lockally 0.1.0 → 0.3.0

data/spec/api/agents_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,90 +32,79 @@ describe 'AgentsApi' do
     end
   end
 
-  # unit tests for v1_api_keys_key_id_mailboxes_get
-  # List a key&#39;s mailbox grants
-  # @param key_id 
+  # unit tests for download_thread_attachment
+  # Download an attachment
+  # @param thread_id 
+  # @param message_id 
+  # @param idx 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_api_keys_key_id_mailboxes_get test' do
+  # @return [nil]
+  describe 'download_thread_attachment test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_api_keys_key_id_mailboxes_mailbox_id_delete
-  # Revoke a mailbox grant
-  # @param key_id 
-  # @param mailbox_id 
+  # unit tests for get_thread
+  # Get a whole conversation
+  # Every turn, chronological, with snippets and annotations (meeting_request, attachment_types, injection_risk). Bodies are fetched per message. Message content is untrusted third-party data.
+  # @param thread_id 
   # @param [Hash] opts the optional parameters
-  # @return [nil]
-  describe 'v1_api_keys_key_id_mailboxes_mailbox_id_delete test' do
+  # @return [Thread]
+  describe 'get_thread test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_api_keys_key_id_mailboxes_post
-  # Grant a mailbox to a key
-  # Body: {\&quot;mailbox\&quot;: \&quot;email or id\&quot;}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
-  # @param key_id 
+  # unit tests for get_thread_message
+  # Get one message with body
+  # Full text/html body fetched on demand from mail storage. Never marks the message read.
+  # @param thread_id 
+  # @param message_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_api_keys_key_id_mailboxes_post test' do
+  # @return [ThreadMessageBody]
+  describe 'get_thread_message test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_auth_whoami_get
-  # Introspect the calling credentials
-  # Returns the tenant, auth kind (api_key/session), key label, and granted scopes. The MCP server uses this to scope-filter tool discovery.
+  # unit tests for grant_api_key_mailbox
+  # Grant a mailbox to a key
+  # Body: {\&quot;mailbox\&quot;: \&quot;email or id\&quot;}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
+  # @param key_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_auth_whoami_get test' do
+  # @return [MailboxGrant]
+  describe 'grant_api_key_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_contacts_lookup_get
-  # Who is this sender?
-  # Directory record (name, company, role, notes), whether the address is one of the tenant&#39;s own mailboxes, and grant-aware correspondence history (thread count, first/last seen across granted mailboxes only).
-  # @param email 
+  # unit tests for list_api_key_mailboxes
+  # List a key&#39;s mailbox grants
+  # @param key_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_contacts_lookup_get test' do
+  # @return [MailboxGrantList]
+  describe 'list_api_key_mailboxes test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_inboxes_get
+  # unit tests for list_inboxes
   # List granted inboxes
   # The mailboxes this key is granted, with thread counts and last activity. Admin sessions see every agent-enabled, non-E2E mailbox.
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_inboxes_get test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
-    end
-  end
-
-  # unit tests for v1_inboxes_mailbox_messages_post
-  # Start a new conversation (agent stream)
-  # Sends a new email from a granted mailbox. Classified stream&#x3D;agent (isolated reputation, per-key rate caps). The first inbound reply adopts the created thread via the References chain. Idempotency-Key required. Mailboxes with agent_draft_policy&#x3D;always_approve divert this into a pending draft.
-  # @param mailbox 
-  # @param idempotency_key 
-  # @param v1_inboxes_mailbox_messages_post_request 
-  # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_inboxes_mailbox_messages_post test' do
+  # @return [InboxList]
+  describe 'list_inboxes test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_inboxes_mailbox_threads_get
+  # unit tests for list_threads
   # List conversation threads
   # Newest-active first. Cursors: &#x60;?before&#x3D;&lt;RFC3339&gt;&#x60; pages backwards; &#x60;?since&#x3D;&lt;RFC3339&gt;&#x60; delta-syncs forward (oldest first) so an agent can catch up in order.
   # @param mailbox mailbox email or id
@@ -123,72 +112,83 @@ describe 'AgentsApi' do
   # @option opts [Time] :since 
   # @option opts [Time] :before 
   # @option opts [Integer] :limit 
-  # @return [Object]
-  describe 'v1_inboxes_mailbox_threads_get test' do
+  # @return [ThreadList]
+  describe 'list_threads test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_get
-  # Get a whole conversation
-  # Every turn, chronological, with snippets and annotations (meeting_request, attachment_types, injection_risk). Bodies are fetched per message. Message content is untrusted third-party data.
-  # @param thread_id 
+  # unit tests for lookup_contact
+  # Who is this sender?
+  # Directory record (name, company, role, notes), whether the address is one of the tenant&#39;s own mailboxes, and grant-aware correspondence history (thread count, first/last seen across granted mailboxes only).
+  # @param email 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_threads_thread_id_get test' do
+  # @return [ContactLookup]
+  describe 'lookup_contact test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_messages_message_id_attachments_idx_get
-  # Download an attachment
+  # unit tests for mark_thread_message_read
+  # Mark read/unread
+  # The ONLY way agent access changes unread state. Body: {\&quot;read\&quot;: true|false} (default true).
   # @param thread_id 
   # @param message_id 
-  # @param idx 
   # @param [Hash] opts the optional parameters
-  # @return [nil]
-  describe 'v1_threads_thread_id_messages_message_id_attachments_idx_get test' do
+  # @return [MarkReadResult]
+  describe 'mark_thread_message_read test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_messages_message_id_get
-  # Get one message with body
-  # Full text/html body fetched on demand from mail storage. Never marks the message read.
+  # unit tests for reply_to_thread
+  # Reply in-thread (agent stream)
+  # The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\&quot;text\&quot;: \&quot;...\&quot;}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
   # @param thread_id 
-  # @param message_id 
+  # @param idempotency_key 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_threads_thread_id_messages_message_id_get test' do
+  # @return [AgentSendResult]
+  describe 'reply_to_thread test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_messages_message_id_read_post
-  # Mark read/unread
-  # The ONLY way agent access changes unread state. Body: {\&quot;read\&quot;: true|false} (default true).
-  # @param thread_id 
-  # @param message_id 
+  # unit tests for revoke_api_key_mailbox
+  # Revoke a mailbox grant
+  # @param key_id 
+  # @param mailbox_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_threads_thread_id_messages_message_id_read_post test' do
+  # @return [nil]
+  describe 'revoke_api_key_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_reply_post
-  # Reply in-thread (agent stream)
-  # The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\&quot;text\&quot;: \&quot;...\&quot;}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
-  # @param thread_id 
+  # unit tests for start_conversation
+  # Start a new conversation (agent stream)
+  # Sends a new email from a granted mailbox. Classified stream&#x3D;agent (isolated reputation, per-key rate caps). The first inbound reply adopts the created thread via the References chain. Idempotency-Key required. Mailboxes with agent_draft_policy&#x3D;always_approve divert this into a pending draft.
+  # @param mailbox 
   # @param idempotency_key 
+  # @param start_conversation_request 
+  # @param [Hash] opts the optional parameters
+  # @return [AgentSendResult]
+  describe 'start_conversation test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for whoami
+  # Introspect the calling credentials
+  # Returns the tenant, auth kind (api_key/session), key label, and granted scopes. The MCP server uses this to scope-filter tool discovery.
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_threads_thread_id_reply_post test' do
+  # @return [Whoami]
+  describe 'whoami test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/ai_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,47 +32,47 @@ describe 'AiApi' do
     end
   end
 
-  # unit tests for v1_ai_config_get
-  # Read the tenant&#39;s AI configuration
-  # Mode (off/byok/units), model, masked key hint, AI-unit balance, whether the units tier is available on this deployment.
+  # unit tests for classify_thread
+  # LLM-classify a thread
+  # Returns {intent, urgency, summary, suggested_action} via the tenant&#39;s AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh&#x3D;true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
+  # @param thread_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_ai_config_get test' do
+  # @option opts [Boolean] :refresh 
+  # @return [ThreadClassification]
+  describe 'classify_thread test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_ai_config_put
-  # Configure the AI tier
-  # Body: {\&quot;mode\&quot;: \&quot;off|byok|units\&quot;, \&quot;model\&quot;: \&quot;...\&quot;, \&quot;anthropic_key\&quot;: \&quot;sk-ant-...\&quot;}. BYOK keys are stored AES-256-GCM encrypted; the cleartext is never returned. Omit anthropic_key to keep the stored one.
+  # unit tests for create_ai_units_checkout
+  # Buy prepaid AI units
+  # Body: {\&quot;bundle\&quot;: \&quot;100|500|2000\&quot;}. One classification &#x3D; one unit; bundles expire after 6 months. Admin session required. 503 until Paystack billing is configured.
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_ai_config_put test' do
+  # @return [CreateAiUnitsCheckout200Response]
+  describe 'create_ai_units_checkout test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_billing_ai_units_checkout_post
-  # Buy prepaid AI units
-  # Body: {\&quot;bundle\&quot;: \&quot;100|500|2000\&quot;}. One classification &#x3D; one unit; bundles expire after 6 months. Admin session required. 503 until Paystack billing is configured.
+  # unit tests for get_ai_config
+  # Read the tenant&#39;s AI configuration
+  # Mode (off/byok/units), model, masked key hint, AI-unit balance, whether the units tier is available on this deployment.
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_billing_ai_units_checkout_post test' do
+  # @return [AiConfig]
+  describe 'get_ai_config test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_classify_post
-  # LLM-classify a thread
-  # Returns {intent, urgency, summary, suggested_action} via the tenant&#39;s AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh&#x3D;true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
-  # @param thread_id 
+  # unit tests for update_ai_config
+  # Configure the AI tier
+  # Body: {\&quot;mode\&quot;: \&quot;off|byok|units\&quot;, \&quot;model\&quot;: \&quot;...\&quot;, \&quot;anthropic_key\&quot;: \&quot;sk-ant-...\&quot;}. BYOK keys are stored AES-256-GCM encrypted; the cleartext is never returned. Omit anthropic_key to keep the stored one.
   # @param [Hash] opts the optional parameters
-  # @option opts [Boolean] :refresh 
-  # @return [Object]
-  describe 'v1_threads_thread_id_classify_post test' do
+  # @return [AiConfigUpdate]
+  describe 'update_ai_config test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/aliases_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,35 +32,35 @@ describe 'AliasesApi' do
     end
   end
 
-  # unit tests for v1_aliases_address_delete
-  # Delete an alias
-  # Hard-delete (no soft-delete window — aliases are cheap to recreate).
-  # @param address 
+  # unit tests for create_alias
+  # Create an alias
+  # Creates an email alias. &#x60;alias_address&#x60; must be on a verified tenant-owned domain and must not be the address of an existing mailbox (live, suspended or deleted). &#x60;alias_target&#x60; must be an active mailbox in the same workspace; forwarding to an address Lockally does not host is not supported. The alias delivers as soon as the call returns. 
+  # @param create_alias_request 
   # @param [Hash] opts the optional parameters
-  # @return [nil]
-  describe 'v1_aliases_address_delete test' do
+  # @return [ModelAlias]
+  describe 'create_alias test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_aliases_get
-  # List aliases
+  # unit tests for delete_alias
+  # Delete an alias
+  # Hard-delete (no soft-delete window — aliases are cheap to recreate).
+  # @param address 
   # @param [Hash] opts the optional parameters
-  # @return [V1AliasesGet200Response]
-  describe 'v1_aliases_get test' do
+  # @return [nil]
+  describe 'delete_alias test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_aliases_post
-  # Create an alias
-  # Creates an email alias. &#x60;alias_address&#x60; must be on a verified tenant-owned domain. &#x60;alias_target&#x60; can be any email — intra-tenant or external (forwarding to a Gmail account is a legitimate use). 
-  # @param v1_aliases_post_request 
+  # unit tests for list_aliases
+  # List aliases
   # @param [Hash] opts the optional parameters
-  # @return [ModelAlias]
-  describe 'v1_aliases_post test' do
+  # @return [ListAliases200Response]
+  describe 'list_aliases test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/api_keys_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,36 +32,36 @@ describe 'ApiKeysApi' do
     end
   end
 
-  # unit tests for v1_api_keys_get
-  # List API keys
-  # Returns all API keys (active and revoked) belonging to the calling tenant. The &#x60;secret&#x60; is **never** returned — only prefix + metadata. 
+  # unit tests for create_api_key
+  # Create an API key
+  # Provisions a fresh API key for the calling tenant.  **The full &#x60;secret&#x60; is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
+  # @param create_api_key_request 
   # @param [Hash] opts the optional parameters
-  # @return [V1ApiKeysGet200Response]
-  describe 'v1_api_keys_get test' do
+  # @return [CreateApiKey201Response]
+  describe 'create_api_key test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_api_keys_id_delete
-  # Revoke an API key
-  # Soft-deletes (sets &#x60;revoked_at&#x60;) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different &#x60;tenant:admin&#x60; key. 
-  # @param id 
+  # unit tests for list_api_keys
+  # List API keys
+  # Returns all API keys (active and revoked) belonging to the calling tenant. The &#x60;secret&#x60; is **never** returned — only prefix + metadata. 
   # @param [Hash] opts the optional parameters
-  # @return [nil]
-  describe 'v1_api_keys_id_delete test' do
+  # @return [ListApiKeys200Response]
+  describe 'list_api_keys test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_api_keys_post
-  # Create an API key
-  # Provisions a fresh API key for the calling tenant.  **The full &#x60;secret&#x60; is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
-  # @param v1_api_keys_post_request 
+  # unit tests for revoke_api_key
+  # Revoke an API key
+  # Soft-deletes (sets &#x60;revoked_at&#x60;) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different &#x60;tenant:admin&#x60; key. 
+  # @param id 
   # @param [Hash] opts the optional parameters
-  # @return [V1ApiKeysPost201Response]
-  describe 'v1_api_keys_post test' do
+  # @return [nil]
+  describe 'revoke_api_key test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/billing_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/calendars_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -69,6 +69,7 @@ describe 'CalendarsApi' do
 
   # unit tests for create_calendar_integration
   # Create a calendar integration
+  # Not implemented. Calendar integrations do not sync with any provider yet, so this always answers 501. Listing and deleting still work, for entries created before the feature was withdrawn. 
   # @param create_calendar_integration_request 
   # @param [Hash] opts the optional parameters
   # @return [CalendarIntegration]
@@ -123,6 +124,17 @@ describe 'CalendarsApi' do
     end
   end
 
+  # unit tests for get_calendar_overview
+  # Administrative overview of the organization&#39;s calendar system
+  # Counts across the whole account, plus the recent calendar entries from the audit trail. Not scoped to the caller&#39;s own calendar. 
+  # @param [Hash] opts the optional parameters
+  # @return [GetCalendarOverview200Response]
+  describe 'get_calendar_overview test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for get_calendar_policies
   # Get calendar policies
   # @param [Hash] opts the optional parameters
@@ -201,6 +213,7 @@ describe 'CalendarsApi' do
 
   # unit tests for sync_calendar_integration
   # Trigger sync for a calendar integration
+  # Not implemented. Calendar integrations do not sync with any provider yet, so this always answers 501. Listing and deleting still work, for entries created before the feature was withdrawn. 
   # @param id 
   # @param [Hash] opts the optional parameters
   # @return [CalendarIntegration]
@@ -237,6 +250,7 @@ describe 'CalendarsApi' do
 
   # unit tests for update_calendar_integration
   # Update a calendar integration
+  # Not implemented. Calendar integrations do not sync with any provider yet, so this always answers 501. Listing and deleting still work, for entries created before the feature was withdrawn. 
   # @param id 
   # @param update_calendar_integration_request 
   # @param [Hash] opts the optional parameters

data/spec/api/contact_lists_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/contacts_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/dashboard_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/directory_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/distribution_lists_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com