temper-rb 0.5.1

data/lib/temper/generated/api/resources_api.rb

@@ -0,0 +1,1329 @@
+=begin
+#Temper Cloud API
+
+#Knowledge base management API for temper cloud
+
+The version of the OpenAPI document: 0.5.1
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.23.0
+
+=end
+
+require 'cgi'
+
+module Temper::Generated
+  class ResourcesApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Attach provenance sources to a resource
+    # @param id [String] Resource ID
+    # @param resource_annotate_request [ResourceAnnotateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceView]
+    def annotate_resource(id, resource_annotate_request, opts = {})
+      data, _status_code, _headers = annotate_resource_with_http_info(id, resource_annotate_request, opts)
+      data
+    end
+
+    # Attach provenance sources to a resource
+    # @param id [String] Resource ID
+    # @param resource_annotate_request [ResourceAnnotateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceView, Integer, Hash)>] ResourceView data, response status code and response headers
+    def annotate_resource_with_http_info(id, resource_annotate_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.annotate_resource ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.annotate_resource"
+      end
+      # verify the required parameter 'resource_annotate_request' is set
+      if @api_client.config.client_side_validation && resource_annotate_request.nil?
+        fail ArgumentError, "Missing the required parameter 'resource_annotate_request' when calling ResourcesApi.annotate_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/provenance'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(resource_annotate_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceView'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.annotate_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#annotate_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Create a resource
+    # @param resource_create_request [ResourceCreateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceView]
+    def create_resource(resource_create_request, opts = {})
+      data, _status_code, _headers = create_resource_with_http_info(resource_create_request, opts)
+      data
+    end
+
+    # Create a resource
+    # @param resource_create_request [ResourceCreateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceView, Integer, Hash)>] ResourceView data, response status code and response headers
+    def create_resource_with_http_info(resource_create_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.create_resource ...'
+      end
+      # verify the required parameter 'resource_create_request' is set
+      if @api_client.config.client_side_validation && resource_create_request.nil?
+        fail ArgumentError, "Missing the required parameter 'resource_create_request' when calling ResourcesApi.create_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(resource_create_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceView'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.create_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#create_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Soft-delete a resource
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :invocation_id The invocation this act is correlated under (&#x60;kb_events.invocation_id&#x60;). Optional — a correlation aid, never a substitute for authn/authz.
+    # @option opts [String] :correlation_id The act-grain thread this write belongs to (&#x60;kb_events.correlation_id&#x60;). Optional, caller- minted, provenance-only. Rides independently of &#x60;invocation_id&#x60; and of authorship.
+    # @option opts [String] :reasoning Free-text reasoning for the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [ConfidenceBand] :confidence Graded self-assessed confidence band. Required whenever any other authorship field is set.
+    # @option opts [String] :rationale Structured rationale for the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :persona The persona/role the author acted as. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :model The model that authored the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [DeleteResponse]
+    def delete_resource(id, opts = {})
+      data, _status_code, _headers = delete_resource_with_http_info(id, opts)
+      data
+    end
+
+    # Soft-delete a resource
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :invocation_id The invocation this act is correlated under (&#x60;kb_events.invocation_id&#x60;). Optional — a correlation aid, never a substitute for authn/authz.
+    # @option opts [String] :correlation_id The act-grain thread this write belongs to (&#x60;kb_events.correlation_id&#x60;). Optional, caller- minted, provenance-only. Rides independently of &#x60;invocation_id&#x60; and of authorship.
+    # @option opts [String] :reasoning Free-text reasoning for the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [ConfidenceBand] :confidence Graded self-assessed confidence band. Required whenever any other authorship field is set.
+    # @option opts [String] :rationale Structured rationale for the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :persona The persona/role the author acted as. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :model The model that authored the act. Authorship field — requires &#x60;confidence&#x60;.
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(DeleteResponse, Integer, Hash)>] DeleteResponse data, response status code and response headers
+    def delete_resource_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.delete_resource ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.delete_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'invocation_id'] = opts[:'invocation_id'] if !opts[:'invocation_id'].nil?
+      query_params[:'correlation_id'] = opts[:'correlation_id'] if !opts[:'correlation_id'].nil?
+      query_params[:'reasoning'] = opts[:'reasoning'] if !opts[:'reasoning'].nil?
+      query_params[:'confidence'] = opts[:'confidence'] if !opts[:'confidence'].nil?
+      query_params[:'rationale'] = opts[:'rationale'] if !opts[:'rationale'].nil?
+      query_params[:'persona'] = opts[:'persona'] if !opts[:'persona'].nil?
+      query_params[:'model'] = opts[:'model'] if !opts[:'model'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DeleteResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.delete_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:DELETE, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#delete_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Read a resource's reconstituted content
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ContentResponse]
+    def get_content(id, opts = {})
+      data, _status_code, _headers = get_content_with_http_info(id, opts)
+      data
+    end
+
+    # Read a resource&#39;s reconstituted content
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ContentResponse, Integer, Hash)>] ContentResponse data, response status code and response headers
+    def get_content_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.get_content ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.get_content"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/content'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ContentResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.get_content",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#get_content\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Get one resource
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceView]
+    def get_resource(id, opts = {})
+      data, _status_code, _headers = get_resource_with_http_info(id, opts)
+      data
+    end
+
+    # Get one resource
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceView, Integer, Hash)>] ResourceView data, response status code and response headers
+    def get_resource_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.get_resource ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.get_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceView'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.get_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#get_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Grant access to a resource
+    # @param id [String] Resource ID
+    # @param resource_grant_body [ResourceGrantBody] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [GrantOutcome]
+    def grant_resource_access(id, resource_grant_body, opts = {})
+      data, _status_code, _headers = grant_resource_access_with_http_info(id, resource_grant_body, opts)
+      data
+    end
+
+    # Grant access to a resource
+    # @param id [String] Resource ID
+    # @param resource_grant_body [ResourceGrantBody] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(GrantOutcome, Integer, Hash)>] GrantOutcome data, response status code and response headers
+    def grant_resource_access_with_http_info(id, resource_grant_body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.grant_resource_access ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.grant_resource_access"
+      end
+      # verify the required parameter 'resource_grant_body' is set
+      if @api_client.config.client_side_validation && resource_grant_body.nil?
+        fail ArgumentError, "Missing the required parameter 'resource_grant_body' when calling ResourcesApi.grant_resource_access"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/grants'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(resource_grant_body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'GrantOutcome'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.grant_resource_access",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#grant_resource_access\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # List a finding's citation-audit trail
+    # One row per audit, each naming its auditor.  `GET /api/resources/{id}/evidence` answers with aggregates only, so a finding disputed by one auditor and a finding disputed by three are indistinguishable there. This read names the voters.  Answers 404 when the finding is unreadable or absent. An empty array means the finding is readable and genuinely carries no audits.
+    # @param id [String] Resource ID (the finding whose audit trail is read)
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<CitationAuditRow>]
+    def list_citation_audits(id, opts = {})
+      data, _status_code, _headers = list_citation_audits_with_http_info(id, opts)
+      data
+    end
+
+    # List a finding&#39;s citation-audit trail
+    # One row per audit, each naming its auditor.  &#x60;GET /api/resources/{id}/evidence&#x60; answers with aggregates only, so a finding disputed by one auditor and a finding disputed by three are indistinguishable there. This read names the voters.  Answers 404 when the finding is unreadable or absent. An empty array means the finding is readable and genuinely carries no audits.
+    # @param id [String] Resource ID (the finding whose audit trail is read)
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(Array<CitationAuditRow>, Integer, Hash)>] Array<CitationAuditRow> data, response status code and response headers
+    def list_citation_audits_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.list_citation_audits ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.list_citation_audits"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/citation-audits'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Array<CitationAuditRow>'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.list_citation_audits",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#list_citation_audits\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # List a resource's relationships
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<GraphEdgeRow>]
+    def list_resource_edges(id, opts = {})
+      data, _status_code, _headers = list_resource_edges_with_http_info(id, opts)
+      data
+    end
+
+    # List a resource&#39;s relationships
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(Array<GraphEdgeRow>, Integer, Hash)>] Array<GraphEdgeRow> data, response status code and response headers
+    def list_resource_edges_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.list_resource_edges ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.list_resource_edges"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/edges'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Array<GraphEdgeRow>'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.list_resource_edges",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#list_resource_edges\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # List resources you can see
+    # Answers with one response type, unconditionally. Use `sections` to vary which parts of each resource are filled — the type you receive never changes.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :kb_doc_type_id 
+    # @option opts [String] :context_ref Context filter: UUID string or &#x60;@owner/slug&#x60; decorated ref. Bare context names are rejected server-side (spec Decision 1).
+    # @option opts [String] :doc_type_name Doc-type filter: one name, or a comma-separated list of them, in which case the filter is the UNION (a row matching any listed name is kept). Multi-select is the odd one out among the filters here — &#x60;tags&#x60; narrows with each addition because a resource has many tags, while a resource has exactly one doc type, so ANDing two names could only ever match nothing. A single name behaves exactly as it always has.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;tags&#x60; and &#x60;cogmap_ids&#x60;: the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Each piece is trimmed and empties are dropped; a CSV that trims away entirely is no filter at all rather than a filter matching nothing.  Unknown names are **not** rejected — an unrecognized doc type matches no row, as it always has. See &#x60;ResourceFacets::doc_type&#x60; for the histogram that makes the reachable set visible.
+    # @option opts [String] :owner 
+    # @option opts [String] :q 
+    # @option opts [String] :stage 
+    # @option opts [String] :status Goal-status filter (goal only): matches &#x60;temper-status&#x60; via the &#x60;kb_resource_workflow_props&#x60; pivot, exactly as &#x60;stage&#x60; does. Validated against the goal schema&#39;s enum surface-side, so an unknown value is an error rather than a silent full scan — which is what this field&#39;s absence used to produce.
+    # @option opts [String] :goal Goal filter (task only): the resolved goal &#x60;ResourceId&#x60; (as UUID). Returns only resources joined to this goal via a live &#x60;advances&#x60;→goal edge. The CLI/MCP resolve the caller&#39;s &#x60;--goal &lt;ref&gt;&#x60; to this UUID (trailing-UUID-only) before the query. &#x60;None&#x60; &#x3D; no goal filter.
+    # @option opts [String] :tags Tag filter: a comma-separated list of tags. Returns only resources whose &#x60;open_meta.tags&#x60; contains **every** tag listed (AND, so each added tag narrows — the same direction every other filter here composes in). Matching is exact per tag and **case-insensitive**: the fold happens receive-side in &#x60;filtered_visible_page&#x60;, so the CLI, MCP and raw HTTP cannot disagree about it.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;cogmap_ids&#x60;: the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences). No tag in the corpus contains a comma (verified against production, 580 distinct tags), and a tag containing one cannot be expressed through this transport — which is a constraint on the tag vocabulary, not a silent truncation: the split is on &#x60;,&#x60; and each piece is trimmed.  Unlike &#x60;stage&#x60; (task-only) and &#x60;status&#x60; (goal-only), tags are **not** doc-type-scoped — 14 doc types carry them in production. So there is deliberately no mismatched-filter refusal for this field; pairing it with any &#x60;doc_type_name&#x60;, or with none, is meaningful.
+    # @option opts [String] :cogmap_ids Cognitive-map scope: a comma-separated list of cogmap UUIDs. Returns only resources homed in one of these maps (&#x60;anchor_table &#x3D; &#39;kb_cogmaps&#39;&#x60;), intersected with the caller&#39;s visible set. A CSV string rather than a &#x60;Vec&#x60; because the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences); the CLI/MCP resolve each &#x60;--cogmap &lt;ref&gt;&#x60; (trailing-UUID-only) and join here. &#x60;None&#x60;/empty &#x3D; no cogmap filter.
+    # @option opts [Boolean] :has_artifacts Artifact-ownership filter: &#x60;true&#x60; → only resources owning at least one data artifact; &#x60;false&#x60; → only resources owning none. **Ownership, not liveness** — a folded artifact still means \&quot;owns\&quot;, because the clause this serves says \&quot;own at least one artifact and which own none\&quot;, with no liveness qualifier. Absent &#x3D; no narrowing.  Evaluated inside the caller&#39;s visible set (the predicate sits under the same &#x60;resources_visible_to&#x60; join as every other filter here), so the answer can never widen what the caller can read — and a caller who cannot read a resource gets no existence signal about its artifacts either way.
+    # @option opts [ResourceSortField] :sort 
+    # @option opts [SortOrder] :order 
+    # @option opts [Integer] :limit 
+    # @option opts [Integer] :offset 
+    # @option opts [String] :sections Optional sections to fill on each returned [&#x60;ResourceView&#x60;]. **On this door the vocabulary is &#x60;open-meta&#x60; and nothing else** — a comma-separated list, though there is currently one name in it. &#x60;None&#x60;/empty asks for none, which is the default list row.  &#x60;body&#x60; and &#x60;edges&#x60; are [&#x60;temper_core::types::resource_view::ResourceSection&#x60;] names but are **not** list sections, and asking for either is a &#x60;400&#x60;. A page of reconstructed bodies is unbounded — this endpoint sends no limit when the caller asks for everything, and the body read has no batched form — so &#x60;list&#x60; orients and &#x60;GET /api/resources/{id}&#x60; reads. Nothing fills &#x60;edges&#x60; on a list row at all. Both are accepted on the single-resource door.  Replaces &#x60;meta_only&#x60;, which named a *response type* rather than a part: it selected a second envelope (&#x60;ResourceMetaListResponse&#x60;) whose rows were a different shape. There is one response shape now, so what the caller varies is which parts of it are filled.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;tags&#x60; and &#x60;cogmap_ids&#x60; above — the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Parsed by &#x60;SectionSet::parse_csv_accepting&#x60; against &#x60;ResourceSection::LIST&#x60;, which refuses an unknown name naming this door&#39;s valid set.
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceListResponse]
+    def list_resources(opts = {})
+      data, _status_code, _headers = list_resources_with_http_info(opts)
+      data
+    end
+
+    # List resources you can see
+    # Answers with one response type, unconditionally. Use &#x60;sections&#x60; to vary which parts of each resource are filled — the type you receive never changes.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :kb_doc_type_id 
+    # @option opts [String] :context_ref Context filter: UUID string or &#x60;@owner/slug&#x60; decorated ref. Bare context names are rejected server-side (spec Decision 1).
+    # @option opts [String] :doc_type_name Doc-type filter: one name, or a comma-separated list of them, in which case the filter is the UNION (a row matching any listed name is kept). Multi-select is the odd one out among the filters here — &#x60;tags&#x60; narrows with each addition because a resource has many tags, while a resource has exactly one doc type, so ANDing two names could only ever match nothing. A single name behaves exactly as it always has.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;tags&#x60; and &#x60;cogmap_ids&#x60;: the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Each piece is trimmed and empties are dropped; a CSV that trims away entirely is no filter at all rather than a filter matching nothing.  Unknown names are **not** rejected — an unrecognized doc type matches no row, as it always has. See &#x60;ResourceFacets::doc_type&#x60; for the histogram that makes the reachable set visible.
+    # @option opts [String] :owner 
+    # @option opts [String] :q 
+    # @option opts [String] :stage 
+    # @option opts [String] :status Goal-status filter (goal only): matches &#x60;temper-status&#x60; via the &#x60;kb_resource_workflow_props&#x60; pivot, exactly as &#x60;stage&#x60; does. Validated against the goal schema&#39;s enum surface-side, so an unknown value is an error rather than a silent full scan — which is what this field&#39;s absence used to produce.
+    # @option opts [String] :goal Goal filter (task only): the resolved goal &#x60;ResourceId&#x60; (as UUID). Returns only resources joined to this goal via a live &#x60;advances&#x60;→goal edge. The CLI/MCP resolve the caller&#39;s &#x60;--goal &lt;ref&gt;&#x60; to this UUID (trailing-UUID-only) before the query. &#x60;None&#x60; &#x3D; no goal filter.
+    # @option opts [String] :tags Tag filter: a comma-separated list of tags. Returns only resources whose &#x60;open_meta.tags&#x60; contains **every** tag listed (AND, so each added tag narrows — the same direction every other filter here composes in). Matching is exact per tag and **case-insensitive**: the fold happens receive-side in &#x60;filtered_visible_page&#x60;, so the CLI, MCP and raw HTTP cannot disagree about it.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;cogmap_ids&#x60;: the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences). No tag in the corpus contains a comma (verified against production, 580 distinct tags), and a tag containing one cannot be expressed through this transport — which is a constraint on the tag vocabulary, not a silent truncation: the split is on &#x60;,&#x60; and each piece is trimmed.  Unlike &#x60;stage&#x60; (task-only) and &#x60;status&#x60; (goal-only), tags are **not** doc-type-scoped — 14 doc types carry them in production. So there is deliberately no mismatched-filter refusal for this field; pairing it with any &#x60;doc_type_name&#x60;, or with none, is meaningful.
+    # @option opts [String] :cogmap_ids Cognitive-map scope: a comma-separated list of cogmap UUIDs. Returns only resources homed in one of these maps (&#x60;anchor_table &#x3D; &#39;kb_cogmaps&#39;&#x60;), intersected with the caller&#39;s visible set. A CSV string rather than a &#x60;Vec&#x60; because the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences); the CLI/MCP resolve each &#x60;--cogmap &lt;ref&gt;&#x60; (trailing-UUID-only) and join here. &#x60;None&#x60;/empty &#x3D; no cogmap filter.
+    # @option opts [Boolean] :has_artifacts Artifact-ownership filter: &#x60;true&#x60; → only resources owning at least one data artifact; &#x60;false&#x60; → only resources owning none. **Ownership, not liveness** — a folded artifact still means \&quot;owns\&quot;, because the clause this serves says \&quot;own at least one artifact and which own none\&quot;, with no liveness qualifier. Absent &#x3D; no narrowing.  Evaluated inside the caller&#39;s visible set (the predicate sits under the same &#x60;resources_visible_to&#x60; join as every other filter here), so the answer can never widen what the caller can read — and a caller who cannot read a resource gets no existence signal about its artifacts either way.
+    # @option opts [ResourceSortField] :sort 
+    # @option opts [SortOrder] :order 
+    # @option opts [Integer] :limit 
+    # @option opts [Integer] :offset 
+    # @option opts [String] :sections Optional sections to fill on each returned [&#x60;ResourceView&#x60;]. **On this door the vocabulary is &#x60;open-meta&#x60; and nothing else** — a comma-separated list, though there is currently one name in it. &#x60;None&#x60;/empty asks for none, which is the default list row.  &#x60;body&#x60; and &#x60;edges&#x60; are [&#x60;temper_core::types::resource_view::ResourceSection&#x60;] names but are **not** list sections, and asking for either is a &#x60;400&#x60;. A page of reconstructed bodies is unbounded — this endpoint sends no limit when the caller asks for everything, and the body read has no batched form — so &#x60;list&#x60; orients and &#x60;GET /api/resources/{id}&#x60; reads. Nothing fills &#x60;edges&#x60; on a list row at all. Both are accepted on the single-resource door.  Replaces &#x60;meta_only&#x60;, which named a *response type* rather than a part: it selected a second envelope (&#x60;ResourceMetaListResponse&#x60;) whose rows were a different shape. There is one response shape now, so what the caller varies is which parts of it are filled.  A CSV string rather than a &#x60;Vec&#x60; for the same reason as &#x60;tags&#x60; and &#x60;cogmap_ids&#x60; above — the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Parsed by &#x60;SectionSet::parse_csv_accepting&#x60; against &#x60;ResourceSection::LIST&#x60;, which refuses an unknown name naming this door&#39;s valid set.
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceListResponse, Integer, Hash)>] ResourceListResponse data, response status code and response headers
+    def list_resources_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.list_resources ...'
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'kb_doc_type_id'] = opts[:'kb_doc_type_id'] if !opts[:'kb_doc_type_id'].nil?
+      query_params[:'context_ref'] = opts[:'context_ref'] if !opts[:'context_ref'].nil?
+      query_params[:'doc_type_name'] = opts[:'doc_type_name'] if !opts[:'doc_type_name'].nil?
+      query_params[:'owner'] = opts[:'owner'] if !opts[:'owner'].nil?
+      query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
+      query_params[:'stage'] = opts[:'stage'] if !opts[:'stage'].nil?
+      query_params[:'status'] = opts[:'status'] if !opts[:'status'].nil?
+      query_params[:'goal'] = opts[:'goal'] if !opts[:'goal'].nil?
+      query_params[:'tags'] = opts[:'tags'] if !opts[:'tags'].nil?
+      query_params[:'cogmap_ids'] = opts[:'cogmap_ids'] if !opts[:'cogmap_ids'].nil?
+      query_params[:'has_artifacts'] = opts[:'has_artifacts'] if !opts[:'has_artifacts'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'order'] = opts[:'order'] if !opts[:'order'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'sections'] = opts[:'sections'] if !opts[:'sections'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceListResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.list_resources",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#list_resources\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Read a resource's block provenance
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<BlockProvenanceRow>]
+    def provenance(id, opts = {})
+      data, _status_code, _headers = provenance_with_http_info(id, opts)
+      data
+    end
+
+    # Read a resource&#39;s block provenance
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(Array<BlockProvenanceRow>, Integer, Hash)>] Array<BlockProvenanceRow> data, response status code and response headers
+    def provenance_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.provenance ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.provenance"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/provenance'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Array<BlockProvenanceRow>'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.provenance",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#provenance\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Read one content block by address (the three-state resolution)
+    # The defined-dangling-state design: `200` the block is live (identity, chunk identities, provenance), `410 Gone` the block is folded (the envelope carries its attribution history and its gated successor dispositions), `404` absent. No redirect — successor names ride as data inside the gated envelope, never as a Location the caller may not be authorized to follow.
+    # @param id [String] Resource ID
+    # @param block_id [String] Content block ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [BlockRead]
+    def read_block(id, block_id, opts = {})
+      data, _status_code, _headers = read_block_with_http_info(id, block_id, opts)
+      data
+    end
+
+    # Read one content block by address (the three-state resolution)
+    # The defined-dangling-state design: &#x60;200&#x60; the block is live (identity, chunk identities, provenance), &#x60;410 Gone&#x60; the block is folded (the envelope carries its attribution history and its gated successor dispositions), &#x60;404&#x60; absent. No redirect — successor names ride as data inside the gated envelope, never as a Location the caller may not be authorized to follow.
+    # @param id [String] Resource ID
+    # @param block_id [String] Content block ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(BlockRead, Integer, Hash)>] BlockRead data, response status code and response headers
+    def read_block_with_http_info(id, block_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.read_block ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.read_block"
+      end
+      # verify the required parameter 'block_id' is set
+      if @api_client.config.client_side_validation && block_id.nil?
+        fail ArgumentError, "Missing the required parameter 'block_id' when calling ResourcesApi.read_block"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/blocks/{block_id}'.sub('{id}', CGI.escape(id.to_s)).sub('{block_id}', CGI.escape(block_id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'BlockRead'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.read_block",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#read_block\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Reassign a resource to another owner
+    # @param id [String] Resource ID
+    # @param reassign_resource_request [ReassignResourceRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ReassignAck]
+    def reassign_resource(id, reassign_resource_request, opts = {})
+      data, _status_code, _headers = reassign_resource_with_http_info(id, reassign_resource_request, opts)
+      data
+    end
+
+    # Reassign a resource to another owner
+    # @param id [String] Resource ID
+    # @param reassign_resource_request [ReassignResourceRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ReassignAck, Integer, Hash)>] ReassignAck data, response status code and response headers
+    def reassign_resource_with_http_info(id, reassign_resource_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.reassign_resource ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.reassign_resource"
+      end
+      # verify the required parameter 'reassign_resource_request' is set
+      if @api_client.config.client_side_validation && reassign_resource_request.nil?
+        fail ArgumentError, "Missing the required parameter 'reassign_resource_request' when calling ResourcesApi.reassign_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/reassign'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(reassign_resource_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ReassignAck'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.reassign_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#reassign_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Record a citation-audit verdict
+    # `id` is a routing address. The authorization subject is the finding that owns the block named in the request body, resolved server-side.  If that finding disagrees with `id` the write is refused with 404, so you cannot address one finding in the path while recording an audit against a block of another.
+    # @param id [String] Resource ID (the finding being audited)
+    # @param citation_audit_request [CitationAuditRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [String]
+    def record_citation_audit(id, citation_audit_request, opts = {})
+      data, _status_code, _headers = record_citation_audit_with_http_info(id, citation_audit_request, opts)
+      data
+    end
+
+    # Record a citation-audit verdict
+    # &#x60;id&#x60; is a routing address. The authorization subject is the finding that owns the block named in the request body, resolved server-side.  If that finding disagrees with &#x60;id&#x60; the write is refused with 404, so you cannot address one finding in the path while recording an audit against a block of another.
+    # @param id [String] Resource ID (the finding being audited)
+    # @param citation_audit_request [CitationAuditRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(String, Integer, Hash)>] String data, response status code and response headers
+    def record_citation_audit_with_http_info(id, citation_audit_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.record_citation_audit ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.record_citation_audit"
+      end
+      # verify the required parameter 'citation_audit_request' is set
+      if @api_client.config.client_side_validation && citation_audit_request.nil?
+        fail ArgumentError, "Missing the required parameter 'citation_audit_request' when calling ResourcesApi.record_citation_audit"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/citation-audits'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['text/plain', 'application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(citation_audit_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'String'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.record_citation_audit",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#record_citation_audit\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Read a resource's evidential standing
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [StandingShape]
+    def resource_evidence(id, opts = {})
+      data, _status_code, _headers = resource_evidence_with_http_info(id, opts)
+      data
+    end
+
+    # Read a resource&#39;s evidential standing
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(StandingShape, Integer, Hash)>] StandingShape data, response status code and response headers
+    def resource_evidence_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.resource_evidence ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.resource_evidence"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/evidence'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'StandingShape'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.resource_evidence",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#resource_evidence\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Trace a resource's derivation lineage
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [Integer] :depth Max hop distance to walk from the seed (default 16, clamped to 1..&#x3D;64).
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceLineage]
+    def resource_lineage(id, opts = {})
+      data, _status_code, _headers = resource_lineage_with_http_info(id, opts)
+      data
+    end
+
+    # Trace a resource&#39;s derivation lineage
+    # @param id [String] Resource ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [Integer] :depth Max hop distance to walk from the seed (default 16, clamped to 1..&#x3D;64).
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceLineage, Integer, Hash)>] ResourceLineage data, response status code and response headers
+    def resource_lineage_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.resource_lineage ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.resource_lineage"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/lineage'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'depth'] = opts[:'depth'] if !opts[:'depth'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceLineage'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.resource_lineage",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#resource_lineage\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Revoke access to a resource
+    # @param id [String] Resource ID
+    # @param resource_revoke_body [ResourceRevokeBody] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [RevokeOutcome]
+    def revoke_resource_access(id, resource_revoke_body, opts = {})
+      data, _status_code, _headers = revoke_resource_access_with_http_info(id, resource_revoke_body, opts)
+      data
+    end
+
+    # Revoke access to a resource
+    # @param id [String] Resource ID
+    # @param resource_revoke_body [ResourceRevokeBody] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(RevokeOutcome, Integer, Hash)>] RevokeOutcome data, response status code and response headers
+    def revoke_resource_access_with_http_info(id, resource_revoke_body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.revoke_resource_access ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.revoke_resource_access"
+      end
+      # verify the required parameter 'resource_revoke_body' is set
+      if @api_client.config.client_side_validation && resource_revoke_body.nil?
+        fail ArgumentError, "Missing the required parameter 'resource_revoke_body' when calling ResourcesApi.revoke_resource_access"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}/grants'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(resource_revoke_body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RevokeOutcome'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.revoke_resource_access",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:DELETE, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#revoke_resource_access\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Update a resource
+    # @param id [String] Resource ID
+    # @param resource_update_request [ResourceUpdateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [ResourceView]
+    def update_resource(id, resource_update_request, opts = {})
+      data, _status_code, _headers = update_resource_with_http_info(id, resource_update_request, opts)
+      data
+    end
+
+    # Update a resource
+    # @param id [String] Resource ID
+    # @param resource_update_request [ResourceUpdateRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(ResourceView, Integer, Hash)>] ResourceView data, response status code and response headers
+    def update_resource_with_http_info(id, resource_update_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ResourcesApi.update_resource ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling ResourcesApi.update_resource"
+      end
+      # verify the required parameter 'resource_update_request' is set
+      if @api_client.config.client_side_validation && resource_update_request.nil?
+        fail ArgumentError, "Missing the required parameter 'resource_update_request' when calling ResourcesApi.update_resource"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/resources/{id}'.sub('{id}', CGI.escape(id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(resource_update_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ResourceView'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"ResourcesApi.update_resource",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:PATCH, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ResourcesApi#update_resource\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end