@iblai/iblai-api 4.251.0-core → 4.252.0-core

package/sdk_schema.yml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ibl-data-manager
-  version: 4.251.0-core
+  version: 4.252.0-core
   description: API for iblai
 paths:
   /access-check/{item_type}/{item_id}/:
@@ -20566,6 +20566,859 @@ paths:
                         name: Stu Five
                   summary: Example response
           description: ''
+  /api/core/watched-groups/:
+    get:
+      operationId: core_watched_groups_list
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: List watched groups visible to the caller
+      parameters:
+      - name: limit
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      - name: offset
+        required: false
+        in: query
+        description: The initial index from which to return the results.
+        schema:
+          type: integer
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedWatchedGroupListList'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: Platform not found
+    post:
+      operationId: core_watched_groups_create
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: Create a watched group
+      parameters:
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: query
+        name: watched_user_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watched users in the response (0 = none, max 100).
+          Use the nested /watched-users/ endpoint for paginated walks.
+      - in: query
+        name: watcher_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watchers in the response (0 = none, max 100).
+          Use the nested /watchers/ endpoint for paginated walks.
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupCreate'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupCreate'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupCreate'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupCreate'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/WatchedGroupCreate'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedGroupDetail'
+          description: ''
+        '400':
+          description: Invalid request
+        '403':
+          description: Permission denied
+  /api/core/watched-groups/{id}/:
+    get:
+      operationId: core_watched_groups_retrieve
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: Retrieve a watched group
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this Watched Group.
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: query
+        name: watched_user_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watched users in the response (0 = none, max 100).
+          Use the nested /watched-users/ endpoint for paginated walks.
+      - in: query
+        name: watcher_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watchers in the response (0 = none, max 100).
+          Use the nested /watchers/ endpoint for paginated walks.
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedGroupDetail'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    put:
+      operationId: core_watched_groups_update
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: Update a watched group's name
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this Watched Group.
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: query
+        name: watched_user_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watched users in the response (0 = none, max 100).
+          Use the nested /watched-users/ endpoint for paginated walks.
+      - in: query
+        name: watcher_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watchers in the response (0 = none, max 100).
+          Use the nested /watchers/ endpoint for paginated walks.
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupUpdate'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupUpdate'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupUpdate'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/WatchedGroupUpdate'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/WatchedGroupUpdate'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedGroupDetail'
+          description: ''
+        '400':
+          description: Invalid request
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    patch:
+      operationId: core_watched_groups_partial_update
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: Partially update a watched group's name
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this Watched Group.
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: query
+        name: watched_user_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watched users in the response (0 = none, max 100).
+          Use the nested /watched-users/ endpoint for paginated walks.
+      - in: query
+        name: watcher_limit
+        schema:
+          type: integer
+          maximum: 100
+          minimum: 0
+          default: 0
+        description: Inline up to N watchers in the response (0 = none, max 100).
+          Use the nested /watchers/ endpoint for paginated walks.
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchedWatchedGroupUpdate'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/PatchedWatchedGroupUpdate'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedWatchedGroupUpdate'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedWatchedGroupUpdate'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/PatchedWatchedGroupUpdate'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedGroupDetail'
+          description: ''
+        '400':
+          description: Invalid request
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    delete:
+      operationId: core_watched_groups_destroy
+      description: |-
+        CRUD for WatchedGroup. Watcher mutations live on the nested /watchers/ endpoint;
+        POST here accepts an optional `watchers` array as a create-time convenience.
+      summary: Delete a watched group
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this Watched Group.
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Deleted
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+  /api/core/watched-groups/{watched_group_pk}/watched-users/:
+    get:
+      operationId: core_watched_groups_watched_users_list
+      description: |-
+        CRUD-minus-update for watched users (UserGroupLink rows) under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchedusers/{link_id}/
+        No PATCH/PUT — there's nothing meaningful to update on a UserGroupLink for
+        this feature. Add via POST, remove via DELETE.
+      summary: List watched users in a watched group (paginated)
+      parameters:
+      - name: limit
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      - name: offset
+        required: false
+        in: query
+        description: The initial index from which to return the results.
+        schema:
+          type: integer
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedWatchedUserReadList'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: WatchedGroup not found
+    post:
+      operationId: core_watched_groups_watched_users_create
+      description: |-
+        CRUD-minus-update for watched users (UserGroupLink rows) under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchedusers/{link_id}/
+        No PATCH/PUT — there's nothing meaningful to update on a UserGroupLink for
+        this feature. Add via POST, remove via DELETE.
+      summary: Add a user to the watched group
+      parameters:
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WatchedUserWrite'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/WatchedUserWrite'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/WatchedUserWrite'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/WatchedUserWrite'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/WatchedUserWrite'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedUserRead'
+          description: ''
+        '400':
+          description: Invalid payload
+        '403':
+          description: Permission denied
+        '404':
+          description: WatchedGroup not found
+  /api/core/watched-groups/{watched_group_pk}/watched-users/{id}/:
+    get:
+      operationId: core_watched_groups_watched_users_retrieve
+      description: |-
+        CRUD-minus-update for watched users (UserGroupLink rows) under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchedusers/{link_id}/
+        No PATCH/PUT — there's nothing meaningful to update on a UserGroupLink for
+        this feature. Add via POST, remove via DELETE.
+      summary: Retrieve a single watched-user link
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatchedUserRead'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    delete:
+      operationId: core_watched_groups_watched_users_destroy
+      description: |-
+        CRUD-minus-update for watched users (UserGroupLink rows) under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchedusers/{link_id}/
+        No PATCH/PUT — there's nothing meaningful to update on a UserGroupLink for
+        this feature. Add via POST, remove via DELETE.
+      summary: Remove a user from the watched group
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Removed
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+  /api/core/watched-groups/{watched_group_pk}/watchers/:
+    get:
+      operationId: core_watched_groups_watchers_list
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: List watchers of a watched group (paginated)
+      parameters:
+      - name: limit
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      - name: offset
+        required: false
+        in: query
+        description: The initial index from which to return the results.
+        schema:
+          type: integer
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedWatcherReadList'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: WatchedGroup not found
+    post:
+      operationId: core_watched_groups_watchers_create
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: Add a watcher to a watched group
+      parameters:
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WatcherWrite'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/WatcherWrite'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/WatcherWrite'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/WatcherWrite'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/WatcherWrite'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatcherRead'
+          description: ''
+        '400':
+          description: Invalid payload
+        '403':
+          description: Permission denied
+        '404':
+          description: WatchedGroup not found
+  /api/core/watched-groups/{watched_group_pk}/watchers/{id}/:
+    get:
+      operationId: core_watched_groups_watchers_retrieve
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: Retrieve a single watcher
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatcherRead'
+          description: ''
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    put:
+      operationId: core_watched_groups_watchers_update
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: Replace a watcher's events
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WatcherUpdate'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/WatcherUpdate'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/WatcherUpdate'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/WatcherUpdate'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/WatcherUpdate'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatcherRead'
+          description: ''
+        '400':
+          description: Invalid payload
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    patch:
+      operationId: core_watched_groups_watchers_partial_update
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: Update a watcher's events
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchedWatcherUpdate'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/PatchedWatcherUpdate'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedWatcherUpdate'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedWatcherUpdate'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/PatchedWatcherUpdate'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WatcherRead'
+          description: ''
+        '400':
+          description: Invalid payload
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
+    delete:
+      operationId: core_watched_groups_watchers_destroy
+      description: |-
+        CRUD for watchers nested under a WatchedGroup.
+
+        Resource path: /platforms/{pk}/watchedgroups/{wg_id}/watchers/{watcher_id}/
+        `is_owner` here covers two cases that both deserve owner-level perms on a
+        watcher row:
+          - the watcher themselves (WATCHER_OWNER well-known role)
+          - the parent WatchedGroup's owner (WATCHED_GROUP_OWNER role grants
+            `Ibl.Core/Watchers/*`)
+      summary: Remove (or unsubscribe) a watcher from a watched group
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        required: true
+      - in: query
+        name: platform_key
+        schema:
+          type: string
+          minLength: 1
+        description: 'Service-account only: target platform key. Non-SA callers''
+          platform is sourced from the auth token and this is ignored.'
+      - in: path
+        name: watched_group_pk
+        schema:
+          type: integer
+        required: true
+      tags:
+      - core
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Removed
+        '403':
+          description: Permission denied
+        '404':
+          description: Not found
   /api/credentials/exim/credentials/course/{course_id}/export/:
     get:
       operationId: credentials_exim_credentials_course_export_retrieve
@@ -39915,6 +40768,40 @@ components:
         * `two_or_more` - Two or more races
         * `prefer_not_to_say` - Prefer not to say
         * `other` - Other
+    EventsEnum:
+      enum:
+      - USER_NOTIF_COURSE_ENROLLMENT
+      - ADMIN_NOTIF_COURSE_ENROLLMENT
+      - USER_NOTIF_USER_INACTIVITY
+      - USER_NOTIF_COURSE_COMPLETION
+      - USER_NOTIF_CREDENTIALS
+      - USER_NOTIF_LEARNER_PROGRESS
+      - PROACTIVE_LEARNER_NOTIFICATION
+      - ACTIVITY_NEW_CONTENT
+      - ACTIVITY_COURSE_MILESTONE
+      - SKILL_MASTERY_CHANGE
+      - PROGRAM_ENROLLMENT_CONFIRMATION
+      - PATHWAY_ENROLLMENT_CONFIRMATION
+      - COURSE_SCHEDULE_CHANGE
+      - COURSES_PROGRESS_SUMMARY
+      - SUBSECTION_GRADE_UPDATE
+      type: string
+      description: |-
+        * `USER_NOTIF_COURSE_ENROLLMENT` - Course Enrollment
+        * `ADMIN_NOTIF_COURSE_ENROLLMENT` - Admin: Course Enrollment
+        * `USER_NOTIF_USER_INACTIVITY` - User Inactivity
+        * `USER_NOTIF_COURSE_COMPLETION` - Course Completion
+        * `USER_NOTIF_CREDENTIALS` - Credentials Issued
+        * `USER_NOTIF_LEARNER_PROGRESS` - Learner Progress
+        * `PROACTIVE_LEARNER_NOTIFICATION` - Proactive Learner Notification
+        * `ACTIVITY_NEW_CONTENT` - New Activity Content
+        * `ACTIVITY_COURSE_MILESTONE` - Course Milestone Reached
+        * `SKILL_MASTERY_CHANGE` - Skill Mastery Change
+        * `PROGRAM_ENROLLMENT_CONFIRMATION` - Program Enrollment Confirmed
+        * `PATHWAY_ENROLLMENT_CONFIRMATION` - Pathway Enrollment Confirmed
+        * `COURSE_SCHEDULE_CHANGE` - Course Schedule Change
+        * `COURSES_PROGRESS_SUMMARY` - Courses Progress Summary
+        * `SUBSECTION_GRADE_UPDATE` - Subsection Grade Update
     Experience:
       type: object
       properties:
@@ -43301,74 +44188,202 @@ components:
         results:
           type: array
           items:
-            $ref: '#/components/schemas/RbacGroup'
-    PaginatedRbacPolicyList:
+            $ref: '#/components/schemas/RbacGroup'
+    PaginatedRbacPolicyList:
+      type: object
+      required:
+      - count
+      - results
+      properties:
+        count:
+          type: integer
+          example: 123
+        next:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=4
+        previous:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=2
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/RbacPolicy'
+    PaginatedRbacRoleList:
+      type: object
+      required:
+      - count
+      - results
+      properties:
+        count:
+          type: integer
+          example: 123
+        next:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=4
+        previous:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=2
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/RbacRole'
+    PaginatedSkill:
+      type: object
+      properties:
+        next_page:
+          type: string
+        previous_page:
+          type: string
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/Skill'
+          readOnly: true
+        count:
+          type: integer
+          readOnly: true
+      required:
+      - count
+      - next_page
+      - previous_page
+      - results
+    PaginatedUserAppList:
+      type: object
+      required:
+      - count
+      - results
+      properties:
+        count:
+          type: integer
+          example: 123
+        next:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=4
+        previous:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=2
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/UserApp'
+    PaginatedUserGroupList:
+      type: object
+      required:
+      - count
+      - results
+      properties:
+        count:
+          type: integer
+          example: 123
+        next:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=4
+        previous:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=2
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/UserGroup'
+    PaginatedUserLicense:
       type: object
-      required:
-      - count
-      - results
+      description: Response serializer for paginated user license list
       properties:
         count:
           type: integer
-          example: 123
-        next:
+          description: Total number of results
+        next_page:
           type: string
-          nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=4
-        previous:
-          type: string
           nullable: true
+          description: URL for next page of results
+        previous_page:
+          type: string
           format: uri
-          example: http://api.example.org/accounts/?page=2
+          nullable: true
+          description: URL for previous page of results
         results:
           type: array
           items:
-            $ref: '#/components/schemas/RbacPolicy'
-    PaginatedRbacRoleList:
-      type: object
+            $ref: '#/components/schemas/UserLicenseDetail'
+          description: List of user licenses
       required:
       - count
+      - next_page
+      - previous_page
       - results
+    PaginatedUserLicenseAssignment:
+      type: object
+      description: Response serializer for paginated user license assignment list
       properties:
         count:
           type: integer
-          example: 123
-        next:
+          description: Total number of results
+        next_page:
           type: string
-          nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=4
-        previous:
-          type: string
           nullable: true
+          description: URL for next page of results
+        previous_page:
+          type: string
           format: uri
-          example: http://api.example.org/accounts/?page=2
+          nullable: true
+          description: URL for previous page of results
         results:
           type: array
           items:
-            $ref: '#/components/schemas/RbacRole'
-    PaginatedSkill:
+            $ref: '#/components/schemas/UserLicenseAssignmentDetail'
+          description: List of user license assignments
+      required:
+      - count
+      - next_page
+      - previous_page
+      - results
+    PaginatedUserLicenseGroupAssignment:
       type: object
+      description: Response serializer for paginated user license group assignment
+        list
       properties:
+        count:
+          type: integer
+          description: Total number of results
         next_page:
           type: string
+          format: uri
+          nullable: true
+          description: URL for next page of results
         previous_page:
           type: string
+          format: uri
+          nullable: true
+          description: URL for previous page of results
         results:
           type: array
           items:
-            $ref: '#/components/schemas/Skill'
-          readOnly: true
-        count:
-          type: integer
-          readOnly: true
+            $ref: '#/components/schemas/UserLicenseGroupAssignmentDetail'
+          description: List of user license group assignments
       required:
       - count
       - next_page
       - previous_page
       - results
-    PaginatedUserAppList:
+    PaginatedWatchedGroupListList:
       type: object
       required:
       - count
@@ -43381,17 +44396,17 @@ components:
           type: string
           nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=4
+          example: http://api.example.org/accounts/?offset=400&limit=100
         previous:
           type: string
           nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=2
+          example: http://api.example.org/accounts/?offset=200&limit=100
         results:
           type: array
           items:
-            $ref: '#/components/schemas/UserApp'
-    PaginatedUserGroupList:
+            $ref: '#/components/schemas/WatchedGroupList'
+    PaginatedWatchedUserReadList:
       type: object
       required:
       - count
@@ -43404,98 +44419,39 @@ components:
           type: string
           nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=4
+          example: http://api.example.org/accounts/?offset=400&limit=100
         previous:
           type: string
           nullable: true
           format: uri
-          example: http://api.example.org/accounts/?page=2
+          example: http://api.example.org/accounts/?offset=200&limit=100
         results:
           type: array
           items:
-            $ref: '#/components/schemas/UserGroup'
-    PaginatedUserLicense:
+            $ref: '#/components/schemas/WatchedUserRead'
+    PaginatedWatcherReadList:
       type: object
-      description: Response serializer for paginated user license list
-      properties:
-        count:
-          type: integer
-          description: Total number of results
-        next_page:
-          type: string
-          format: uri
-          nullable: true
-          description: URL for next page of results
-        previous_page:
-          type: string
-          format: uri
-          nullable: true
-          description: URL for previous page of results
-        results:
-          type: array
-          items:
-            $ref: '#/components/schemas/UserLicenseDetail'
-          description: List of user licenses
       required:
       - count
-      - next_page
-      - previous_page
       - results
-    PaginatedUserLicenseAssignment:
-      type: object
-      description: Response serializer for paginated user license assignment list
       properties:
         count:
           type: integer
-          description: Total number of results
-        next_page:
+          example: 123
+        next:
           type: string
-          format: uri
           nullable: true
-          description: URL for next page of results
-        previous_page:
-          type: string
           format: uri
-          nullable: true
-          description: URL for previous page of results
-        results:
-          type: array
-          items:
-            $ref: '#/components/schemas/UserLicenseAssignmentDetail'
-          description: List of user license assignments
-      required:
-      - count
-      - next_page
-      - previous_page
-      - results
-    PaginatedUserLicenseGroupAssignment:
-      type: object
-      description: Response serializer for paginated user license group assignment
-        list
-      properties:
-        count:
-          type: integer
-          description: Total number of results
-        next_page:
+          example: http://api.example.org/accounts/?offset=400&limit=100
+        previous:
           type: string
-          format: uri
           nullable: true
-          description: URL for next page of results
-        previous_page:
-          type: string
           format: uri
-          nullable: true
-          description: URL for previous page of results
+          example: http://api.example.org/accounts/?offset=200&limit=100
         results:
           type: array
           items:
-            $ref: '#/components/schemas/UserLicenseGroupAssignmentDetail'
-          description: List of user license group assignments
-      required:
-      - count
-      - next_page
-      - previous_page
-      - results
+            $ref: '#/components/schemas/WatcherRead'
     Pagination:
       type: object
       description: Serializer for pagination metadata.
@@ -45039,6 +45995,24 @@ components:
           type: array
           items:
             type: string
+    PatchedWatchedGroupUpdate:
+      type: object
+      description: |-
+        Payload for PATCH /watched-groups/{pk}/ — name only.
+
+        Watchers are managed via /watchers/; watched users via /watched-users/.
+      properties:
+        name:
+          type: string
+    PatchedWatcherUpdate:
+      type: object
+      description: Payload for PATCH /watched-groups/{wg_pk}/watchers/{pk}/ — events
+        only.
+      properties:
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/EventsEnum'
     Pathway:
       type: object
       properties:
@@ -53922,6 +54896,135 @@ components:
       - display_name
       - id
       - total_watch
+    WatchedGroupCreate:
+      type: object
+      description: |-
+        Payload for POST /watched-groups/.
+
+        Platform is resolved by the view (auth token for normal callers, query
+        param or body `platform_key` for service accounts) and passed via
+        `context["platform"]`. The body `platform_key` field is consumed by the
+        view, not the serializer.
+
+        `owner_id` is reserved for service-account callers. Platform users are
+        implicitly the owner; specifying `owner_id` from a platform user yields 400.
+      properties:
+        watched_users:
+          type: array
+          items:
+            type: integer
+            description: edX user ID
+        name:
+          type: string
+        watchers:
+          type: array
+          items:
+            $ref: '#/components/schemas/WatcherEntry'
+        owner_id:
+          type: integer
+          description: edX user ID
+          writeOnly: true
+          nullable: true
+      required:
+      - name
+    WatchedGroupDetail:
+      type: object
+      description: |-
+        Detail shape — counts plus opt-in inline collections.
+
+        `watchers` honors `watcher_limit` from context (default 0).
+        `watched_users` honors `watched_user_limit` from context (default 0).
+        Use the dedicated sub-resources for paginated walks.
+      properties:
+        id:
+          type: integer
+          readOnly: true
+        name:
+          type: string
+          readOnly: true
+        platform_key:
+          type: string
+          readOnly: true
+        watcher_count:
+          type: integer
+          readOnly: true
+        watchers:
+          type: array
+          items: {}
+          readOnly: true
+        watched_user_count:
+          type: integer
+          readOnly: true
+        watched_users:
+          type: array
+          items: {}
+          readOnly: true
+      required:
+      - id
+      - name
+      - platform_key
+      - watched_user_count
+      - watched_users
+      - watcher_count
+      - watchers
+    WatchedGroupList:
+      type: object
+      description: Lean shape for list responses — no watchers, no watched_users,
+        no counts.
+      properties:
+        id:
+          type: integer
+          readOnly: true
+        name:
+          type: string
+          readOnly: true
+        platform_key:
+          type: string
+          readOnly: true
+      required:
+      - id
+      - name
+      - platform_key
+    WatchedGroupUpdate:
+      type: object
+      description: |-
+        Payload for PATCH /watched-groups/{pk}/ — name only.
+
+        Watchers are managed via /watchers/; watched users via /watched-users/.
+      properties:
+        name:
+          type: string
+    WatchedUserRead:
+      type: object
+      description: |-
+        Output for a single user inside a WatchedGroup.
+
+        The entity is the user — `id` is the user's id (matching the URL pk). The
+        underlying `UserGroupLink.id` is a routing artifact and isn't surfaced.
+      properties:
+        id:
+          type: integer
+          readOnly: true
+        username:
+          type: string
+          readOnly: true
+        email:
+          type: string
+          format: email
+          readOnly: true
+      required:
+      - email
+      - id
+      - username
+    WatchedUserWrite:
+      type: object
+      description: Payload for POST /watched-groups/{wg_pk}/watched-users/.
+      properties:
+        user_id:
+          type: integer
+          description: edX user ID
+      required:
+      - user_id
     WatchedVideosPerCourse:
       type: object
       properties:
@@ -53984,6 +55087,68 @@ components:
       - full_name
       - percentage
       - username
+    WatcherEntry:
+      type: object
+      description: 'A single watcher entry in the create payload: who watches and
+        which events.'
+      properties:
+        watcher_id:
+          type: integer
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/EventsEnum'
+      required:
+      - watcher_id
+    WatcherRead:
+      type: object
+      description: |-
+        Output for a watcher (a user watching a WatchedGroup).
+
+        The entity is the user — `id` is the watcher's user id (matching the URL
+        pk). The underlying `WatcherToWatchedGroup.id` is a routing artifact and
+        isn't surfaced.
+      properties:
+        id:
+          type: integer
+          readOnly: true
+        username:
+          type: string
+          readOnly: true
+        email:
+          type: string
+          format: email
+          readOnly: true
+        events:
+          description: List of events the watcher is subscribed to for this group
+      required:
+      - email
+      - id
+      - username
+    WatcherUpdate:
+      type: object
+      description: Payload for PATCH /watched-groups/{wg_pk}/watchers/{pk}/ — events
+        only.
+      properties:
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/EventsEnum'
+      required:
+      - events
+    WatcherWrite:
+      type: object
+      description: Payload for POST /watched-groups/{wg_pk}/watchers/.
+      properties:
+        watcher_id:
+          type: integer
+          description: edX user ID
+        events:
+          type: array
+          items:
+            $ref: '#/components/schemas/EventsEnum'
+      required:
+      - watcher_id
     WhitelistedDomain:
       type: object
       properties: