_SEC"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier for this operation."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n The ID of the resource affected by this operation.\
            \ May be empty for\n async operations where the resource does not yet\
            \ exist."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n The type of resource (e.g., \"VirtualMachine\"\
            )."
        operation_type:
          readOnly: true
          enum:
          - "COMPUTE_OPERATION_TYPE_UNSPECIFIED"
          - "COMPUTE_OPERATION_TYPE_CREATE"
          - "COMPUTE_OPERATION_TYPE_UPDATE"
          - "COMPUTE_OPERATION_TYPE_DELETE"
          - "COMPUTE_OPERATION_TYPE_START"
          - "COMPUTE_OPERATION_TYPE_STOP"
          - "COMPUTE_OPERATION_TYPE_RESTART"
          - "COMPUTE_OPERATION_TYPE_SUSPEND"
          - "COMPUTE_OPERATION_TYPE_RESUME"
          - "COMPUTE_OPERATION_TYPE_RESET"
          - "COMPUTE_OPERATION_TYPE_SCHEDULE"
          type: "string"
          description: "Operation Type\n\n The kind of mutation that was requested."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "COMPUTE_OPERATION_STATUS_UNSPECIFIED"
          - "COMPUTE_OPERATION_STATUS_PENDING"
          - "COMPUTE_OPERATION_STATUS_RUNNING"
          - "COMPUTE_OPERATION_STATUS_DONE"
          - "COMPUTE_OPERATION_STATUS_ERROR"
          type: "string"
          description: "Status\n\n Current lifecycle state of the operation."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was first created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When the operation started executing."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When the operation completed (either successfully\
            \ or with errors)."
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperationError"
          description: "Errors\n\n Business rule errors encountered during the operation."
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperationWarning"
          description: "Warnings\n\n Non-fatal notices about the operation."
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Percentage of completion (0-100)."
          format: "int32"
      description: "Compute Operation\n\n An acknowledgment of a mutation request,\
        \ carrying tracking metadata,\n errors, and warnings. Follows GCP's Operations\
        \ pattern (AIP-151)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperationError:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Error Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the error."
      description: "Operation Error\n\n A structured error returned inside an operation\
        \ when a business rule fails."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperationWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the warning."
      description: "Operation Warning\n\n A non-fatal notice attached to an operation."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOps:
      type: "object"
      properties:
        value:
          type: "number"
          format: "double"
        unit:
          enum:
          - "DURATION_UNIT_UNSPECIFIED"
          - "NANOSECONDS"
          - "MICROSECONDS"
          - "MILLISECONDS"
          - "SECONDS"
          - "MINUTES"
          - "HOURS"
          - "DAYS"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.AcpiFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.ApicFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cipher:
      type: "object"
      properties:
        algorithm:
          enum:
          - "ENCRYPTION_ALGORITHM_UNSPECIFIED"
          - "AES"
          - "DES"
          - "CAST5"
          - "SERPENT"
          - "TWOFISH"
          type: "string"
          format: "enum"
        size:
          enum:
          - "CIPHER_WORD_SIZE_UNSPECIFIED"
          - "BITS_128"
          - "BITS_192"
          - "BITS_256"
          - "BITS_512"
          type: "string"
          format: "enum"
        mode:
          enum:
          - "CIPHER_MODE_UNSPECIFIED"
          - "CBC"
          - "XTS"
          - "ECB"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Clock:
      type: "object"
      properties:
        offset:
          enum:
          - "OFFSET_UNSPECIFIED"
          - "UTC"
          - "LOCALTIME"
          type: "string"
          description: "Clock offset basis relative to the host clock."
          format: "enum"
        timers:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Clock_Timer"
          description: "Named timer configurations for the guest."
      description: "Clock configuration for a virtual machine.\n\n Defines the clock\
        \ offset basis and timer configuration for the guest."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Clock_Timer:
      type: "object"
      properties:
        name:
          enum:
          - "TIMER_NAME_UNSPECIFIED"
          - "HPET"
          - "PIT"
          - "RTC"
          - "HYPERV"
          - "KVM"
          type: "string"
          description: "Timer hardware name."
          format: "enum"
        is_present:
          type: "boolean"
          description: "Whether this timer is present (enabled) in the guest."
        tick_policy:
          enum:
          - "TICK_POLICY_UNSPECIFIED"
          - "DELAY"
          - "CATCHUP"
          - "MERGE"
          - "DISCARD"
          type: "string"
          description: "Tick policy when the guest falls behind the host clock."
          format: "enum"
        track:
          enum:
          - "TRACK_UNSPECIFIED"
          - "BOOT"
          - "GUEST"
          - "WALL"
          - "REALTIME"
          type: "string"
          description: "Clock track source (RTC-specific)."
          format: "enum"
      description: "A named timer with presence and tick policy configuration."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces:
      type: "object"
      properties:
        console:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces_CommunicationInterface"
        serial:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces_CommunicationInterface"
        debug:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces_DebugInterface"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces_CommunicationInterface:
      type: "object"
      properties:
        file:
          type: "string"
        socket:
          type: "string"
        mode:
          enum:
          - "INTERFACE_MODE__UNSPECIFIED"
          - false
          - "PTY"
          - "TTY"
          type: "string"
          format: "enum"
        is_iommu_enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces_DebugInterface:
      type: "object"
      properties:
        file:
          type: "string"
        mode:
          enum:
          - "INTERFACE_MODE__UNSPECIFIED"
          - false
          - "PTY"
          - "TTY"
          type: "string"
          format: "enum"
        io_base:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu:
      type: "object"
      properties:
        v_cpus_boot:
          type: "integer"
          description: "Number of vCPUs present at boot time.\n\n This is the number\
            \ of virtual CPUs (vCPUs) that will be present in the virtual machine\
            \ when it boots."
          format: "uint32"
        v_cpus_max:
          type: "integer"
          description: "Maximum number of vCPUs.\n\n This option defines the maximum\
            \ number of vCPUs that can be assigned to the VM.\n In particular, this\
            \ option is used when looking for CPU hotplug as it lets the provide an\
            \ indication\n about how many vCPUs might be needed later during the runtime\
            \ of the VM.\n\n For instance, if booting the VM with 2 vCPUs and a maximum\
            \ of 6 vCPUs, it means up to 4 vCPUs can be added\n later at runtime by\
            \ resizing the VM.\n\n The value must be greater than or equal to the\
            \ number of boot vCPUs"
          format: "uint32"
        topology:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Topology"
          description: "Topology\n\n CPU topology refers to the physical organization\
            \ of central processing units (CPUs) within a system,\n including the\
            \ number of sockets, cores, and threads. This information is essential\n\
            \ for optimizing virtualization, workload distribution, and performance\
            \ tuning."
        affinity:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_ProcessorAffinity"
          description: "Affinity\n\n List of Processor affinity, or CPU pinning or\
            \ \"cache affinity\", enables the binding and unbinding of a process or\
            \ a\n thread to a central processing unit (CPU) or a range of CPUs, so\
            \ that the process or thread will execute\n only on the designated CPU\
            \ or CPUs rather than any CPU.\n It is useful for achieving CPU pinning,\
            \ ensuring multiple VMs won't affect the performance of each other.\n\
            \ It might also be used in the context of NUMA as it is way of making\
            \ sure the VM can run on a specific host\n NUMA node. In general, this\
            \ option is used to increase the performances of a VM depending on the\
            \ host platform\n and the type of workload running in the guest"
        features:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Feature"
          description: "Features\n\n A list of Features used to fine-tune features\
            \ provided by the selected CPU model.\n The list of known feature names\
            \ can be found in the same file as CPU models.\n The meaning of each feature\
            \ element depends on its policy attribute."
        maximum_number_physical_bits:
          type: "integer"
          description: "Maximum number of physical bits.\n\n Maximum size for guest's\
            \ addressable space.\n This option defines the maximum number of physical\
            \ bits for all vCPUs, which sets a limit for the size of\n the guest's\
            \ addressable space. This is mainly useful for debug purpose."
          format: "uint32"
        emulation:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_CpuEmulation"
      description: "Cpu\n\n CPU configuration for a virtual machine."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_CpuEmulation:
      type: "object"
      properties:
        mode:
          enum:
          - "MODE_UNSPECIFIED"
          - "CUSTOM"
          - "HOST_MODEL"
          - "HOST_PASSTHROUGH"
          - "MAXIMUM"
          type: "string"
          format: "enum"
        models:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Model"
        vendor:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Vendor"
        architecture:
          enum:
          - "CPU_ARCHITECTURE_UNSPECIFIED"
          - "X86_64"
          - "X86"
          - "PPC64"
          - "ARM64"
          type: "string"
          format: "enum"
      description: "CPU Emulation\n\n Emulation properties for a CPU. It defines properties\
        \ like the model, vendor, etc"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Feature:
      type: "object"
      properties:
        name:
          type: "string"
          description: "Name of the feature\n\n The name of the feature is a string\
            \ that represents the feature that is being enabled or disabled."
        policy:
          enum:
          - "FEATURE_POLICY_UNSPECIFIED"
          - "FORCE"
          - "REQUIRE"
          - "OPTIONAL"
          - "DISABLE"
          - "FORBID"
          type: "string"
          format: "enum"
      description: "Feature\n\n A Feature is used to fine-tune features provided by\
        \ the selected CPU model.\n The list of known feature names can be found in\
        \ the same file as CPU models.\n The meaning of each feature element depends\
        \ on its policy attribute."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Model:
      type: "object"
      properties:
        id:
          type: "string"
      description: "Cpu Emulation Model\n\n Specifies CPU model requested by the guest."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_ProcessorAffinity:
      type: "object"
      properties:
        v_cpu:
          type: "integer"
          description: "Virtual CPU number"
          format: "uint32"
        host_cpus:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
          description: "The physical CPU numbers"
      description: "Processor Affinity\n\n Processor affinity, or CPU pinning or \"\
        cache affinity\".\n It enables the binding and unbinding of a process or a\
        \ thread to a central processing unit (CPU) or a range of CPUs,\n so that\
        \ the process or thread will execute only on the designated CPU or CPUs rather\
        \ than any CPU.\n It is useful for achieving CPU pinning, ensuring multiple\
        \ VMs won't affect the performance of each other.\n It might also be used\
        \ in the context of NUMA as it is way of making sure the VM can run on a specific\
        \ host NUMA node.\n In general, this option is used to increase the performances\
        \ of a VM depending on the host platform and the type of workload running\
        \ in the guest"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Topology:
      type: "object"
      properties:
        threads_per_core:
          type: "integer"
          description: "Number of threads per core.\n\n A CPU core can support multiple\
            \ threads of execution, depending on its capabilities.\n This attribute\
            \ refers to how many threads each core can handle simultaneously,\n commonly\
            \ known as \"simultaneous multithreading\" (SMT).\n For example, a core\
            \ with threadsPerCore set to 2 would be able to handle two threads at\
            \ once,\n essentially doubling the performance of the core in certain\
            \ multi-threaded workloads."
          format: "uint32"
        cores_per_die:
          type: "integer"
          description: "Number of cores per die.\n\n A CPU die is a single piece of\
            \ silicon that contains the CPU's processing units (cores).\n The coresPerDie\
            \ represents how many cores are physically present on a single die within\
            \ the CPU.\n\n Typically, a CPU die will have several cores, and each\
            \ core might handle multiple threads (depending on the threadsPerCore\
            \ value)."
          format: "uint32"
        dies_per_socket:
          type: "integer"
          description: "Number of dies per socket.\n\n A CPU socket is the physical\
            \ interface that connects a processor to the motherboard, typically containing\
            \ one or more CPU dies.\n The diesPerSocket attribute represents how many\
            \ CPU dies are available in each socket.\n Some high-end server CPUs may\
            \ have multiple dies in a single socket, each with its own set of cores.\n\
            \ The Virtual Machine Manager (VMM) may refer to this as \"diesPerPackage,\"\
            \ as a \"package\" is often used to refer to\n a single CPU or socket\
            \ that includes multiple dies."
          format: "uint32"
        sockets:
          type: "integer"
          description: "Number of CPU sockets."
          format: "uint32"
      description: "Topology\n\n CPU topology refers to the physical organization\
        \ of central processing units (CPUs) within a system,\n including the number\
        \ of sockets, cores, and threads. This information is essential\n for optimizing\
        \ virtualization, workload distribution, and performance tuning."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu_Vendor:
      type: "object"
      properties:
        id:
          type: "string"
      description: "CPU Vendor\n\n Specifies CPU vendor requested by the guest. e.g.\
        \ Intel"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskDeviceBlock:
      type: "object"
      properties:
        device_prefix:
          type: "string"
        device_type:
          enum:
          - "DISK_BLOCK_DEVICE_UNSPECIFIED"
          - "SD"
          - "VD"
          - "NVME"
          - "HD"
          - "MD"
          - "LOOP"
          - "RAM"
          - "MMCBLK"
          - "UBD"
          - "SR"
          type: "string"
          format: "enum"
        block:
          type: "string"
        partition:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathBlock:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathDirectory:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathFile:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathNetwork:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
        protocol:
          enum:
          - "NETWORK_PROTOCOL_UNSPECIFIED"
          - "NBD"
          - "ISCSI"
          - "RBD"
          - "SHEEPDOG"
          - "GLUSTER"
          - "VXHS"
          - "HTTP"
          - "HTTPS"
          - "FTP"
          - "FTPS"
          - "TFTP"
          - "SSH"
          type: "string"
          format: "enum"
        volume_id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathNvme:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
        address_type:
          enum:
          - "ADDRESS_TYPE_UNSPECIFIED"
          - "PCI"
          type: "string"
          format: "enum"
        is_managed:
          type: "boolean"
        namespace:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathVHostUser:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
        char_device_type:
          enum:
          - "CHAR_DEVICE_TYPE_UNSPECIFIED"
          - "UNIX"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathVolume:
      type: "object"
      properties:
        host_id:
          type: "string"
        path:
          type: "string"
        pool:
          type: "string"
        storage_volume:
          type: "string"
        mode:
          enum:
          - "MODE_UNSPECIFIED"
          - "HOST"
          - "DIRECT"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter:
      type: "object"
      properties:
        bandwidth:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter_DiskBandwidthRate"
        operations:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter_DiskOperationsRate"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter_DiskBandwidthRate:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        one_time_burst:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        refill_time:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
      description: "Bandwidth Rate for Disk"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter_DiskOperationsRate:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOps"
        one_time_burst:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOps"
        refill_time:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
      description: "Operations Rate for Disk"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Encryption:
      type: "object"
      properties:
        format:
          enum:
          - "ENCRYPTION_FORMAT_UNSPECIFIED"
          - "LUKS"
          - "LUKS2"
          type: "string"
          format: "enum"
        secret:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Secret"
        cipher:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cipher"
        iv:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.InitializationVector"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.GicFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        version:
          type: "integer"
          format: "int32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HapFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HugePage:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        nodes:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        relaxed_timers_enabled:
          type: "boolean"
        virtual_apic_enabled:
          type: "boolean"
        vpindex_enabled:
          type: "boolean"
        runtime_enabled:
          type: "boolean"
        synic_enabled:
          type: "boolean"
        reset_enabled:
          type: "boolean"
        vendor_id:
          type: "string"
        frequencies_enabled:
          type: "boolean"
        reenlightenment_enabled:
          type: "boolean"
        ipi_enabled:
          type: "boolean"
        evmcs_enabled:
          type: "boolean"
        avic_enabled:
          type: "boolean"
        emsr_bitmap_enabled:
          type: "boolean"
        xmm_input_enabled:
          type: "boolean"
        spinlocks:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Spinlocks"
        stimer:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Stimer"
        tlbflush:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Tlbflush"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Spinlocks:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        retries:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Stimer:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        direct_enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature_Tlbflush:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        direct:
          type: "boolean"
        extended:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervisorFeatures:
      type: "object"
      properties:
        pae:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PaeFeature"
        acpi:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.AcpiFeature"
        apic:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.ApicFeature"
        hap:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HapFeature"
        gic:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.GicFeature"
        hyperv:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervFeature"
        kvm:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.KvmFeature"
        xen:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.XenFeature"
        viridian:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.ViridianFeature"
        privnet:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PrivnetFeature"
        pvspinlock:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PvSpinLockFeature"
        pmu:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PmuFeature"
        vmport:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VmportFeature"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.InitializationVector:
      type: "object"
      properties:
        name:
          type: "string"
        hash:
          enum:
          - "HASH_ALGORITHM_UNSPECIFIED"
          - "MD5"
          - "SHA1"
          - "SHA256"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.KvmFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        hidden:
          type: "boolean"
        hint_dedicated:
          type: "boolean"
        poll_control_enabled:
          type: "boolean"
        paravirtualized_ipis_enabled:
          type: "boolean"
        dirty_ring:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.KvmFeature_DirtyRing"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.KvmFeature_DirtyRing:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        name:
          type: "string"
        description:
          type: "string"
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        vm_id:
          type: "string"
        source_id:
          type: "string"
        zone_id:
          readOnly: true
          type: "string"
        status:
          readOnly: true
          enum:
          - "DISK_STATUS_UNSPECIFIED"
          - "SCHEDULING"
          - "CREATING"
          - "UNATTACHED"
          - "ATTACHED"
          - "UPDATING"
          - "DELETING"
          - "FAILED"
          type: "string"
          format: "enum"
        device_id:
          type: "string"
        init_config:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk_InitConfig"
        qemu_driver:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QemuDiskDriver"
        path_file:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathFile"
        path_block:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathBlock"
        path_directory:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathDirectory"
        path_network:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathNetwork"
        path_volume:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathVolume"
        path_nvme:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathNvme"
        path_v_host_user:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskPathVHostUser"
        mount_path:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MountPath"
        is_read_only:
          type: "boolean"
        is_shareable:
          type: "boolean"
        is_direct:
          type: "boolean"
        has_iommu:
          type: "boolean"
        number_of_queues:
          type: "integer"
          format: "uint32"
        queue_size:
          type: "integer"
          format: "uint32"
        has_v_host_user:
          type: "boolean"
        v_host_socket:
          type: "string"
        rate_limiter:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskRateLimiter"
        pci_segment_id:
          type: "integer"
          format: "uint32"
        serial:
          type: "string"
        rate_limit_groupId:
          type: "string"
        queue_affinity:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QueueAffinity"
        encryption:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Encryption"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n Timestamp when the disk was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the disk was last updated"
          format: "date-time"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk_CloudInit:
      type: "object"
      properties:
        config:
          type: "string"
        template_id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk_InitConfig:
      type: "object"
      properties:
        cloud_init:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk_CloudInit"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MaxMemorySize:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        slots:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Memory:
      required:
      - "size"
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        access_mode:
          enum:
          - "MEMORY_ACCESS_MODE_UNSPECIFIED"
          - "SHARED"
          - "PRIVATE"
          type: "string"
          format: "enum"
        huge_pages:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HugePage"
        is_prefault:
          type: "boolean"
        is_mergeable:
          type: "boolean"
        uses_transparent_huge_pages:
          type: "boolean"
        zones:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MemoryZone"
        is_discardable:
          type: "boolean"
        memory_backing:
          enum:
          - "MEMORY_BACKING_UNSPECIFIED"
          - "FILE"
          - "ANONYMOUS"
          - "MEMFD"
          type: "string"
          format: "enum"
        allocation:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MemoryAllocation"
        max_size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MaxMemorySize"
      description: "Memory\n\n Memory configuration for a qibdo Virtual Machine.\n\
        \ It indicates the amount of memory that the VM will have, the access mode,\
        \ the usage or not of huge pages,\n the memory zones, the memory backing,\
        \ among other properties."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MemoryAllocation:
      type: "object"
      properties:
        mode:
          enum:
          - "ALLOCATION_MODE_UNSPECIFIED"
          - "IMMEDIATE"
          - "ON_DEMAND"
          type: "string"
          format: "enum"
        threads:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MemoryZone:
      type: "object"
      properties:
        id:
          type: "string"
        file:
          type: "string"
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        access_mode:
          enum:
          - "MEMORY_ACCESS_MODE_UNSPECIFIED"
          - "SHARED"
          - "PRIVATE"
          type: "string"
          format: "enum"
        huge_pages:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HugePage"
        is_prefault:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.MountPath:
      type: "object"
      properties:
        block:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.DiskDeviceBlock"
        bus:
          enum:
          - "BUS_UNSPECIFIED"
          - "VIRTIO"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkIO_NetworkBandwidth:
      type: "object"
      properties:
        average:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        peak:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        burst:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        floor:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface:
      type: "object"
      properties:
        mac_address:
          type: "string"
        network_io:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_NetworkIO"
        nic:
          enum:
          - "INTERFACE_CARD_UNSPECIFIED"
          - "VIRTIO"
          - "E1000"
          - "RTL8139"
          - "NE2000"
          - "VMX"
          - "I82551"
          - "I82557B"
          - "I825579A"
          - "PCNET"
          type: "string"
          format: "enum"
        mount_path:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_NetworkMountPath"
        openv_switch:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_OpenvSwitchPort"
        mido_net:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_MidoNetPort"
        ieee_port:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeePort"
        virtual_network_interface:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_VirtualNetworkInterface"
        bridge_interface:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_BridgeInterface"
        userspace_interface:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_UserspaceInterface"
        ethernet_interface:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_EthernetInterface"
        direct_physical_interface:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_DirectPhysicalInterface"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_BridgeInterface:
      type: "object"
      properties:
        bridge:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_DirectPhysicalInterface:
      type: "object"
      properties:
        mode:
          enum:
          - "DIRECT_PHYSICAL_INTERFACE_MODE_UNSPECIFIED"
          - "VEPA"
          - "BRIDGE"
          - "PRIVATE"
          - "PASS_THROUGH"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_EthernetInterface:
      type: "object"
      properties: {}
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeeBhPort:
      type: "object"
      properties:
        profile_id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeeBqPort:
      type: "object"
      properties: {}
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeePort:
      type: "object"
      properties:
        manager_id:
          type: "integer"
          format: "uint32"
        type_id:
          type: "integer"
          format: "uint32"
        type_id_version:
          type: "integer"
          format: "uint32"
        instance_id:
          type: "string"
        ieee_bq_port:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeeBqPort"
        ieee_bh_port:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_IeeeBhPort"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_MidoNetPort:
      type: "object"
      properties:
        interface_id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_NetworkIO:
      type: "object"
      properties:
        inbound:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkIO_NetworkBandwidth"
        outbound:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkIO_NetworkBandwidth"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_NetworkMountPath:
      type: "object"
      properties:
        block:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkMountPath_NetworkInterfaceDeviceBlock"
        bus:
          enum:
          - "BUS_UNSPECIFIED"
          - "VIRTIO"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_OpenvSwitchPort:
      type: "object"
      properties:
        interface_id:
          type: "string"
        profile_id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_UserspaceInterface:
      type: "object"
      properties:
        ipv4_addresses:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.UserspaceInterface_IpAddress"
        ipv6_addresses:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.UserspaceInterface_IpAddress"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface_VirtualNetworkInterface:
      type: "object"
      properties:
        network_name:
          type: "string"
        port_group:
          type: "string"
        subnet_id:
          type: "string"
          description: "The subnet this interface attaches to. When set, the platform\
            \ allocates a network port on\n that subnet at create time and assigns\
            \ the interface's address and MAC automatically."
        allocated_port_id:
          type: "string"
          description: "The allocated network port identifier. Server-assigned when\
            \ subnet_id is set; the port is\n released when the virtual machine is\
            \ deleted."
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkMountPath_NetworkInterfaceDeviceBlock:
      type: "object"
      properties:
        device_type:
          enum:
          - "BLOCK_DEVICE_TYPE_UNSPECIFIED"
          - "VNET"
          - "ETH"
          - "ENS"
          - "BR"
          - "TAP"
          - "VIRBR"
          - "BOND"
          - "VXLAN"
          - "VETH"
          type: "string"
          format: "enum"
        number:
          type: "integer"
          format: "uint32"
        device_prefix:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Numa:
      type: "object"
      properties:
        mode:
          enum:
          - "NUMA_MODE_UNSPECIFIED"
          - "INTERLEAVE"
          - "STRICT"
          - "PREFERRED"
          - "RESTRICTIVE"
          type: "string"
          format: "enum"
        nodes:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode:
      required:
      - "memory_size"
      type: "object"
      properties:
        guest_numa_id:
          type: "integer"
          format: "uint32"
        cpus:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
        distances:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaDistance"
        memory_zones:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaMemoryZone"
        sgx_epc_sections:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaSgxEpcSection"
        pci_segments:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
        memory_size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataSize"
        access_mode:
          enum:
          - "MEMORY_ACCESS_MODE_UNSPECIFIED"
          - "SHARED"
          - "PRIVATE"
          type: "string"
          format: "enum"
        numa_hosts:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
        mode:
          enum:
          - "NUMA_MODE_UNSPECIFIED"
          - "INTERLEAVE"
          - "STRICT"
          - "PREFERRED"
          - "RESTRICTIVE"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaDistance:
      type: "object"
      properties:
        destination_numa_id:
          type: "integer"
          format: "uint32"
        distance:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaMemoryZone:
      type: "object"
      properties:
        id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NumaNode_NumaSgxEpcSection:
      type: "object"
      properties:
        id:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os:
      type: "object"
      properties:
        type:
          enum:
          - "OS_TYPE_UNSPECIFIED"
          - "XEN"
          - "XEN_PVH"
          - "HVM"
          - "EXE"
          type: "string"
          format: "enum"
        kernel:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Kernel"
        firmware:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Firmware"
        initrd:
          type: "string"
        cmdline:
          type: "string"
        boot_devices:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Boot"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Boot:
      type: "object"
      properties:
        device:
          enum:
          - "DEVICE_UNSPECIFIED"
          - "NETWORK"
          - "CD_ROM"
          - "FD"
          - "HD"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Firmware:
      type: "object"
      properties:
        type:
          enum:
          - "STANDARD_TYPE_UNSPECIFIED"
          - "BIOS"
          - "EFI"
          type: "string"
          format: "enum"
        path:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os_Kernel:
      type: "object"
      properties:
        path:
          type: "string"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PaeFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PmuFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PrivnetFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.PvSpinLockFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QemuDiskDriver:
      type: "object"
      properties:
        type:
          enum:
          - "QEMU_TYPE_UNSPECIFIED"
          - "RAW"
          - "BOCHS"
          - "QCOW2"
          - "QED"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QibdoVirtualMachine:
      required:
      - "name"
      - "hypervisor"
      - "cpu"
      - "memory"
      - "disks"
      - "os"
      - "interfaces"
      - "network"
      - "resource_pool_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique Identifier\n\n Global unique identifier for the virtual\
            \ machine. This a String that uses the UUID format."
        gen_id:
          readOnly: true
          type: "string"
          description: "Generation Identifier\n\n Virtual Machine Generation ID that\
            \ is used to help notify the guest operating system when the virtual machine\n\
            \ is re-executing something that has already executed before."
        name:
          type: "string"
          description: "Name\n\n Name/title of the virtual machine (RFC 1035 DNS label,\
            \ max 62 chars)"
        description:
          type: "string"
          description: "Description\n\n Optional description of the virtual machine"
        hypervisor:
          enum:
          - "HYPERVISOR_UNSPECIFIED"
          - "KVM"
          - "MSHV"
          - "HVF"
          type: "string"
          format: "enum"
        vmm:
          enum:
          - "VMM_UNSPECIFIED"
          - "CH"
          - "QEMU"
          - "AWS"
          - "GCP"
          - "AZURE"
          - "KUBE_VIRT"
          type: "string"
          format: "enum"
        location_id:
          type: "string"
          description: "Location Id\n\n On create, the placement intent: a ZONE (pins)\
            \ or REGION (collapses to one active zone) location\n reference. On read,\
            \ the concrete zone the VM was placed in. GLOBAL and MULTI_REGION are\
            \ rejected."
        workspace_id:
          readOnly: true
          type: "string"
          description: "Workspace Id\n\n Unique identifier of the workspace that the\
            \ virtual machine belongs to"
        status:
          readOnly: true
          enum:
          - "QIBDO_VM_STATUS_UNSPECIFIED"
          - "QIBDO_VM_STATUS_SCHEDULING"
          - "QIBDO_VM_STATUS_CREATING"
          - "QIBDO_VM_STATUS_STARTING"
          - "QIBDO_VM_STATUS_RUNNING"
          - "QIBDO_VM_STATUS_STOPPING"
          - "QIBDO_VM_STATUS_STOPPED"
          - "QIBDO_VM_STATUS_REPAIRING"
          - "QIBDO_VM_STATUS_SUSPENDING"
          - "QIBDO_VM_STATUS_SUSPENDED"
          - "QIBDO_VM_STATUS_DELETING"
          - "QIBDO_VM_STATUS_DELETED"
          - "QIBDO_VM_STATUS_RESTARTING"
          - "QIBDO_VM_STATUS_RESUMING"
          - "QIBDO_VM_STATUS_RESETTING"
          type: "string"
          format: "enum"
        cpu:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Cpu"
        memory:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Memory"
        disks:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.LocalDisk"
        numa:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Numa"
        os:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Os"
        rate_limit_group:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiterGroup"
        interfaces:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.CommunicationInterfaces"
        features:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.HypervisorFeatures"
        network:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.NetworkInterface"
        deployment_target_id:
          readOnly: true
          type: "string"
          description: "Deployment Target Id\n\n Unique identifier of the physical\
            \ host where the virtual machine is running"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n Timestamp when the virtual machine was\
            \ created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the virtual machine was\
            \ last updated"
          format: "date-time"
        clock:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Clock"
          description: "Clock Configuration\n\n Clock offset basis and timer configuration\
            \ for the guest"
        restart_policy:
          enum:
          - "RESTART_POLICY_UNSPECIFIED"
          - "RESTART_POLICY_ALWAYS"
          - "RESTART_POLICY_ON_FAILURE"
          - "RESTART_POLICY_MANUAL"
          - "RESTART_POLICY_NEVER"
          type: "string"
          description: "Restart Policy\n\n Defines what the system should do when\
            \ the VM stops: always restart, restart on failure only, manual control,\
            \ or never restart"
          format: "enum"
        resource_pool_id:
          type: "string"
          description: "Resource Pool Id\n\n The ResourcePool this VM is placed into,\
            \ either named explicitly by the caller or\n auto-resolved from the VM's\
            \ domain spec. Always populated after create."
        cloud_init_extension:
          writeOnly: true
          type: "string"
          description: "Cloud-init Extension\n\n Optional caller-supplied cloud-init\
            \ YAML, merged on top of the platform baseline at VM\n creation time.\
            \ Transient — not persisted on the aggregate; size-bounded;\n YAML-validated\
            \ server-side before CRD submission. Responses MUST NOT echo this\n back\
            \ because secrets may be present."
        eviction_strategy:
          enum:
          - "EVICTION_STRATEGY_UNSPECIFIED"
          - "LIVE_MIGRATE_IF_POSSIBLE"
          - "LIVE_MIGRATE"
          - "EXTERNAL"
          - "NONE"
          type: "string"
          description: "Eviction Strategy\n\n User intent when the VM's host enters\
            \ maintenance. Maps to the virtualization host's\n eviction strategy.\
            \ Mutating via Update changes future eviction behaviour only —\n it never\
            \ triggers a live migration of a running VM. Unspecified on Create is\
            \ read by\n the server as LIVE_MIGRATE_IF_POSSIBLE."
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QueueAffinity:
      type: "object"
      properties:
        queue_index:
          type: "integer"
          format: "uint32"
        host_cpus:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.Secret:
      type: "object"
      properties:
        id:
          type: "string"
        vault_id:
          type: "string"
        type:
          enum:
          - "SECRET_TYPE_UNSPECIFIED"
          - "PASSPHRASE"
          - "TLS"
          - "CEPH"
          - "ISCSI"
          - "RBD"
          - "VOLUME"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.UserspaceInterface_IpAddress:
      type: "object"
      properties:
        address:
          type: "string"
        prefix:
          type: "integer"
          format: "uint32"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.ViridianFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter:
      type: "object"
      properties:
        bandwidth:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter_VirtualMachineBandwidthRate"
          description: "The bandwidth rate limiter"
        operations:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter_VirtualMachineOperationsRate"
          description: "The operations rate limiter"
      description: "Represents a rate limiter for a virtual machine"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiterGroup:
      type: "object"
      properties:
        id:
          type: "string"
          description: "The unique ID of the rate limiter group"
        group_id:
          type: "string"
          description: "The group identifier"
        rate_limiter:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter"
          description: "The associated virtual machine rate limiter"
      description: "Represents a rate limiter group for virtual machines"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter_VirtualMachineBandwidthRate:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        one_time_burst:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeDataTransferRate"
        refill_time:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
      description: "Represents bandwidth-related rate-limiting for a virtual machine"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VirtualMachineRateLimiter_VirtualMachineOperationsRate:
      type: "object"
      properties:
        size:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOps"
        one_time_burst:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOps"
        refill_time:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
      description: "Represents operations-related rate-limiting for a virtual machine"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.VmportFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.XenFeature:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        e820_host_enabled:
          type: "boolean"
        passthrough:
          $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.XenFeature_Passthrough"
    com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.XenFeature_Passthrough:
      type: "object"
      properties:
        enabled:
          type: "boolean"
        mode:
          enum:
          - "MODE_UNSPECIFIED"
          - "SYNC_PT"
          - "SHARE_PT"
          type: "string"
          format: "enum"
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.ListComputeOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.ComputeOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListComputeOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ListQibdoVirtualMachineResponse:
      type: "object"
      properties:
        vms:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.compute.infrastructure.integration.v1.schema.qibdo.QibdoVirtualMachine"
          description: "List of the virtual machines from the specified workspace\
            \ and zone."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListQibdoVirtualMachineResponse\n\n Response message for ListQibdoVirtualMachine.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ResetQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "ResetQibdoVirtualMachineRequest\n\n Request message for ResetQibdoVirtualMachine.\
        \ Identifies the VM to reset by\n its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.RestartQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "RestartQibdoVirtualMachineRequest\n\n Request message for RestartQibdoVirtualMachine.\
        \ Identifies the VM to restart\n by its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.ResumeQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "ResumeQibdoVirtualMachineRequest\n\n Request message for ResumeQibdoVirtualMachine.\
        \ Identifies the VM to resume\n by its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.StartQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "StartQibdoVirtualMachineRequest\n\n Request message for StartQibdoVirtualMachine.\
        \ Identifies the VM to start by\n its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.StopQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "StopQibdoVirtualMachineRequest\n\n Request message for StopQibdoVirtualMachine.\
        \ Identifies the VM to stop by\n its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.compute.infrastructure.integration.v1.service.vm.qibdo.SuspendQibdoVirtualMachineRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the virtual machine\
            \ belongs to"
        id:
          type: "string"
          description: "The unique identifier of the virtual machine to retrieve"
      description: "SuspendQibdoVirtualMachineRequest\n\n Request message for SuspendQibdoVirtualMachine.\
        \ Identifies the VM to suspend\n by its unique ID under the parent (workspace,\
        \ zone)."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Condition:
      type: "object"
      properties:
        source_ip:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.SourceIpCondition"
          description: "Source IP address condition"
        time_window:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.TimeWindowCondition"
          description: "Time window condition"
        role:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.RoleCondition"
          description: "Role delegation condition"
        location:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.LocationCondition"
          description: "Location condition"
      description: "Condition — a polymorphic condition within a policy"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.EffectiveRole:
      type: "object"
      properties:
        role_id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the role."
        role_name:
          readOnly: true
          type: "string"
          description: "The human-readable name of the role."
        origin:
          readOnly: true
          enum:
          - "ROLE_ORIGIN_UNSPECIFIED"
          - "ROLE_ORIGIN_DIRECT"
          - "ROLE_ORIGIN_INHERITED"
          type: "string"
          description: "Whether the role is direct or inherited."
          format: "enum"
        origin_scope_type:
          readOnly: true
          type: "string"
          description: "The scope type the role was inherited from; empty when origin\
            \ is DIRECT."
        origin_scope_id:
          readOnly: true
          type: "string"
          description: "The scope id the role was inherited from; empty when origin\
            \ is DIRECT."
      description: "A single effective role a principal holds at a scope, tagged with\
        \ its origin."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamBinding:
      required:
      - "principal_id"
      - "principal_type"
      - "role_id"
      - "scope_type"
      - "scope_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the binding"
        principal_id:
          type: "string"
          description: "The ID of the principal (user) this binding applies to"
        principal_type:
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          description: "The type of principal"
          format: "enum"
        role_id:
          type: "string"
          description: "The role granted by this binding"
        scope_type:
          enum:
          - "SCOPE_TYPE_UNSPECIFIED"
          - "SCOPE_TYPE_WORKSPACE"
          - "SCOPE_TYPE_GROUP"
          - "SCOPE_TYPE_ORGANISATION"
          - "SCOPE_TYPE_PLATFORM"
          type: "string"
          description: "The type of scope this binding applies to"
          format: "enum"
        scope_id:
          type: "string"
          description: "The ID of the scoped resource (workspace, group, or organisation)"
        policy_id:
          type: "string"
          description: "Optional policy that constrains when this binding is effective"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the binding was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the IamBinding was last\
            \ updated"
          format: "date-time"
      description: "IamBinding resource — links a principal to a role within a scope,\
        \ optionally constrained by a policy"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier for this operation."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n The ID of the resource affected by this operation.\
            \ May be empty for\n async operations where the resource does not yet\
            \ exist."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n The type of resource (e.g., \"User\", \"\
            Role\", \"IamBinding\")."
        operation_type:
          readOnly: true
          enum:
          - "IAM_OPERATION_TYPE_UNSPECIFIED"
          - "IAM_OPERATION_TYPE_CREATE"
          - "IAM_OPERATION_TYPE_UPDATE"
          - "IAM_OPERATION_TYPE_DELETE"
          - "IAM_OPERATION_TYPE_AUTHENTICATE"
          - "IAM_OPERATION_TYPE_CHANGE_PASSWORD"
          - "IAM_OPERATION_TYPE_REVOKE"
          - "IAM_OPERATION_TYPE_GRANT"
          - "IAM_OPERATION_TYPE_INVITE"
          - "IAM_OPERATION_TYPE_DEACTIVATE"
          - "IAM_OPERATION_TYPE_REACTIVATE"
          - "IAM_OPERATION_TYPE_ACTIVATE"
          - "IAM_OPERATION_TYPE_UPLOAD_AVATAR"
          - "IAM_OPERATION_TYPE_CLEAR_AVATAR"
          type: "string"
          description: "Operation Type\n\n The kind of mutation that was requested."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "IAM_OPERATION_STATUS_UNSPECIFIED"
          - "IAM_OPERATION_STATUS_PENDING"
          - "IAM_OPERATION_STATUS_RUNNING"
          - "IAM_OPERATION_STATUS_DONE"
          - "IAM_OPERATION_STATUS_ERROR"
          type: "string"
          description: "Status\n\n Current lifecycle state of the operation."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was first created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When the operation started executing."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When the operation completed (either successfully\
            \ or with errors)."
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperationError"
          description: "Errors\n\n Business rule errors encountered during the operation."
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperationWarning"
          description: "Warnings\n\n Non-fatal notices about the operation."
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Percentage of completion (0-100)."
          format: "int32"
        cause:
          readOnly: true
          enum:
          - "REVOCATION_CAUSE_UNSPECIFIED"
          - "REVOCATION_CAUSE_SELF"
          - "REVOCATION_CAUSE_TARGETED"
          - "REVOCATION_CAUSE_ADMIN_TARGETED"
          - "REVOCATION_CAUSE_SESSION_CAP_EXCEEDED"
          type: "string"
          description: "Revocation Cause\n\n Discriminator for REVOKE operations only\
            \ (UNSPECIFIED for every other\n operation_type). See RevocationCause\
            \ for the four flavours."
          format: "enum"
      description: "IAM Operation\n\n An acknowledgment of a mutation request, carrying\
        \ tracking metadata,\n errors, and warnings. Follows GCP's Operations pattern\
        \ (AIP-151)."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperationError:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Error Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the error."
      description: "Operation Error\n\n A structured error returned inside an operation\
        \ when a business rule fails."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperationWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the warning."
      description: "Operation Warning\n\n A non-fatal notice attached to an operation."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IpAddress:
      required:
      - "address"
      - "prefix"
      type: "object"
      properties:
        address:
          type: "string"
          description: "The IP address (e.g. \"10.0.0.0\" or \"2001:db8::1\")"
        prefix:
          type: "integer"
          description: "The CIDR prefix length (e.g. 8 for /8, 24 for /24)"
          format: "uint32"
      description: "IpAddress — an IP address (IPv4 or IPv6) with its CIDR prefix\
        \ length"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.LocationCondition:
      required:
      - "operator"
      - "allowed_location_ids"
      type: "object"
      properties:
        operator:
          enum:
          - "LOCATION_CONDITION_OPERATOR_UNSPECIFIED"
          - "LOCATION_CONDITION_OPERATOR_IN_SET"
          type: "string"
          description: "The comparison operator for the location check"
          format: "enum"
        allowed_location_ids:
          type: "array"
          items:
            type: "string"
          description: "The set of allowed location ids (weak references to topology\
            \ Locations)"
      description: "LocationCondition — restricts a binding to operations targeting\
        \ an allowed set of locations\n\n When attached to a binding's policy, the\
        \ operation's target location must be in the allowed set\n for the binding\
        \ to be effective. A binding without a LocationCondition is unconstrained\
        \ by location."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Permission:
      type: "object"
      properties:
        name:
          type: "string"
          description: "The natural key of the permission (<service>.<resource>.<action>)"
        service:
          readOnly: true
          type: "string"
          description: "The service this permission belongs to (e.g. \"compute\")"
        resource:
          readOnly: true
          type: "string"
          description: "The resource this permission applies to (e.g. \"vm\")"
        action:
          readOnly: true
          type: "string"
          description: "The action this permission grants (e.g. \"create\")"
        description:
          readOnly: true
          type: "string"
          description: "Human-readable explanation of the permission"
      description: "Permission resource — a granular action that can be assigned to\
        \ roles"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Policy:
      required:
      - "name"
      - "conditions"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the policy"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this policy belongs to"
        name:
          type: "string"
          description: "The display name of the policy"
        description:
          type: "string"
          description: "An optional description of the policy"
        conditions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Condition"
          description: "The conditions that must be satisfied for the policy to apply"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the policy was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the Policy was last updated"
          format: "date-time"
      description: "Policy resource — a set of conditions that constrain when an IAM\
        \ binding is effective"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Principal:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the principal."
        display_name:
          readOnly: true
          type: "string"
          description: "Polymorphic human-readable label — a Person's \"name surname\"\
            \ or a\n service account's service email."
        status:
          readOnly: true
          enum:
          - "PRINCIPAL_STATUS_UNSPECIFIED"
          - "PRINCIPAL_STATUS_INVITED"
          - "PRINCIPAL_STATUS_ACTIVE"
          - "PRINCIPAL_STATUS_DEACTIVATED"
          type: "string"
          description: "The lifecycle status of the principal."
          format: "enum"
        type:
          readOnly: true
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          description: "The discriminated kind of the principal."
          format: "enum"
        last_seen:
          readOnly: true
          type: "string"
          description: "Best-effort last-authentication instant; absent until the\
            \ principal first\n authenticates."
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the principal was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the principal was last updated."
          format: "date-time"
      description: "Principal resource — the lean, discriminated directory projection\
        \ shared by\n users and service accounts. Carries ONLY core identity; person-specific\n\
        \ profile fields (name/surname/avatar) are exposed on the richer User message."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Role:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the role"
        name:
          type: "string"
          description: "The display name of the role"
        description:
          type: "string"
          description: "An optional description of the role"
        role_type:
          readOnly: true
          enum:
          - "ROLE_TYPE_UNSPECIFIED"
          - "ROLE_TYPE_SYSTEM"
          - "ROLE_TYPE_CUSTOM"
          type: "string"
          description: "The type of role (system or custom)"
          format: "enum"
        stage:
          readOnly: true
          enum:
          - "ROLE_STAGE_UNSPECIFIED"
          - "ROLE_STAGE_ACTIVE"
          - "ROLE_STAGE_DEPRECATED"
          - "ROLE_STAGE_DISABLED"
          type: "string"
          description: "The lifecycle stage of the role"
          format: "enum"
        scope_type:
          enum:
          - "SCOPE_TYPE_UNSPECIFIED"
          - "SCOPE_TYPE_WORKSPACE"
          - "SCOPE_TYPE_GROUP"
          - "SCOPE_TYPE_ORGANISATION"
          - "SCOPE_TYPE_PLATFORM"
          type: "string"
          description: "The type of scope this role is defined in (only for custom\
            \ roles)"
          format: "enum"
        scope_id:
          type: "string"
          description: "The ID of the scoped resource (only for custom roles)"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the role was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the Role was last updated"
          format: "date-time"
      description: "Role resource — a named collection of permissions assignable to\
        \ principals"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.RoleCondition:
      required:
      - "operator"
      - "services"
      type: "object"
      properties:
        operator:
          enum:
          - "ROLE_CONDITION_OPERATOR_UNSPECIFIED"
          - "ROLE_CONDITION_OPERATOR_MATCHES_SERVICE"
          type: "string"
          description: "The comparison operator for the role check"
          format: "enum"
        services:
          type: "array"
          items:
            type: "string"
          description: "The service names that the delegated role's permissions must\
            \ belong to"
      description: "RoleCondition — restricts role delegation to specific service\
        \ scopes\n\n When attached to an IamBinding for `iam.binding.create`, this\
        \ condition ensures\n that the user can only grant roles whose permissions\
        \ fall within the listed services."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.RolePermission:
      required:
      - "role_id"
      - "permission"
      type: "object"
      properties:
        role_id:
          type: "string"
          description: "The role this permission is assigned to"
        permission:
          type: "string"
          description: "The permission string (e.g. \"compute.vm.create\")"
      description: "RolePermission resource — a single permission assigned to a role"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.ScopeAccessEntry:
      type: "object"
      properties:
        principal:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Principal"
          description: "The principal that has access."
        roles:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.EffectiveRole"
          description: "Every effective role the principal holds at the requested\
            \ scope."
      description: "One principal's effective access at a scope: the principal plus\
        \ every role\n they hold there, each tagged direct/inherited."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.SourceIpCondition:
      required:
      - "operator"
      - "cidrs"
      type: "object"
      properties:
        operator:
          enum:
          - "SOURCE_IP_OPERATOR_UNSPECIFIED"
          - "SOURCE_IP_OPERATOR_IN_RANGE"
          - "SOURCE_IP_OPERATOR_NOT_IN_RANGE"
          type: "string"
          description: "The comparison operator for the IP check"
          format: "enum"
        cidrs:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IpAddress"
          description: "The CIDR ranges to match against"
      description: "SourceIpCondition — restricts access based on the client's source\
        \ IP address"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.TimeWindowCondition:
      required:
      - "operator"
      type: "object"
      properties:
        operator:
          enum:
          - "TIME_WINDOW_OPERATOR_UNSPECIFIED"
          - "TIME_WINDOW_OPERATOR_WITHIN"
          - "TIME_WINDOW_OPERATOR_OUTSIDE"
          type: "string"
          description: "The comparison operator for the time check"
          format: "enum"
        from:
          allOf:
          - $ref: "#/components/schemas/google.type.TimeOfDay"
          description: "Start time of the window"
        to:
          allOf:
          - $ref: "#/components/schemas/google.type.TimeOfDay"
          description: "End time of the window"
        timezone:
          type: "string"
          description: "IANA timezone identifier (e.g. \"America/New_York\")"
      description: "TimeWindowCondition — restricts access to specific time windows"
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Token:
      type: "object"
      properties:
        token_hash:
          readOnly: true
          type: "string"
          description: "SHA-512 hex fingerprint of the raw token (128 lowercase hex\
            \ chars).\n Acts as both the natural identifier and the lookup key — clients\n\
            \ pass this back to RevokeToken / Get / List operations."
        metadata:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.TokenMetadata"
          description: "Session context captured at token creation time"
        expires_at:
          readOnly: true
          type: "string"
          description: "Expiration Timestamp\n\n The timestamp when the token expires\
            \ and can no longer be used for authentication"
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the token was created"
          format: "date-time"
      description: "Token resource — an opaque session token for an authenticated\
        \ user.\n The raw token value is never exposed after creation; only metadata\
        \ is returned."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.TokenMetadata:
      type: "object"
      properties:
        source_ip:
          readOnly: true
          type: "string"
          description: "The client IP address at the time the token was created"
        user_agent:
          readOnly: true
          type: "string"
          description: "The User-Agent header value at the time the token was created"
      description: "TokenMetadata — session context captured at token creation time.\n\
        \ Write-once: set when the token is created, never modified afterwards."
    com.qibdo.cloud.iam.infrastructure.integration.v1.schema.User:
      required:
      - "email"
      - "name"
      - "surname"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the user"
        email:
          type: "string"
          description: "The email address of the user"
        name:
          type: "string"
          description: "The given name of the user"
        surname:
          type: "string"
          description: "The family name of the user"
        avatar:
          type: "string"
          description: "Reference to the user's avatar image in object storage; empty\
            \ when unset."
        status:
          readOnly: true
          enum:
          - "PRINCIPAL_STATUS_UNSPECIFIED"
          - "PRINCIPAL_STATUS_INVITED"
          - "PRINCIPAL_STATUS_ACTIVE"
          - "PRINCIPAL_STATUS_DEACTIVATED"
          type: "string"
          description: "The lifecycle status of the user."
          format: "enum"
        type:
          readOnly: true
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          description: "The discriminated principal kind (always USER for this resource)."
          format: "enum"
        last_seen:
          readOnly: true
          type: "string"
          description: "Best-effort last-authentication instant; absent until first\
            \ authentication."
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the user was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the User was last updated"
          format: "date-time"
      description: "User resource — an authenticated human identity in the platform\
        \ (a Person)."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ActivateUserRequest:
      required:
      - "id"
      - "new_password"
      type: "object"
      properties:
        id:
          type: "string"
          description: "The unique identifier of the user to activate"
        new_password:
          type: "string"
          description: "The first password for the account being activated"
      description: "ActivateUserRequest\n\n Request message for Activate. Identifies\
        \ the invited user and carries the\n first password to set."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.AddRolePermissionRequest:
      required:
      - "role"
      - "role_permission"
      type: "object"
      properties:
        role:
          type: "string"
          description: "The role to add the permission to"
        role_permission:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.RolePermission"
          description: "The permission to add"
      description: "AddRolePermissionRequest\n\n Request message for AddRolePermission.\
        \ Identifies the role and the permission\n binding to add."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.AuthenticateRequest:
      required:
      - "email"
      - "password"
      type: "object"
      properties:
        email:
          type: "string"
          description: "The email address of the user"
        password:
          type: "string"
          description: "The password of the user"
      description: "AuthenticateRequest\n\n Request message for Authenticate. Carries\
        \ the user's email and password for\n password-based login."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.AuthenticateResponse:
      type: "object"
      properties:
        access_token:
          type: "string"
          description: "The opaque access token used as Bearer credential for authenticated\
            \ requests"
        access_token_expires_at:
          readOnly: true
          type: "string"
          description: "The expiration time of the access token"
          format: "date-time"
        refresh_token:
          type: "string"
          description: "The opaque refresh token used to obtain new access tokens\
            \ without re-authenticating"
        refresh_token_expires_at:
          readOnly: true
          type: "string"
          description: "The expiration time of the refresh token"
          format: "date-time"
        access_token_hash:
          readOnly: true
          type: "string"
          description: "SHA-512 hex fingerprint of the access token.\n CLI/TUI clients\
            \ use this as the stable session identifier — it matches\n the row's `iam.tokens.token_hash`,\
            \ so clients never need to compute\n SHA-512 themselves. Same field number\
            \ on RefreshTokenResponse so the\n wire shape is symmetric across mint\
            \ and rotation."
      description: "AuthenticateResponse\n\n Response message for Authenticate. Carries\
        \ the freshly issued access +\n refresh token pair and their expiry timestamps."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ChangePasswordRequest:
      required:
      - "id"
      - "current_password"
      - "new_password"
      type: "object"
      properties:
        id:
          type: "string"
          description: "The unique identifier of the user whose password to change"
        current_password:
          type: "string"
          description: "The current password for verification"
        new_password:
          type: "string"
          description: "The new password to set"
      description: "ChangePasswordRequest\n\n Request message for ChangePassword.\
        \ Identifies the user, the current password\n for verification, and the new\
        \ password to set."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.GrantRequest:
      required:
      - "scope_type"
      - "scope_id"
      - "principal_id"
      - "principal_type"
      - "role_id"
      type: "object"
      properties:
        scope_type:
          type: "string"
          description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        scope_id:
          type: "string"
          description: "The unique identifier of the scope."
        principal_id:
          type: "string"
          description: "The principal receiving the role."
        principal_type:
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          description: "The discriminated kind of the principal."
          format: "enum"
        role_id:
          type: "string"
          description: "The role to grant."
      description: "GrantRequest\n\n Request message for Grant. Scope is identified\
        \ by path parameters."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.InvitePrincipalRequest:
      required:
      - "scope_type"
      - "scope_id"
      - "email"
      - "name"
      - "surname"
      - "role_id"
      type: "object"
      properties:
        scope_type:
          type: "string"
          description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        scope_id:
          type: "string"
          description: "The unique identifier of the scope."
        email:
          type: "string"
          description: "The email address of the principal to invite."
        name:
          type: "string"
          description: "The given name of the invited principal."
        surname:
          type: "string"
          description: "The family name of the invited principal."
        role_id:
          type: "string"
          description: "The role to grant on invitation."
      description: "InvitePrincipalRequest\n\n Request message for InvitePrincipal.\
        \ Scope is identified by path parameters."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListIamBindingsResponse:
      type: "object"
      properties:
        iam_bindings:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamBinding"
          description: "The list of IAM bindings"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListIamBindingsResponse\n\n Response message for ListIamBindings.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListIamOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.IamOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListIamOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPermissionsResponse:
      type: "object"
      properties:
        permissions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Permission"
          description: "The list of permissions"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListPermissionsResponse\n\n Response message for ListPermissions.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPoliciesResponse:
      type: "object"
      properties:
        policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Policy"
          description: "The list of policies"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListPoliciesResponse\n\n Response message for ListPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListPrincipalsResponse:
      type: "object"
      properties:
        principals:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Principal"
          description: "The list of principals visible to the caller."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListPrincipalsResponse\n\n Response message for ListPrincipals."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListRolePermissionsResponse:
      type: "object"
      properties:
        permissions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Permission"
          description: "The list of permissions assigned to the role"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListRolePermissionsResponse\n\n Response message for ListRolePermissions.\
        \ Returns full Permission resources\n (name, service, resource, action, description)\
        \ so clients can render\n permission metadata without a follow-up GetPermission\
        \ per row.\n\n Note: This API intentionally omits `total_size` from list responses.\n\
        \ Keyset pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListRolesResponse:
      type: "object"
      properties:
        roles:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Role"
          description: "The list of roles"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListRolesResponse\n\n Response message for ListRoles.\n Note:\
        \ This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListScopeAccessResponse:
      type: "object"
      properties:
        entries:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.ScopeAccessEntry"
          description: "One entry per principal with effective access at the requested\
            \ scope."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListScopeAccessResponse\n\n Response message for ListScopeAccess."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListTokensResponse:
      type: "object"
      properties:
        tokens:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.Token"
          description: "The list of tokens"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListTokensResponse\n\n Response message for ListTokens.\n Note:\
        \ This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.ListUsersResponse:
      type: "object"
      properties:
        users:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.iam.infrastructure.integration.v1.schema.User"
          description: "The list of users"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListUsersResponse\n\n Response message for ListUsers.\n Note:\
        \ This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.RefreshTokenRequest:
      required:
      - "refresh_token"
      type: "object"
      properties:
        refresh_token:
          type: "string"
          description: "The refresh token value (prefixed with qbr_)"
      description: "RefreshTokenRequest\n\n Request message for RefreshToken. Carries\
        \ the refresh token to exchange for\n a new access + refresh token pair."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.RefreshTokenResponse:
      type: "object"
      properties:
        access_token:
          type: "string"
          description: "The new opaque access token"
        access_token_expires_at:
          readOnly: true
          type: "string"
          description: "The expiration time of the new access token"
          format: "date-time"
        refresh_token:
          type: "string"
          description: "The new opaque refresh token (replaces the consumed one)"
        refresh_token_expires_at:
          readOnly: true
          type: "string"
          description: "The expiration time of the new refresh token"
          format: "date-time"
        access_token_hash:
          readOnly: true
          type: "string"
          description: "SHA-512 hex fingerprint of the new access token.\n CLI/TUI\
            \ clients use this as the stable session identifier — it matches\n the\
            \ row's `iam.tokens.token_hash` for the just-rotated access token, so\n\
            \ clients never need to compute SHA-512 themselves."
      description: "RefreshTokenResponse\n\n Response message for RefreshToken. Carries\
        \ a freshly issued access + refresh\n token pair and their expiry timestamps."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.RevokeRequest:
      required:
      - "scope_type"
      - "scope_id"
      - "principal_id"
      - "principal_type"
      - "role_id"
      type: "object"
      properties:
        scope_type:
          type: "string"
          description: "The scope type: ORGANISATION, WORKSPACE, or GROUP."
        scope_id:
          type: "string"
          description: "The unique identifier of the scope."
        principal_id:
          type: "string"
          description: "The principal losing the role."
        principal_type:
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          description: "The discriminated kind of the principal."
          format: "enum"
        role_id:
          type: "string"
          description: "The role to revoke."
      description: "RevokeRequest\n\n Request message for Revoke. Scope is identified\
        \ by path parameters."
    com.qibdo.cloud.iam.infrastructure.integration.v1.service.RevokeTokenRequest:
      type: "object"
      properties:
        token_hash:
          type: "string"
          description: "Optional. SHA-512 hex fingerprint of the access OR refresh\
            \ token to revoke.\n Leave empty to revoke the bearer credential from\
            \ the Authorization header."
      description: "RevokeTokenRequest\n\n Request message for RevokeToken. Carries\
        \ an optional `token_hash` identifying\n the session to revoke. Empty form\
        \ (self-revoke) targets the bearer credential\n from the `Authorization` header;\
        \ populated form targets the named session.\n\n No `buf.validate` constraint\
        \ on `token_hash` length — empty IS the valid\n self-revoke form. Length validation\
        \ (128 lowercase hex chars when populated)\n runs in the handler so empty\
        \ + populated both flow through one entry point."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress:
      type: "object"
      properties:
        address:
          type: "string"
        prefix:
          type: "integer"
          format: "uint32"
      description: "IpAddress — an IPv4 or IPv6 address, disambiguated by the `address`\
        \ string\n format. `prefix` carries the CIDR prefix length (0-32 for IPv4,\
        \ 0-128 for\n IPv6); set to 32 or 128 for single-host addresses such as a\
        \ subnet gateway."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier for this operation."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n The ID of the resource affected by this operation.\
            \ May be empty for\n async operations where the resource does not yet\
            \ exist."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n The type of resource (e.g., \"com.qibdo.cloud.network:vpc\"\
            )."
        operation_type:
          readOnly: true
          enum:
          - "NETWORK_OPERATION_TYPE_UNSPECIFIED"
          - "NETWORK_OPERATION_TYPE_CREATE"
          - "NETWORK_OPERATION_TYPE_UPDATE"
          - "NETWORK_OPERATION_TYPE_DELETE"
          type: "string"
          description: "Operation Type\n\n The kind of mutation that was requested."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "NETWORK_OPERATION_STATUS_UNSPECIFIED"
          - "NETWORK_OPERATION_STATUS_PENDING"
          - "NETWORK_OPERATION_STATUS_RUNNING"
          - "NETWORK_OPERATION_STATUS_DONE"
          - "NETWORK_OPERATION_STATUS_ERROR"
          type: "string"
          description: "Status\n\n Current lifecycle state of the operation."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was first created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When the operation started executing."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When the operation completed (either successfully\
            \ or with errors)."
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperationError"
          description: "Errors\n\n Business rule errors encountered during the operation."
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperationWarning"
          description: "Warnings\n\n Non-fatal notices about the operation."
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Percentage of completion (0-100)."
          format: "int32"
      description: "Network Operation\n\n An acknowledgment of a mutation request,\
        \ carrying tracking metadata,\n errors, and warnings. Follows GCP's Operations\
        \ pattern (AIP-151)."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperationError:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Error Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the error."
      description: "Network Operation Error\n\n A structured error returned inside\
        \ an operation when a business rule fails."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperationWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the warning."
      description: "Network Operation Warning\n\n A non-fatal notice attached to an\
        \ operation."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaDefinition:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this quota definition."
        metric:
          readOnly: true
          type: "string"
          description: "The human-readable metric identifier following the\n `<service>/<resource>/<measure>`\
            \ convention (e.g., \"network/vpc/count\")."
        display_name:
          readOnly: true
          type: "string"
          description: "A human-readable display name (e.g., \"VPCs per workspace\"\
            )."
        description:
          readOnly: true
          type: "string"
          description: "An optional longer explanation of what this quota limits."
        unit:
          readOnly: true
          type: "string"
          description: "The unit of measurement (e.g., \"count\", \"bytes\", \"bytes_per_second\"\
            )."
        quota_type:
          readOnly: true
          type: "string"
          description: "The quota type: ALLOCATION (concurrent cap) or RATE (time-windowed)."
        container_type:
          readOnly: true
          type: "string"
          description: "The taxonomy scope at which this quota is administered\n (ORGANISATION,\
            \ WORKSPACE, or GROUP)."
        dimension_keys:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "Ordered list of applicable dimension names (e.g., [\"region\"\
            ], [\"zone\"],\n or [] for global). Quota limits must only use keys from\
            \ this list."
        default_limit:
          readOnly: true
          type: "integer"
          description: "The platform-wide default limit applied when no explicit QuotaLimit\n\
            \ override exists for a given container and dimensions."
          format: "int32"
        adjustable:
          readOnly: true
          type: "boolean"
          description: "Whether administrators can create QuotaLimit overrides for\
            \ this metric."
        refresh_interval:
          readOnly: true
          type: "string"
          description: "For RATE quotas only: the refresh interval as an ISO 8601\
            \ duration\n (e.g., \"PT1M\", \"PT1H\"). Empty for ALLOCATION quotas."
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n When this quota definition was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n When this quota definition was last\
            \ updated."
          format: "date-time"
      description: "QuotaDefinition — metadata describing a quota: what it limits,\
        \ its unit,\n type, container scope, applicable dimensions, and platform-wide\
        \ default.\n Seeded via Flyway. Each service owns its own quota definitions."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaLimit:
      required:
      - "container_id"
      - "container_type"
      - "effective_limit"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this quota limit."
        quota_definition_id:
          readOnly: true
          type: "string"
          description: "The quota definition this limit overrides."
        container_id:
          type: "string"
          description: "The scoped resource (workspace UUID, org UUID, group UUID)\
            \ this\n limit applies to."
        container_type:
          type: "string"
          description: "The taxonomy scope type (ORGANISATION, WORKSPACE, or GROUP).\n\
            \ Must match the parent quota definition's container_type."
        dimensions:
          type: "object"
          additionalProperties:
            type: "string"
          description: "Key-value dimension overrides (e.g., {\"region\": \"us-east-1\"\
            }).\n Empty map means global/unscoped. Keys must be from the parent\n\
            \ definition's dimension_keys list."
        effective_limit:
          type: "integer"
          description: "The overridden limit for this container and dimensions."
          format: "int32"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n When this quota limit was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n When this quota limit was last updated."
          format: "date-time"
      description: "QuotaLimit — an override of a quota definition's default limit\
        \ for a\n specific container (organisation, workspace, or group) and optional\n\
        \ dimensions. Resolution: explicit QuotaLimit > QuotaDefinition.default_limit."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.PortRange:
      type: "object"
      properties:
        min:
          type: "integer"
          description: "Lowest port in the range (inclusive). 0–65535."
          format: "int32"
        max:
          type: "integer"
          description: "Highest port in the range (inclusive). 0–65535. Must be >=\
            \ min."
          format: "int32"
      description: "PortRange is an inclusive range of transport-layer port numbers."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.ProtocolMatch:
      required:
      - "protocol"
      type: "object"
      properties:
        protocol:
          type: "string"
          description: "IANA protocol name (e.g., \"tcp\", \"udp\", \"icmp\") or number.\
            \ Use \"all\" for any."
        port_ranges:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.PortRange"
          description: "Port ranges this match applies to. Empty list means \"all\
            \ ports for this\n protocol\". Not applicable when protocol is \"icmp\"\
            , \"icmpv6\", or \"all\"."
      description: "ProtocolMatch describes one protocol + port-range combination\
        \ that a\n QibdoFirewallPolicyRule can match. A rule carries a list of these\
        \ to\n support multi-protocol / multi-port matching (GCP-style allowed[] /\
        \ denied[])."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicy:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this firewall policy."
        vpc_id:
          readOnly: true
          type: "string"
          description: "The VPC that this firewall policy is associated with."
        name:
          type: "string"
          description: "The display name of the firewall policy."
        description:
          type: "string"
          description: "An optional human-readable description of the firewall policy."
        disabled:
          type: "boolean"
          description: "Whether this firewall policy is disabled. When true, none\
            \ of its\n rules are enforced."
        provider_resource_id:
          readOnly: true
          type: "string"
          description: "OVN-assigned policy identifier. Populated once OVN provisions\
            \ the policy."
        created:
          readOnly: true
          type: "string"
          description: "When this firewall policy was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "When this firewall policy was last updated."
          format: "date-time"
        rules:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule"
          description: "The list of rules attached to this policy. Server-populated:\n\
            \ GetQibdoFirewallPolicy returns this list; ListQibdoFirewallPolicies\
            \ does not."
      description: "QibdoFirewallPolicy — an OVN-backed named collection of firewall\
        \ rules\n that governs network traffic for a VPC."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule:
      required:
      - "direction"
      - "action"
      - "matches"
      - "priority"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this rule."
        description:
          type: "string"
          description: "An optional human-readable description of the rule."
        direction:
          type: "string"
          description: "The traffic direction this rule applies to (INGRESS or EGRESS)."
        action:
          type: "string"
          description: "The action to take when this rule matches (ALLOW or DENY)."
        matches:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.ProtocolMatch"
          description: "Protocol + port-range matches describing which traffic this\
            \ rule applies to.\n A rule matches if ANY listed ProtocolMatch matches.\
            \ At least one match is required."
        source_cidrs:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress"
          description: "Source CIDR blocks for INGRESS rules. OR semantics; empty\
            \ = any source."
        destination_cidrs:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress"
          description: "Destination CIDR blocks for EGRESS rules. OR semantics; empty\
            \ = any destination."
        priority:
          type: "integer"
          description: "The priority of this rule. Lower numbers indicate higher priority.\n\
            \ Range: 0-32767."
          format: "int32"
        disabled:
          type: "boolean"
          description: "Whether this rule is disabled. When true, the rule is not\
            \ enforced."
        logging_enabled:
          type: "boolean"
          description: "Whether traffic matching this rule should be logged for security\
            \ auditing."
        provider_resource_id:
          readOnly: true
          type: "string"
          description: "OVN-assigned rule identifier. Populated once OVN provisions\
            \ the rule."
        created:
          readOnly: true
          type: "string"
          description: "When this rule was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "When this rule was last updated."
          format: "date-time"
      description: "QibdoFirewallPolicyRule — an OVN-shaped traffic control rule within\
        \ a\n QibdoFirewallPolicy. The match syntax (protocol + port ranges,\n source/destination\
        \ CIDR arrays) is OVN-specific; future engines (AWS SG,\n GCP firewall) will\
        \ introduce their own rule schema."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoLogicalPort:
      required:
      - "subnet_id"
      - "vm_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this port."
        subnet_id:
          type: "string"
          description: "The subnet this port draws its address from."
        vm_id:
          type: "string"
          description: "The virtual machine this port is attached to."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace that owns this port."
        requested_ipv4:
          type: "string"
          description: "An optional requested static IPv4 address. When omitted, the\
            \ address is\n assigned automatically from the subnet's range. The assigned\
            \ address is\n reported in ipv4_address."
        requested_ipv6:
          type: "string"
          description: "An optional requested static IPv6 address. When omitted, the\
            \ address is\n assigned automatically from the subnet's range. The assigned\
            \ address is\n reported in ipv6_address."
        ipv4_address:
          readOnly: true
          type: "string"
          description: "The assigned IPv4 address."
        ipv6_address:
          readOnly: true
          type: "string"
          description: "The assigned IPv6 address."
        mac_address:
          readOnly: true
          type: "string"
          description: "The assigned hardware (MAC) address of the interface."
        state:
          readOnly: true
          type: "string"
          description: "Current lifecycle state of the port (pending, ready, failed)."
        firewall_policy_id:
          type: "string"
          description: "An optional firewall policy applied to this interface. When\
            \ omitted, the\n default deny-inbound / allow-egress policy is enforced."
        provider_resource_id:
          readOnly: true
          type: "string"
          description: "The provider-assigned logical-switch-port identifier. Populated\
            \ once the\n port is provisioned."
        created:
          readOnly: true
          type: "string"
          description: "When this port was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "When this port was last updated."
          format: "date-time"
      description: "QibdoLogicalPort — a virtual machine network-interface attachment\
        \ to a subnet.\n The port is the addressable point at which a VM joins the\
        \ network: it carries\n the assigned IPv4/IPv6 addresses and MAC, and the\
        \ firewall policy applied to\n the interface. Addresses are assigned automatically\
        \ from the subnet's range\n (or pinned to a requested static address when\
        \ supplied).\n\n Equivalent concepts in other platforms (same resource, different\
        \ vendor\n vocabulary): OpenStack Neutron \"port\"; OVN / Open vSwitch \"\
        logical switch\n port\"; VMware NSX \"logical port\" / \"segment port\"; AWS\
        \ \"elastic network\n interface (ENI)\"; Azure and Google Cloud \"network\
        \ interface (NIC)\"; Nutanix\n AHV and VMware vSphere \"vNIC\"; Kubernetes\
        \ virtualization virtual machine\n \"interface\"."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoSubnet:
      required:
      - "location_id"
      - "name"
      - "cidr"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this subnet."
        vpc_id:
          readOnly: true
          type: "string"
          description: "The VPC that this subnet belongs to."
        location_id:
          type: "string"
          description: "The zone this subnet is placed in. The zone must belong to\
            \ the parent VPC's\n region; a VPC's subnets may span multiple zones for\
            \ fault tolerance."
        name:
          type: "string"
          description: "The display name of the subnet."
        description:
          type: "string"
          description: "An optional human-readable description of the subnet."
        cidr:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress"
          description: "The CIDR block that defines the IP address range for this\
            \ subnet.\n Must be a subset of the parent VPC's CIDR."
        gateway_ip:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress"
          description: "The gateway IP address for this subnet. If omitted on creation,\n\
            \ the system automatically derives the gateway from the CIDR block."
        provider_resource_id:
          readOnly: true
          type: "string"
          description: "OVN-assigned subnet identifier. Populated once OVN provisions\
            \ the subnet."
        created:
          readOnly: true
          type: "string"
          description: "When this subnet was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "When this subnet was last updated."
          format: "date-time"
      description: "QibdoSubnet — an OVN-backed subdivision of a VPC's IP address\
        \ space."
    com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoVpc:
      required:
      - "location_id"
      - "name"
      - "cidr"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique identifier for this VPC."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace that owns this VPC."
        location_id:
          type: "string"
          description: "The region this VPC is deployed in. A VPC spans a region;\
            \ its subnets are\n placed in individual zones within that region."
        name:
          type: "string"
          description: "The display name of the VPC."
        description:
          type: "string"
          description: "An optional human-readable description of the VPC."
        cidr:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.IpAddress"
          description: "The CIDR block that defines the IP address space for this\
            \ VPC."
        provider_resource_id:
          readOnly: true
          type: "string"
          description: "OVN-assigned VPC identifier. Populated once OVN provisions\
            \ the VPC."
        created:
          readOnly: true
          type: "string"
          description: "When this VPC was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "When this VPC was last updated."
          format: "date-time"
      description: "QibdoVpc — a virtual private cloud backed by Open Virtual Network\
        \ (OVN).\n The agnostic CTI root holds workspace, location, name, description,\
        \ cidr; this\n engine-specific message exposes the OVN-shaped surface clients\
        \ interact\n with directly."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.ListNetworkOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.NetworkOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListNetworkOperationsResponse\n\n Response message for ListNetworkOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.ListQuotaDefinitionsResponse:
      type: "object"
      properties:
        quota_definitions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaDefinition"
          description: "Quota Definitions\n\n The list of quota definitions."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListQuotaDefinitionsResponse\n\n Response message for ListQuotaDefinitions.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.ListQuotaLimitsResponse:
      type: "object"
      properties:
        quota_limits:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.QuotaLimit"
          description: "Quota Limits\n\n The list of quota limits."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListQuotaLimitsResponse\n\n Response message for ListQuotaLimits.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.AddQibdoFirewallPolicyRuleRequest:
      required:
      - "workspace"
      - "vpc"
      - "id"
      - "firewall_policy_rule"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the policy belongs\
            \ to"
        vpc:
          type: "string"
          description: "The unique identifier of the parent VPC"
        id:
          type: "string"
          description: "The unique identifier of the parent firewall policy"
        firewall_policy_rule:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule"
          description: "The firewall rule to add to the policy"
      description: "AddQibdoFirewallPolicyRuleRequest\n\n Request message for AddQibdoFirewallPolicyRule\
        \ (AIP-136 custom method).\n Carries the parent policy reference and the rule\
        \ resource to append."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoFirewallPoliciesResponse:
      type: "object"
      properties:
        firewall_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicy"
          description: "The list of firewall policies"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListQibdoFirewallPoliciesResponse\n\n Response message for ListQibdoFirewallPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoFirewallPolicyRulesResponse:
      type: "object"
      properties:
        firewall_policy_rules:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoFirewallPolicyRule"
          description: "The list of firewall rules"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListQibdoFirewallPolicyRulesResponse\n\n Response message for\
        \ ListQibdoFirewallPolicyRules.\n Note: This API intentionally omits `total_size`\
        \ from list responses."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoLogicalPortsResponse:
      type: "object"
      properties:
        logical_ports:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoLogicalPort"
        next_page_token:
          type: "string"
      description: "ListQibdoLogicalPortsResponse\n\n Response message for ListQibdoLogicalPorts.\n\
        \ Note: This API intentionally omits `total_size` from list responses."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoSubnetsResponse:
      type: "object"
      properties:
        subnets:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoSubnet"
        next_page_token:
          type: "string"
      description: "ListQibdoSubnetsResponse\n\n Response message for ListQibdoSubnets.\n\
        \ Note: This API intentionally omits `total_size` from list responses."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.ListQibdoVpcsResponse:
      type: "object"
      properties:
        vpcs:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.network.infrastructure.integration.v1.schema.qibdo.QibdoVpc"
          description: "The list of VPCs."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListQibdoVpcsResponse\n\n Response message for ListQibdoVpcs.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.network.infrastructure.integration.v1.service.qibdo.RemoveQibdoFirewallPolicyRuleRequest:
      required:
      - "workspace"
      - "vpc"
      - "id"
      - "rule_id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the policy belongs\
            \ to"
        vpc:
          type: "string"
          description: "The unique identifier of the parent VPC"
        id:
          type: "string"
          description: "The unique identifier of the parent firewall policy"
        rule_id:
          type: "string"
          description: "The unique identifier of the firewall rule to remove"
      description: "RemoveQibdoFirewallPolicyRuleRequest\n\n Request message for RemoveQibdoFirewallPolicyRule\
        \ (AIP-136 custom method).\n Identifies the rule to detach from its parent\
        \ policy."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ActivityRecord:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the activity record."
        source_operation_id:
          readOnly: true
          type: "string"
          description: "The identifier of the operation that produced this activity."
        actor_id:
          readOnly: true
          type: "string"
          description: "The identifier of the actor (principal) that performed the\
            \ activity."
        resource_type:
          readOnly: true
          type: "string"
          description: "The type of resource the activity acted upon."
        action:
          readOnly: true
          type: "string"
          description: "The action performed."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace the activity is scoped to."
        trace_id:
          readOnly: true
          type: "string"
          description: "The distributed trace identifier correlating this activity."
        occurred:
          readOnly: true
          type: "string"
          description: "When the activity occurred."
          format: "date-time"
        payload:
          readOnly: true
          type: "string"
          description: "The opaque JSON audit snapshot captured for this activity."
        created:
          readOnly: true
          type: "string"
          description: "When the record was created."
          format: "date-time"
      description: "ActivityRecord\n\n A read-only audit projection of a single platform\
        \ activity. Each record is\n derived from the operation that produced it;\
        \ it is addressed by its own id\n (and its source operation id), and carries\
        \ no engine axis."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.AlertRule:
      required:
      - "location_id"
      - "name"
      - "kind"
      - "signal"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the alert rule."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this rule belongs to. Derived from the `{workspace}`\
            \ path segment on create;\n reported read-only thereafter."
        location_id:
          type: "string"
          description: "Weak reference to a topology Location — where the telemetry\
            \ resides. Immutable after create."
        name:
          type: "string"
          description: "The rule's handle: a DNS-label (lowercase alphanumerics and\
            \ hyphens, up to 63 characters),\n unique within the workspace. Set on\
            \ create, immutable thereafter."
        kind:
          enum:
          - "ALERT_KIND_UNSPECIFIED"
          - "ALERT_KIND_ALERT"
          - "ALERT_KIND_RECORDING"
          type: "string"
          description: "Whether the rule raises notifications (ALERT) or precomputes\
            \ a series (RECORDING). Immutable after create."
          format: "enum"
        signal:
          enum:
          - "ALERT_SIGNAL_UNSPECIFIED"
          - "ALERT_SIGNAL_METRIC"
          - "ALERT_SIGNAL_LOG"
          type: "string"
          description: "The signal the rule's expression evaluates over (metric or\
            \ log). Immutable after create."
          format: "enum"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that evaluates this rule."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the rule was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the rule was last updated."
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoAlertRuleSpec"
          description: "Rule spec for a Qibdo-managed alert rule."
      description: "An alert rule evaluates a PromQL/LogQL expression over a signal\
        \ (metric or log) and, for ALERT-kind\n rules, routes fired alerts through\
        \ a notification tree to webhook, email, or app-message receivers.\n A RECORDING-kind\
        \ rule instead precomputes a derived series and needs no route. The provider\
        \ that\n evaluates the rule is reported by the read-only `engine` field."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ArchiveDestination:
      required:
      - "container"
      - "path"
      type: "object"
      properties:
        container:
          type: "string"
          description: "The object container (bucket) that receives the archived lines."
        path:
          type: "string"
          description: "The object-key path prefix under which lines are written."
      description: "Archive delivery: an object container and a key-prefix path."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.EmailReceiver:
      type: "object"
      properties:
        addresses:
          type: "array"
          items:
            type: "string"
          description: "The recipient email addresses."
      description: "Email delivery: one or more recipient addresses."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ExternalDestination:
      required:
      - "target"
      - "reference"
      type: "object"
      properties:
        target:
          type: "string"
          description: "A free-form descriptor of the external delivery target."
        reference:
          type: "string"
          description: "An opaque reference (endpoint, handle) for the external target."
      description: "External delivery: a target descriptor plus an opaque endpoint\
        \ reference."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.IngestionConfig:
      required:
      - "location_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the ingestion config."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this config governs. Derived from the `{workspace}`\
            \ path segment on create;\n reported read-only thereafter."
        location_id:
          type: "string"
          description: "Weak reference to a topology Location — where the telemetry\
            \ is collected. Immutable after create."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that runs this workspace's ingestion pipeline."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the config was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the config was last updated."
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoIngestionConfigSpec"
          description: "Ingestion settings for a Qibdo-managed workspace."
      description: "An ingestion config governs how telemetry is collected for a workspace:\
        \ which sources\n the pipeline scrapes, and how aggressively traces are head-sampled.\
        \ One config exists per\n workspace. The provider that runs the pipeline is\
        \ reported by the read-only `engine` field."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogEntry:
      type: "object"
      properties:
        timestamp:
          type: "string"
          description: "When the line was emitted."
          format: "date-time"
        line:
          type: "string"
          description: "The raw log line."
        labels:
          type: "object"
          additionalProperties:
            type: "string"
          description: "The stream labels (the unique label set this line belongs\
            \ to)."
      description: "LogEntry\n\n A single log line returned by a query or live tail."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogSink:
      required:
      - "location_id"
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the log sink."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this sink belongs to. Derived from the `{workspace}`\
            \ path segment on create;\n reported read-only thereafter."
        location_id:
          type: "string"
          description: "Weak reference to a topology Location — where the telemetry\
            \ resides. Immutable after create."
        name:
          type: "string"
          description: "The sink's handle: a DNS-label (lowercase alphanumerics and\
            \ hyphens, up to 63 characters),\n unique within the workspace. Set on\
            \ create, immutable thereafter."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that operates this sink."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the sink was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the sink was last updated."
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoLogSinkSpec"
          description: "Routing spec for a Qibdo-managed sink."
      description: "A log sink routes a workspace's matching log lines to a destination\
        \ (an archive, a downstream\n stream, or an external endpoint), selecting\
        \ which lines flow with inclusion/exclusion filters.\n The provider that operates\
        \ the sink is reported by the read-only `engine` field."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.MetricSample:
      type: "object"
      properties:
        timestamp:
          type: "string"
          description: "The sample instant."
          format: "date-time"
        value:
          type: "number"
          description: "The sample value."
          format: "double"
      description: "MetricSample\n\n A single (timestamp, value) point in a series."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.MetricSeries:
      type: "object"
      properties:
        labels:
          type: "object"
          additionalProperties:
            type: "string"
          description: "The series' label set."
        samples:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.MetricSample"
          description: "The samples, ordered by time."
      description: "MetricSeries\n\n One labelled time series. An instant result carries\
        \ a single sample."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.NotificationReceiver:
      type: "object"
      properties:
        webhook:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.WebhookReceiver"
          description: "Generic HTTP callback delivery."
        email:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.EmailReceiver"
          description: "Email delivery."
        slack:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SlackReceiver"
          description: "Slack delivery."
      description: "A delivery target for a fired alert — exactly one channel arm\
        \ is set."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.NotificationRoute:
      type: "object"
      properties:
        group_by:
          type: "array"
          items:
            type: "string"
          description: "Label keys to group fired alerts by before notifying."
        matchers:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RouteMatcher"
          description: "Label-equality predicates selecting which fired alerts this\
            \ route applies to."
        child_routes:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.NotificationRoute"
          description: "More specific routes evaluated within this one."
        receivers:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.NotificationReceiver"
          description: "The receivers fired alerts matching this route are delivered\
            \ to."
      description: "A node in an alert rule's notification routing tree: group fired\
        \ alerts, select them by matchers,\n deliver to receivers, and recurse into\
        \ more specific child routes."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique operation identifier."
        resource_id:
          readOnly: true
          type: "string"
          description: "The id of the affected resource."
        resource_type:
          readOnly: true
          type: "string"
          description: "The type of resource the operation acted upon (URN)."
        operation_type:
          readOnly: true
          enum:
          - "OBSERVABILITY_OPERATION_TYPE_UNSPECIFIED"
          - "OBSERVABILITY_OPERATION_TYPE_CREATE"
          - "OBSERVABILITY_OPERATION_TYPE_UPDATE"
          - "OBSERVABILITY_OPERATION_TYPE_DELETE"
          type: "string"
          description: "The operation type (CREATE, UPDATE, DELETE)."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "OBSERVABILITY_OPERATION_STATUS_UNSPECIFIED"
          - "OBSERVABILITY_OPERATION_STATUS_PENDING"
          - "OBSERVABILITY_OPERATION_STATUS_RUNNING"
          - "OBSERVABILITY_OPERATION_STATUS_DONE"
          - "OBSERVABILITY_OPERATION_STATUS_ERROR"
          type: "string"
          description: "The operation status (DONE for synchronous config mutations)."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "When the operation was recorded."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "When execution started."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "When execution completed."
          format: "date-time"
        progress:
          readOnly: true
          type: "integer"
          description: "Progress percentage (0–100)."
          format: "int32"
      description: "ObservabilityOperation\n\n Tracks the synchronous result of an\
        \ observability config-plane command (retention,\n sink, or ingestion mutation).\
        \ Engine-neutral — operations carry no engine axis."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoAlertRuleSpec:
      required:
      - "expression"
      type: "object"
      properties:
        expression:
          type: "string"
          description: "The PromQL/LogQL expression the rule evaluates (required)."
        for_seconds:
          type: "string"
          description: "Pending duration in seconds the condition must hold before\
            \ firing. 0 (or unset) means fire immediately."
        labels:
          type: "object"
          additionalProperties:
            type: "string"
          description: "Labels stamped onto fired alerts."
        annotations:
          type: "object"
          additionalProperties:
            type: "string"
          description: "Annotations attached to fired alerts."
        route:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.NotificationRoute"
          description: "The notification routing tree. Optional; a recording rule\
            \ omits it."
      description: "Provider-specific spec for a Qibdo-managed alert rule, carried\
        \ in `AlertRule.for_engine`\n when the provider is Qibdo."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoIngestionConfigSpec:
      required:
      - "sampling"
      - "sources"
      type: "object"
      properties:
        sampling:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SamplingConfig"
          description: "The trace head-sampling configuration."
        sources:
          type: "array"
          items:
            enum:
            - "TELEMETRY_SOURCE_UNSPECIFIED"
            - "TELEMETRY_SOURCE_K8S"
            - "TELEMETRY_SOURCE_CEPH"
            - "TELEMETRY_SOURCE_KUBEVIRT"
            - "TELEMETRY_SOURCE_HARBOR"
            - "TELEMETRY_SOURCE_OPENBAO"
            - "TELEMETRY_SOURCE_APP"
            type: "string"
            format: "enum"
          description: "The enabled telemetry sources. At least one source must be\
            \ enabled."
      description: "Provider-specific ingestion settings for a Qibdo-managed ingestion\
        \ config, carried in\n `IngestionConfig.for_engine` when the provider is Qibdo."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoLogSinkSpec:
      required:
      - "destination"
      - "inclusion_filter"
      type: "object"
      properties:
        destination:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SinkDestination"
          description: "Where the matched lines are delivered."
        inclusion_filter:
          type: "string"
          description: "AIP-160 filter expression selecting which log lines are routed\
            \ (required)."
        exclusion_filter:
          type: "string"
          description: "Optional AIP-160 filter expression excluding lines from the\
            \ routed set."
      description: "Provider-specific routing spec for a Qibdo-managed log sink, carried\
        \ in `LogSink.for_engine`\n when the provider is Qibdo."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoRetentionPolicySpec:
      required:
      - "logs_interactive_seconds"
      - "metrics_interactive_seconds"
      - "traces_interactive_seconds"
      - "activity_interactive_seconds"
      type: "object"
      properties:
        logs_interactive_seconds:
          type: "string"
          description: "Interactive log retention window, in seconds (> 0)."
        metrics_interactive_seconds:
          type: "string"
          description: "Interactive metric retention window, in seconds (> 0)."
        traces_interactive_seconds:
          type: "string"
          description: "Interactive trace retention window, in seconds (> 0)."
        activity_interactive_seconds:
          type: "string"
          description: "Interactive activity retention window, in seconds (> 0)."
      description: "Provider-specific retention windows for a Qibdo-managed retention\
        \ policy, carried in\n `RetentionPolicy.for_engine` when the provider is Qibdo.\
        \ Each window is the interactive\n (queryable) retention for one signal pillar,\
        \ in seconds."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RetentionPolicy:
      required:
      - "location_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the retention policy."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this policy governs. Derived from the `{workspace}`\
            \ path segment on create;\n reported read-only thereafter."
        location_id:
          type: "string"
          description: "Weak reference to a topology Location — where the telemetry\
            \ resides. Immutable after create."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that stores this workspace's telemetry."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the policy was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the policy was last updated."
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.QibdoRetentionPolicySpec"
          description: "Retention windows for a Qibdo-managed workspace."
      description: "A retention policy governs how long telemetry is kept for a workspace,\
        \ per signal\n pillar (logs, metrics, traces, activity). One policy exists\
        \ per workspace. The\n provider that stores the telemetry is reported by the\
        \ read-only `engine` field."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RouteMatcher:
      required:
      - "label"
      - "value"
      type: "object"
      properties:
        label:
          type: "string"
          description: "The alert label to match on."
        value:
          type: "string"
          description: "The value the label must equal."
      description: "A label-equality predicate selecting which fired alerts a route\
        \ applies to."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SamplingConfig:
      required:
      - "mode"
      - "ratio"
      type: "object"
      properties:
        mode:
          enum:
          - "SAMPLING_MODE_UNSPECIFIED"
          - "SAMPLING_MODE_HEAD_PARENT_BASED"
          type: "string"
          description: "The trace head-sampling mode (a specific mode is required)."
          format: "enum"
        ratio:
          type: "number"
          description: "The fraction of traces retained, in the half-open range (0,\
            \ 1]. 1.0 keeps every trace."
          format: "double"
      description: "Trace head-sampling configuration: the mode and the fraction of\
        \ traces retained."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceEdge:
      type: "object"
      properties:
        source:
          type: "string"
          description: "The calling service."
        target:
          type: "string"
          description: "The called service."
        call_count:
          type: "string"
          description: "The number of calls over the window."
        error_count:
          type: "string"
          description: "The number of failed calls over the window."
      description: "ServiceEdge\n\n One directed call edge between two services (RED\
        \ — request/error/duration)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceGraph:
      type: "object"
      properties:
        nodes:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceNode"
          description: "The service vertices."
        edges:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceEdge"
          description: "The directed call edges."
      description: "ServiceGraph\n\n The RED service-dependency graph derived from\
        \ trace data."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceNode:
      type: "object"
      properties:
        name:
          type: "string"
          description: "The service name."
      description: "ServiceNode\n\n One service vertex in the service-dependency graph."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Silence:
      required:
      - "matchers"
      - "starts_at"
      - "ends_at"
      - "comment"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the silence."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this silence belongs to. Derived from the `{workspace}`\
            \ path segment on create;\n reported read-only thereafter."
        matchers:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SilenceMatcher"
          description: "The label matchers selecting which firing alerts this silence\
            \ suppresses (at least one)."
        starts_at:
          type: "string"
          description: "Start of the suppression window (inclusive)."
          format: "date-time"
        ends_at:
          type: "string"
          description: "End of the suppression window (exclusive); must be after starts_at."
          format: "date-time"
        created_by:
          readOnly: true
          type: "string"
          description: "Identifier of the principal who created the silence. Server-stamped\
            \ from the authenticated\n caller; read-only (never accepted from the\
            \ request body, to prevent attribution spoofing)."
        comment:
          type: "string"
          description: "Free-text reason for the silence."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the silence was created."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the silence was last modified."
          format: "date-time"
      description: "A silence is a workspace-scoped suppression window: while active,\
        \ firing alerts whose\n labels satisfy the matchers are muted. It carries\
        \ no engine axis. A silence is created\n and deleted, never edited."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SilenceMatcher:
      required:
      - "label"
      - "value"
      type: "object"
      properties:
        label:
          type: "string"
          description: "The alert label name to match against."
        value:
          type: "string"
          description: "The value to compare the label against (exact, or a regex\
            \ when is_regex is true)."
        is_regex:
          type: "boolean"
          description: "Whether value is a regular expression rather than an exact\
            \ match."
      description: "A single label matcher used to select firing alerts for suppression."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SinkDestination:
      type: "object"
      properties:
        archive:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ArchiveDestination"
          description: "Long-term object-archive delivery."
        stream:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.StreamDestination"
          description: "Continuous delivery to a named downstream stream."
        external:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ExternalDestination"
          description: "Delivery to an external endpoint."
      description: "The delivery destination for a log sink — exactly one arm is set,\
        \ describing how the lines are\n delivered (by archive, by stream, or to an\
        \ external endpoint)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.SlackReceiver:
      required:
      - "channel"
      - "credential_ref"
      type: "object"
      properties:
        channel:
          type: "string"
          description: "The Slack channel fired alerts are delivered to."
        credential_ref:
          type: "string"
          description: "A weak reference to the Slack credential (never an inline\
            \ secret)."
      description: "Slack delivery: a channel plus a credential reference."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.StreamDestination:
      required:
      - "name"
      type: "object"
      properties:
        name:
          type: "string"
          description: "The downstream stream name."
      description: "Stream delivery: a named downstream stream."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Trace:
      type: "object"
      properties:
        trace_id:
          type: "string"
          description: "The trace id."
        spans:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.TraceSpan"
          description: "The spans that make up the trace."
      description: "Trace\n\n A full distributed trace."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.TraceSpan:
      type: "object"
      properties:
        span_id:
          type: "string"
          description: "The span id."
        parent_span_id:
          type: "string"
          description: "The parent span id; empty for the root span."
        service_name:
          type: "string"
          description: "The service that produced the span."
        operation_name:
          type: "string"
          description: "The operation the span represents."
        start_time:
          type: "string"
          description: "When the span started."
          format: "date-time"
        duration:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "How long the span took."
      description: "TraceSpan\n\n A single span within a trace."
    com.qibdo.cloud.observability.infrastructure.integration.v1.schema.WebhookReceiver:
      required:
      - "url"
      type: "object"
      properties:
        url:
          type: "string"
          description: "The callback URL fired alerts are POSTed to."
      description: "Webhook delivery: a generic HTTP callback URL."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.GetServiceGraphResponse:
      type: "object"
      properties:
        service_graph:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ServiceGraph"
          description: "The service-dependency graph."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the query."
          format: "enum"
      description: "GetServiceGraphResponse\n\n Response for GetServiceGraph."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.GetTraceResponse:
      type: "object"
      properties:
        trace:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Trace"
          description: "The full trace."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the query."
          format: "enum"
      description: "GetTraceResponse\n\n Response for GetTrace."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListActivitiesResponse:
      type: "object"
      properties:
        activities:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ActivityRecord"
          description: "The list of activities."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListActivitiesResponse\n\n Response message for ListActivities.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListAlertRulesResponse:
      type: "object"
      properties:
        alert_rules:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.AlertRule"
          description: "The list of alert rules."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListAlertRulesResponse\n\n Response for ListAlertRules. Keyset\
        \ pagination intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListIngestionConfigsResponse:
      type: "object"
      properties:
        ingestion_configs:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.IngestionConfig"
          description: "The list of ingestion configs."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListIngestionConfigsResponse\n\n Response for ListIngestionConfigs.\
        \ Keyset pagination intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListLogSinksResponse:
      type: "object"
      properties:
        log_sinks:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogSink"
          description: "The list of log sinks."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListLogSinksResponse\n\n Response for ListLogSinks. Keyset pagination\
        \ intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListLogStreamsResponse:
      type: "object"
      properties:
        streams:
          type: "array"
          items:
            type: "string"
          description: "The distinct log streams (label dimensions)."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the listing."
          format: "enum"
      description: "ListLogStreamsResponse\n\n Response for ListLogStreams."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListMetricDescriptorsResponse:
      type: "object"
      properties:
        descriptors:
          type: "array"
          items:
            type: "string"
          description: "The metric names."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the listing."
          format: "enum"
      description: "ListMetricDescriptorsResponse\n\n Response for ListMetricDescriptors."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListMetricLabelsResponse:
      type: "object"
      properties:
        labels:
          type: "array"
          items:
            type: "string"
          description: "The label names."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the listing."
          format: "enum"
      description: "ListMetricLabelsResponse\n\n Response for ListMetricLabels."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListObservabilityOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.ObservabilityOperation"
          description: "The list of operations."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListObservabilityOperationsResponse\n\n Response for ListOperations.\
        \ Keyset pagination intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListRetentionPoliciesResponse:
      type: "object"
      properties:
        retention_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.RetentionPolicy"
          description: "The list of retention policies."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListRetentionPoliciesResponse\n\n Response for ListRetentionPolicies.\
        \ Keyset pagination intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.ListSilencesResponse:
      type: "object"
      properties:
        silences:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Silence"
          description: "The list of silences."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page; empty when there are no\
            \ further pages."
      description: "ListSilencesResponse\n\n Response for ListSilences. Keyset pagination\
        \ intentionally omits total_size (AIP-158)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryLogsRequest:
      required:
      - "workspace"
      - "engine"
      - "query"
      - "start"
      - "end"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
            \ query across\n every workspace under `organisation` the caller may read\
            \ (AIP-159; read-only)."
        engine:
          type: "string"
          description: "The provider: qibdo, aws, gcp, or azure."
        query:
          type: "string"
          description: "The native log query expression (LogQL for the qibdo engine)."
        start:
          type: "string"
          description: "Start of the query window (inclusive)."
          format: "date-time"
        end:
          type: "string"
          description: "End of the query window (exclusive)."
          format: "date-time"
        limit:
          type: "integer"
          description: "Maximum lines to return."
          format: "int32"
        filter:
          type: "string"
          description: "AIP-160 filter expression."
        order_by:
          type: "string"
          description: "AIP-132 order_by expression (e.g. 'timestamp desc')."
        organisation:
          type: "string"
          description: "The organisation to federate across when `workspace` is '-'.\
            \ Required (and authorized at\n organisation scope) for an organisation-wide\
            \ query; ignored for a single-workspace query."
      description: "QueryLogsRequest\n\n Request for QueryLogs."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryLogsResponse:
      type: "object"
      properties:
        entries:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogEntry"
          description: "The matching log lines."
        next_page_token:
          type: "string"
          description: "The continuation cursor, empty when this is the last page."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the query."
          format: "enum"
      description: "QueryLogsResponse\n\n Response for QueryLogs."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsRangeRequest:
      required:
      - "workspace"
      - "engine"
      - "query"
      - "start"
      - "end"
      - "step"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
            \ query across\n every workspace under `organisation` the caller may read\
            \ (AIP-159; read-only)."
        engine:
          type: "string"
          description: "The provider: qibdo, aws, gcp, or azure."
        query:
          type: "string"
          description: "The native metric query expression (PromQL for the qibdo engine)."
        start:
          type: "string"
          description: "Start of the query window (inclusive)."
          format: "date-time"
        end:
          type: "string"
          description: "End of the query window (exclusive)."
          format: "date-time"
        step:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Resolution step between evaluations."
        filter:
          type: "string"
          description: "AIP-160 filter expression."
        organisation:
          type: "string"
          description: "The organisation to federate across when `workspace` is '-'.\
            \ Required (and authorized at\n organisation scope) for an organisation-wide\
            \ query; ignored for a single-workspace query."
      description: "QueryMetricsRangeRequest\n\n Request for QueryMetricsRange."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsRequest:
      required:
      - "workspace"
      - "engine"
      - "query"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
            \ query across\n every workspace under `organisation` the caller may read\
            \ (AIP-159; read-only)."
        engine:
          type: "string"
          description: "The provider: qibdo, aws, gcp, or azure."
        query:
          type: "string"
          description: "The native metric query expression (PromQL for the qibdo engine)."
        time:
          type: "string"
          description: "The instant to evaluate at; defaults to now when unset."
          format: "date-time"
        filter:
          type: "string"
          description: "AIP-160 filter expression."
        organisation:
          type: "string"
          description: "The organisation to federate across when `workspace` is '-'.\
            \ Required (and authorized at\n organisation scope) for an organisation-wide\
            \ query; ignored for a single-workspace query."
      description: "QueryMetricsRequest\n\n Request for QueryMetrics (instant)."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.QueryMetricsResponse:
      type: "object"
      properties:
        mode:
          enum:
          - "METRIC_QUERY_MODE_UNSPECIFIED"
          - "METRIC_QUERY_MODE_INSTANT"
          - "METRIC_QUERY_MODE_RANGE"
          type: "string"
          description: "Whether the result was evaluated at an instant or across a\
            \ window."
          format: "enum"
        series:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.MetricSeries"
          description: "The matching series."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the query."
          format: "enum"
      description: "QueryMetricsResponse\n\n Response for QueryMetrics / QueryMetricsRange."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.SearchTracesRequest:
      required:
      - "workspace"
      - "engine"
      - "query"
      - "start"
      - "end"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose telemetry is queried, or '-' for an organisation-wide\
            \ query across\n every workspace under `organisation` the caller may read\
            \ (AIP-159; read-only)."
        engine:
          type: "string"
          description: "The provider: qibdo, aws, gcp, or azure."
        query:
          type: "string"
          description: "The native trace search expression (TraceQL for the qibdo\
            \ engine)."
        start:
          type: "string"
          description: "Start of the query window (inclusive)."
          format: "date-time"
        end:
          type: "string"
          description: "End of the query window (exclusive)."
          format: "date-time"
        page_size:
          type: "integer"
          description: "Maximum traces per page."
          format: "int32"
        page_token:
          type: "string"
          description: "A page token from a previous SearchTraces call."
        filter:
          type: "string"
          description: "AIP-160 filter expression."
        order_by:
          type: "string"
          description: "AIP-132 order_by expression."
        organisation:
          type: "string"
          description: "The organisation to federate across when `workspace` is '-'.\
            \ Required (and authorized at\n organisation scope) for an organisation-wide\
            \ query; ignored for a single-workspace query."
      description: "SearchTracesRequest\n\n Request for SearchTraces."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.SearchTracesResponse:
      type: "object"
      properties:
        traces:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.Trace"
          description: "The matching traces."
        next_page_token:
          type: "string"
          description: "The continuation cursor, empty when this is the last page."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The provider that served the query."
          format: "enum"
      description: "SearchTracesResponse\n\n Response for SearchTraces."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.TailLogsRequest:
      required:
      - "workspace"
      - "engine"
      - "query"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose telemetry is tailed. Live tail is single-workspace\
            \ only: the\n organisation-wide '-' wildcard is rejected (cross-workspace\
            \ access is read-only)."
        engine:
          type: "string"
          description: "The provider: qibdo, aws, gcp, or azure (the wildcard '-'\
            \ is not allowed for tail)."
        query:
          type: "string"
          description: "The native log query expression (LogQL for the qibdo engine)."
        filter:
          type: "string"
          description: "AIP-160 filter expression."
      description: "TailLogsRequest\n\n Request for TailLogs."
    com.qibdo.cloud.observability.infrastructure.integration.v1.service.TailLogsResponse:
      type: "object"
      properties:
        entry:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.observability.infrastructure.integration.v1.schema.LogEntry"
          description: "The log line."
      description: "TailLogsResponse\n\n One streamed log line from a live tail."
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy:
      required:
      - "scope_type"
      - "scope_id"
      - "principal_id"
      - "principal_type"
      - "actions"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        scope_type:
          enum:
          - "POLICY_SCOPE_TYPE_UNSPECIFIED"
          - "POLICY_SCOPE_TYPE_NAMESPACE"
          - "POLICY_SCOPE_TYPE_REPOSITORY"
          type: "string"
          format: "enum"
        scope_id:
          type: "string"
        principal_id:
          type: "string"
        principal_type:
          enum:
          - "PRINCIPAL_TYPE_UNSPECIFIED"
          - "PRINCIPAL_TYPE_USER"
          - "PRINCIPAL_TYPE_GROUP"
          - "PRINCIPAL_TYPE_SERVICE_ACCOUNT"
          type: "string"
          format: "enum"
        actions:
          type: "array"
          items:
            enum:
            - "REGISTRY_ACTION_UNSPECIFIED"
            - "REGISTRY_ACTION_PULL"
            - "REGISTRY_ACTION_PUSH"
            - "REGISTRY_ACTION_DELETE"
            - "REGISTRY_ACTION_ADMIN"
            type: "string"
            format: "enum"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.Artifact:
      type: "object"
      properties:
        digest:
          readOnly: true
          type: "string"
          description: "Content-derived identifier (`sha256:…`). Stable for the lifetime\
            \ of the manifest."
        repository_id:
          readOnly: true
          type: "string"
          description: "Parent repository UUID — identifies the repository this artifact\
            \ lives in."
        size_bytes:
          readOnly: true
          type: "string"
          description: "Total size of the manifest plus its referenced blobs, in bytes."
        media_type:
          readOnly: true
          type: "string"
          description: "OCI media type (e.g. `application/vnd.oci.image.manifest.v1+json`)."
        tags:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.Tag"
          description: "All tags currently pointing at this manifest (the registry\
            \ returns these inline via\n `?with_tag=true`). Empty when the artifact\
            \ is referenced only by digest."
        pushed_at:
          readOnly: true
          type: "string"
          description: "When the manifest was first pushed."
          format: "date-time"
        pulled_at:
          readOnly: true
          type: "string"
          description: "Most recent pull time, if any."
          format: "date-time"
        scan_status:
          readOnly: true
          enum:
          - "ARTIFACT_SCAN_STATUS_UNSPECIFIED"
          - "ARTIFACT_SCAN_STATUS_NOT_SCANNED"
          - "ARTIFACT_SCAN_STATUS_SCANNING"
          - "ARTIFACT_SCAN_STATUS_SCANNED"
          - "ARTIFACT_SCAN_STATUS_FAILED"
          type: "string"
          description: "Latest scan status reported by the configured scanner."
          format: "enum"
      description: "An OCI artifact: a manifest (the JSON document the registry stores)\
        \ plus the blobs it\n references (image layers, configs). Identified by content-derived\
        \ digest. May have\n zero or more tags pointing at it; deleting a tag does\
        \ not delete the artifact."
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ArtifactScanReport:
      type: "object"
      properties:
        digest:
          readOnly: true
          type: "string"
        status:
          readOnly: true
          enum:
          - "ARTIFACT_SCAN_STATUS_UNSPECIFIED"
          - "ARTIFACT_SCAN_STATUS_NOT_SCANNED"
          - "ARTIFACT_SCAN_STATUS_SCANNING"
          - "ARTIFACT_SCAN_STATUS_SCANNED"
          - "ARTIFACT_SCAN_STATUS_FAILED"
          type: "string"
          format: "enum"
        scanned_at:
          readOnly: true
          type: "string"
          format: "date-time"
        critical_count:
          readOnly: true
          type: "integer"
          format: "int32"
        high_count:
          readOnly: true
          type: "integer"
          format: "int32"
        medium_count:
          readOnly: true
          type: "integer"
          format: "int32"
        low_count:
          readOnly: true
          type: "integer"
          format: "int32"
        findings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.VulnerabilityFinding"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AuditEntry:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        actor_id:
          readOnly: true
          type: "string"
        actor_type:
          readOnly: true
          type: "string"
        action:
          readOnly: true
          type: "string"
        resource_type:
          readOnly: true
          type: "string"
        resource_id:
          readOnly: true
          type: "string"
        resource_name:
          readOnly: true
          type: "string"
        workspace_id:
          readOnly: true
          type: "string"
        timestamp:
          readOnly: true
          type: "string"
          format: "date-time"
        outcome:
          readOnly: true
          type: "string"
        metadata:
          readOnly: true
          type: "object"
          additionalProperties:
            type: "string"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.CrossNamespaceGrant:
      required:
      - "source_namespace_id"
      - "target_namespace_id"
      - "actions"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        source_namespace_id:
          type: "string"
        target_namespace_id:
          type: "string"
        actions:
          type: "array"
          items:
            enum:
            - "REGISTRY_ACTION_UNSPECIFIED"
            - "REGISTRY_ACTION_PULL"
            - "REGISTRY_ACTION_PUSH"
            - "REGISTRY_ACTION_DELETE"
            - "REGISTRY_ACTION_ADMIN"
            type: "string"
            format: "enum"
        expires_at:
          type: "string"
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
        tag_pattern:
          type: "string"
          description: "Optional Registry-specific tag limiter constraining which\
            \ image tags the\n grant covers (e.g. \"release-*\"). Empty means the\
            \ grant is unrestricted."
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.DeploymentLock:
      required:
      - "digest"
      - "deployment_context"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        repository_id:
          readOnly: true
          type: "string"
        digest:
          type: "string"
        deployment_context:
          type: "string"
        expires_at:
          type: "string"
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryCredential:
      type: "object"
      properties:
        registry_url:
          readOnly: true
          type: "string"
        username:
          readOnly: true
          type: "string"
        password:
          readOnly: true
          type: "string"
        expires_at:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        resource_id:
          readOnly: true
          type: "string"
        resource_type:
          readOnly: true
          type: "string"
        operation_type:
          readOnly: true
          enum:
          - "REGISTRY_OPERATION_TYPE_UNSPECIFIED"
          - "REGISTRY_OPERATION_TYPE_CREATE"
          - "REGISTRY_OPERATION_TYPE_UPDATE"
          - "REGISTRY_OPERATION_TYPE_DELETE"
          - "REGISTRY_OPERATION_TYPE_TRIGGER"
          type: "string"
          format: "enum"
        status:
          readOnly: true
          enum:
          - "REGISTRY_OPERATION_STATUS_UNSPECIFIED"
          - "REGISTRY_OPERATION_STATUS_PENDING"
          - "REGISTRY_OPERATION_STATUS_RUNNING"
          - "REGISTRY_OPERATION_STATUS_DONE"
          - "REGISTRY_OPERATION_STATUS_ERROR"
          type: "string"
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperationError"
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperationWarning"
        progress:
          readOnly: true
          type: "integer"
          format: "int32"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperationError:
      type: "object"
      properties:
        code:
          type: "integer"
          format: "uint32"
        description:
          type: "string"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperationWarning:
      type: "object"
      properties:
        code:
          type: "integer"
          format: "uint32"
        description:
          type: "string"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionPolicy:
      required:
      - "rules"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        repository_id:
          readOnly: true
          type: "string"
        rules:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionRule"
        schedule:
          type: "string"
        enabled:
          type: "boolean"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionRule:
      type: "object"
      properties:
        keep_last_n:
          type: "integer"
          format: "int32"
        keep_newer_than_days:
          type: "integer"
          format: "int32"
        keep_tag_pattern:
          type: "string"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy:
      required:
      - "scope_type"
      - "scope_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        scope_type:
          enum:
          - "POLICY_SCOPE_TYPE_UNSPECIFIED"
          - "POLICY_SCOPE_TYPE_NAMESPACE"
          - "POLICY_SCOPE_TYPE_REPOSITORY"
          type: "string"
          format: "enum"
        scope_id:
          type: "string"
        auto_scan_on_push:
          type: "boolean"
        block_on_critical_cve:
          type: "boolean"
        cve_allowlist:
          type: "array"
          items:
            type: "string"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.Tag:
      type: "object"
      properties:
        name:
          readOnly: true
          type: "string"
          description: "The tag name as understood by `docker pull foo:<name>`. Unique\
            \ per repository."
        digest:
          readOnly: true
          type: "string"
          description: "The digest of the manifest this tag currently points at."
        pushed_at:
          readOnly: true
          type: "string"
          description: "When this tag was last pushed (i.e. the most recent `docker\
            \ push image:<name>`)."
          format: "date-time"
        immutable:
          readOnly: true
          type: "boolean"
          description: "True when the repository's immutable-tag policy applies to\
            \ this tag — the registry\n refuses to overwrite it on push."
      description: "A mutable label that points at an artifact's manifest digest.\
        \ Multiple tags can point\n at the same digest; deleting a tag (DeleteTag)\
        \ does not delete the underlying manifest\n unless it was the last reference."
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.VulnerabilityFinding:
      type: "object"
      properties:
        cve_id:
          type: "string"
        severity:
          type: "string"
        package_name:
          type: "string"
        affected_version:
          type: "string"
        fixed_version:
          type: "string"
        description:
          type: "string"
        advisory_url:
          type: "string"
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoImageRepository:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        namespace_id:
          readOnly: true
          type: "string"
        name:
          type: "string"
        description:
          type: "string"
        visibility:
          enum:
          - "VISIBILITY_UNSPECIFIED"
          - "VISIBILITY_PRIVATE"
          - "VISIBILITY_PUBLIC"
          type: "string"
          format: "enum"
        immutable_tags:
          type: "boolean"
        format:
          readOnly: true
          enum:
          - "REPOSITORY_FORMAT_UNSPECIFIED"
          - "REPOSITORY_FORMAT_DOCKER"
          - "REPOSITORY_FORMAT_HELM"
          - "REPOSITORY_FORMAT_OCI"
          type: "string"
          format: "enum"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
      description: "format: set at creation time, not updatable. Enforced at handler\
        \ level via UpdateFieldMapping.immutableFields()."
    com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoNamespace:
      required:
      - "name"
      - "region_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
        workspace_id:
          readOnly: true
          type: "string"
        name:
          type: "string"
        description:
          type: "string"
        region_id:
          type: "string"
        registry_url:
          readOnly: true
          type: "string"
        created:
          readOnly: true
          type: "string"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          format: "date-time"
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListArtifactsResponse:
      type: "object"
      properties:
        artifacts:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.Artifact"
          description: "The list of artifacts under the requested repository."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListArtifactsResponse\n\n Response message for ListArtifacts.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListAuditEntriesResponse:
      type: "object"
      properties:
        audit_entries:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AuditEntry"
          description: "The list of audit entries."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListAuditEntriesResponse\n\n Response message for ListAuditEntries.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListCrossNamespaceGrantsResponse:
      type: "object"
      properties:
        cross_namespace_grants:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.CrossNamespaceGrant"
        next_page_token:
          type: "string"
      description: "ListCrossNamespaceGrantsResponse\n\n Response message for ListCrossNamespaceGrants.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListDeploymentLocksResponse:
      type: "object"
      properties:
        deployment_locks:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.DeploymentLock"
          description: "The list of deployment locks."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListDeploymentLocksResponse\n\n Response message for ListDeploymentLocks.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListNamespaceAccessPoliciesResponse:
      type: "object"
      properties:
        access_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
          description: "List of the access policies bound to the requested namespace."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListNamespaceAccessPoliciesResponse\n\n Response message for ListNamespaceAccessPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListNamespaceScanPoliciesResponse:
      type: "object"
      properties:
        scan_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        next_page_token:
          type: "string"
      description: "ListNamespaceScanPoliciesResponse\n\n Response message for ListNamespaceScanPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRegistryOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RegistryOperation"
          description: "The list of operations."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListRegistryOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRepositoryAccessPoliciesResponse:
      type: "object"
      properties:
        access_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.AccessPolicy"
          description: "List of the access policies bound to the requested repository."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListRepositoryAccessPoliciesResponse\n\n Response message for\
        \ ListRepositoryAccessPolicies.\n Note: This API intentionally omits `total_size`\
        \ from list responses.\n Keyset pagination does not support efficient total\
        \ count computation\n (COUNT(*) requires a full table scan). Per AIP-158,\
        \ total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRepositoryScanPoliciesResponse:
      type: "object"
      properties:
        scan_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.ScanPolicy"
        next_page_token:
          type: "string"
      description: "ListRepositoryScanPoliciesResponse\n\n Response message for ListRepositoryScanPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.ListRetentionPoliciesResponse:
      type: "object"
      properties:
        retention_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.RetentionPolicy"
          description: "The list of retention policies."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListRetentionPoliciesResponse\n\n Response message for ListRetentionPolicies.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.TriggerScanRequest:
      required:
      - "workspace"
      - "namespace"
      - "repository"
      - "reference"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The unique identifier of the workspace that the repository\
            \ belongs to"
        namespace:
          type: "string"
          description: "The unique identifier of the namespace that the repository\
            \ belongs to"
        repository:
          type: "string"
          description: "The unique identifier of the parent repository"
        reference:
          type: "string"
          description: "Digest or tag identifying the artifact to scan"
      description: "TriggerScanRequest\n\n Request message for TriggerScan. Identifies\
        \ the artifact to scan;\n `reference` is digest or tag."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.qibdo.ListQibdoImageRepositoriesResponse:
      type: "object"
      properties:
        repositories:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoImageRepository"
          description: "The list of image repositories."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListQibdoImageRepositoriesResponse\n\n Response message for ListQibdoImageRepositories.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.registry.infrastructure.integration.v1.service.qibdo.ListQibdoNamespacesResponse:
      type: "object"
      properties:
        namespaces:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.registry.infrastructure.integration.v1.schema.qibdo.QibdoNamespace"
          description: "The list of namespaces."
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListQibdoNamespacesResponse\n\n Response message for ListQibdoNamespaces.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.Bucket:
      required:
      - "name"
      - "location_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the bucket"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this bucket belongs to"
        name:
          type: "string"
          description: "The bucket name (3–26 chars, lowercase alphanumeric and hyphens\
            \ only).\n Must match ^[a-z0-9][a-z0-9\\-]{1,24}[a-z0-9]$ — the 26-char\
            \ limit derives\n from the 63-char S3 bucket name limit minus the 37-char\
            \ {workspaceId}-\n prefix (UUID = 36 chars + separator)."
        description:
          type: "string"
          description: "An optional human-readable description of the bucket"
        location_id:
          type: "string"
          description: "Weak reference to a topology Location — the region where the\
            \ bucket's data\n resides. A shared concept across providers, so it lives\
            \ at the top level\n rather than in a provider-specific arm."
        default_storage_class_id:
          type: "string"
          description: "Weak reference to storage.storage_classes — the default storage\
            \ class for objects in this\n bucket. Optional; when omitted the bucket\
            \ inherits the global default tier."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider this bucket is provisioned on."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the bucket was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the bucket was last updated"
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.QibdoBucketSpec"
          description: "Attributes specific to a Qibdo-managed bucket."
      description: "A bucket is a workspace-scoped container that holds a set of stored\
        \ objects.\n Buckets can be provisioned across different cloud providers;\
        \ the provider a bucket\n lives on is reported by the read-only `engine` field."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.CompletedPart:
      type: "object"
      properties:
        part_number:
          type: "integer"
          description: "The part number"
          format: "int32"
        etag:
          type: "string"
          description: "The ETag returned by the storage data plane after the part\
            \ was uploaded"
      description: "A completed part of a multipart upload, identified by its part\
        \ number and ETag."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.MultipartUploadInfo:
      type: "object"
      properties:
        upload_id:
          type: "string"
          description: "The upload ID"
        object_key:
          type: "string"
          description: "The object key being uploaded"
        initiated:
          readOnly: true
          type: "string"
          description: "When the upload was initiated"
          format: "date-time"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider this upload is running on."
          format: "enum"
      description: "Information about an in-progress multipart upload."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.ObjectMetadata:
      type: "object"
      properties:
        bucket_id:
          readOnly: true
          type: "string"
          description: "The bucket this object belongs to"
        object_key:
          readOnly: true
          type: "string"
          description: "The object key (path-like string, no leading slash)"
        size:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageDataSize"
          description: "Object size"
        content_type:
          type: "string"
          description: "MIME type (e.g. \"application/octet-stream\")"
        etag:
          readOnly: true
          type: "string"
          description: "Entity tag (checksum)"
        last_modified:
          readOnly: true
          type: "string"
          description: "Timestamp when the object was last modified"
        content_md5:
          readOnly: true
          type: "string"
          description: "Base64-encoded MD5 digest of the object content (nullable\
            \ for multipart uploads)"
        metadata:
          type: "object"
          additionalProperties:
            type: "string"
          description: "Arbitrary key-value user metadata"
        storage_class:
          readOnly: true
          type: "string"
          description: "Storage class or tier (provider-specific string, e.g. STANDARD,\
            \ GLACIER)"
        version_id:
          readOnly: true
          type: "string"
          description: "Version identifier (format varies by provider)"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider this object is stored on."
          format: "enum"
      description: "Metadata describing a stored object. Returned by the storage data\
        \ plane on\n head, get, and put responses."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.QibdoBucketSpec:
      type: "object"
      properties:
        versioning_enabled:
          type: "boolean"
          description: "Whether object versioning is enabled on this bucket (default\
            \ false).\n Kept provider-specific rather than shared at the top level."
      description: "Provider-specific attributes for a Qibdo-managed bucket, carried\
        \ in\n `Bucket.for_engine` when the bucket's provider is Qibdo."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.QibdoStorageClassSpec:
      required:
      - "redundancy"
      - "performance_class"
      type: "object"
      properties:
        redundancy:
          enum:
          - "REDUNDANCY_UNSPECIFIED"
          - "REDUNDANCY_REPLICATED_2"
          - "REDUNDANCY_REPLICATED_3"
          - "REDUNDANCY_REPLICATED_4"
          - "REDUNDANCY_ERASURE_CODED_2_1"
          - "REDUNDANCY_ERASURE_CODED_4_2"
          - "REDUNDANCY_ERASURE_CODED_6_3"
          - "REDUNDANCY_ERASURE_CODED_8_3"
          type: "string"
          description: "The redundancy scheme the tier guarantees (replication factor\
            \ or erasure-coding profile)."
          format: "enum"
        performance_class:
          enum:
          - "PERFORMANCE_CLASS_UNSPECIFIED"
          - "PERFORMANCE_CLASS_STANDARD"
          - "PERFORMANCE_CLASS_FAST_SSD"
          - "PERFORMANCE_CLASS_FAST_NVME"
          - "PERFORMANCE_CLASS_ARCHIVE"
          type: "string"
          description: "The performance class the tier targets (media tier)."
          format: "enum"
        compression_type:
          type: "string"
          description: "The compression type for data in this storage class (NONE,\
            \ SNAPPY, ZLIB, ZSTD, LZ4)"
      description: "Provider-specific attributes for a Qibdo-managed storage class,\
        \ carried in\n `StorageClass.for_engine` when the storage class's provider\
        \ is Qibdo. Carries durability\n intent — the redundancy scheme and performance\
        \ class the tier guarantees — never a pool."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageClass:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the storage class"
        name:
          type: "string"
          description: "The storage class name (1–64 chars, uppercase alphanumeric\
            \ and underscores).\n Must match ^[A-Z][A-Z0-9_]{0,63}$. Examples: STANDARD,\
            \ REDUCED_REDUNDANCY, ARCHIVE."
        display_name:
          type: "string"
          description: "An optional human-readable label for the storage class. Free\
            \ text, mutable, and not an\n identifier — use `name` to address the tier."
        description:
          type: "string"
          description: "An optional human-readable description of the storage class"
        is_default:
          type: "boolean"
          description: "Whether this is the global default tier for its provider.\
            \ Buckets that omit a storage\n class inherit the default. At most one\
            \ default exists per provider."
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider this storage class is provisioned on."
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the storage class was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the storage class was last updated"
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.QibdoStorageClassSpec"
          description: "Attributes specific to a Qibdo-managed storage class."
      description: "A storage class is a global storage tier — declared once, it carries\
        \ the durability\n intent (redundancy + performance class) and compression\
        \ a bucket may select, independent\n of any region. The tier is materialized\
        \ into each region's backing store on demand; the\n per-region readiness is\
        \ reported separately by the storage class instance. Storage classes\n can\
        \ be defined across different cloud providers; the provider is reported by\
        \ the read-only\n `engine` field."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageDataSize:
      required:
      - "size"
      - "unit"
      type: "object"
      properties:
        size:
          type: "number"
          description: "Size of the object\n\n Is the numerical size of an object"
          format: "double"
        unit:
          enum:
          - "STORAGE_DATA_UNIT_UNSPECIFIED"
          - "BYTES"
          - "KIB"
          - "MIB"
          - "GIB"
          - "TIB"
          - "PIB"
          - "EIB"
          - "KB"
          - "MB"
          - "GB"
          - "TB"
          - "PB"
          - "EB"
          type: "string"
          format: "enum"
      description: "Storage Data Size\n\n Represents the size of a storage object\
        \ in different information units."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Unique operation identifier"
        resource_id:
          readOnly: true
          type: "string"
          description: "The ID of the affected resource (bucket ID; null for object-only\
            \ ops)"
        resource_type:
          readOnly: true
          type: "string"
          description: "The type of resource (\"Bucket\" or \"Object\")"
        operation_type:
          readOnly: true
          type: "string"
          description: "The operation type (CREATE, UPDATE, DELETE, COPY)"
        status:
          readOnly: true
          type: "string"
          description: "The operation status (PENDING, RUNNING, DONE, ERROR)"
        insert_time:
          readOnly: true
          type: "string"
          description: "When the operation was created"
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "When execution started"
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "When execution completed"
          format: "date-time"
        progress:
          readOnly: true
          type: "integer"
          description: "Progress percentage (0–100)"
          format: "int32"
      description: "StorageOperation tracks the result of a storage command (bucket\
        \ or object operation)."
    com.qibdo.cloud.storage.infrastructure.integration.v1.schema.qibdo.QibdoStorageClassInstance:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of this instance (UUID)"
        storage_class_id:
          readOnly: true
          type: "string"
          description: "The storage class tier this instance materializes (UUID)"
        location_id:
          readOnly: true
          type: "string"
          description: "The region this instance materializes the tier into — weak\
            \ reference to a topology\n Location of kind REGION (UUID)."
        status:
          readOnly: true
          enum:
          - "STORAGE_CLASS_INSTANCE_STATUS_UNSPECIFIED"
          - "STORAGE_CLASS_INSTANCE_STATUS_PENDING"
          - "STORAGE_CLASS_INSTANCE_STATUS_AVAILABLE"
          - "STORAGE_CLASS_INSTANCE_STATUS_UNSUPPORTED"
          - "STORAGE_CLASS_INSTANCE_STATUS_FAILED"
          type: "string"
          description: "Current provisioning status of this instance."
          format: "enum"
        data_pool:
          readOnly: true
          type: "string"
          description: "The backing data pool placement reference, empty until the\
            \ instance is AVAILABLE."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when this instance was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when this instance was last updated (server-managed)."
          format: "date-time"
      description: "The per-region materialization of a global storage class tier\
        \ — the reconciler-managed\n record of whether that tier is actually provisioned\
        \ in one region's backing store. A tier\n is declared once, globally; an instance\
        \ answers \"is the tier ready in region R, and where\".\n qibdo-only: AWS,\
        \ GCP, and Azure storage classes are globally available with no per-region\
        \ instance."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.CompleteMultipartUploadRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "upload_id"
      - "parts"
      - "object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the bucket belongs to"
        engine:
          type: "string"
          description: "The cloud provider: qibdo, aws, gcp, or azure"
        bucket:
          type: "string"
          description: "The bucket containing the multipart upload"
        upload_id:
          type: "string"
          description: "The multipart upload ID"
        parts:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.CompletedPart"
          description: "The completed parts with their ETags"
        object_key:
          type: "string"
          description: "The object key for the multipart upload"
      description: "CompleteMultipartUploadRequest\n\n Request message for CompleteMultipartUpload.\
        \ Carries the parent upload reference and the list\n of completed parts with\
        \ their ETags."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.CopyObjectRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "source_object_key"
      - "dest_bucket"
      - "dest_object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace (both source and destination buckets must belong\
            \ to this workspace)"
        engine:
          type: "string"
          description: "The cloud provider: qibdo, aws, gcp, or azure"
        bucket:
          type: "string"
          description: "Source bucket (bound from the URL path)"
        source_object_key:
          type: "string"
          description: "Source object key"
        dest_bucket:
          type: "string"
          description: "Destination bucket"
        dest_object_key:
          type: "string"
          description: "Destination object key"
      description: "CopyObjectRequest\n\n Request message for CopyObject. Carries\
        \ the source (bucket, key) and the destination\n (bucket, key); both must\
        \ be in the same workspace."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.GenerateDownloadUrlRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the bucket belongs to"
        engine:
          type: "string"
          description: "The cloud provider: qibdo, aws, gcp, or azure"
        bucket:
          type: "string"
          description: "The bucket to generate the download URL for"
        object_key:
          type: "string"
          description: "The object key to download"
        expiry:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "URL validity duration (default 1h, max 24h)"
      description: "GenerateDownloadUrlRequest\n\n Request message for GenerateDownloadUrl.\
        \ Carries the parent workspace and bucket, the target\n cloud provider, the\
        \ object key, and the URL validity duration."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.GeneratePartUploadUrlRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "upload_id"
      - "part_number"
      - "object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the bucket belongs to"
        engine:
          type: "string"
          description: "The cloud provider: qibdo, aws, gcp, or azure"
        bucket:
          type: "string"
          description: "The bucket containing the multipart upload"
        upload_id:
          type: "string"
          description: "The multipart upload ID"
        part_number:
          type: "integer"
          description: "The part number (1–10000)"
          format: "int32"
        expiry:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "URL validity duration (default 1h)"
        object_key:
          type: "string"
          description: "The object key for the multipart upload"
      description: "GeneratePartUploadUrlRequest\n\n Request message for GeneratePartUploadUrl.\
        \ Carries the parent upload reference, the part\n number, and an optional\
        \ URL-validity duration."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.GenerateUploadUrlRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the bucket belongs to"
        engine:
          type: "string"
          description: "The cloud provider: qibdo, aws, gcp, or azure"
        bucket:
          type: "string"
          description: "The bucket to generate the upload URL for"
        object_key:
          type: "string"
          description: "The object key for the upload"
        content_type:
          type: "string"
          description: "Optional MIME type restriction for the upload"
        expiry:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "URL validity duration (default 1h, max 24h)"
      description: "GenerateUploadUrlRequest\n\n Request message for GenerateUploadUrl.\
        \ Carries the parent workspace and bucket, the target\n cloud provider, the\
        \ object key, an optional content type, and the URL validity duration."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.GetObjectResponse:
      type: "object"
      properties:
        metadata:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.ObjectMetadata"
          description: "Object metadata (only in the first chunk)"
        data:
          type: "string"
          description: "Streamed data chunks"
          format: "bytes"
      description: "GetObjectResponse\n\n Response message for GetObject. Uses gRPC\
        \ server streaming: the first message\n carries metadata, and subsequent messages\
        \ carry data chunks."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.InitiateMultipartUploadRequest:
      required:
      - "workspace"
      - "engine"
      - "bucket"
      - "object_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the bucket belongs to"
        engine:
          type: "string"
          description: "The cloud provider to initiate the upload on: qibdo, aws,\
            \ gcp, or azure"
        bucket:
          type: "string"
          description: "The bucket to initiate the upload in"
        object_key:
          type: "string"
          description: "The object key for the multipart upload"
        content_type:
          type: "string"
          description: "Optional MIME type for the final object"
      description: "InitiateMultipartUploadRequest\n\n Request message for InitiateMultipartUpload.\
        \ Carries the parent workspace and bucket, the\n target cloud provider, the\
        \ object key, and an optional content type."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.InitiateMultipartUploadResponse:
      type: "object"
      properties:
        upload_id:
          type: "string"
          description: "The generated upload ID"
        object_key:
          type: "string"
          description: "The object key"
        bucket:
          type: "string"
          description: "The bucket name"
      description: "InitiateMultipartUploadResponse\n\n Response message for InitiateMultipartUpload.\
        \ Carries the generated upload ID, the object key,\n and the bucket name."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListBucketsResponse:
      type: "object"
      properties:
        buckets:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.Bucket"
          description: "The list of buckets"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page. If this field is\n empty, there are no subsequent pages."
      description: "ListBucketsResponse\n\n Response message for ListBuckets.\n Note:\
        \ This API intentionally omits `total_size` from list responses. Keyset pagination\
        \ does\n not support efficient total count computation (COUNT(*) requires\
        \ a full table scan). Per\n AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListMultipartUploadsResponse:
      type: "object"
      properties:
        uploads:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.MultipartUploadInfo"
          description: "The list of in-progress multipart uploads"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListMultipartUploadsResponse\n\n Response message for ListMultipartUploads.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListObjectsResponse:
      type: "object"
      properties:
        objects:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.ObjectMetadata"
          description: "The list of objects matching the query"
        common_prefixes:
          type: "array"
          items:
            type: "string"
          description: "Directory-like prefixes when a delimiter is set"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
        is_truncated:
          type: "boolean"
          description: "Whether the result set was truncated"
      description: "ListObjectsResponse\n\n Response message for ListObjects.\n Note:\
        \ This API intentionally omits `total_size` from list responses. Keyset\n\
        \ pagination does not support efficient total count computation (a count requires\
        \ a\n full scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListStorageClassesResponse:
      type: "object"
      properties:
        storage_classes:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageClass"
          description: "The list of storage classes"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page. If this field is\n empty, there are no subsequent pages."
      description: "ListStorageClassesResponse\n\n Response message for ListStorageClasses.\n\
        \ Note: This API intentionally omits `total_size` from list responses. Keyset\
        \ pagination does\n not support efficient total count computation (COUNT(*)\
        \ requires a full table scan). Per\n AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.ListStorageOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.StorageOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListStorageOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.PresignedUrlResponse:
      type: "object"
      properties:
        url:
          type: "string"
          description: "The pre-signed URL (direct to the storage data plane)"
        expiry_time:
          type: "string"
          description: "ISO 8601 timestamp when the URL expires"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider this URL targets"
          format: "enum"
      description: "PresignedUrlResponse\n\n Response message for GenerateUploadUrl\
        \ and GenerateDownloadUrl. Carries the pre-signed URL,\n its expiry timestamp,\
        \ and the cloud provider the URL targets."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.qibdo.InstantiateQibdoStorageClassRequest:
      required:
      - "storage_class"
      - "location_id"
      type: "object"
      properties:
        storage_class:
          type: "string"
          description: "The storage class tier to instantiate (UUID, concrete — no\
            \ wildcard)."
        location_id:
          type: "string"
          description: "The region to instantiate the tier into (UUID, topology Location\
            \ of kind REGION)."
      description: "InstantiateQibdoStorageClassRequest\n\n Request message for InstantiateQibdoStorageClass.\
        \ The storage class is the path parent; the\n region is supplied in the body."
    com.qibdo.cloud.storage.infrastructure.integration.v1.service.qibdo.ListQibdoStorageClassInstancesResponse:
      type: "object"
      properties:
        storage_class_instances:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.storage.infrastructure.integration.v1.schema.qibdo.QibdoStorageClassInstance"
          description: "The list of storage class instances."
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page, empty when there are no\
            \ more pages."
      description: "ListQibdoStorageClassInstancesResponse\n\n Response message for\
        \ ListQibdoStorageClassInstances."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Group:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the group"
        organisation_id:
          readOnly: true
          type: "string"
          description: "The organisation this group belongs to"
        name:
          type: "string"
          description: "The display name of the group"
        description:
          type: "string"
          description: "An optional description of the group"
        parent_group_id:
          type: "string"
          description: "Optional self-referential parent; empty = root-level group\
            \ under the organisation"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the group was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the group was last updated"
          format: "date-time"
      description: "Group resource — a folder that organises workspaces within an\
        \ organisation"
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Organisation:
      required:
      - "name"
      - "owner_user_id"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the organisation"
        name:
          type: "string"
          description: "The display name of the organisation"
        owner_user_id:
          type: "string"
          description: "The user ID of the organisation owner (weak reference to iam.users)"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the organisation\
            \ was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the Organisation was\
            \ last updated"
          format: "date-time"
      description: "Organisation resource"
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier for this operation."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n The ID of the resource affected by this operation.\
            \ May be empty for\n async operations where the resource does not yet\
            \ exist."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n The type of resource (e.g., \"Group\", \"\
            Organisation\", \"Workspace\")."
        operation_type:
          readOnly: true
          enum:
          - "TAXONOMY_OPERATION_TYPE_UNSPECIFIED"
          - "TAXONOMY_OPERATION_TYPE_CREATE"
          - "TAXONOMY_OPERATION_TYPE_UPDATE"
          - "TAXONOMY_OPERATION_TYPE_DELETE"
          - "TAXONOMY_OPERATION_TYPE_MOVE"
          type: "string"
          description: "Operation Type\n\n The kind of mutation that was requested."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "TAXONOMY_OPERATION_STATUS_UNSPECIFIED"
          - "TAXONOMY_OPERATION_STATUS_PENDING"
          - "TAXONOMY_OPERATION_STATUS_RUNNING"
          - "TAXONOMY_OPERATION_STATUS_DONE"
          - "TAXONOMY_OPERATION_STATUS_ERROR"
          type: "string"
          description: "Status\n\n Current lifecycle state of the operation."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was first created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When the operation started executing."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When the operation completed (either successfully\
            \ or with errors)."
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperationError"
          description: "Errors\n\n Business rule errors encountered during the operation."
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperationWarning"
          description: "Warnings\n\n Non-fatal notices about the operation."
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Percentage of completion (0-100)."
          format: "int32"
      description: "Workspace Operation\n\n An acknowledgment of a mutation request,\
        \ carrying tracking metadata,\n errors, and warnings. Follows GCP's Operations\
        \ pattern (AIP-151)."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperationError:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Error Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the error."
      description: "Operation Error\n\n A structured error returned inside an operation\
        \ when a business rule fails."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperationWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the warning."
      description: "Operation Warning\n\n A non-fatal notice attached to an operation."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Workspace:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the workspace"
        organisation_id:
          readOnly: true
          type: "string"
          description: "The organisation this workspace belongs to"
        group_id:
          type: "string"
          description: "Optional group (folder) the workspace is placed in.\n An IAM\
            \ binding scoped to that group automatically covers this workspace."
        name:
          type: "string"
          description: "The display name of the workspace"
        created:
          readOnly: true
          type: "string"
          description: "Created Timestamp\n\n The timestamp when the workspace was\
            \ created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Updated Timestamp\n\n Timestamp when the Workspace was last\
            \ updated"
          format: "date-time"
      description: "Workspace resource — the resource isolation boundary for all platform\
        \ services"
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListGroupsResponse:
      type: "object"
      properties:
        groups:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Group"
          description: "The list of groups"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListGroupsResponse\n\n Response message for ListGroups.\n Note:\
        \ This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListOrganisationsResponse:
      type: "object"
      properties:
        organisations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Organisation"
          description: "The list of organisations"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListOrganisationsResponse\n\n Response message for ListOrganisations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListTaxonomyOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.TaxonomyOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListTaxonomyOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.ListWorkspacesResponse:
      type: "object"
      properties:
        workspaces:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.taxonomy.infrastructure.integration.v1.schema.Workspace"
          description: "The list of workspaces"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListWorkspacesResponse\n\n Response message for ListWorkspaces.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.MoveGroupRequest:
      required:
      - "organisation"
      - "id"
      type: "object"
      properties:
        organisation:
          type: "string"
          description: "The organisation the group belongs to"
        id:
          type: "string"
          description: "The unique identifier of the group to move"
        parent_group_id:
          type: "string"
          description: "The new parent group ID; empty string = move to org root (no\
            \ parent)"
      description: "MoveGroupRequest\n\n Request message for MoveGroup. Reparents\
        \ a group under another group, or\n makes it a root-level group by setting\
        \ `parent_group_id` to empty string.\n Cycle detection rejects if the target\
        \ parent is the group itself or any of\n its descendants."
    com.qibdo.cloud.taxonomy.infrastructure.integration.v1.service.MoveWorkspaceRequest:
      required:
      - "organisation"
      - "id"
      type: "object"
      properties:
        organisation:
          type: "string"
          description: "The organisation the workspace belongs to"
        id:
          type: "string"
          description: "The unique identifier of the workspace to move"
        group_id:
          type: "string"
          description: "The target group ID; empty string = remove from folder (back\
            \ to org root)"
      description: "MoveWorkspaceRequest\n\n Request message for MoveWorkspace. Moves\
        \ a workspace into a group (folder),\n or out of one by setting `group_id`\
        \ to empty string."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.AiFeatures:
      type: "object"
      properties:
        tensor_cores:
          type: "integer"
          description: "The number of tensor cores (NVIDIA) or equivalent"
          format: "uint32"
        rt_cores:
          type: "integer"
          description: "The number of ray tracing cores"
          format: "uint32"
        has_dlss_support:
          type: "boolean"
          description: "Whether DLSS (Deep Learning Super Sampling) is supported"
        has_fp16_support:
          type: "boolean"
          description: "Whether FP16 (half-precision) is supported"
        has_fp64_support:
          type: "boolean"
          description: "Whether FP64 (double-precision) is supported"
      description: "AI Features\n\n AI-specific hardware features of a GPU, such as\
        \ tensor cores and precision support."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.CpuCache:
      required:
      - "level"
      - "bytes"
      type: "object"
      properties:
        level:
          type: "integer"
          description: "The cache level (1, 2, 3, etc.)"
          format: "uint32"
        bytes:
          type: "string"
          description: "The cache size in bytes"
      description: "CPU Cache\n\n Represents a single level of CPU cache (L1, L2,\
        \ L3, etc.)."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.CpuTopology:
      required:
      - "online_cpus"
      - "architecture"
      type: "object"
      properties:
        byte_order:
          enum:
          - "BYTE_ORDER_UNSPECIFIED"
          - "BYTE_ORDER_LITTLE_ENDIAN"
          - "BYTE_ORDER_BIG_ENDIAN"
          type: "string"
          description: "The byte order of the CPU"
          format: "enum"
        vendor_id:
          type: "string"
          description: "The CPU vendor identifier (e.g., \"GenuineIntel\", \"AuthenticAMD\"\
            )"
        model_name:
          type: "string"
          description: "The CPU model name (e.g., \"Intel(R) Xeon(R) Gold 6248R\")"
        model:
          type: "integer"
          description: "The CPU model number"
          format: "uint32"
        cpu_family_id:
          type: "integer"
          description: "The CPU family identifier"
          format: "uint32"
        stepping:
          type: "integer"
          description: "The CPU stepping (revision within a model)"
          format: "uint32"
        min_frequency:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyClockSpeed"
          description: "The minimum clock frequency of the CPU"
        max_frequency:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyClockSpeed"
          description: "The maximum clock frequency of the CPU"
        online_cpus:
          type: "integer"
          description: "The number of online (available) CPUs.\n In hybrid architectures\
            \ this number won't necessarily match the formula:\n threads_per_core\
            \ x cores_per_socket x sockets"
          format: "uint32"
        threads_per_core:
          type: "integer"
          description: "The number of threads per physical core"
          format: "uint32"
        cores_per_socket:
          type: "integer"
          description: "The number of physical cores per socket"
          format: "uint32"
        sockets:
          type: "integer"
          description: "The number of CPU sockets"
          format: "uint32"
        architecture:
          enum:
          - "CPU_ARCHITECTURE_UNSPECIFIED"
          - "CPU_ARCHITECTURE_X86_64"
          - "CPU_ARCHITECTURE_X86"
          - "CPU_ARCHITECTURE_PPC64"
          - "CPU_ARCHITECTURE_ARM64"
          type: "string"
          description: "The CPU architecture"
          format: "enum"
        caches:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.CpuCache"
          description: "The CPU caches (L1, L2, L3, etc.)"
        numa:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NumaTopology"
          description: "The NUMA topology of the CPU"
      description: "CPU Topology\n\n Describes the CPU topology of a physical host,\
        \ including architecture, caches,\n frequency ranges, and NUMA topology."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DeploymentTarget:
      required:
      - "name"
      - "hostname"
      - "os"
      - "cpu_topology"
      - "memory_topology"
      - "disks"
      - "network_info"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the deployment target"
        resource_pool_id:
          type: "string"
          description: "The unique identifier of the parent resource pool (optional\
            \ — a deployment target\n can exist without belonging to a resource pool)"
        name:
          type: "string"
          description: "The display name of the deployment target (RFC 1035 DNS label)"
        hostname:
          type: "string"
          description: "The hostname of the physical host (RFC 1123 FQDN, max 253)"
        os:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.OperatingSystem"
          description: "The operating system running on the host"
        cpu_topology:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.CpuTopology"
          description: "The CPU topology of the host"
        gpu_topology:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.GpuTopology"
          description: "The GPU topology of the host (may have zero or more GPUs)"
        memory_topology:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MemoryTopology"
          description: "The memory topology of the host"
        disks:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskNode"
          description: "The disk nodes attached to the deployment target"
        network_info:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NodeNetwork"
          description: "The network information of the host"
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyTag"
          description: "Tags associated with this deployment target for labeling and\
            \ categorization"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the deployment target was registered"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the deployment target was last updated"
          format: "date-time"
        node_name:
          readOnly: true
          type: "string"
          description: "Node Name\n\n The Kubernetes Node name this deployment target\
            \ projects (`node.metadata.name`).\n Mutable on K8s rename. Used for human-friendly\
            \ identification and filtering, NOT for\n correlation — use `node_uid`\
            \ for that."
        node_uid:
          readOnly: true
          type: "string"
          description: "Node Uid\n\n The Kubernetes Node uid (`node.metadata.uid`)\
            \ — durable correlation key (AD-003\n §Correlation). Immutable; a deleted-and-recreated\
            \ Node yields a new uid, which\n produces a new DeploymentTarget row rather\
            \ than resurrecting the old one."
        status:
          readOnly: true
          type: "string"
          description: "Status\n\n Domain status of the deployment target: one of\
            \ `ready`, `not_ready`,\n `maintenance`, `deleted`. `deleted` is the terminal\
            \ soft-delete state;\n `findAll` listings exclude it by default. `maintenance`\
            \ is preferred over\n the K8s-specific \"cordoned\" — see AD-003 §Vocabulary."
        labels:
          readOnly: true
          type: "object"
          additionalProperties:
            type: "string"
          description: "Labels\n\n The full Kubernetes Node label map. Powers ResourcePool\
            \ selector matching."
        last_observed_at:
          readOnly: true
          type: "string"
          description: "Last Observed At\n\n Last successful reconciler observation\
            \ — freshness proof for the 5-second SLA."
          format: "date-time"
        zone_id:
          readOnly: true
          type: "string"
          description: "Zone Id\n\n The zone this deployment target belongs to (FK\
            \ to topology.zones(id), denormalised onto\n the row so AIP-160 filters\
            \ can scope by zone without a JOIN). Populated by the K8s\n reconciler\
            \ from the standard topology.kubernetes.io/zone label; empty when the\
            \ label\n is absent. Used by compute's scheduler feasibility check."
      description: "Deployment Target\n\n Represents a physical host (deployment target)\
        \ within a resource pool in the Qibdo Cloud topology.\n A deployment target\
        \ contains full hardware specifications including CPU topology,\n GPU topology,\
        \ memory topology, disk nodes, and network information."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskIOPS:
      type: "object"
      properties:
        ips:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOps"
          description: "Input operations per time unit (read IOPS)"
        ops:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOps"
          description: "Output operations per time unit (write IOPS)"
      description: "Disk IOPS\n\n Describes the input/output operations per second\
        \ of a physical disk."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskNode:
      required:
      - "name"
      - "size"
      - "free_space"
      - "type"
      type: "object"
      properties:
        name:
          type: "string"
          description: "The disk device name (e.g., \"/dev/sda\", \"/dev/nvme0n1\"\
            )"
        serial:
          type: "string"
          description: "The disk serial number"
        size:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The total disk size"
        free_space:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The free space available on the disk"
        model:
          type: "string"
          description: "The disk model name"
        type:
          enum:
          - "DISK_TYPE_UNSPECIFIED"
          - "DISK_TYPE_HDD"
          - "DISK_TYPE_SSD"
          - "DISK_TYPE_SSHD"
          - "DISK_TYPE_NVME"
          - "DISK_TYPE_UNKNOWN"
          type: "string"
          description: "The type of physical disk"
          format: "enum"
        throughput:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskThroughput"
          description: "The disk throughput (read/write speeds)"
        iops:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskIOPS"
          description: "The disk IOPS (input/output operations per second)"
      description: "Disk Node\n\n Describes a physical disk attached to the deployment\
        \ target."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DiskThroughput:
      type: "object"
      properties:
        read_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The sequential read speed"
        write_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The sequential write speed"
      description: "Disk Throughput\n\n Describes the read and write throughput of\
        \ a physical disk."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.GpuTopology:
      required:
      - "name"
      - "device_id"
      type: "object"
      properties:
        name:
          type: "string"
          description: "The GPU name (e.g., \"NVIDIA A100\", \"AMD Instinct MI300X\"\
            )"
        device_id:
          type: "string"
          description: "The GPU device identifier"
        vendor:
          type: "string"
          description: "The GPU vendor (e.g., \"NVIDIA\", \"AMD\", \"Intel\")"
        base_clock:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyClockSpeed"
          description: "The base clock speed of the GPU"
        boost_clock:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyClockSpeed"
          description: "The boost clock speed of the GPU"
        tflops:
          type: "string"
          description: "The theoretical peak performance in TFLOPS"
        vram:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Vram"
          description: "The GPU video RAM"
        cores:
          type: "integer"
          description: "The number of GPU cores (CUDA cores, stream processors, etc.)"
          format: "uint32"
        ai_features:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.AiFeatures"
          description: "AI-specific features of the GPU"
        memory_bandwidth:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The memory bandwidth of the GPU"
      description: "GPU Topology\n\n Describes a GPU installed on the physical host,\
        \ including clock speeds,\n VRAM, core count, and AI-specific features."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.LabelSelector:
      required:
      - "match_labels"
      type: "object"
      properties:
        match_labels:
          type: "object"
          additionalProperties:
            type: "string"
          description: "Required labels and their values. A DeploymentTarget matches\
            \ iff every key is present\n in its label map with the matching value."
      description: "LabelSelector\n\n A Kubernetes-style label selector over DeploymentTarget\
        \ labels."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Location:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The stable unique identifier of the location (the weak-reference\
            \ target carried by other resources)"
        name:
          readOnly: true
          type: "string"
          description: "The handle of the location, e.g. \"global\" or \"us-east-1\""
        kind:
          readOnly: true
          enum:
          - "LOCATION_KIND_UNSPECIFIED"
          - "LOCATION_KIND_GLOBAL"
          - "LOCATION_KIND_MULTI_REGION"
          - "LOCATION_KIND_REGION"
          - "LOCATION_KIND_ZONE"
          type: "string"
          description: "The kind of location (global, multi-region, region, or zone)"
          format: "enum"
        display_name:
          readOnly: true
          type: "string"
          description: "A human-readable label for the location"
        status:
          readOnly: true
          enum:
          - "LOCATION_STATUS_UNSPECIFIED"
          - "LOCATION_STATUS_PENDING_FOR_APPROVAL"
          - "LOCATION_STATUS_ACTIVE"
          - "LOCATION_STATUS_DISABLED"
          type: "string"
          description: "The usability status of the location"
          format: "enum"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider that backs the location"
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the location was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the location was last updated"
          format: "date-time"
      description: "Location\n\n The lean, engine-agnostic catalogue projection of\
        \ a place a resource can be deployed. It answers\n \"what kind of place is\
        \ this, and is it usable?\" in one read. Kind-specific detail (a region's\n\
        \ backing cluster, a zone's parent region, a multi-region's members) is served\
        \ by the typed\n GetRegion / GetZone / GetMultiRegion resources, not here."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MemoryTopology:
      required:
      - "available_memory"
      - "free_memory"
      - "total_memory"
      type: "object"
      properties:
        available_memory:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The available memory (usable without swapping)"
        free_memory:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The free memory (unused by the OS)"
        total_memory:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The total physical memory installed"
        type:
          enum:
          - "MEMORY_TYPE_UNSPECIFIED"
          - "MEMORY_TYPE_DDR"
          - "MEMORY_TYPE_DRAM"
          - "MEMORY_TYPE_SRAM"
          - "MEMORY_TYPE_SDRAM"
          type: "string"
          description: "The type of physical memory"
          format: "enum"
        ddr_generation:
          type: "integer"
          description: "The DDR generation (e.g., 4 for DDR4, 5 for DDR5). Only applicable\
            \ when type is DDR."
          format: "uint32"
      description: "Memory Topology\n\n Describes the memory topology of a physical\
        \ host, including available,\n free, and total memory, along with memory type\
        \ information."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MultiRegion:
      required:
      - "name"
      - "display_name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the multi-region"
        name:
          type: "string"
          description: "The DNS-label handle of the multi-region (create input)"
        display_name:
          type: "string"
          description: "A human-readable label for the multi-region"
        description:
          type: "string"
          description: "An optional description of the multi-region"
        status:
          readOnly: true
          enum:
          - "LOCATION_STATUS_UNSPECIFIED"
          - "LOCATION_STATUS_PENDING_FOR_APPROVAL"
          - "LOCATION_STATUS_ACTIVE"
          - "LOCATION_STATUS_DISABLED"
          type: "string"
          description: "The usability status of the multi-region"
          format: "enum"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider that backs the multi-region"
          format: "enum"
        region_ids:
          type: "array"
          items:
            type: "string"
          description: "The member regions of this multi-region (zero or more weak\
            \ references)"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the multi-region was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the multi-region was last updated"
          format: "date-time"
      description: "Multi-Region\n\n An administrator-defined grouping over zero or\
        \ more regions. A region belongs to at most one\n multi-region. An empty multi-region\
        \ (zero members) is valid."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NetworkBandwidth:
      type: "object"
      properties:
        download_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The current download speed"
        upload_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The current upload speed"
        peak_download_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The peak download speed observed"
        peak_upload_speed:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate"
          description: "The peak upload speed observed"
      description: "Network Bandwidth\n\n Describes the bandwidth of a network interface,\
        \ including current and peak speeds."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NetworkInterface:
      required:
      - "status"
      type: "object"
      properties:
        ip_addresses:
          type: "array"
          items:
            type: "string"
          description: "The IP addresses assigned to this interface"
        type:
          type: "integer"
          description: "The interface type identifier"
          format: "uint32"
        status:
          enum:
          - "NETWORK_STATUS_UNSPECIFIED"
          - "NETWORK_STATUS_UP"
          - "NETWORK_STATUS_DOWN"
          - "NETWORK_STATUS_TESTING"
          - "NETWORK_STATUS_DORMANT"
          - "NETWORK_STATUS_NOT_PRESENT"
          - "NETWORK_STATUS_LOWER_LAYER_DOWN"
          - "NETWORK_STATUS_UNKNOWN"
          type: "string"
          description: "The operational status of the interface"
          format: "enum"
        mtu:
          type: "string"
          description: "The Maximum Transmission Unit (MTU) in bytes"
        name:
          type: "string"
          description: "The interface name (e.g., \"eth0\", \"ens3\")"
        display_name:
          type: "string"
          description: "The display name of the interface"
        bandwidth:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NetworkBandwidth"
          description: "The bandwidth of the interface"
      description: "Network Interface\n\n Describes a network interface on the physical\
        \ host."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NodeNetwork:
      required:
      - "host_name"
      type: "object"
      properties:
        host_name:
          type: "string"
          description: "The hostname of the host"
        domain_name:
          type: "string"
          description: "The domain name of the host"
        dns_servers:
          type: "array"
          items:
            type: "string"
          description: "The DNS servers configured on the host"
        mac_address:
          type: "string"
          description: "The primary MAC address of the host"
        interfaces:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NetworkInterface"
          description: "The network interfaces available on the host"
        ip_gateways:
          type: "array"
          items:
            type: "string"
          description: "The IP gateways configured on the host"
      description: "Node Network\n\n Describes the network configuration of the physical\
        \ host."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NumaNode:
      required:
      - "id"
      type: "object"
      properties:
        id:
          type: "integer"
          description: "The NUMA node identifier"
          format: "uint32"
        cpus:
          type: "array"
          items:
            type: "integer"
            format: "uint32"
          description: "The list of CPU identifiers belonging to this NUMA node"
      description: "NUMA Node\n\n Represents a single NUMA node with its associated\
        \ CPUs."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NumaTopology:
      required:
      - "nodes"
      type: "object"
      properties:
        nodes:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.NumaNode"
          description: "The list of NUMA nodes"
      description: "NUMA Topology\n\n Describes the Non-Uniform Memory Access (NUMA)\
        \ topology of a CPU."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.OperatingSystem:
      required:
      - "family"
      type: "object"
      properties:
        family:
          type: "string"
          description: "The OS family (e.g., \"Linux\", \"Windows\")"
        manufacturer:
          type: "string"
          description: "The OS manufacturer (e.g., \"Canonical\", \"Microsoft\")"
        version:
          type: "string"
          description: "The OS version (e.g., \"22.04\", \"11\")"
        bitness:
          enum:
          - "OS_BITNESS_UNSPECIFIED"
          - "OS_BITNESS_8"
          - "OS_BITNESS_16"
          - "OS_BITNESS_32"
          - "OS_BITNESS_64"
          - "OS_BITNESS_128"
          - "OS_BITNESS_256"
          type: "string"
          description: "The bitness of the operating system"
          format: "enum"
      description: "Operating System\n\n Describes the operating system running on\
        \ a deployment target."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.QibdoRegionSpec:
      type: "object"
      properties:
        cluster_id:
          readOnly: true
          type: "string"
          description: "The backing Kubernetes cluster handle (a region corresponds\
            \ to a cluster). May be empty."
      description: "Qibdo-specific region detail."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Region:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the region"
        name:
          readOnly: true
          type: "string"
          description: "The DNS-label handle of the region (e.g. \"us-east-1\"), immutable"
        display_name:
          readOnly: true
          type: "string"
          description: "A human-readable label for the region (e.g. \"US East (N.\
            \ Virginia)\")"
        status:
          readOnly: true
          enum:
          - "LOCATION_STATUS_UNSPECIFIED"
          - "LOCATION_STATUS_PENDING_FOR_APPROVAL"
          - "LOCATION_STATUS_ACTIVE"
          - "LOCATION_STATUS_DISABLED"
          type: "string"
          description: "The usability status of the region"
          format: "enum"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider that backs the region"
          format: "enum"
        multi_region_id:
          readOnly: true
          type: "string"
          description: "The multi-region this region belongs to, if any (at most one)"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the region was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the region was last updated"
          format: "date-time"
        qibdo:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.QibdoRegionSpec"
          description: "Qibdo-specific region detail."
      description: "Region\n\n A region in the Qibdo Cloud topology — the backing-cluster\
        \ analog that groups zones. Regions are\n read-only inventory built by the\
        \ per-provider sync source; they are never user-created and move\n only through\
        \ the location lifecycle verbs. Every field is server-managed."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.ResourcePool:
      required:
      - "name"
      - "label_selector"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the resource pool"
        zone_id:
          type: "string"
          description: "The unique identifier of the parent zone. Supplied on create\
            \ (the flat collection's parent\n reference), immutable thereafter."
        name:
          type: "string"
          description: "The display name of the resource pool (RFC 1035 DNS label)"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the resource pool was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the resource pool was last updated"
          format: "date-time"
        label_selector:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.LabelSelector"
          description: "Label Selector\n\n Defines pool membership over DeploymentTargets.\
            \ A DeploymentTarget\n belongs to this pool iff its Kubernetes label map\
            \ contains every key in match_labels\n with the matching value. matchLabels-only\
            \ for the alpha; matchExpressions is\n reserved for future use."
      description: "Resource Pool\n\n Represents a resource pool within a zone in\
        \ the Qibdo Cloud topology.\n A resource pool groups deployment targets (physical\
        \ hosts) for resource management and scheduling."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyClockSpeed:
      required:
      - "value"
      - "unit"
      type: "object"
      properties:
        value:
          type: "number"
          description: "The numerical value of the clock speed"
          format: "double"
        unit:
          enum:
          - "TOPOLOGY_CLOCK_SPEED_UNIT_UNSPECIFIED"
          - "TOPOLOGY_CLOCK_SPEED_UNIT_HZ"
          - "TOPOLOGY_CLOCK_SPEED_UNIT_KHZ"
          - "TOPOLOGY_CLOCK_SPEED_UNIT_MHZ"
          - "TOPOLOGY_CLOCK_SPEED_UNIT_GHZ"
          - "TOPOLOGY_CLOCK_SPEED_UNIT_THZ"
          type: "string"
          description: "The unit of the clock speed value"
          format: "enum"
      description: "Topology Clock Speed\n\n Represents the clock speed of a processor\
        \ or component in different frequency units\n within the topology domain."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize:
      required:
      - "value"
      - "unit"
      type: "object"
      properties:
        value:
          type: "number"
          description: "The numerical value of the size"
          format: "double"
        unit:
          enum:
          - "TOPOLOGY_DATA_UNIT_UNSPECIFIED"
          - "TOPOLOGY_DATA_UNIT_BYTES"
          - "TOPOLOGY_DATA_UNIT_KIB"
          - "TOPOLOGY_DATA_UNIT_MIB"
          - "TOPOLOGY_DATA_UNIT_GIB"
          - "TOPOLOGY_DATA_UNIT_TIB"
          - "TOPOLOGY_DATA_UNIT_PIB"
          - "TOPOLOGY_DATA_UNIT_EIB"
          - "TOPOLOGY_DATA_UNIT_KB"
          - "TOPOLOGY_DATA_UNIT_MB"
          - "TOPOLOGY_DATA_UNIT_GB"
          - "TOPOLOGY_DATA_UNIT_TB"
          - "TOPOLOGY_DATA_UNIT_PB"
          - "TOPOLOGY_DATA_UNIT_EB"
          type: "string"
          description: "The unit of the size value"
          format: "enum"
      description: "Topology Data Size\n\n Represents the size of a resource in different\
        \ information units within the topology domain."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataTransferRate:
      required:
      - "value"
      - "unit"
      type: "object"
      properties:
        value:
          type: "number"
          description: "The numerical value of the transfer rate"
          format: "double"
        unit:
          enum:
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_UNSPECIFIED"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_BPS"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_KBPS"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_MBPS"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_GBPS"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_BYTES_PER_SEC"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_KBYTES_PER_SEC"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_MBYTES_PER_SEC"
          - "TOPOLOGY_DATA_TRANSFER_RATE_UNIT_GBYTES_PER_SEC"
          type: "string"
          description: "The unit of the transfer rate value"
          format: "enum"
      description: "Topology Data Transfer Rate\n\n Represents the data transfer rate\
        \ of a resource in different units within the topology domain."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier for this operation."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n The ID of the resource affected by this operation.\
            \ May be empty for\n async operations where the resource does not yet\
            \ exist."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n The type of resource (e.g., \"Region\",\
            \ \"Zone\", \"ResourcePool\", \"DeploymentTarget\")."
        operation_type:
          readOnly: true
          enum:
          - "TOPOLOGY_OPERATION_PROTO_TYPE_UNSPECIFIED"
          - "TOPOLOGY_OPERATION_PROTO_TYPE_CREATE"
          - "TOPOLOGY_OPERATION_PROTO_TYPE_UPDATE"
          - "TOPOLOGY_OPERATION_PROTO_TYPE_DELETE"
          - "TOPOLOGY_OPERATION_PROTO_TYPE_REGISTER"
          type: "string"
          description: "Operation Type\n\n The kind of mutation that was requested."
          format: "enum"
        status:
          readOnly: true
          enum:
          - "TOPOLOGY_OPERATION_STATUS_UNSPECIFIED"
          - "TOPOLOGY_OPERATION_STATUS_PENDING"
          - "TOPOLOGY_OPERATION_STATUS_RUNNING"
          - "TOPOLOGY_OPERATION_STATUS_DONE"
          - "TOPOLOGY_OPERATION_STATUS_ERROR"
          type: "string"
          description: "Status\n\n Current lifecycle state of the operation."
          format: "enum"
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was first created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When the operation started executing."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When the operation completed (either successfully\
            \ or with errors)."
          format: "date-time"
        errors:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperationError"
          description: "Errors\n\n Business rule errors encountered during the operation."
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperationWarning"
          description: "Warnings\n\n Non-fatal notices about the operation."
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Percentage of completion (0-100)."
          format: "int32"
      description: "Topology Operation\n\n An acknowledgment of a mutation request,\
        \ carrying tracking metadata,\n errors, and warnings. Follows GCP's Operations\
        \ pattern (AIP-151)."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperationError:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Error Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the error."
      description: "Operation Error\n\n A structured error returned inside an operation\
        \ when a business rule fails."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperationWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier following the S_SSS_EEE\
            \ convention."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of the warning."
      description: "Operation Warning\n\n A non-fatal notice attached to an operation."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOps:
      required:
      - "value"
      - "unit"
      type: "object"
      properties:
        value:
          type: "number"
          description: "The numerical value of operations"
          format: "double"
        unit:
          enum:
          - "TOPOLOGY_DURATION_UNIT_UNSPECIFIED"
          - "TOPOLOGY_DURATION_UNIT_NANOSECONDS"
          - "TOPOLOGY_DURATION_UNIT_MICROSECONDS"
          - "TOPOLOGY_DURATION_UNIT_MILLISECONDS"
          - "TOPOLOGY_DURATION_UNIT_SECONDS"
          - "TOPOLOGY_DURATION_UNIT_MINUTES"
          - "TOPOLOGY_DURATION_UNIT_HOURS"
          - "TOPOLOGY_DURATION_UNIT_DAYS"
          type: "string"
          description: "The time unit denominator"
          format: "enum"
      description: "Topology Ops\n\n Represents operations per time unit within the\
        \ topology domain."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyTag:
      required:
      - "key"
      - "value"
      type: "object"
      properties:
        id:
          type: "string"
          description: "The unique identifier of the tag"
        key:
          type: "string"
          description: "The key of the tag"
        value:
          type: "string"
          description: "The value of the tag"
        type:
          enum:
          - "TOPOLOGY_TAG_TYPE_UNSPECIFIED"
          - "TOPOLOGY_TAG_TYPE_SYSTEM"
          - "TOPOLOGY_TAG_TYPE_USER"
          type: "string"
          description: "The type of the tag (system or user-defined)"
          format: "enum"
        description:
          type: "string"
          description: "An optional description for the tag"
      description: "Topology Tag\n\n A key-value pair used to label and categorize\
        \ topology resources such as\n regions, zones, resource pools, and deployment\
        \ targets."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Vram:
      required:
      - "size"
      - "type"
      type: "object"
      properties:
        size:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The total VRAM size"
        type:
          enum:
          - "VRAM_TYPE_UNSPECIFIED"
          - "VRAM_TYPE_GDDR"
          - "VRAM_TYPE_HBM"
          - "VRAM_TYPE_SGRAM"
          - "VRAM_TYPE_UNKNOWN"
          type: "string"
          description: "The type of VRAM"
          format: "enum"
        memory_bus:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyDataSize"
          description: "The memory bus width"
      description: "VRAM\n\n Describes the video RAM of a GPU."
    com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Zone:
      required:
      - "region_id"
      - "name"
      - "display_name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the zone"
        region_id:
          type: "string"
          description: "The unique identifier of the parent region (create input)"
        name:
          type: "string"
          description: "The DNS-label handle of the zone (create input)"
        display_name:
          type: "string"
          description: "A human-readable label for the zone"
        description:
          type: "string"
          description: "An optional description of the zone"
        status:
          readOnly: true
          enum:
          - "LOCATION_STATUS_UNSPECIFIED"
          - "LOCATION_STATUS_PENDING_FOR_APPROVAL"
          - "LOCATION_STATUS_ACTIVE"
          - "LOCATION_STATUS_DISABLED"
          type: "string"
          description: "The usability status of the zone"
          format: "enum"
        engine:
          readOnly: true
          enum:
          - "ENGINE_UNSPECIFIED"
          - "ENGINE_QIBDO"
          - "ENGINE_AWS"
          - "ENGINE_GCP"
          - "ENGINE_AZURE"
          type: "string"
          description: "The cloud provider that backs the zone"
          format: "enum"
        created:
          readOnly: true
          type: "string"
          description: "The timestamp when the zone was created"
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "The timestamp when the zone was last updated"
          format: "date-time"
      description: "Zone\n\n A failure domain within a region — the concrete unit\
        \ a workload is placed in. A qibdo zone is\n administrator-created within\
        \ a synced region; a cloud zone arrives via that provider's sync source.\n\
        \ A zone is immutable once it has been enabled."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ApproveLocationRequest:
      required:
      - "engine"
      - "id"
      - "display_name"
      type: "object"
      properties:
        engine:
          type: "string"
          description: "The cloud provider, or `-` to resolve regardless of provider"
        id:
          type: "string"
          description: "The unique identifier of the location to approve"
        display_name:
          type: "string"
          description: "The confirmed human-readable display name"
        description:
          type: "string"
          description: "An optional description confirmed at approval"
      description: "ApproveLocationRequest\n\n Request message for ApproveLocation.\
        \ Confirms the display name (and optional description) of a\n pending location."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.DisableLocationRequest:
      required:
      - "engine"
      - "id"
      type: "object"
      properties:
        engine:
          type: "string"
          description: "The cloud provider, or `-` to resolve regardless of provider"
        id:
          type: "string"
          description: "The unique identifier of the location to disable"
      description: "DisableLocationRequest\n\n Request message for DisableLocation."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.EnableLocationRequest:
      required:
      - "engine"
      - "id"
      type: "object"
      properties:
        engine:
          type: "string"
          description: "The cloud provider, or `-` to resolve regardless of provider"
        id:
          type: "string"
          description: "The unique identifier of the location to enable"
      description: "EnableLocationRequest\n\n Request message for EnableLocation."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListDeploymentTargetsResponse:
      type: "object"
      properties:
        deployment_targets:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DeploymentTarget"
          description: "The list of deployment targets"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListDeploymentTargetsResponse\n\n Response message for ListDeploymentTargets.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListLocationsResponse:
      type: "object"
      properties:
        locations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Location"
          description: "The list of locations"
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page, or empty if there are no\
            \ further pages."
      description: "ListLocationsResponse\n\n Response message for ListLocations."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListMultiRegionsResponse:
      type: "object"
      properties:
        multi_regions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.MultiRegion"
          description: "The list of multi-regions"
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page, or empty if there are no\
            \ further pages."
      description: "ListMultiRegionsResponse\n\n Response message for ListMultiRegions."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListRegionsResponse:
      type: "object"
      properties:
        regions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Region"
          description: "The list of regions"
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page, or empty if there are no\
            \ further pages."
      description: "ListRegionsResponse\n\n Response message for ListRegions."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListResourcePoolsResponse:
      type: "object"
      properties:
        resource_pools:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.ResourcePool"
          description: "The list of resource pools"
        next_page_token:
          type: "string"
          description: "A token, which can be sent as `page_token` to retrieve the\
            \ next page.\n If this field is empty, there are no subsequent pages."
      description: "ListResourcePoolsResponse\n\n Response message for ListResourcePools.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListTopologyOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.TopologyOperation"
          description: "Operations\n\n The list of operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as `page_token`\
            \ to retrieve the next page.\n If this field is empty, there are no subsequent\
            \ pages."
      description: "ListTopologyOperationsResponse\n\n Response message for ListOperations.\n\
        \ Note: This API intentionally omits `total_size` from list responses.\n Keyset\
        \ pagination does not support efficient total count computation\n (COUNT(*)\
        \ requires a full table scan). Per AIP-158, total_size is optional."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.ListZonesResponse:
      type: "object"
      properties:
        zones:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.Zone"
          description: "The list of zones"
        next_page_token:
          type: "string"
          description: "A token to retrieve the next page, or empty if there are no\
            \ further pages."
      description: "ListZonesResponse\n\n Response message for ListZones."
    com.qibdo.cloud.topology.infrastructure.integration.v1.service.RegisterDeploymentTargetRequest:
      required:
      - "deployment_target"
      type: "object"
      properties:
        deployment_target:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.topology.infrastructure.integration.v1.schema.DeploymentTarget"
          description: "The deployment target to register"
      description: "RegisterDeploymentTargetRequest\n\n Request message for RegisterDeploymentTarget.\
        \ Carries the deployment target\n resource body to register."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "Operation ID\n\n Unique identifier of the operation."
        workspace_id:
          readOnly: true
          type: "string"
          description: "Workspace ID\n\n The workspace in whose namespace the operation\
            \ was executed."
        resource_id:
          readOnly: true
          type: "string"
          description: "Resource ID\n\n ID of the affected resource (nullable for\
            \ vault-level lifecycle ops such as snapshot)."
        resource_type:
          readOnly: true
          type: "string"
          description: "Resource Type\n\n URN of the affected resource type (e.g.,\
            \ \"com.qibdo.cloud.vault:secret\")."
        operation_type:
          readOnly: true
          type: "string"
          description: "Operation Type\n\n The action performed (CREATE, ROTATE, REVOKE,\
            \ ENCRYPT, ...)."
        status:
          readOnly: true
          type: "string"
          description: "Status\n\n The operation status (PENDING, RUNNING, DONE, FAILED)."
        insert_time:
          readOnly: true
          type: "string"
          description: "Insert Time\n\n When the operation was created."
          format: "date-time"
        start_time:
          readOnly: true
          type: "string"
          description: "Start Time\n\n When execution started (nullable)."
          format: "date-time"
        end_time:
          readOnly: true
          type: "string"
          description: "End Time\n\n When execution completed (nullable)."
          format: "date-time"
        progress:
          readOnly: true
          type: "integer"
          description: "Progress\n\n Progress percentage (0–100)."
          format: "int32"
        warnings:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultWarning"
          description: "Warnings\n\n Non-fatal notices emitted during the operation."
      description: "Vault Operation\n\n Tracks the result of a vault command (secret,\
        \ crypto key, lease, certificate\n authority, certificate, access policy,\
        \ or vault-level lifecycle action)."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag:
      required:
      - "key"
      - "value"
      type: "object"
      properties:
        key:
          type: "string"
          description: "Tag Key\n\n Tag key (1–63 chars, lowercase letters/digits/dashes/underscores)."
        value:
          type: "string"
          description: "Tag Value\n\n Tag value (free-form, up to 255 chars)."
        type:
          enum:
          - "VAULT_TAG_TYPE_UNSPECIFIED"
          - "VAULT_TAG_TYPE_SYSTEM"
          - "VAULT_TAG_TYPE_USER"
          type: "string"
          description: "Tag Type\n\n Whether the tag is system-managed or user-defined."
          format: "enum"
        description:
          type: "string"
          description: "Tag Description\n\n Optional description."
      description: "Vault Tag\n\n A key-value pair used to label and categorize vault\
        \ resources such as\n secrets, crypto keys, leases, certificate authorities,\
        \ certificates, and\n access policies."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultWarning:
      type: "object"
      properties:
        code:
          readOnly: true
          type: "integer"
          description: "Warning Code\n\n Numeric identifier of the warning type."
          format: "uint32"
        description:
          readOnly: true
          type: "string"
          description: "Description\n\n Human-readable explanation of what was ignored\
            \ or degraded."
      description: "Vault Warning\n\n A non-fatal notice emitted by a vault operation.\
        \ The operation still\n completed; the warning surfaces unsupported features\
        \ or capability gaps in\n the underlying engine.\n\n Warning codes follow\
        \ the S_SSS_EEE convention:\n   - Millions digit: service (9 = vault)\n  \
        \ - Thousands: group\n   - Units: specific warning"
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyCondition:
      type: "object"
      properties:
        source_ip:
          $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.SourceIpCondition"
        time_window:
          $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.TimeWindowCondition"
      description: "AccessPolicyCondition — a constraint evaluated at authorization\
        \ time.\n Mirrors IAM's Condition hierarchy structurally (DOM-003: no shared\
        \ domain\n types across bounded contexts)."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyDocument:
      type: "object"
      properties:
        rules:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyRule"
          description: "The rules that make up this policy. Every rule's resource_name_pattern\n\
            \ MUST be unique within a document."
      description: "AccessPolicyDocument — the active policy body. Rules are additive:\
        \ a\n principal's effective permissions are the union of permissions granted\
        \ by\n every matching rule."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyRevision:
      type: "object"
      properties:
        revision_number:
          readOnly: true
          type: "string"
          description: "Monotonically increasing revision number; starts at 1 for\
            \ the first edit."
        previous_document:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyDocument"
          description: "The document that was replaced."
        edited_by:
          readOnly: true
          type: "string"
          description: "The principal that performed the edit (UUID, weak reference\
            \ to IAM user)."
        edited_at:
          readOnly: true
          type: "string"
          description: "When the edit happened (server-managed)."
          format: "date-time"
      description: "AccessPolicyRevision — a snapshot of a previous policy document\
        \ captured at\n update time. Qibdo-invented audit trail (upstream clouds do\
        \ not expose\n policy revision history)."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyRule:
      required:
      - "resource_name_pattern"
      - "permissions"
      type: "object"
      properties:
        resource_name_pattern:
          type: "string"
          description: "Resource-name pattern, e.g. \"workspaces/*/secrets/*\". The\
            \ wildcard\n semantics follow Google AIP-159."
        permissions:
          type: "array"
          items:
            type: "string"
          description: "Permissions granted when the rule matches, e.g. \"vault.secret.get\"\
            .\n At least one permission is required per rule."
        ttl_cap_seconds:
          type: "string"
          description: "Optional upper bound on credentials issued via this rule (seconds).\n\
            \ Unset means no TTL cap imposed by this rule."
        conditions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyCondition"
          description: "Conjunctive constraints; all listed conditions must evaluate\
            \ to true for\n the rule to apply."
      description: "AccessPolicyRule — grants a set of permissions on a resource-name\
        \ pattern,\n optionally bounded by TTL and conditions."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoAccessPolicy:
      required:
      - "name"
      - "document"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the access policy (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this policy belongs to (UUID, weak reference\
            \ to taxonomy)."
        name:
          type: "string"
          description: "Human-readable name of the policy, unique within the workspace\n\
            \ (3–256 chars, lowercase alphanumerics plus / - _)."
        schema_version:
          readOnly: true
          type: "string"
          description: "The JSONB schema version governing the shape of `document`\
            \ and\n `version_history` entries. Server-managed."
        document:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyDocument"
          description: "The active policy document (rules + conditions)."
        version_history:
          readOnly: true
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.AccessPolicyRevision"
          description: "Append-only list of previous document revisions. Each update\
            \ pushes the\n pre-mutation document onto this list. Server-managed."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the policy was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the policy was last updated (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoAccessPolicy resource — workspace-scoped access policy document\
        \ layered\n on top of Qibdo IAM. The policy document composes one or more\
        \ rules that\n grant a set of permissions on a resource-name pattern, optionally\
        \ constrained\n by source IP ranges or time windows. The `version_history`\
        \ list is a\n Qibdo-invented enhancement: every update appends the previous\
        \ document so the\n full revision trail is auditable. Policies are consulted\
        \ as a second-pass\n check after the IAM @PreAuthorize gate."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the application credential (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this credential belongs to (UUID, weak reference\
            \ to\n taxonomy.workspaces)."
        principal_id:
          readOnly: true
          type: "string"
          description: "The IAM principal this credential authenticates as on success."
        name:
          readOnly: true
          type: "string"
          description: "Workspace-unique human-readable name for the credential."
        role_id:
          readOnly: true
          type: "string"
          description: "The app-role RoleID (UUID). Stable for the lifetime of the\n\
            \ credential — only the SecretID rotates."
        ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Default time-to-live applied to access tokens minted via Authenticate."
        max_ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Maximum total lifetime of any access token issued under this\
            \ credential."
        last_rotated_at:
          readOnly: true
          type: "string"
          description: "Timestamp of the last SecretID rotation (or initial issuance)."
          format: "date-time"
        is_revoked:
          readOnly: true
          type: "boolean"
          description: "Whether the credential is revoked. Once true, Authenticate\
            \ returns\n PERMISSION_DENIED and the row is logically tombstoned."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was last modified (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoApplicationCredential resource — a workspace-scoped, Qibdo-managed\n\
        \ RoleID + SecretID pair used by CI\n pipelines and non-K8s workloads to authenticate\
        \ to the Qibdo Vault. The\n SecretID itself is NEVER persisted nor returned\
        \ by Get/List — it is\n returned exactly once by Issue and RotateSecretId,\
        \ and the persisted\n credential row carries only its SHA-512 hash (hex) so\
        \ the Authenticate\n RPC can verify replays without storing the cleartext."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificate:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the certificate (UUID)."
        certificate_authority_id:
          readOnly: true
          type: "string"
          description: "The CA that issued the certificate."
        serial:
          readOnly: true
          type: "string"
          description: "X.509 serial number (unique per CA)."
        subject:
          readOnly: true
          type: "string"
          description: "X.509 subject Distinguished Name."
        subject_alternative_names:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "Subject Alternative Names (DNS names, IP addresses, URIs)."
        not_before:
          readOnly: true
          type: "string"
          description: "Notbefore timestamp (cert validity start)."
          format: "date-time"
        not_after:
          readOnly: true
          type: "string"
          description: "Notafter timestamp (cert validity end)."
          format: "date-time"
        state:
          readOnly: true
          enum:
          - "CERTIFICATE_STATE_UNSPECIFIED"
          - "CERTIFICATE_STATE_ISSUED"
          - "CERTIFICATE_STATE_REVOKED"
          - "CERTIFICATE_STATE_EXPIRED"
          type: "string"
          description: "Lifecycle state of the certificate."
          format: "enum"
        revoked_at:
          readOnly: true
          type: "string"
          description: "Timestamp the certificate was revoked, if state is REVOKED."
          format: "date-time"
        revocation_reason:
          readOnly: true
          enum:
          - "CERTIFICATE_REVOCATION_REASON_UNSPECIFIED"
          - "CERTIFICATE_REVOCATION_REASON_UNSPECIFIED_REASON"
          - "CERTIFICATE_REVOCATION_REASON_KEY_COMPROMISE"
          - "CERTIFICATE_REVOCATION_REASON_CA_COMPROMISE"
          - "CERTIFICATE_REVOCATION_REASON_AFFILIATION_CHANGED"
          - "CERTIFICATE_REVOCATION_REASON_SUPERSEDED"
          - "CERTIFICATE_REVOCATION_REASON_CESSATION_OF_OPERATION"
          - "CERTIFICATE_REVOCATION_REASON_CERTIFICATE_HOLD"
          - "CERTIFICATE_REVOCATION_REASON_PRIVILEGE_WITHDRAWN"
          - "CERTIFICATE_REVOCATION_REASON_AA_COMPROMISE"
          type: "string"
          description: "RFC 5280 revocation reason — set when state is REVOKED."
          format: "enum"
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag"
          description: "Tag entries used for organisation and policy matching."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the certificate row was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the certificate row was last modified (server-managed)."
          format: "date-time"
      description: "QibdoCertificate — leaf X.509 certificate issued under a Qibdo\
        \ CA. The\n private key is held by the vault when issued there (or by the\
        \ requestor when\n signing a CSR); only metadata is persisted in the relational\
        \ database."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificateAuthority:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the certificate authority (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this CA belongs to (UUID, weak reference to\
            \ taxonomy)."
        name:
          type: "string"
          description: "Human-readable name unique within the workspace."
        type:
          enum:
          - "CERTIFICATE_AUTHORITY_TYPE_UNSPECIFIED"
          - "CERTIFICATE_AUTHORITY_TYPE_ROOT"
          - "CERTIFICATE_AUTHORITY_TYPE_INTERMEDIATE"
          type: "string"
          description: "Topology of the CA — ROOT or INTERMEDIATE."
          format: "enum"
        parent_ca_id:
          type: "string"
          description: "Parent CA id when this is an INTERMEDIATE; empty for ROOT."
        algorithm:
          type: "string"
          description: "Signing algorithm — must match `vault.crypto_algorithms`."
        subject:
          type: "string"
          description: "X.509 subject Distinguished Name."
        valid_from:
          type: "string"
          description: "Notbefore timestamp (CA validity start)."
          format: "date-time"
        valid_until:
          type: "string"
          description: "Notafter timestamp (CA validity end)."
          format: "date-time"
        crl_endpoint:
          type: "string"
          description: "Optional CRL distribution point URL published by this CA."
        ocsp_responder_url:
          type: "string"
          description: "Optional OCSP responder URL published by this CA."
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag"
          description: "Tag entries used for organisation and policy matching."
        is_revoked:
          readOnly: true
          type: "boolean"
          description: "Whether the CA itself has been revoked. Once true, the CA\
            \ can issue no further\n certificates and existing certs SHOULD be rotated."
        mount_path:
          readOnly: true
          type: "string"
          description: "Vault PKI mount path where this CA is materialised\n (e.g.,\
            \ \"workspaces/{workspace}/pki/{name}/\")."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the CA was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the CA metadata was last modified (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoCertificateAuthority — workspace-scoped certificate authority\
        \ backed by\n the vault's PKI engine. CAs form a hierarchical trust chain:\
        \ a `ROOT` CA is\n self-signed, and one or more `INTERMEDIATE` CAs may chain\
        \ off it. The CA's\n private key is held by the vault; only metadata is persisted\
        \ in the relational database."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKey:
      required:
      - "name"
      - "purpose"
      - "algorithm"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the crypto key (UUID)"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this crypto key belongs to (UUID, weak reference\
            \ to taxonomy)"
        name:
          type: "string"
          description: "Human-readable name of the crypto key, unique within the workspace\n\
            \ (3–256 chars, lowercase alphanumerics plus / - _)."
        purpose:
          enum:
          - "CRYPTO_KEY_PURPOSE_UNSPECIFIED"
          - "CRYPTO_KEY_PURPOSE_ENCRYPT_DECRYPT"
          - "CRYPTO_KEY_PURPOSE_SIGN_VERIFY"
          - "CRYPTO_KEY_PURPOSE_MAC"
          - "CRYPTO_KEY_PURPOSE_WRAP"
          type: "string"
          description: "Intended use of the crypto key (encrypt/decrypt, sign/verify,\
            \ MAC, wrap)."
          format: "enum"
        algorithm:
          enum:
          - "CRYPTO_ALGORITHM_UNSPECIFIED"
          - "CRYPTO_ALGORITHM_AES_256_GCM"
          - "CRYPTO_ALGORITHM_CHACHA20_POLY1305"
          - "CRYPTO_ALGORITHM_RSA_2048"
          - "CRYPTO_ALGORITHM_RSA_3072"
          - "CRYPTO_ALGORITHM_RSA_4096"
          - "CRYPTO_ALGORITHM_EC_P256"
          - "CRYPTO_ALGORITHM_EC_P384"
          - "CRYPTO_ALGORITHM_EC_P521"
          - "CRYPTO_ALGORITHM_ED25519"
          - "CRYPTO_ALGORITHM_HMAC_SHA256"
          - "CRYPTO_ALGORITHM_HMAC_SHA384"
          - "CRYPTO_ALGORITHM_HMAC_SHA512"
          type: "string"
          description: "Cryptographic algorithm of the key. Must be compatible with\
            \ the purpose."
          format: "enum"
        protection_level:
          enum:
          - "PROTECTION_LEVEL_UNSPECIFIED"
          - "PROTECTION_LEVEL_SOFTWARE"
          - "PROTECTION_LEVEL_HSM"
          type: "string"
          description: "Where key material is protected: in software (default) or\
            \ in an HSM."
          format: "enum"
        minimum_decryptable_version:
          type: "string"
          description: "Lowest version number still allowed to decrypt (>= 1)."
        rotation_period:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Optional automatic rotation period; null means no auto-rotation."
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag"
          description: "User-defined tags (key/value pairs) attached to the crypto\
            \ key."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the crypto key metadata was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the crypto key metadata was last updated (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoCryptoKey resource — a workspace-scoped, versioned cryptographic\
        \ key\n managed by the Qibdo vault engine. The relational database stores\
        \ key\n metadata only; key material lives exclusively in the engine."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKeyVersion:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of this version (UUID)"
        cryptokey_id:
          readOnly: true
          type: "string"
          description: "The parent crypto key that owns this version (UUID)"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace that owns this version (UUID, denormalised from\
            \ the parent crypto key)."
        version_number:
          readOnly: true
          type: "string"
          description: "Monotonically-increasing version number (1, 2, 3, ...)"
        state:
          readOnly: true
          enum:
          - "QIBDO_CRYPTO_KEY_VERSION_STATE_UNSPECIFIED"
          - "QIBDO_CRYPTO_KEY_VERSION_STATE_ENABLED"
          - "QIBDO_CRYPTO_KEY_VERSION_STATE_DISABLED"
          - "QIBDO_CRYPTO_KEY_VERSION_STATE_DESTROY_SCHEDULED"
          - "QIBDO_CRYPTO_KEY_VERSION_STATE_DESTROYED"
          type: "string"
          description: "Current lifecycle state of this version."
          format: "enum"
        destroy_scheduled_for:
          readOnly: true
          type: "string"
          description: "For DESTROY_SCHEDULED versions, the timestamp when the engine\
            \ will permanently destroy material."
          format: "date-time"
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when this version was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when this version's state last changed (server-managed)."
          format: "date-time"
      description: "QibdoCryptoKeyVersion — an immutable version of a QibdoCryptoKey's\
        \ material.\n Key material is never persisted in the relational database;\
        \ only metadata round-trips."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the database role (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this role belongs to (UUID, weak reference to\n\
            \ taxonomy.workspaces)."
        name:
          readOnly: true
          type: "string"
          description: "Workspace-unique human-readable role name. Mirrored as the\
            \ role name\n on the vault side."
        db_engine:
          readOnly: true
          enum:
          - "DB_ENGINE_UNSPECIFIED"
          - "DB_ENGINE_POSTGRES"
          - "DB_ENGINE_MYSQL"
          - "DB_ENGINE_MSSQL"
          - "DB_ENGINE_MONGODB"
          - "DB_ENGINE_ORACLE"
          - "DB_ENGINE_REDSHIFT"
          - "DB_ENGINE_CASSANDRA"
          type: "string"
          description: "Target database engine."
          format: "enum"
        connection_ref:
          readOnly: true
          type: "string"
          description: "Reference to the target database connection (engine-specific\
            \ opaque\n string — e.g., the vault's database connection name or a JDBC\
            \ URL key in\n the JdbcConnectionRegistry)."
        creation_statements:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "SQL statements executed at credential issuance. Engine-specific\n\
            \ placeholders ({{name}}, {{password}}, {{expiration}}) are honoured.\n\
            \ Capped to bound storage in `vault.database_roles` and prevent abuse:\n\
            \ at most 64 statements, each at most 8 KiB."
        revocation_statements:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "SQL statements executed at credential revocation ({{name}}\
            \ placeholder).\n Same caps as `creation_statements`."
        default_ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Default time-to-live applied to credentials issued under this\
            \ role."
        max_ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Maximum total lifetime any credential under this role can\
            \ hold."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was last modified (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoDatabaseRole resource — a workspace-scoped, Qibdo-managed\
        \ database\n role definition. Carries the creation + revocation SQL\n templates\
        \ that the vault will execute when issuing or revoking dynamic\n database\
        \ credentials. Qibdo is the single source of truth; the vault\n receives a\
        \ derived projection via POST /v1/database/roles/{name} after\n the templates\
        \ have been dry-run validated against the target database."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoEphemeralCredential:
      type: "object"
      properties:
        lease:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease"
          description: "The lease metadata for this credential — the persistent server-side\
            \ handle\n used to renew or revoke the credential."
        username:
          readOnly: true
          type: "string"
          description: "The username portion of the credential (e.g., a transient\
            \ database role)."
        password:
          readOnly: true
          type: "string"
          description: "The password portion of the credential. Returned exactly once\
            \ — clients\n MUST store it before the lease expires."
      description: "QibdoEphemeralCredential — server-issued response payload for\
        \ dynamic credential\n generation. Bundles the credential material (which\
        \ is NEVER persisted on the\n server) with the durable lease metadata that\
        \ governs its lifetime. Returned\n once at issuance time; callers MUST store\
        \ the credential client-side before\n the lease expires."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the lease (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this lease belongs to (UUID, weak reference\
            \ to taxonomy)."
        principal_id:
          readOnly: true
          type: "string"
          description: "The principal (IAM user / service account) the lease was issued\
            \ to."
        ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Initial time-to-live for the lease."
        max_ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Maximum total lifetime including renewals — capped by the\
            \ engine."
        renewable:
          readOnly: true
          type: "boolean"
          description: "Whether the lease can be renewed."
        revocable:
          readOnly: true
          type: "boolean"
          description: "Whether the lease can be revoked early."
        issued_at:
          readOnly: true
          type: "string"
          description: "Timestamp when the lease was issued."
          format: "date-time"
        expires_at:
          readOnly: true
          type: "string"
          description: "Timestamp when the lease expires (may be extended by RenewQibdoLease)."
          format: "date-time"
        status:
          readOnly: true
          enum:
          - "LEASE_STATUS_UNSPECIFIED"
          - "LEASE_STATUS_ACTIVE"
          - "LEASE_STATUS_RENEWED"
          - "LEASE_STATUS_REVOKED"
          - "LEASE_STATUS_EXPIRED"
          type: "string"
          description: "Current lifecycle status of the lease."
          format: "enum"
        source_type:
          readOnly: true
          enum:
          - "LEASE_SOURCE_TYPE_UNSPECIFIED"
          - "LEASE_SOURCE_TYPE_DATABASE"
          - "LEASE_SOURCE_TYPE_CLOUD_AWS"
          - "LEASE_SOURCE_TYPE_CLOUD_GCP"
          - "LEASE_SOURCE_TYPE_CLOUD_AZURE"
          - "LEASE_SOURCE_TYPE_SSH"
          - "LEASE_SOURCE_TYPE_KUBERNETES"
          type: "string"
          description: "The engine that produced this lease (database / cloud_aws\
            \ / cloud_gcp / cloud_azure / ssh / kubernetes)."
          format: "enum"
        source_role:
          readOnly: true
          type: "string"
          description: "Engine-specific role identifier the lease was issued against\
            \ (e.g., the vault\n database role name for `database` leases)."
        engine_lease_id:
          readOnly: true
          type: "string"
          description: "The engine-side lease identifier (e.g., vault lease ID). Used\
            \ as the prefix\n key for bulk-revoke operations."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the lease metadata row was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the lease metadata was last modified (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoLease resource — a workspace-scoped, time-bounded credential\
        \ lease\n issued by the Qibdo vault engine. Leases bind ephemeral credentials\n\
        \ (database, cloud IAM, SSH OTP, K8s SA tokens) to a principal for a fixed\n\
        \ TTL with optional renewal. The credential payload itself is NEVER persisted\n\
        \ in the relational database — only the lease metadata."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the PKI role (UUID)."
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this role belongs to (UUID, weak reference to\n\
            \ taxonomy.workspaces)."
        certificate_authority_id:
          readOnly: true
          type: "string"
          description: "The certificate authority this role is attached to (UUID)."
        name:
          readOnly: true
          type: "string"
          description: "(CA-unique) human-readable role name. Mirrored as the role\
            \ name on the\n vault side. 3–64 chars, lowercase letters/digits/hyphen,\
            \ neither\n leading nor trailing hyphen."
        allowed_domains:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "Allowed Common Name / SAN domain patterns. Accepts bare DNS\
            \ labels and\n a single leading-wildcard form (`*.example.com`). At most\
            \ 64 entries,\n each at most 253 chars."
        max_ttl:
          readOnly: true
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Maximum total lifetime any certificate issued under this role\
            \ may hold."
        allowed_key_types:
          readOnly: true
          type: "array"
          items:
            type: "string"
          description: "Allowed crypto algorithms / key sizes. Names must match the\n\
            \ `CryptoAlgorithm` enum (e.g., `RSA_2048`, `EC_P256`, `ED25519`).\n At\
            \ most 16 entries."
        allowed_extended_key_usages:
          readOnly: true
          type: "array"
          items:
            enum:
            - "EXTENDED_KEY_USAGE_UNSPECIFIED"
            - "EXTENDED_KEY_USAGE_SERVER_AUTH"
            - "EXTENDED_KEY_USAGE_CLIENT_AUTH"
            - "EXTENDED_KEY_USAGE_CODE_SIGNING"
            - "EXTENDED_KEY_USAGE_EMAIL_PROTECTION"
            - "EXTENDED_KEY_USAGE_TIME_STAMPING"
            - "EXTENDED_KEY_USAGE_OCSP_SIGNING"
            - "EXTENDED_KEY_USAGE_IPSEC_USER"
            - "EXTENDED_KEY_USAGE_IPSEC_TUNNEL"
            type: "string"
            format: "enum"
          description: "Allowed Extended Key Usages."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the row was last modified (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoPkiRole resource — a per-CA, workspace-scoped role that constrains\n\
        \ which certificates a caller may request from `IssueQibdoCertificate`. A\n\
        \ role is the certificate-issuance contract: every issuance is checked\n against\
        \ four dimensions before the engine is touched:\n   - allowed_domains: requested\
        \ common_name + SANs must match\n   - max_ttl: requested ttl must not exceed\n\
        \   - allowed_key_types: requested key algorithm must be in the set\n   -\
        \ allowed_extended_key_usages: requested EKUs must be in the set\n\n Roles\
        \ are projected to the vault via POST /v1/<mount>/roles/{name} during\n register/update.\
        \ Delete unbinds the engine-side role."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecret:
      required:
      - "name"
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of the secret (UUID)"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace this secret belongs to (UUID, weak reference\
            \ to taxonomy)"
        name:
          type: "string"
          description: "Human-readable name of the secret, unique within the workspace\n\
            \ (3–256 chars, lowercase alphanumerics plus / - _)."
        rotation_period:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Optional automatic rotation period; null means no auto-rotation."
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag"
          description: "User-defined tags (key/value pairs) attached to the secret."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when the secret metadata was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when the secret metadata was last updated (server-managed)."
          format: "date-time"
        location_id:
          readOnly: true
          type: "string"
          description: "Weak reference to a topology Location — where this resource\
            \ resides.\n Defaults to the global location when omitted at creation\
            \ and is immutable\n thereafter. Only the global location is available\
            \ in this release."
      description: "QibdoSecret resource — a workspace-scoped, versioned container\
        \ of opaque\n secret material persisted by the Qibdo vault engine.\n Metadata\
        \ is stored in the relational database; payload bytes live exclusively in\
        \ the vault."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecretVersion:
      type: "object"
      properties:
        id:
          readOnly: true
          type: "string"
          description: "The unique identifier of this version (UUID)"
        secret_id:
          readOnly: true
          type: "string"
          description: "The parent secret that owns this version (UUID)"
        workspace_id:
          readOnly: true
          type: "string"
          description: "The workspace that owns this version (UUID, denormalised from\
            \ the parent secret)."
        version_number:
          readOnly: true
          type: "string"
          description: "Monotonically-increasing version number (1, 2, 3, ...)"
        state:
          readOnly: true
          enum:
          - "QIBDO_SECRET_VERSION_STATE_UNSPECIFIED"
          - "QIBDO_SECRET_VERSION_STATE_ENABLED"
          - "QIBDO_SECRET_VERSION_STATE_DISABLED"
          - "QIBDO_SECRET_VERSION_STATE_DESTROYED"
          type: "string"
          description: "Current lifecycle state of this version."
          format: "enum"
        checksum:
          readOnly: true
          type: "string"
          description: "Vault-specific content checksum (etag) of the payload."
        created:
          readOnly: true
          type: "string"
          description: "Timestamp when this version was created (server-managed)."
          format: "date-time"
        updated:
          readOnly: true
          type: "string"
          description: "Timestamp when this version's state last changed (server-managed)."
          format: "date-time"
      description: "QibdoSecretVersion — an immutable version of a QibdoSecret's payload.\n\
        \ Payload bytes are never persisted in the relational database; only metadata\
        \ round-trips."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.SourceIpCondition:
      required:
      - "operator"
      - "cidrs"
      type: "object"
      properties:
        operator:
          type: "string"
          description: "IN_RANGE grants the rule when the source IP is in any listed\
            \ CIDR;\n NOT_IN_RANGE grants the rule when it is in none."
        cidrs:
          type: "array"
          items:
            type: "string"
          description: "List of CIDR ranges to match against the caller's source IP."
      description: "SourceIpCondition — restricts access to callers whose source IP\
        \ falls\n inside (or outside) a set of CIDR ranges."
    com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.TimeWindowCondition:
      required:
      - "operator"
      - "from"
      - "to"
      - "timezone"
      type: "object"
      properties:
        operator:
          type: "string"
          description: "WITHIN grants the rule when the current time is inside [from,\
            \ to];\n OUTSIDE grants the rule when it is not."
        from:
          type: "string"
          description: "Start of the window in HH:mm 24-hour notation."
        to:
          type: "string"
          description: "End of the window in HH:mm 24-hour notation."
        timezone:
          type: "string"
          description: "IANA timezone identifier, e.g. \"Europe/Amsterdam\"."
      description: "TimeWindowCondition — restricts access to callers whose request\
        \ timestamp\n falls inside (or outside) a daily time window in the given timezone."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.ListVaultOperationsResponse:
      type: "object"
      properties:
        operations:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultOperation"
          description: "Operations\n\n The page of vault operations."
        next_page_token:
          type: "string"
          description: "Next Page Token\n\n A token, which can be sent as page_token\
            \ to retrieve the next page. If\n this field is empty, there are no subsequent\
            \ pages."
      description: "List Vault Operations Response\n\n Response message for ListOperations.\
        \ Per AIP-158, total_size is omitted —\n keyset pagination does not support\
        \ efficient total count computation."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.RestoreSnapshotRequest:
      required:
      - "snapshot"
      type: "object"
      properties:
        snapshot:
          type: "string"
          description: "Snapshot\n\n The snapshot bytes to restore. Typically these\
            \ are bytes returned from a\n previous TakeSnapshot call."
          format: "bytes"
      description: "Restore Snapshot Request\n\n Request message for RestoreSnapshot.\
        \ Carries the raw snapshot bytes inline."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.RotateRootKeyRequest:
      type: "object"
      properties: {}
      description: "Rotate Root Key Request\n\n Request message for RotateRootKey.\
        \ The RPC takes no parameters — it rotates\n the underlying keyring atomically."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.TakeSnapshotRequest:
      type: "object"
      properties: {}
      description: "Take Snapshot Request\n\n Request message for TakeSnapshot. The\
        \ RPC takes no parameters — the snapshot\n covers the entire vault contents\
        \ and is identified by the returned\n VaultOperation.id."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AddQibdoSecretVersionRequest:
      required:
      - "workspace"
      - "secret"
      - "payload"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the secret belongs to."
        secret:
          type: "string"
          description: "The parent secret to append a new version to."
        payload:
          type: "string"
          description: "The payload bytes to store (1 byte – 1 MiB)."
          format: "bytes"
      description: "Request payload for Add Qibdo Secret Version\n\n Carries the input\
        \ fields required to add qibdo secret version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AuthenticateWithQibdoApplicationCredentialRequest:
      required:
      - "workspace"
      - "role_id"
      - "secret_id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the credential belongs to."
        role_id:
          type: "string"
          description: "The RoleID (UUID) of the credential to authenticate against."
        secret_id:
          type: "string"
          description: "The SecretID returned by Issue or RotateSecretId."
        requested_ttl:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Optional explicit TTL request for the issued access token.\
            \ Capped at the\n credential's max_ttl. When unset, the credential's default\
            \ ttl applies."
      description: "Request payload for Authenticate With Qibdo Application Credential\n\
        \n Carries the input fields required to authenticate with qibdo application\
        \ credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.AuthenticateWithQibdoApplicationCredentialResponse:
      type: "object"
      properties:
        access_token:
          type: "string"
          description: "Short-lived the vault backend access token bound to the credential's\
            \ principal."
        expires_at:
          type: "string"
          description: "Timestamp at which the access token expires."
          format: "date-time"
      description: "Response payload from Authenticate With Qibdo Application Credential\n\
        \n Carries the output produced by authenticate with qibdo application credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.BulkRevokeQibdoLeasesByPrefixRequest:
      required:
      - "workspace"
      - "engine_lease_id_prefix"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose leases are subject to bulk revocation."
        engine_lease_id_prefix:
          type: "string"
          description: "The prefix every targeted lease's `engine_lease_id` must begin\
            \ with.\n For example, `database/creds/<role-name>/` revokes every credential\n\
            \ currently outstanding for that database role."
      description: "Request payload for Bulk Revoke Qibdo Leases By Prefix\n\n Carries\
        \ the input fields required to bulk revoke qibdo leases by prefix."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DecryptWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "ciphertext"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the crypto key."
        ciphertext:
          type: "string"
          description: "The ciphertext bytes to decrypt."
          format: "bytes"
        associated_data:
          type: "string"
          description: "Optional associated data (AAD) for AEAD modes; must match\
            \ what was supplied at encryption."
          format: "bytes"
      description: "Request payload for Decrypt With Qibdo Crypto Key\n\n Carries\
        \ the input fields required to decrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DecryptWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        plaintext:
          type: "string"
          description: "The recovered plaintext."
          format: "bytes"
      description: "Response payload from Decrypt With Qibdo Crypto Key\n\n Carries\
        \ the output produced by decrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DestroyQibdoSecretVersionRequest:
      required:
      - "workspace"
      - "secret"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the secret belongs to."
        secret:
          type: "string"
          description: "The parent secret."
        id:
          type: "string"
          description: "The version id (UUID) to destroy (irreversible)."
      description: "Request payload for Destroy Qibdo Secret Version\n\n Carries the\
        \ input fields required to destroy qibdo secret version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DisableQibdoCryptoKeyVersionRequest:
      required:
      - "workspace"
      - "cryptokey"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        cryptokey:
          type: "string"
          description: "The parent crypto key."
        id:
          type: "string"
          description: "The version id (UUID) to disable."
      description: "Request payload for Disable Qibdo Crypto Key Version\n\n Carries\
        \ the input fields required to disable qibdo crypto key version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.DisableQibdoSecretVersionRequest:
      required:
      - "workspace"
      - "secret"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the secret belongs to."
        secret:
          type: "string"
          description: "The parent secret."
        id:
          type: "string"
          description: "The version id (UUID) to disable."
      description: "Request payload for Disable Qibdo Secret Version\n\n Carries the\
        \ input fields required to disable qibdo secret version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.EncryptWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "plaintext"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the crypto key."
        plaintext:
          type: "string"
          description: "The plaintext bytes to encrypt (1 byte – 1 MiB)."
          format: "bytes"
        key_version:
          type: "string"
          description: "Optional explicit version number to encrypt under. Defaults\
            \ to the latest ENABLED version."
        associated_data:
          type: "string"
          description: "Optional associated data (AAD) for AEAD modes; empty when\
            \ omitted."
          format: "bytes"
      description: "Request payload for Encrypt With Qibdo Crypto Key\n\n Carries\
        \ the input fields required to encrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.EncryptWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        ciphertext:
          type: "string"
          description: "The opaque ciphertext envelope. Carries the version number\
            \ internally so it\n can decrypt without external bookkeeping."
          format: "bytes"
        key_version:
          type: "string"
          description: "The version of the crypto key that produced the ciphertext."
      description: "Response payload from Encrypt With Qibdo Crypto Key\n\n Carries\
        \ the output produced by encrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateCloudQibdoCredentialRequest:
      required:
      - "workspace"
      - "cloud_provider"
      - "source_role"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace to issue the credential under."
        cloud_provider:
          enum:
          - "CLOUD_PROVIDER_UNSPECIFIED"
          - "CLOUD_PROVIDER_AWS"
          - "CLOUD_PROVIDER_GCP"
          - "CLOUD_PROVIDER_AZURE"
          type: "string"
          description: "The cloud provider whose IAM credentials are requested."
          format: "enum"
        source_role:
          type: "string"
          description: "The pre-configured role to draw the credential from. Names\
            \ map to:\n   - AWS:   STS role (preferred) or static IAM role\n   - GCP:\
            \   roleset\n   - Azure: role"
      description: "Request payload for Generate Cloud Qibdo Credential\n\n Carries\
        \ the input fields required to generate cloud qibdo credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateCloudQibdoCredentialResponse:
      type: "object"
      properties:
        credential:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoEphemeralCredential"
          description: "The freshly issued ephemeral credential bundled with its lease\
            \ handle."
        cloud_provider:
          readOnly: true
          enum:
          - "CLOUD_PROVIDER_UNSPECIFIED"
          - "CLOUD_PROVIDER_AWS"
          - "CLOUD_PROVIDER_GCP"
          - "CLOUD_PROVIDER_AZURE"
          type: "string"
          description: "The cloud provider that issued the credential — echoed for\
            \ convenience."
          format: "enum"
      description: "Response payload from Generate Cloud Qibdo Credential\n\n Carries\
        \ the output produced by generate cloud qibdo credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDataEncryptionKeyRequest:
      required:
      - "workspace"
      - "id"
      - "bits"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the wrapping crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the wrapping crypto key."
        bits:
          type: "integer"
          description: "The size of the DEK to generate, in bits. Typical values:\
            \ 128, 256, 512."
          format: "int32"
        wrapped_only:
          type: "boolean"
          description: "When true, the response omits the plaintext DEK (only the\
            \ wrapped form is returned)."
      description: "Request payload for Generate Data Encryption Key\n\n Carries the\
        \ input fields required to generate data encryption key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDataEncryptionKeyResponse:
      type: "object"
      properties:
        plaintext:
          type: "string"
          description: "The DEK in plaintext form. Empty when `wrapped_only=true`."
          format: "bytes"
        ciphertext:
          type: "string"
          description: "The DEK wrapped (encrypted) under the named crypto key."
          format: "bytes"
        key_version:
          type: "string"
          description: "The version of the wrapping crypto key."
      description: "Response payload from Generate Data Encryption Key\n\n Carries\
        \ the output produced by generate data encryption key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDatabaseQibdoCredentialRequest:
      required:
      - "workspace"
      - "source_role"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace to issue the credential under."
        source_role:
          type: "string"
          description: "Legacy: free-form the vault backend database role name to\
            \ draw the credential from.\n Pre-configured out-of-band by a vault administrator.\
            \ Kept for the\n transition window — when both `source_role` and `database_role`\
            \ are\n supplied, `database_role` wins."
        database_role:
          type: "string"
          description: "The QibdoDatabaseRole UUID to draw the credential from. When\n\
            \ supplied, the handler resolves the role's name + workspace before\n\
            \ forwarding to the engine — replacing the legacy `source_role` lookup."
      description: "Request payload for Generate Database Qibdo Credential\n\n Carries\
        \ the input fields required to generate database qibdo credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateDatabaseQibdoCredentialResponse:
      type: "object"
      properties:
        credential:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoEphemeralCredential"
          description: "The freshly issued ephemeral credential bundled with its lease\
            \ handle."
      description: "Response payload from Generate Database Qibdo Credential\n\n Carries\
        \ the output produced by generate database qibdo credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateKubernetesQibdoTokenRequest:
      required:
      - "workspace"
      - "source_role"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace to issue the workload-identity ServiceAccount\
            \ token under."
        source_role:
          type: "string"
          description: "The pre-configured workload-identity role that binds the ServiceAccount,\
            \ allowed\n namespaces, and audience scopes."
        kubernetes_namespace:
          type: "string"
          description: "Optional workload-identity namespace for the ServiceAccount\
            \ binding. Required when\n the role allows multiple namespaces; ignored\
            \ when the role pins a single\n namespace."
        cluster_role_binding:
          type: "boolean"
          description: "Whether the role binding is cluster-wide (true) or namespace-scoped\
            \ (false)."
        ttl_seconds:
          type: "string"
          description: "Optional override of the role's default TTL in seconds."
      description: "Request payload for Generate Workload Qibdo Token\n\n Carries\
        \ the input fields required to generate workload qibdo token."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateKubernetesQibdoTokenResponse:
      type: "object"
      properties:
        token:
          readOnly: true
          type: "string"
          description: "The raw bearer token. Returned exactly once — clients MUST\
            \ persist it before\n the lease expires."
        service_account_name:
          readOnly: true
          type: "string"
          description: "The bound ServiceAccount name as resolved by the engine."
        service_account_namespace:
          readOnly: true
          type: "string"
          description: "The bound ServiceAccount namespace as resolved by the engine."
        lease:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease"
          description: "The lease metadata that governs the token's lifetime."
      description: "Response payload from Generate Workload Qibdo Token\n\n Carries\
        \ the output produced by generate workload qibdo token."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateRandomBytesRequest:
      required:
      - "workspace"
      - "bytes"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace whose namespace the random material is drawn\
            \ from."
        bytes:
          type: "integer"
          description: "The number of random bytes to return (1 – 4096)."
          format: "int32"
      description: "Request payload for Generate Random Bytes\n\n Carries the input\
        \ fields required to generate random bytes."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GenerateRandomBytesResponse:
      type: "object"
      properties:
        random:
          type: "string"
          description: "The random material."
          format: "bytes"
      description: "Response payload from Generate Random Bytes\n\n Carries the output\
        \ produced by generate random bytes."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GetQibdoCertificateRevocationListResponse:
      type: "object"
      properties:
        crl_pem:
          readOnly: true
          type: "string"
          description: "PEM-encoded X.509 CRL."
      description: "Response payload from Get Qibdo Certificate Revocation List\n\n\
        \ Carries the output produced by get qibdo certificate revocation list."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.GetQibdoSecretVersionResponse:
      type: "object"
      properties:
        version:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecretVersion"
          description: "The version metadata."
        payload:
          readOnly: true
          type: "string"
          description: "The version's payload bytes (server-returned)."
          format: "bytes"
      description: "Response payload from Get Qibdo Secret Version\n\n Carries the\
        \ output produced by get qibdo secret version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.HmacWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "message"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the MAC crypto key."
        message:
          type: "string"
          description: "The message bytes to authenticate."
          format: "bytes"
        key_version:
          type: "string"
          description: "Optional explicit version number to use. Defaults to the latest\
            \ ENABLED version."
        mac_algorithm:
          type: "string"
          description: "Optional MAC algorithm hint (e.g. \"sha2-256\", \"sha2-384\"\
            , \"sha2-512\")."
      description: "Request payload for Hmac With Qibdo Crypto Key\n\n Carries the\
        \ input fields required to hmac with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.HmacWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        tag:
          type: "string"
          description: "The MAC tag bytes."
          format: "bytes"
        key_version:
          type: "string"
          description: "The version of the MAC key that produced the tag."
      description: "Response payload from Hmac With Qibdo Crypto Key\n\n Carries the\
        \ output produced by hmac with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoApplicationCredentialRequest:
      required:
      - "workspace"
      - "application_credential"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the credential belongs to."
        application_credential:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential"
          description: "The credential to create. Only `name`, `principal_id`, `ttl`,\
            \ and\n `max_ttl` are honoured — every other field is OUTPUT_ONLY."
        location_id:
          type: "string"
          description: "Optional weak reference to a topology Location where the credential\
            \ resides.\n Defaults to the global location when omitted; immutable after\
            \ creation.\n Only the global location is available in this release."
      description: "Request payload for Issue Qibdo Application Credential\n\n Carries\
        \ the input fields required to issue qibdo application credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoApplicationCredentialResponse:
      type: "object"
      properties:
        application_credential:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential"
          description: "The persisted credential metadata. SecretID is NOT included\
            \ here."
        secret_id:
          type: "string"
          description: "The freshly-minted SecretID. Returned exactly once — the server\
            \ retains\n only its SHA-512 hash."
      description: "Response payload from Issue Qibdo Application Credential\n\n Carries\
        \ the output produced by issue qibdo application credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueQibdoCertificateRequest:
      required:
      - "workspace"
      - "certificate_authority"
      - "role"
      - "common_name"
      - "ttl"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the CA belongs to."
        certificate_authority:
          type: "string"
          description: "The CA that will issue the certificate."
        role:
          type: "string"
          description: "The QibdoPkiRole used to constrain certificate parameters\
            \ (allowed\n domains, key types, max TTL, allowed extended key usages).\
            \ Carried as\n a UUID identifying the role aggregate; the handler loads\
            \ the role and\n enforces all four dimensions before delegating to the\
            \ engine."
        common_name:
          type: "string"
          description: "Common Name for the issued certificate (typically a DNS name\
            \ or service\n identity). Subject DN is composed from this."
        subject_alternative_names:
          type: "array"
          items:
            type: "string"
          description: "Optional Subject Alternative Names — DNS names, IP addresses,\
            \ or URIs."
        ttl:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Requested validity duration. The role's max_ttl caps the granted\
            \ TTL —\n the vault backend silently truncates if exceeded."
        tags:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.VaultTag"
          description: "Optional tag entries used for organisation and policy matching."
        requested_key_type:
          type: "string"
          description: "Optional requested key algorithm. When omitted the role's\
            \ first allowed\n key type is implied. Names must match the `CryptoAlgorithm`\
            \ enum\n (`RSA_2048`, `EC_P256`, `ED25519`, etc.). When provided, must\
            \ appear in\n the role's `allowed_key_types`; otherwise INVALID_ARGUMENT."
        requested_extended_key_usages:
          type: "array"
          items:
            enum:
            - "EXTENDED_KEY_USAGE_UNSPECIFIED"
            - "EXTENDED_KEY_USAGE_SERVER_AUTH"
            - "EXTENDED_KEY_USAGE_CLIENT_AUTH"
            - "EXTENDED_KEY_USAGE_CODE_SIGNING"
            - "EXTENDED_KEY_USAGE_EMAIL_PROTECTION"
            - "EXTENDED_KEY_USAGE_TIME_STAMPING"
            - "EXTENDED_KEY_USAGE_OCSP_SIGNING"
            - "EXTENDED_KEY_USAGE_IPSEC_USER"
            - "EXTENDED_KEY_USAGE_IPSEC_TUNNEL"
            type: "string"
            format: "enum"
          description: "Optional requested Extended Key Usages. When non-empty, every\
            \ entry must\n appear in the role's `allowed_extended_key_usages`; otherwise\n\
            \ INVALID_ARGUMENT."
      description: "Request payload for Issue Qibdo Certificate\n\n Carries the input\
        \ fields required to issue qibdo certificate."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueSshQibdoOtpRequest:
      required:
      - "workspace"
      - "source_role"
      - "username"
      - "ip_address"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace to issue the OTP under."
        source_role:
          type: "string"
          description: "The pre-configured OTP role."
        username:
          type: "string"
          description: "The username that will use the OTP on the target host."
        ip_address:
          type: "string"
          description: "The target host IP address."
      description: "Request payload for Issue Ssh Qibdo Otp\n\n Carries the input\
        \ fields required to issue ssh qibdo otp."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.IssueSshQibdoOtpResponse:
      type: "object"
      properties:
        credential:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoEphemeralCredential"
          description: "The freshly issued one-time password bundled with its lease\
            \ handle.\n The credential's username/password fields carry the SSH username\
            \ + OTP."
      description: "Response payload from Issue Ssh Qibdo Otp\n\n Carries the output\
        \ produced by issue ssh qibdo otp."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoAccessPoliciesResponse:
      type: "object"
      properties:
        access_policies:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoAccessPolicy"
          description: "The page of access policies."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Access Policies\n\n Carries the\
        \ output produced by list qibdo access policies."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoApplicationCredentialsResponse:
      type: "object"
      properties:
        application_credentials:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential"
          description: "The page of credentials."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Application Credentials\n\n Carries\
        \ the output produced by list qibdo application credentials."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCertificateAuthoritiesResponse:
      type: "object"
      properties:
        certificate_authorities:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificateAuthority"
          description: "The page of CAs."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Certificate Authorities\n\n Carries\
        \ the output produced by list qibdo certificate authorities."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCertificatesResponse:
      type: "object"
      properties:
        certificates:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCertificate"
          description: "The page of certificates."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Certificates\n\n Carries the\
        \ output produced by list qibdo certificates."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCryptoKeyVersionsResponse:
      type: "object"
      properties:
        versions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKeyVersion"
          description: "The page of crypto key versions (metadata only)."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page."
      description: "Response payload from List Qibdo Crypto Key Versions\n\n Carries\
        \ the output produced by list qibdo crypto key versions."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoCryptoKeysResponse:
      type: "object"
      properties:
        cryptokeys:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoCryptoKey"
          description: "The page of crypto keys."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Crypto Keys\n\n Carries the output\
        \ produced by list qibdo crypto keys."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoDatabaseRolesResponse:
      type: "object"
      properties:
        database_roles:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole"
          description: "The page of roles."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Database Roles\n\n Carries the\
        \ output produced by list qibdo database roles."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoLeasesResponse:
      type: "object"
      properties:
        leases:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease"
          description: "The page of leases."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Leases\n\n Carries the output\
        \ produced by list qibdo leases."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoPkiRolesResponse:
      type: "object"
      properties:
        pki_roles:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole"
          description: "The page of roles."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Pki Roles\n\n Carries the output\
        \ produced by list qibdo pki roles."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoSecretVersionsResponse:
      type: "object"
      properties:
        versions:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecretVersion"
          description: "The page of secret versions (metadata only — no payloads)."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page."
      description: "Response payload from List Qibdo Secret Versions\n\n Carries the\
        \ output produced by list qibdo secret versions."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ListQibdoSecretsResponse:
      type: "object"
      properties:
        secrets:
          type: "array"
          items:
            $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoSecret"
          description: "The page of secrets."
        next_page_token:
          type: "string"
          description: "Opaque token for the next page; empty when no more results."
      description: "Response payload from List Qibdo Secrets\n\n Carries the output\
        \ produced by list qibdo secrets."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ReEncryptWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "ciphertext"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the crypto key."
        ciphertext:
          type: "string"
          description: "The ciphertext to migrate to the latest ENABLED version."
          format: "bytes"
        associated_data:
          type: "string"
          description: "Optional associated data (AAD) for AEAD modes."
          format: "bytes"
      description: "Request payload for Re Encrypt With Qibdo Crypto Key\n\n Carries\
        \ the input fields required to re encrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ReEncryptWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        ciphertext:
          type: "string"
          description: "The new ciphertext, encrypted under the latest ENABLED version."
          format: "bytes"
        key_version:
          type: "string"
          description: "The new version number that produced the re-encrypted ciphertext."
      description: "Response payload from Re Encrypt With Qibdo Crypto Key\n\n Carries\
        \ the output produced by re encrypt with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoDatabaseRoleRequest:
      required:
      - "workspace"
      - "database_role"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the role belongs to."
        database_role:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole"
          description: "The role to register."
        location_id:
          type: "string"
          description: "Optional weak reference to a topology Location where the role\
            \ resides.\n Defaults to the global location when omitted; immutable after\
            \ creation.\n Only the global location is available in this release."
      description: "Request payload for Register Qibdo Database Role\n\n Carries the\
        \ input fields required to register qibdo database role."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoDatabaseRoleResponse:
      type: "object"
      properties:
        database_role:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoDatabaseRole"
          description: "The persisted role metadata."
      description: "Response payload from Register Qibdo Database Role\n\n Carries\
        \ the output produced by register qibdo database role."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoPkiRoleRequest:
      required:
      - "workspace"
      - "certificate_authority"
      - "pki_role"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the role belongs to."
        certificate_authority:
          type: "string"
          description: "The CA the role is attached to."
        pki_role:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole"
          description: "The role to register."
        location_id:
          type: "string"
          description: "Optional weak reference to a topology Location where the role\
            \ resides.\n Defaults to the global location when omitted; immutable after\
            \ creation.\n Only the global location is available in this release."
      description: "Request payload for Register Qibdo Pki Role\n\n Carries the input\
        \ fields required to register qibdo pki role."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RegisterQibdoPkiRoleResponse:
      type: "object"
      properties:
        pki_role:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoPkiRole"
          description: "The persisted role metadata."
      description: "Response payload from Register Qibdo Pki Role\n\n Carries the\
        \ output produced by register qibdo pki role."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RenewQibdoLeaseRequest:
      required:
      - "workspace"
      - "id"
      - "extension"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the lease belongs to."
        id:
          type: "string"
          description: "The lease to renew."
        extension:
          pattern: "^-?(?:0|[1-9][0-9]{0,11})(?:\\.[0-9]{1,9})?s$"
          type: "string"
          description: "Requested extension. The engine may cap it at the lease's\
            \ max TTL."
      description: "Request payload for Renew Qibdo Lease\n\n Carries the input fields\
        \ required to renew qibdo lease."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoApplicationCredentialRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the credential belongs to."
        id:
          type: "string"
          description: "The credential to revoke."
      description: "Request payload for Revoke Qibdo Application Credential\n\n Carries\
        \ the input fields required to revoke qibdo application credential."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoCertificateAuthorityRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the CA belongs to."
        id:
          type: "string"
          description: "The CA to revoke."
      description: "Request payload for Revoke Qibdo Certificate Authority\n\n Carries\
        \ the input fields required to revoke qibdo certificate authority."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoCertificateRequest:
      required:
      - "workspace"
      - "certificate_authority"
      - "id"
      - "reason"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the CA belongs to."
        certificate_authority:
          type: "string"
          description: "The CA that issued the certificate."
        id:
          type: "string"
          description: "The certificate to revoke."
        reason:
          enum:
          - "CERTIFICATE_REVOCATION_REASON_UNSPECIFIED"
          - "CERTIFICATE_REVOCATION_REASON_UNSPECIFIED_REASON"
          - "CERTIFICATE_REVOCATION_REASON_KEY_COMPROMISE"
          - "CERTIFICATE_REVOCATION_REASON_CA_COMPROMISE"
          - "CERTIFICATE_REVOCATION_REASON_AFFILIATION_CHANGED"
          - "CERTIFICATE_REVOCATION_REASON_SUPERSEDED"
          - "CERTIFICATE_REVOCATION_REASON_CESSATION_OF_OPERATION"
          - "CERTIFICATE_REVOCATION_REASON_CERTIFICATE_HOLD"
          - "CERTIFICATE_REVOCATION_REASON_PRIVILEGE_WITHDRAWN"
          - "CERTIFICATE_REVOCATION_REASON_AA_COMPROMISE"
          type: "string"
          description: "RFC 5280 §5.3.1 revocation reason."
          format: "enum"
      description: "Request payload for Revoke Qibdo Certificate\n\n Carries the input\
        \ fields required to revoke qibdo certificate."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RevokeQibdoLeaseRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the lease belongs to."
        id:
          type: "string"
          description: "The lease to revoke."
      description: "Request payload for Revoke Qibdo Lease\n\n Carries the input fields\
        \ required to revoke qibdo lease."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoApplicationCredentialSecretIdRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the credential belongs to."
        id:
          type: "string"
          description: "The credential to rotate."
      description: "Request payload for Rotate Qibdo Application Credential Secret\
        \ Id\n\n Carries the input fields required to rotate qibdo application credential\
        \ secret id."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoApplicationCredentialSecretIdResponse:
      type: "object"
      properties:
        application_credential:
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoApplicationCredential"
          description: "The persisted credential metadata after rotation. SecretID\
            \ is NOT\n included here."
        secret_id:
          type: "string"
          description: "The freshly-minted SecretID. Returned exactly once."
      description: "Response payload from Rotate Qibdo Application Credential Secret\
        \ Id\n\n Carries the output produced by rotate qibdo application credential\
        \ secret id."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.RotateQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the crypto key to rotate."
      description: "Request payload for Rotate Qibdo Crypto Key\n\n Carries the input\
        \ fields required to rotate qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.ScheduleDestroyQibdoCryptoKeyVersionRequest:
      required:
      - "workspace"
      - "cryptokey"
      - "id"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        cryptokey:
          type: "string"
          description: "The parent crypto key."
        id:
          type: "string"
          description: "The version id (UUID) to schedule for destruction."
      description: "Request payload for Schedule Destroy Qibdo Crypto Key Version\n\
        \n Carries the input fields required to schedule destroy qibdo crypto key\
        \ version."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignSshQibdoCertificateRequest:
      required:
      - "workspace"
      - "source_role"
      - "public_key"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace to issue the SSH certificate under."
        source_role:
          type: "string"
          description: "The pre-configured SSH role bound to the workspace SSH CA."
        public_key:
          type: "string"
          description: "The OpenSSH-formatted client public key to sign (e.g., `ssh-rsa\
            \ AAAAB3...`)."
      description: "Request payload for Sign Ssh Qibdo Certificate\n\n Carries the\
        \ input fields required to sign ssh qibdo certificate."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignSshQibdoCertificateResponse:
      type: "object"
      properties:
        signed_key:
          readOnly: true
          type: "string"
          description: "The OpenSSH-formatted signed certificate (`ssh-rsa-cert-v01@openssh.com\
            \ ...`).\n Returned exactly once — clients MUST persist it before the\
            \ lease expires."
        serial_number:
          readOnly: true
          type: "string"
          description: "The serial number assigned by the SSH CA at signing time."
        lease:
          readOnly: true
          allOf:
          - $ref: "#/components/schemas/com.qibdo.cloud.vault.infrastructure.integration.v1.schema.qibdo.QibdoLease"
          description: "The lease metadata that governs the certificate's lifetime."
      description: "Response payload from Sign Ssh Qibdo Certificate\n\n Carries the\
        \ output produced by sign ssh qibdo certificate."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "message"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the SIGN_VERIFY crypto key."
        message:
          type: "string"
          description: "The message bytes to sign (or pre-computed digest if `prehashed=true`)."
          format: "bytes"
        key_version:
          type: "string"
          description: "Optional explicit version number to sign with. Defaults to\
            \ the latest ENABLED version."
        signature_algorithm:
          type: "string"
          description: "Optional signature algorithm hint for RSA keys (e.g. \"pss\"\
            , \"pkcs1v15\")."
        prehashed:
          type: "boolean"
          description: "When true, treat `message` as a pre-computed digest of the\
            \ same hash size as the key."
      description: "Request payload for Sign With Qibdo Crypto Key\n\n Carries the\
        \ input fields required to sign with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.SignWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        signature:
          type: "string"
          description: "The signature bytes, opaque to the caller."
          format: "bytes"
        key_version:
          type: "string"
          description: "The version of the crypto key that produced the signature."
      description: "Response payload from Sign With Qibdo Crypto Key\n\n Carries the\
        \ output produced by sign with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.UnwrapResponseRequest:
      required:
      - "workspace"
      - "token"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace under which the token was wrapped."
        token:
          type: "string"
          description: "The wrapping token issued by `WrapResponse`."
      description: "Request payload for Unwrap Response\n\n Carries the input fields\
        \ required to unwrap response."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.UnwrapResponseResponse:
      type: "object"
      properties:
        payload:
          readOnly: true
          type: "string"
          description: "The original payload."
          format: "bytes"
        original_creation_time:
          readOnly: true
          type: "string"
          description: "The engine-side wrap-time creation timestamp echoed for auditability."
          format: "date-time"
      description: "Response payload from Unwrap Response\n\n Carries the output produced\
        \ by unwrap response."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.VerifyWithQibdoCryptoKeyRequest:
      required:
      - "workspace"
      - "id"
      - "message"
      - "signature"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace the crypto key belongs to."
        id:
          type: "string"
          description: "The unique identifier of the SIGN_VERIFY crypto key."
        message:
          type: "string"
          description: "The message bytes that were signed (or its digest if `prehashed=true`)."
          format: "bytes"
        signature:
          type: "string"
          description: "The signature bytes to verify."
          format: "bytes"
        signature_algorithm:
          type: "string"
          description: "Optional signature algorithm hint for RSA keys (e.g. \"pss\"\
            , \"pkcs1v15\")."
        prehashed:
          type: "boolean"
          description: "When true, treat `message` as a pre-computed digest."
      description: "Request payload for Verify With Qibdo Crypto Key\n\n Carries the\
        \ input fields required to verify with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.VerifyWithQibdoCryptoKeyResponse:
      type: "object"
      properties:
        valid:
          type: "boolean"
          description: "True iff the signature is valid for the given message under\
            \ the named key."
      description: "Response payload from Verify With Qibdo Crypto Key\n\n Carries\
        \ the output produced by verify with qibdo crypto key."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.WrapResponseRequest:
      required:
      - "workspace"
      - "ttl_seconds"
      - "payload"
      type: "object"
      properties:
        workspace:
          type: "string"
          description: "The workspace under which the payload is wrapped."
        ttl_seconds:
          type: "string"
          description: "Time-to-live in seconds. Token expires automatically when\
            \ reached."
        payload:
          type: "string"
          description: "The payload to wrap, as opaque bytes. Treated as base64 in\
            \ REST."
          format: "bytes"
      description: "Request payload for Wrap Response\n\n Carries the input fields\
        \ required to wrap response."
    com.qibdo.cloud.vault.infrastructure.integration.v1.service.qibdo.WrapResponseResponse:
      type: "object"
      properties:
        token:
          readOnly: true
          type: "string"
          description: "The one-time wrapping token. Returned exactly once — clients\
            \ MUST persist\n it before delivering it to the consumer."
        ttl_seconds:
          readOnly: true
          type: "string"
          description: "Echoed TTL in seconds."
        creation_time:
          readOnly: true
          type: "string"
          description: "Engine-side wrap-time creation timestamp."
          format: "date-time"
      description: "Response payload from Wrap Response\n\n Carries the output produced\
        \ by wrap response."
    google.protobuf.Any:
      type: "object"
      properties:
        '@type':
          type: "string"
          description: "The type of the serialized message."
      additionalProperties: true
      description: "Contains an arbitrary serialized message along with a @type that\
        \ describes the type of the serialized message."
    google.rpc.Status:
      type: "object"
      properties:
        code:
          type: "integer"
          description: "The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]."
          format: "int32"
        message:
          type: "string"
          description: "A developer-facing error message, which should be in English.\
            \ Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details]\
            \ field, or localized by the client."
        details:
          type: "array"
          items:
            $ref: "#/components/schemas/google.protobuf.Any"
          description: "A list of messages that carry the error details.  There is\
            \ a common set of message types for APIs to use."
      description: "The `Status` type defines a logical error model that is suitable\
        \ for different programming environments, including REST APIs and RPC APIs.\
        \ It is used by [gRPC](https://github.com/grpc). Each `Status` message contains\
        \ three pieces of data: error code, error message, and error details. You\
        \ can find out more about this error model and how to work with it in the\
        \ [API Design Guide](https://cloud.google.com/apis/design/errors)."
    google.type.TimeOfDay:
      type: "object"
      properties:
        hours:
          type: "integer"
          description: "Hours of a day in 24 hour format. Must be greater than or\
            \ equal to 0 and\n typically must be less than or equal to 23. An API\
            \ may choose to allow the\n value \"24:00:00\" for scenarios like business\
            \ closing time."
          format: "int32"
        minutes:
          type: "integer"
          description: "Minutes of an hour. Must be greater than or equal to 0 and\
            \ less than or\n equal to 59."
          format: "int32"
        seconds:
          type: "integer"
          description: "Seconds of a minute. Must be greater than or equal to 0 and\
            \ typically must\n be less than or equal to 59. An API may allow the value\
            \ 60 if it allows\n leap-seconds."
          format: "int32"
        nanos:
          type: "integer"
          description: "Fractions of seconds, in nanoseconds. Must be greater than\
            \ or equal to 0\n and less than or equal to 999,999,999."
          format: "int32"
      description: "Represents a time of day. The date and time zone are either not\
        \ significant\n or are specified elsewhere. An API may choose to allow leap\
        \ seconds. Related\n types are [google.type.Date][google.type.Date] and\n\
        \ `google.protobuf.Timestamp`."
tags:
- name: "AccessPolicyService"
  description: "Access Policies\n\n The AccessPolicyService service definition.\n\
    \ Access policies grant principals (users, groups, service accounts) one of the\n\
    \ registry actions (push, pull, delete, admin) on a registry resource. The\n resource\
    \ is the URL parent — a Namespace OR an Image Repository — and the\n scope is\
    \ derived from the URL path. Policies are evaluated server-side ahead\n of every\
    \ registry request, so revocation is immediate.\n We use the Google AIP (API Improvement\
    \ Proposal) style guide for API design.\n https://google.aip.dev/\n https://google.aip.dev/130"
- name: "ActivityService"
  description: "Activities\n\n Provides read-only access to platform activity records.\
    \ Activities are an\n audit projection created as a side-effect of mutation RPCs\
    \ and can be queried\n to review who did what, where, and when. This surface is\
    \ engine-neutral.\n We use the Google AIP (API Improvement Proposal) style guide\
    \ for API design.\n https://google.aip.dev/"
- name: "AlertRuleService"
  description: "Alert Rules\n\n Manages per-workspace alert and recording rules and\
    \ their notification routing. The provider that\n evaluates the rule is selected\
    \ by the `engines/{engine}` path segment; `-` lists across all\n providers or\
    \ resolves the provider from the record on a by-id read.\n We use the Google AIP\
    \ (API Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "ArtifactService"
  description: "Artifacts\n\n The ArtifactService service definition.\n Control-plane\
    \ surface for artifacts (manifests + tags) in a Qibdo registry.\n Push and pull\
    \ traffic flows through the registry data plane directly; this\n service handles\
    \ read, list, and delete — operations that need IAM gating\n and audit records.\
    \ The two delete operations are intentionally separate:\n DeleteArtifact removes\
    \ the manifest and detaches all of its tags; DeleteTag\n removes one tag and the\
    \ manifest survives if any other tag still references\n it or it is referenced\
    \ by digest. Vulnerability scanning lives on the\n sibling ScanService.\n We use\
    \ the Google AIP (API Improvement Proposal) style guide for API design.\n https://google.aip.dev/\n\
    \ https://google.aip.dev/130"
- name: "AuditLogService"
  description: "Audit Log\n\n The AuditLogService service definition.\n Read-only\
    \ access to the registry audit trail. Every mutation in the registry\n (create/update/delete\
    \ of namespaces, repositories, policies, locks) and\n every successful push/pull/delete\
    \ on the data plane produces an AuditEntry\n that is queryable here for compliance\
    \ and forensics.\n We use the Google AIP (API Improvement Proposal) style guide\
    \ for API design.\n https://google.aip.dev/\n https://google.aip.dev/130"
- name: "BucketService"
  description: "Buckets\n\n Manages workspace-scoped storage containers. The cloud\
    \ provider is selected by the\n `engines/{engine}` path segment; `-` acts across\
    \ all providers (lists every provider, or\n resolves the provider from the record\
    \ on a by-id read). Buckets are the parent scope for\n objects, multipart uploads,\
    \ and presigned URLs.\n We use the Google AIP (API Improvement Proposal) style\
    \ guide for API design.\n https://google.aip.dev/"
- name: "ComputeOperationService"
  description: "Compute Operations\n\n The ComputeOperationService provides read-only\
    \ access to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Delete,\n Start, Stop, etc.) and can be queried to track progress\
    \ or retrieve results."
- name: "CredentialService"
  description: "Credentials\n\n The CredentialService service definition.\n Issues\
    \ short-lived, IAM-gated registry credentials that clients use to push\n and pull\
    \ through the registry data plane. Credentials are derived from the\n caller's\
    \ identity and the namespace's access policies — they are never\n long-lived secrets.\n\
    \ We use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/\n https://google.aip.dev/130"
- name: "CrossNamespaceGrantService"
  description: "Cross-Namespace Grants\n\n The CrossNamespaceGrantService service\
    \ definition.\n A cross-namespace grant authorises namespace B to pull from namespace\
    \ A,\n optionally restricted by a tag pattern. The URL parent is the **source**\n\
    \ namespace (the granter); the target namespace travels in the request\n body.\
    \ The grant is one-directional and may cross workspace boundaries.\n We use the\
    \ Google AIP (API Improvement Proposal) style guide for API\n design. https://google.aip.dev/\n\
    \ https://google.aip.dev/130 (Standard methods)\n https://google.aip.dev/122 (Resource\
    \ names)"
- name: "DeploymentLockService"
  description: "Deployment Locks\n\n The DeploymentLockService service definition.\n\
    \ A deployment lock pins a (repository, digest) pair so that the artifact\n cannot\
    \ be deleted, retagged, or garbage-collected while the lock is held.\n Locks are\
    \ taken when a workload is launched from a registry image and\n released when\
    \ the workload terminates.\n We use the Google AIP (API Improvement Proposal)\
    \ style guide for API design.\n https://google.aip.dev/\n https://google.aip.dev/130"
- name: "DeploymentTargetService"
  description: "Deployment Targets\n\n The DeploymentTargetService manages physical\
    \ hosts (deployment targets) in the Qibdo Cloud\n topology. Deployment targets\
    \ can optionally be assigned to a resource pool; the zone\n relationship is derived\
    \ through the resource pool.\n We use the Google AIP (API Improvement Proposal)\
    \ style guide for API design.\n https://google.aip.dev/"
- name: "GroupService"
  description: "Groups\n\n The GroupService manages folder-like containers that organise\
    \ workspaces\n inside an organisation. Groups support arbitrary nesting via a\
    \ self-referential\n parent_group_id. A root-level group has no parent."
- name: "IamBindingService"
  description: "IAM Bindings\n\n The IamBindingService manages the assignment of roles\
    \ to principals\n within a scope. Each binding links a principal (user) to a role,\n\
    \ scoped to a workspace, group, or organisation, optionally constrained\n by a\
    \ policy."
- name: "IamOperationService"
  description: "IAM Operations\n\n The IamOperationService provides read-only access\
    \ to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Update,\n Delete, Authenticate) and can be queried to track progress\
    \ or retrieve results."
- name: "IngestionConfigService"
  description: "Ingestion Configs\n\n Manages per-workspace telemetry ingestion (collected\
    \ sources + trace head-sampling). The provider\n that runs the pipeline is selected\
    \ by the `engines/{engine}` path segment; `-` lists across all\n providers or\
    \ resolves the provider from the record on a by-id read. A config is created and\
    \ updated,\n never deleted (one per workspace; reset to defaults instead).\n We\
    \ use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/"
- name: "LocationService"
  description: "Locations\n\n The engine-agnostic geography catalogue. A single service\
    \ exposes a cross-kind / cross-provider\n browse-and-resolve surface (Locations),\
    \ the typed Region / Zone / Multi-Region collections, and the\n kind-uniform usability\
    \ lifecycle. The cloud provider is selected by the `engines/{engine}` path\n segment;\
    \ `-` spans all providers. Only the qibdo provider is populated today; aws/gcp/azure\
    \ rows are\n representable (provider-tagged inventory) without an adapter.\n We\
    \ use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/"
- name: "LogService"
  description: "Logs\n\n Queries and live-tails log telemetry. The provider is selected\
    \ by the\n `engines/{engine}` path segment; the telemetry itself lives in the\
    \ engine's\n log store and is never persisted by this service.\n We use the Google\
    \ AIP (API Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "LogSinkService"
  description: "Log Sinks\n\n Manages per-workspace log sinks. The provider that operates\
    \ the sink is selected by the\n `engines/{engine}` path segment; `-` lists across\
    \ all providers or resolves the provider from\n the record on a by-id read.\n\
    \ We use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/"
- name: "MetricService"
  description: "Metrics\n\n Queries metric telemetry. The provider is selected by\
    \ the `engines/{engine}`\n path segment; the telemetry lives in the engine's metric\
    \ store.\n We use the Google AIP (API Improvement Proposal) style guide for API\
    \ design.\n https://google.aip.dev/"
- name: "MultipartUploadService"
  description: "Multipart Uploads\n\n Manages multi-part uploads for large objects.\
    \ Individual part data is uploaded directly to the\n storage data plane via pre-signed\
    \ URLs — the API only orchestrates the lifecycle. The cloud\n provider is selected\
    \ by the `engines/{engine}` path segment.\n We use the Google AIP (API Improvement\
    \ Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "NetworkOperationService"
  description: "Network Operations\n\n The NetworkOperationService provides read-only\
    \ access to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Update,\n Delete) and can be queried to track progress or retrieve\
    \ results."
- name: "ObjectService"
  description: "Objects\n\n Manages objects within a bucket. The cloud provider is\
    \ selected by the\n `engines/{engine}` path segment. Object data flows directly\
    \ to the storage\n data plane via its S3-compatible API.\n We use the Google AIP\
    \ (API Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "ObservabilityOperationService"
  description: "Observability Operations\n\n Read-only access to observability config-plane\
    \ operation records. Operations are created as a\n side-effect of the retention\
    \ / sink / ingestion mutation RPCs and can be queried to retrieve\n their result.\
    \ Engine-neutral — operations carry no engine axis.\n We use the Google AIP (API\
    \ Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "OrganisationService"
  description: "Organisations\n\n The OrganisationService manages the top-level organisational\
    \ entity.\n All groups and workspaces belong to an organisation."
- name: "PermissionService"
  description: "Permissions\n\n The PermissionService provides read-only access to\
    \ the catalogue of\n granular actions that can be assigned to roles. Permissions\
    \ are\n system-defined and follow the <service>.<resource>.<action> naming convention."
- name: "PolicyService"
  description: "Policies\n\n The PolicyService manages conditional policies scoped\
    \ to a workspace.\n Policies define conditions (source IP, time windows) that\
    \ constrain\n when an IAM binding is effective."
- name: "PresignedUrlService"
  description: "Presigned URLs\n\n Generates time-limited pre-signed URLs for direct\
    \ upload to and download from the storage\n data plane, bypassing the gRPC server\
    \ for the actual data transfer. This is essential for\n large files — the client\
    \ receives a URL and talks to the data plane directly. The cloud\n provider is\
    \ selected by the `engines/{engine}` path segment.\n We use the Google AIP (API\
    \ Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "PrincipalService"
  description: "Principals\n\n The PrincipalService surfaces the discriminated principal\
    \ directory, the\n scope-centric access view, and single-step grant/invite/revoke\
    \ writes."
- name: "QibdoAccessPolicyService"
  description: "Access Policies\n\n QibdoAccessPolicyService manages workspace-scoped\
    \ access policy documents.\n Policies compose with Qibdo IAM: the IAM @PreAuthorize\
    \ gate runs first,\n and AccessPolicy documents are consulted as a second-pass\
    \ check for\n fine-grained, resource-scoped authorization."
- name: "QibdoApplicationCredentialService"
  description: "Application Credentials\n\n QibdoApplicationCredentialService manages\
    \ the lifecycle of workspace-scoped\n RoleID + SecretID credentials (mapped to\
    \ the configured AppRole backend internally) used by\n CI pipelines and out-of-cluster\
    \ workloads. Authenticate is the only RPC that does\n not require a vault permission\
    \ — the supplied SecretID is itself the auth\n proof, mirroring the IAM Authenticate\
    \ flow."
- name: "QibdoCertificateAuthorityService"
  description: "Certificate Authorities\n\n QibdoCertificateAuthorityService manages\
    \ Root and Intermediate CAs backed\n by the vault backend's PKI engine. Covers\
    \ CA creation and revocation;\n leaf-cert lifecycle lives on QibdoCertificateService."
- name: "QibdoCertificateService"
  description: "Leaf Certificates\n\n QibdoCertificateService manages leaf X.509 certificates\
    \ issued by a Qibdo\n Certificate Authority. The CA's signing material lives in\
    \ the vault backend's PKI\n engine; only certificate metadata (serial, subject,\
    \ validity window,\n state) is persisted in the relational store."
- name: "QibdoCryptoKeyService"
  description: "Crypto Keys\n\n QibdoCryptoKeyService manages named cryptographic\
    \ keys scoped to a workspace\n and exposes the the vault backend transit engine's\
    \ encrypt/decrypt/sign/verify/MAC/random\n surface as workspace-scoped RPCs. Versions\
    \ are a separate API resource managed\n by QibdoCryptoKeyVersionService; the only\
    \ version-scoped RPC that lives on the\n crypto key service is RotateQibdoCryptoKey,\
    \ modelled as an AIP-136 custom method\n on the parent."
- name: "QibdoCryptoKeyVersionService"
  description: "Crypto Key Versions\n\n QibdoCryptoKeyVersionService manages the lifecycle\
    \ of a crypto key's\n immutable versions as a first-class API resource (AIP-131/135).\
    \ Creation\n is served by the parent's RotateQibdoCryptoKey custom method on\n\
    \ QibdoCryptoKeyService; everything else (read, list with filter/order_by,\n disable,\
    \ schedule destroy) lives here."
- name: "QibdoDatabaseRoleService"
  description: "Database Roles\n\n QibdoDatabaseRoleService manages the lifecycle\
    \ of workspace-scoped database\n role definitions. Each role carries the creation\
    \ +\n revocation SQL templates that the vault backend executes when issuing or\
    \ revoking\n dynamic database credentials. Register / Update run a dry-run against\
    \ the\n target database (`BEGIN; ...; ROLLBACK`) before persisting and projecting\n\
    \ to the vault backend via POST /v1/database/roles/{name}. Delete is refused while\n\
    \ active leases reference the role."
- name: "QibdoDynamicCredentialService"
  description: "Dynamic Credentials\n\n QibdoDynamicCredentialService issues short-lived\
    \ credentials backed by the\n Qibdo vault engine's dynamic secret backends: database,\
    \ cloud IAM (AWS/GCP/\n Azure), SSH (sign + OTP), and workload-identity ServiceAccount\
    \ tokens. Every\n credential is bound to a `QibdoLease` aggregate which governs\
    \ renewal/\n revocation."
- name: "QibdoFirewallPolicyService"
  description: "Firewall Policies\n\n The QibdoFirewallPolicyService manages firewall\
    \ policies and their rules.\n Rules are managed via AIP-136 custom methods (`addRule`,\
    \ `patchRule`,\n `removeRule`, `getRule`, `listRules`) on the parent policy aggregate."
- name: "QibdoImageRepositoryService"
  description: "Image Repositories\n\n The QibdoImageRepositoryService service definition.\n\
    \ A repository is a named collection of artifacts (e.g. `nginx`, `redis`)\n inside\
    \ a namespace. It carries visibility (public / private / internal),\n format metadata,\
    \ and is the parent scope for tags, deployment locks,\n retention policies, and\
    \ scan policies.\n We use the Google AIP (API Improvement Proposal) style guide\
    \ for API design.\n https://google.aip.dev/\n https://google.aip.dev/130"
- name: "QibdoLeaseService"
  description: "Leases\n\n QibdoLeaseService manages the lifecycle of credential leases\
    \ issued by the\n Qibdo vault engine. Read RPCs (Get, List) ship in Phase 12;\
    \ lifecycle RPCs\n (Renew, Revoke, BulkRevokeByPrefix) ship in Phase 13."
- name: "QibdoLogicalPortService"
  description: "Logical Ports\n\n The QibdoLogicalPortService exposes read access\
    \ to a virtual machine's\n network-interface attachments (logical ports). Ports\
    \ are a VM-lifecycle side\n effect allocated by the compute service over the internal\n\
    \ QibdoLogicalPortPlatformService, never created directly by a tenant — so this\n\
    \ tenant-facing service is read-only (get / list)."
- name: "QibdoNamespaceService"
  description: "Namespaces\n\n The QibdoNamespaceService service definition.\n A namespace\
    \ is the top-level isolation boundary inside a workspace's\n registry — it owns\
    \ repositories, IAM access policies, and quotas. The\n lifecycle (create/update/delete)\
    \ is driven through Qibdo so that IAM and\n audit semantics stay consistent.\n\
    \ We use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/\n https://google.aip.dev/130"
- name: "QibdoPkiRoleService"
  description: "PKI Roles\n\n QibdoPkiRoleService manages the lifecycle of per-CA,\
    \ workspace-scoped role\n definitions that govern leaf certificate issuance. Each\
    \ role enforces four\n dimensions: allowed_domains, max_ttl, allowed_key_types,\n\
    \ allowed_extended_key_usages. Register / Update project the role to the vault\
    \ backend\n via POST /v1/<mount>/roles/{name}; Delete unbinds it."
- name: "QibdoResponseWrappingService"
  description: "Response Wrapping\n\n Used to deliver a secret payload through an\
    \ untrusted intermediary without\n leaking the underlying material. WrapResponse\
    \ stores the payload in the vault backend\n and returns a one-time wrapping token;\
    \ UnwrapResponse redeems the token\n exactly once. Replay attempts return FAILED_PRECONDITION."
- name: "QibdoSecretService"
  description: "Secrets\n\n QibdoSecretService manages named secret containers scoped\
    \ to a workspace.\n Versions are a separate API resource managed by QibdoSecretVersionService;\
    \ the\n only version-scoped RPC that lives on the secret service is AddQibdoSecretVersion,\n\
    \ modelled as an AIP-136 custom method on the parent (mirrors Google Secret Manager's\n\
    \ {parent=projects/*/secrets/*}:addVersion)."
- name: "QibdoSecretVersionService"
  description: "Secret Versions\n\n QibdoSecretVersionService manages the lifecycle\
    \ of a secret's immutable versions\n as a first-class API resource (AIP-131/135).\
    \ Creation is served by the parent's\n AddQibdoSecretVersion custom method on\
    \ QibdoSecretService; everything else\n (read, list with filter/order_by, disable,\
    \ destroy) lives here. Mirrors\n Google Secret Manager's projects.secrets.versions\
    \ resource."
- name: "QibdoStorageClassInstanceService"
  description: "Storage Class Instances\n\n Inspects and operates the per-region materialization\
    \ matrix of Qibdo storage class tiers.\n Platform-admin only: requests carry no\
    \ workspace, so authorization resolves at PLATFORM\n scope. End-users do not call\
    \ this service — they discover usable tiers through the guarded\n bucket-create\
    \ path. Instances are nested under their parent storage class; `-` lists or gets\n\
    \ across all classes (AIP-159 cross-collection matrix)."
- name: "QibdoSubnetService"
  description: "Subnets\n\n The QibdoSubnetService manages subdivisions of a VPC's\
    \ address space.\n Subnet CIDRs must fall within the parent VPC's CIDR and must\
    \ not overlap\n with sibling subnets in the same VPC."
- name: "QibdoVirtualMachineService"
  description: "Virtual Machines\n\n The VirtualMachineService service definition.\n\
    \ We use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/\n https://google.aip.dev/130"
- name: "QibdoVpcService"
  description: "Virtual Private Clouds\n\n The QibdoVpcService manages VPCs — the\
    \ top-level network isolation boundary\n scoped to a workspace and region. VPCs\
    \ define the IP address space and are\n the parent of subnets and firewall policies."
- name: "QuotaDefinitionService"
  description: "Quota Definitions\n\n The QuotaDefinitionService provides read-only\
    \ access to quota definition\n records. Quota definitions describe what a quota\
    \ limits — metric, unit,\n type, container scope, dimensions, and platform-wide\
    \ default. Definitions\n are seeded via Flyway and are not user-modifiable for\
    \ alpha."
- name: "QuotaLimitService"
  description: "Quota Limits\n\n The QuotaLimitService manages quota limit overrides.\
    \ Each quota limit\n overrides a quota definition's default for a specific container\
    \ (organisation,\n workspace, or group) and optional dimensions. Resolution order:\n\
    \ explicit QuotaLimit > QuotaDefinition.default_limit."
- name: "RegistryOperationService"
  description: "Registry Operations\n\n The RegistryOperationService service definition.\n\
    \ Provides read-only access to operation records. Operations are created as a\n\
    \ side-effect of mutation RPCs (Create, Update, Delete, TriggerScan, …) and\n\
    \ can be queried to track progress or retrieve results.\n We use the Google AIP\
    \ (API Improvement Proposal) style guide for API design.\n https://google.aip.dev/\n\
    \ https://google.aip.dev/130"
- name: "ResourcePoolService"
  description: "Resource Pools\n\n The ResourcePoolService manages resource pools\
    \ — a just-in-time label-selector grouping of\n deployment targets within a zone.\
    \ Resource pools are a flat collection: the parent zone is a\n body-level reference\
    \ on the resource (`zone_id`), never a URL path segment,\n and lists scope to\
    \ a zone via the AIP-160 `filter`.\n We use the Google AIP (API Improvement Proposal)\
    \ style guide for API design.\n https://google.aip.dev/"
- name: "RetentionPolicyService"
  description: "Retention Policies\n\n Manages per-workspace telemetry retention.\
    \ The provider that stores the telemetry is\n selected by the `engines/{engine}`\
    \ path segment; `-` lists across all providers or resolves\n the provider from\
    \ the record on a by-id read. A policy is created and updated, never deleted\n\
    \ (one per workspace; reset to defaults instead).\n We use the Google AIP (API\
    \ Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "RetentionPolicyService"
  description: "Retention Policies\n\n The RetentionPolicyService service definition.\n\
    \ Retention policies control automatic garbage-collection of artifacts inside\n\
    \ a repository — e.g. \"keep the last 10 tags matching `v*`, plus anything\n tagged\
    \ in the last 30 days\". This service is the IAM-gated façade for\n managing them.\n\
    \ We use the Google AIP (API Improvement Proposal) style guide for API design.\n\
    \ https://google.aip.dev/\n https://google.aip.dev/130"
- name: "RoleService"
  description: "Roles\n\n The RoleService manages named collections of permissions.\
    \ Roles can be\n platform built-ins (immutable) or workspace-scoped custom roles."
- name: "ScanPolicyService"
  description: "Scan Policies\n\n The ScanPolicyService service definition.\n Scan\
    \ policies configure vulnerability scanning behavior on a registry\n resource\
    \ (auto-scan-on-push, block-on-critical-CVE, per-scope CVE\n allowlist). The resource\
    \ is the URL parent: a Namespace OR an\n ImageRepository — the scope_type / scope_id\
    \ fields on the schema are\n derived from the URL and are not set by clients on\
    \ input.\n We use the Google AIP (API Improvement Proposal) style guide for API\n\
    \ design. https://google.aip.dev/\n https://google.aip.dev/130 (Standard methods)\n\
    \ https://google.aip.dev/122 (Resource names)"
- name: "ScanService"
  description: "Artifact Vulnerability Scanning\n\n The ScanService service definition.\n\
    \ Control-plane surface for vulnerability scanning of artifacts. Scanning is\n\
    \ conceptually independent from artifact lifecycle — triggering a scan,\n fetching\
    \ the merged report, and (future) streaming the scanner log all\n belong here\
    \ rather than on ArtifactService.\n We use the Google AIP (API Improvement Proposal)\
    \ style guide for API design.\n https://google.aip.dev/\n https://google.aip.dev/130"
- name: "SilenceService"
  description: "Silences\n\n Manages workspace-scoped alert-suppression windows. A\
    \ silence mutes firing alerts whose\n labels satisfy its matchers for the configured\
    \ window. This surface is engine-neutral —\n silences carry no provider axis.\
    \ A silence is created and deleted, never updated.\n We use the Google AIP (API\
    \ Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "StorageClassService"
  description: "Storage Classes\n\n Manages region-scoped storage classes — the storage\
    \ tiers (compression, replication)\n available within a region. The cloud provider\
    \ is selected by the `engines/{engine}` path\n segment; `-` acts across all providers\
    \ (lists every provider, or resolves the provider from\n the record on a by-id\
    \ read).\n We use the Google AIP (API Improvement Proposal) style guide for API\
    \ design.\n https://google.aip.dev/"
- name: "StorageOperationService"
  description: "Storage Operations\n\n The StorageOperationService provides read-only\
    \ access to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Update,\n Delete, Copy) and can be queried to track progress or\
    \ retrieve results."
- name: "TaxonomyOperationService"
  description: "Workspace Operations\n\n The TaxonomyOperationService provides read-only\
    \ access to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Update,\n Delete, Move) and can be queried to track progress or\
    \ retrieve results."
- name: "TokenService"
  description: "Tokens\n\n The TokenService manages opaque session tokens for authenticated\
    \ users.\n Token management operations are self-service — a user manages only\
    \ their own sessions."
- name: "TopologyOperationService"
  description: "Topology Operations\n\n The TopologyOperationService provides read-only\
    \ access to operation records.\n Operations are created as a side-effect of mutation\
    \ RPCs (Create, Update,\n Delete, Register) and can be queried to track progress\
    \ or retrieve results."
- name: "TraceService"
  description: "Traces\n\n Searches and retrieves distributed traces and the service-dependency\
    \ graph.\n The provider is selected by the `engines/{engine}` path segment; the\
    \ telemetry\n lives in the engine's trace store.\n We use the Google AIP (API\
    \ Improvement Proposal) style guide for API design.\n https://google.aip.dev/"
- name: "UserService"
  description: "Users\n\n The UserService manages authenticated identities in the\
    \ platform.\n Users are the primary principals for IAM bindings and authentication."
- name: "VaultOperationService"
  description: "Vault Operations\n\n The VaultOperationService provides read-only\
    \ access to vault operation\n records. Operations are created as a side-effect\
    \ of mutation RPCs across\n every vault resource (secrets, crypto keys, leases,\
    \ certificates, access\n policies, vault-level lifecycle) and can be queried to\
    \ track progress or\n retrieve historical results for audit/compliance evidence.\n\
    \n Authorization: every RPC in this service is platform-admin-only. Get/List\n\
    \ carry no `workspace` field, and the lifecycle RPCs (TakeSnapshot,\n RestoreSnapshot,\
    \ RotateRootKey) act on the entire vault backend rather\n than a single workspace.\
    \ ScopeAwarePermissionEvaluator falls back to\n PLATFORM scope when no workspace\
    \ is present in the request, and the\n `vault.operation.*` / `vault.vault.snapshot|restore|rotaterootkey`\n\
    \ permissions are bound exclusively to admin tiers in the IAM migrations.\n This\
    \ matches the cross-BC convention for `*Operation` services."
- name: "WorkspaceService"
  description: "Workspaces\n\n The WorkspaceService manages workspaces — the resource\
    \ isolation boundary\n used by every platform service (compute, network, storage).\
    \ Workspaces belong\n to an organisation and can optionally be placed inside a\
    \ group (folder)."