npm - @opensoha/contracts - Versions diffs - 0.1.15 → 0.1.16 - Mend

@opensoha/contracts 0.1.15 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

package/openapi/soha-api.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.15
+  version: 0.1.16
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -37,6 +37,7 @@ tags:
   - name: Software
   - name: Access
   - name: Identity
+  - name: Portal
   - name: Directory
 paths:
   /healthz:
@@ -166,6 +167,142 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/AuthResultEnvelope"
+  /auth/desktop/attempts:
+    post:
+      tags: [Auth]
+      operationId: createDesktopAuthAttempt
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DesktopAuthAttemptCreateRequest"
+      responses:
+        "201":
+          description: Short-lived desktop authentication attempt.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DesktopAuthAttemptEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "413":
+          $ref: "#/components/responses/Error"
+        "429":
+          $ref: "#/components/responses/Error"
+        "501":
+          $ref: "#/components/responses/Error"
+  /auth/desktop/attempts/{attemptID}/start:
+    get:
+      tags: [Auth]
+      operationId: startDesktopAuthAttempt
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/AttemptID"
+      responses:
+        "307":
+          description: Redirect to the identity provider for this attempt.
+        "400":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
+        "429":
+          $ref: "#/components/responses/Error"
+        "501":
+          $ref: "#/components/responses/Error"
+  /auth/desktop/attempts/{attemptID}/exchange:
+    post:
+      tags: [Auth]
+      operationId: exchangeDesktopAuthAttempt
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/AttemptID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DesktopAuthAttemptExchangeRequest"
+      responses:
+        "200":
+          description: Authenticated desktop session.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthResultEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
+        "413":
+          $ref: "#/components/responses/Error"
+        "429":
+          $ref: "#/components/responses/Error"
+        "501":
+          $ref: "#/components/responses/Error"
+  /auth/browser-handoffs/{browserHandoffID}:
+    get:
+      tags: [Auth]
+      operationId: getBrowserHandoff
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/BrowserHandoffID"
+      responses:
+        "200":
+          description: Pending desktop-to-browser session handoff.
+          headers:
+            Cache-Control:
+              schema: { type: string, enum: [no-store] }
+            Referrer-Policy:
+              schema: { type: string, enum: [no-referrer] }
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BrowserHandoffEnvelope"
+        "404":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
+        "429":
+          $ref: "#/components/responses/Error"
+  /auth/browser-handoffs/{browserHandoffID}/complete:
+    post:
+      tags: [Auth]
+      operationId: completeBrowserHandoff
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/BrowserHandoffID"
+      responses:
+        "200":
+          description: Browser session created after explicit confirmation.
+          headers:
+            Cache-Control:
+              schema: { type: string, enum: [no-store] }
+            Referrer-Policy:
+              schema: { type: string, enum: [no-referrer] }
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BrowserHandoffCompletionEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
+        "429":
+          $ref: "#/components/responses/Error"
   /auth/login/{providerID}/start:
     get:
       tags: [Auth]
@@ -212,6 +349,51 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/UserProfileEnvelope"
+        "401":
+          $ref: "#/components/responses/Error"
+    patch:
+      tags: [Auth]
+      operationId: updateCurrentUserProfile
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpdateProfileRequest"
+      responses:
+        "200":
+          description: Updated current user profile.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UserProfileEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+  /auth/profile/password:
+    post:
+      tags: [Auth]
+      operationId: changeCurrentUserPassword
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChangePasswordRequest"
+      responses:
+        "200":
+          description: Password changed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PasswordChangeResult"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
   /auth/bootstrap:
     get:
       tags: [Auth]
@@ -1050,6 +1232,32 @@ paths:
                 $ref: "#/components/schemas/ApplicationRuntimeDetailEnvelope"
         "404":
           $ref: "#/components/responses/Error"
+  /applications/{applicationID}/application-environments/{applicationEnvironmentID}/workflow:
+    put:
+      tags: [Applications, Delivery]
+      operationId: saveApplicationEnvironmentWorkflow
+      parameters:
+        - $ref: "#/components/parameters/ApplicationID"
+        - $ref: "#/components/parameters/ApplicationEnvironmentID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ApplicationWorkflowInput"
+      responses:
+        "200":
+          description: Application environment with its atomically saved workflow.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApplicationEnvironmentEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /applications/{applicationID}/services:
     get:
       tags: [Applications]
@@ -1788,6 +1996,142 @@ paths:
                 $ref: "#/components/schemas/OperationStatus"
         "404":
           $ref: "#/components/responses/Error"
+  /delivery/environments:
+    get:
+      tags: [Delivery]
+      operationId: listDeliveryEnvironments
+      responses:
+        "200":
+          description: Reusable delivery environments visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DeliveryEnvironmentListEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+  /delivery/manifest-packages:
+    get:
+      tags: [Delivery]
+      operationId: listManifestPackages
+      parameters:
+        - name: applicationId
+          in: query
+          required: false
+          schema: { type: string }
+        - name: serviceId
+          in: query
+          required: false
+          schema: { type: string }
+        - name: clusterId
+          in: query
+          required: false
+          schema: { type: string }
+        - name: namespace
+          in: query
+          required: false
+          schema: { type: string }
+        - name: search
+          in: query
+          required: false
+          schema: { type: string }
+        - name: page
+          in: query
+          required: false
+          schema: { type: integer, minimum: 1 }
+        - name: pageSize
+          in: query
+          required: false
+          schema: { type: integer, minimum: 1, maximum: 200 }
+        - name: limit
+          in: query
+          required: false
+          schema: { type: integer, minimum: 1, maximum: 200 }
+      responses:
+        "200":
+          description: Manifest packages visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ManifestPackagePageEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+    post:
+      tags: [Delivery]
+      operationId: createManifestPackage
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ManifestPackageInput"
+      responses:
+        "201":
+          description: Created manifest package.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ManifestPackageEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /delivery/manifest-packages/{manifestPackageID}:
+    get:
+      tags: [Delivery]
+      operationId: getManifestPackage
+      parameters:
+        - $ref: "#/components/parameters/ManifestPackageID"
+      responses:
+        "200":
+          description: Manifest package detail.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ManifestPackageEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+    put:
+      tags: [Delivery]
+      operationId: updateManifestPackage
+      parameters:
+        - $ref: "#/components/parameters/ManifestPackageID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ManifestPackageInput"
+      responses:
+        "200":
+          description: Updated manifest package.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ManifestPackageEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+    delete:
+      tags: [Delivery]
+      operationId: deleteManifestPackage
+      parameters:
+        - $ref: "#/components/parameters/ManifestPackageID"
+      responses:
+        "200":
+          description: Deleted manifest package.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OperationStatus"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /delivery/manifest-packages/{manifestPackageID}/source:
     get:
       tags: [Delivery]
@@ -2776,6 +3120,11 @@ paths:
         name: virtualization.vms.create.plan
         riskLevel: analyze
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - virtualization.flavors.view
+          - virtualization.images.view
+          - virtualization.vms.view
       requestBody:
         required: true
         content:
@@ -2825,6 +3174,9 @@ paths:
         name: virtualization.vms.create.trigger
         riskLevel: execute
         requiresApproval: true
+        permissionKeys:
+          - ai.gateway.invoke
+          - virtualization.vms.create
       parameters:
         - $ref: "#/components/parameters/IdempotencyKey"
       requestBody:
@@ -3351,6 +3703,10 @@ paths:
         name: docker.hosts.quick_create.plan
         riskLevel: analyze
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - docker.hosts.view
+          - virtualization.vms.view
       requestBody:
         required: true
         content:
@@ -3377,6 +3733,10 @@ paths:
         name: docker.hosts.quick_create.trigger
         riskLevel: execute
         requiresApproval: true
+        permissionKeys:
+          - ai.gateway.invoke
+          - docker.hosts.create
+          - virtualization.vms.create
       parameters:
         - $ref: "#/components/parameters/IdempotencyKey"
       requestBody:
@@ -3407,6 +3767,10 @@ paths:
         name: docker.projects.deploy.plan
         riskLevel: analyze
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - docker.projects.view
+          - docker.templates.view
       parameters:
         - $ref: "#/components/parameters/DockerProjectID"
       requestBody:
@@ -3437,6 +3801,9 @@ paths:
         name: docker.projects.deploy.trigger
         riskLevel: execute
         requiresApproval: true
+        permissionKeys:
+          - ai.gateway.invoke
+          - docker.projects.deploy
       parameters:
         - $ref: "#/components/parameters/DockerProjectID"
         - $ref: "#/components/parameters/IdempotencyKey"
@@ -4497,6 +4864,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesClusters
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.clusters.view
       x-soha-implementation-status: implemented
       responses:
         "200":
@@ -4511,6 +4882,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesClusterDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.clusters.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4529,6 +4904,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesNamespaces
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.namespaces.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4549,6 +4928,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesNodes
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.nodes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4569,11 +4952,19 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesNodeDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.nodes.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.nodes.detail
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.nodes.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesNodeName"
@@ -4594,6 +4985,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesWorkloadOverview
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.overview.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4615,11 +5010,19 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesPods
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.pods.list
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.pods.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesNamespaceQuery"
@@ -4640,11 +5043,19 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPodDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.pods.describe
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.pods.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesPodName"
@@ -4666,11 +5077,19 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesDeployments
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.deployments.list
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.deployment.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesNamespaceQuery"
@@ -4691,6 +5110,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDeploymentDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4713,11 +5136,19 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPodLogs
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.logs
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.pods.logs
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.pods.logs
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesPodName"
@@ -4748,6 +5179,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPodYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4767,6 +5202,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDeploymentYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4786,6 +5225,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDeploymentMetrics
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4808,11 +5251,19 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDeploymentRolloutStatus
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.deployments.rollout_status
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.deployment.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesDeploymentName"
@@ -4831,6 +5282,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesDeploymentRollouts
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.deployment.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4850,6 +5305,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesStatefulSets
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.stateful-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4868,6 +5327,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesStatefulSetDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.stateful-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4887,6 +5350,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesStatefulSetYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.stateful-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4906,6 +5373,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesStatefulSetMetrics
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.stateful-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4928,6 +5399,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesDaemonSets
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.daemon-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4946,6 +5421,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDaemonSetDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.daemon-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4965,6 +5444,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDaemonSetYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.daemon-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -4984,6 +5467,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesDaemonSetMetrics
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.daemon-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5006,6 +5493,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesJobs
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5024,6 +5515,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesJobDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5043,6 +5538,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesJobYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5062,6 +5561,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesCronJobs
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.cron-jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5080,6 +5583,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesCronJobDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.cron-jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5099,6 +5606,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesCronJobYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.cron-jobs.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5118,6 +5629,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesReplicaSets
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replica-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5136,6 +5651,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesReplicaSetDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replica-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5155,6 +5674,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesReplicaSetYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replica-sets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5174,6 +5697,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesReplicationControllers
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replication-controllers.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5192,6 +5719,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesReplicationControllerDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replication-controllers.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5211,6 +5742,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesReplicationControllerYaml
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.replication-controllers.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5230,6 +5765,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesConfigMaps
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.config-maps.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5251,6 +5790,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesConfigMapDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.config-maps.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5273,6 +5816,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesSecretMetadata
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.secrets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5294,6 +5841,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesConfigMapReferences
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.config-maps.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5312,6 +5863,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesSecretReferences
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.secrets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5330,6 +5885,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesHorizontalPodAutoscalers
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.horizontal-pod-autoscalers.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5347,6 +5906,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesHorizontalPodAutoscalerDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.horizontal-pod-autoscalers.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5365,6 +5928,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesPodDisruptionBudgets
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.pod-disruption-budgets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5382,6 +5949,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPodDisruptionBudgetDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.pod-disruption-budgets.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5400,6 +5971,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesPriorityClasses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.priority-classes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5416,6 +5991,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesRuntimeClasses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.runtime-classes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5432,6 +6011,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesMutatingWebhookConfigurations
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.mutating-webhook-configurations.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5448,6 +6031,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesMutatingWebhookConfigurationDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.mutating-webhook-configurations.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5465,6 +6052,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesValidatingWebhookConfigurations
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.validating-webhook-configurations.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5481,6 +6072,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesValidatingWebhookConfigurationDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.validating-webhook-configurations.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5498,6 +6093,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesResourceQuotas
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.resource-quotas.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5515,6 +6114,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesResourceQuotaDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.resource-quotas.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5533,6 +6136,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesLimitRanges
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.limit-ranges.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5550,6 +6157,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesLimitRangeDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.limit-ranges.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5568,6 +6179,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesLeases
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.configuration.leases.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5585,6 +6200,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesServiceAccounts
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.service-accounts.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5602,6 +6221,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesServiceAccountDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.service-accounts.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5620,6 +6243,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesRoles
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.roles.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5637,6 +6264,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesRoleDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.roles.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5655,6 +6286,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesRoleBindings
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.role-bindings.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5676,6 +6311,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesRoleBindingDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.role-bindings.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5694,6 +6333,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesClusterRoles
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.cluster-roles.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5710,6 +6353,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesClusterRoleDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.cluster-roles.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5727,6 +6374,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesClusterRoleBindings
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.cluster-role-bindings.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5747,6 +6398,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesClusterRoleBindingDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.access-control.cluster-role-bindings.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5764,6 +6419,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesPersistentVolumeClaims
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.persistent-volume-claims.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5781,6 +6440,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPersistentVolumeClaimDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.persistent-volume-claims.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5799,6 +6462,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesPersistentVolumes
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.persistent-volumes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5815,6 +6482,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesPersistentVolumeDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.persistent-volumes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5832,6 +6503,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesStorageClasses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.storage-classes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5848,6 +6523,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesStorageClassDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.storage.storage-classes.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5865,11 +6544,19 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesServices
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.services.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.services.list
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.network.services.view
+          - workspace.resource.view
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
         "200": { description: Kubernetes Services visible in the selected scope., content: { application/json: { schema: { $ref: "#/components/schemas/KubernetesServiceListEnvelope" } } } }
@@ -5880,6 +6567,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesServiceDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.services.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesServiceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5891,6 +6582,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesNetworkTopology
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.topology.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5902,6 +6597,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesServiceMetrics
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.services.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -5918,6 +6617,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesIngresses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.ingresses.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5929,6 +6632,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesIngressDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.ingresses.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5940,6 +6647,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesEndpointSlices
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.endpoint-slices.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5951,6 +6662,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesEndpointSliceDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.endpoint-slices.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5962,6 +6677,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesNetworkPolicies
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.network-policies.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5973,6 +6692,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesNetworkPolicyDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.network-policies.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -5984,6 +6707,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesGatewayClasses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.gateway-classes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }]
       responses:
@@ -5995,6 +6722,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesGatewayClassDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.gateway-classes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }]
       responses:
@@ -6006,6 +6737,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesGateways
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.gateways.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6017,6 +6752,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesGatewayDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.gateways.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6028,6 +6767,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesHTTPRoutes
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.http-routes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6039,6 +6782,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesHTTPRouteDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.http-routes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6050,6 +6797,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesBackendTLSPolicies
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.backend-tls-policies.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6061,6 +6812,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesBackendTLSPolicyDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.backend-tls-policies.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6072,6 +6827,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesGRPCRoutes
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.grpc-routes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6083,6 +6842,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesGRPCRouteDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.grpc-routes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6094,6 +6857,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesReferenceGrants
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.reference-grants.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6105,6 +6872,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesReferenceGrantDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.reference-grants.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6116,6 +6887,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesIngressClasses
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.ingress-classes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }]
       responses:
@@ -6127,6 +6902,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesIngressClassDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.network.ingress-classes.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesResourceName" }]
       responses:
@@ -6138,6 +6917,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesCustomResourceDefinitions
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.extensions.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }]
       responses:
@@ -6149,6 +6932,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesCustomResources
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.extensions.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesCRDName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6160,6 +6947,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesHelmCharts
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6175,6 +6966,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesHelmChartDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6190,6 +6985,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesHelmReleases
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6201,6 +7000,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesHelmReleaseDetail
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesReleaseName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6212,6 +7015,10 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesHelmReleaseHistory
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesReleaseName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
@@ -6223,6 +7030,11 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesHelmReleaseManifest
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.values.view
+          - platform.helm.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6241,6 +7053,10 @@ paths:
     post:
       tags: [Platform]
       operationId: planKubernetesHelmReleaseRollback
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.releases.rollback
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesReleaseName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       requestBody:
@@ -6256,6 +7072,10 @@ paths:
     post:
       tags: [Platform]
       operationId: rollbackKubernetesHelmRelease
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.helm.releases.rollback
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesReleaseName" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       requestBody:
@@ -6267,6 +7087,170 @@ paths:
         "403": { $ref: "#/components/responses/Error" }
         "404": { $ref: "#/components/responses/Error" }
         "503": { $ref: "#/components/responses/Error" }
+  /alert-rules:
+    get:
+      tags: [Observability]
+      operationId: listAlertRules
+      responses:
+        "200":
+          description: Alert rules visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleListEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+    post:
+      tags: [Observability]
+      operationId: createAlertRule
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AlertRuleInput"
+      responses:
+        "201":
+          description: Alert rule created.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /alert-rules/{ruleID}:
+    get:
+      tags: [Observability]
+      operationId: getAlertRule
+      parameters:
+        - $ref: "#/components/parameters/AlertRuleID"
+      responses:
+        "200":
+          description: Alert rule detail.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+    put:
+      tags: [Observability]
+      operationId: updateAlertRule
+      parameters:
+        - $ref: "#/components/parameters/AlertRuleID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AlertRuleInput"
+      responses:
+        "200":
+          description: Alert rule updated.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+  /alert-rules/{ruleID}/validate:
+    post:
+      tags: [Observability]
+      operationId: validateAlertRule
+      description: Compatibility alias for testing an alert rule without persisting it.
+      parameters:
+        - name: ruleID
+          in: path
+          required: true
+          description: Compatibility token retained in the legacy path; preview evaluation does not resolve a persisted rule.
+          schema:
+            type: string
+            minLength: 1
+            maxLength: 128
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AlertRuleInput"
+      responses:
+        "200":
+          description: Alert rule evaluation preview.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleTestResultEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /alert-rules/{ruleID}/test:
+    post:
+      tags: [Observability]
+      operationId: testAlertRule
+      description: Test an alert rule payload without persisting it; ruleID is a legacy compatibility token.
+      parameters:
+        - name: ruleID
+          in: path
+          required: true
+          description: Compatibility token retained in the legacy path; preview evaluation does not resolve a persisted rule.
+          schema:
+            type: string
+            minLength: 1
+            maxLength: 128
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AlertRuleInput"
+      responses:
+        "200":
+          description: Alert rule evaluation preview.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleTestResultEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /alert-rule-runs:
+    get:
+      tags: [Observability]
+      operationId: listAlertRuleRuns
+      parameters:
+        - name: ruleId
+          in: query
+          required: false
+          schema:
+            type: string
+            minLength: 1
+            maxLength: 128
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            default: 20
+      responses:
+        "200":
+          description: Recent alert rule evaluation runs visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AlertRuleRunListEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
   /alert-events/stream:
     get:
       tags: [Observability]
@@ -6287,11 +7271,20 @@ paths:
     get:
       tags: [Platform]
       operationId: listKubernetesClusterEvents
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.workloads.overview.view
       x-soha-implementation-status: implemented
       x-soha-capability:
         name: k8s.events.list
         riskLevel: read
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - observe.events.view
+          - platform.workloads.overview.view
+          - workspace.resource.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesNamespaceQuery"
@@ -6305,6 +7298,8 @@ paths:
     get:
       tags: [Platform]
       operationId: searchKubernetesResources
+      x-soha-permissions:
+        mode: resource
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6341,6 +7336,8 @@ paths:
     get:
       tags: [Platform]
       operationId: streamKubernetesResourceEvents
+      x-soha-permissions:
+        mode: resource
       x-soha-implementation-status: implemented
       description: >
         Upgrades to an authenticated WebSocket that publishes metadata-only Kubernetes
@@ -6368,6 +7365,8 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesResourceGraph
+      x-soha-permissions:
+        mode: resource
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6390,6 +7389,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getKubernetesSecurityPosture
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.clusters.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6407,6 +7410,8 @@ paths:
     post:
       tags: [Platform]
       operationId: planKubernetesResourceUpdate
+      x-soha-permissions:
+        mode: resource
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6431,6 +7436,11 @@ paths:
     post:
       tags: [Platform]
       operationId: reviewKubernetesSubjectAccess
+      x-soha-permissions:
+        mode: subject
+        keys:
+          - platform.access-control.access-reviews.execute
+          - platform.access-control.service-accounts.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6450,6 +7460,8 @@ paths:
     get:
       tags: [Platform]
       operationId: listClusterCapabilityMatrix
+      x-soha-permissions:
+        mode: authenticated
       responses:
         "200":
           description: Cluster runtime capability matrix for Direct and Agent modes.
@@ -6463,6 +7475,10 @@ paths:
     get:
       tags: [Platform]
       operationId: getClusterPodMetrics
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.view
       x-soha-implementation-status: implemented
       parameters:
         - $ref: "#/components/parameters/ClusterID"
@@ -6512,6 +7528,10 @@ paths:
     post:
       tags: [Platform]
       operationId: createClusterAgentInstallation
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.clusters.update
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       responses:
@@ -6533,6 +7553,8 @@ paths:
     get:
       tags: [Platform]
       operationId: downloadKubernetesAgentInstallationManifest
+      x-soha-permissions:
+        mode: install-ticket
       security: []
       parameters:
         - $ref: "#/components/parameters/AgentInstallTicket"
@@ -6572,6 +7594,10 @@ paths:
     post:
       tags: [Platform]
       operationId: queryClusterLogs
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.logs
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -6601,6 +7627,10 @@ paths:
     post:
       tags: [Platform]
       operationId: issueClusterLogStreamTicket
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.pods.logs
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -6748,6 +7778,10 @@ paths:
     get:
       tags: [Observability]
       operationId: getClusterLogCollection
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.clusters.view
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       responses:
@@ -6765,6 +7799,10 @@ paths:
     post:
       tags: [Observability]
       operationId: preflightClusterLogCollection
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.observability.logging.enable
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -6790,6 +7828,10 @@ paths:
     post:
       tags: [Observability]
       operationId: enableClusterLogCollection
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.observability.logging.enable
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -6817,6 +7859,10 @@ paths:
     post:
       tags: [Observability]
       operationId: disableClusterLogCollection
+      x-soha-permissions:
+        mode: all
+        keys:
+          - platform.observability.logging.disable
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -7190,6 +8236,8 @@ paths:
     post:
       tags: [Platform]
       operationId: decideKubernetesResourceCreateScope
+      x-soha-permissions:
+        mode: resource
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -7215,10 +8263,14 @@ paths:
     post:
       tags: [Platform]
       operationId: generateKubernetesWorkloadSnapshot
+      x-soha-permissions:
+        mode: resource
       x-soha-capability:
         name: k8s.workloads.snapshot.generate
         riskLevel: analyze
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -7244,10 +8296,15 @@ paths:
     post:
       tags: [Platform]
       operationId: preflightKubernetesResourceCreate
+      x-soha-permissions:
+        mode: resource
       x-soha-capability:
         name: k8s.resources.create.preflight
         riskLevel: analyze
         requiresApproval: false
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.resource-creation.use
       parameters:
         - $ref: "#/components/parameters/ClusterID"
       requestBody:
@@ -7275,10 +8332,15 @@ paths:
     post:
       tags: [Platform]
       operationId: executeKubernetesResourceCreate
+      x-soha-permissions:
+        mode: resource
       x-soha-capability:
         name: k8s.resources.create.trigger
         riskLevel: high
         requiresApproval: true
+        permissionKeys:
+          - ai.gateway.invoke
+          - platform.resource-creation.use
       parameters:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/IdempotencyKey"
@@ -8229,6 +9291,13 @@ paths:
           schema:
             type: string
             enum: [success, failure, cancelled, client_cancelled, rate_limited, policy_denied]
+            x-enum-varnames:
+              - ListAIGatewayRelayModelCallsParamsStatusSuccess
+              - ListAIGatewayRelayModelCallsParamsStatusFailure
+              - ListAIGatewayRelayModelCallsParamsStatusCancelled
+              - ListAIGatewayRelayModelCallsParamsStatusClientCancelled
+              - ListAIGatewayRelayModelCallsParamsStatusRateLimited
+              - ListAIGatewayRelayModelCallsParamsStatusPolicyDenied
         - name: endpoint
           in: query
           required: false
@@ -10269,6 +11338,13 @@ paths:
           schema:
             type: string
             maxLength: 64
+        - name: storageIntegrationId
+          in: query
+          required: false
+          schema:
+            type: string
+            minLength: 1
+            maxLength: 128
         - name: cursor
           in: query
           required: false
@@ -10351,6 +11427,13 @@ paths:
       tags: [Software]
       operationId: getSoftwareStorage
       parameters:
+        - name: storageIntegrationId
+          in: query
+          required: false
+          schema:
+            type: string
+            minLength: 1
+            maxLength: 128
         - name: cursor
           in: query
           required: false
@@ -10412,6 +11495,36 @@ paths:
           $ref: "#/components/responses/Error"
         "404":
           $ref: "#/components/responses/Error"
+  /software/packages/{packageID}/download-records:
+    get:
+      tags: [Software]
+      operationId: listSoftwarePackageDownloadRecords
+      description: Lists recent successful downloads. Requires system.audit.view or identity.audit.view.
+      parameters:
+        - $ref: "#/components/parameters/SoftwarePackageID"
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 100
+            default: 50
+      responses:
+        "200":
+          description: Recent successful download records, newest first.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SoftwarePackageDownloadRecordListEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /plugins/installed:
     get:
       tags: [Plugins]
@@ -12104,6 +13217,138 @@ paths:
         "401": { $ref: "#/components/responses/Error" }
         "403": { $ref: "#/components/responses/Error" }
         "404": { $ref: "#/components/responses/Error" }
+  /access/users/{userID}/scope-grants:
+    parameters:
+      - $ref: "#/components/parameters/UserID"
+    get:
+      tags: [Access]
+      operationId: listUserScopeGrants
+      x-soha-implementation-status: implemented
+      responses:
+        "200":
+          description: Resource scope grants for the user.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantListEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+    post:
+      tags: [Access]
+      operationId: createUserScopeGrant
+      x-soha-implementation-status: implemented
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ScopeGrantInput" }
+      responses:
+        "201":
+          description: Created resource scope grant for the user.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+  /access/users/{userID}/scope-grants/{scopeGrantID}:
+    parameters:
+      - $ref: "#/components/parameters/UserID"
+      - $ref: "#/components/parameters/ScopeGrantID"
+    put:
+      tags: [Access]
+      operationId: updateUserScopeGrant
+      x-soha-implementation-status: implemented
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ScopeGrantInput" }
+      responses:
+        "200":
+          description: Updated resource scope grant for the user.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    delete:
+      tags: [Access]
+      operationId: deleteUserScopeGrant
+      x-soha-implementation-status: implemented
+      responses:
+        "204":
+          description: Resource scope grant for the user deleted.
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+  /access/teams/{teamID}/scope-grants:
+    parameters:
+      - $ref: "#/components/parameters/TeamID"
+    get:
+      tags: [Access]
+      operationId: listTeamScopeGrants
+      x-soha-implementation-status: implemented
+      responses:
+        "200":
+          description: Resource scope grants for the team.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantListEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+    post:
+      tags: [Access]
+      operationId: createTeamScopeGrant
+      x-soha-implementation-status: implemented
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ScopeGrantInput" }
+      responses:
+        "201":
+          description: Created resource scope grant for the team.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+  /access/teams/{teamID}/scope-grants/{scopeGrantID}:
+    parameters:
+      - $ref: "#/components/parameters/TeamID"
+      - $ref: "#/components/parameters/ScopeGrantID"
+    put:
+      tags: [Access]
+      operationId: updateTeamScopeGrant
+      x-soha-implementation-status: implemented
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ScopeGrantInput" }
+      responses:
+        "200":
+          description: Updated resource scope grant for the team.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ScopeGrantEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    delete:
+      tags: [Access]
+      operationId: deleteTeamScopeGrant
+      x-soha-implementation-status: implemented
+      responses:
+        "204":
+          description: Resource scope grant for the team deleted.
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
   /identity/capabilities:
     get:
       tags: [Identity]
@@ -12115,6 +13360,112 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/IdentityRuntimeCapabilityEnvelope" }
         "403": { $ref: "#/components/responses/IdentityError" }
+  /portal/bootstrap:
+    get:
+      tags: [Portal]
+      operationId: getPortalBootstrap
+      responses:
+        "200":
+          description: Current principal and visible provider portal data.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/PortalBootstrapEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+  /portal/applications:
+    get:
+      tags: [Portal]
+      operationId: listPortalApplications
+      responses:
+        "200":
+          description: Applications visible to the current principal.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/PortalApplicationListEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+  /portal/applications/{applicationID}:
+    parameters:
+      - $ref: "#/components/parameters/PortalApplicationID"
+    get:
+      tags: [Portal]
+      operationId: getPortalApplication
+      responses:
+        "200":
+          description: Application visible to the current principal.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/IdentityApplicationEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+  /portal/applications/{applicationID}/launch:
+    parameters:
+      - $ref: "#/components/parameters/PortalApplicationID"
+    post:
+      tags: [Portal]
+      operationId: launchPortalApplication
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/PortalLaunchRequest" }
+      responses:
+        "200":
+          description: Authorized launch decision for Web or desktop.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/PortalLaunchDecisionEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+  /portal/applications/{applicationID}/favorite:
+    parameters:
+      - $ref: "#/components/parameters/PortalApplicationID"
+    post:
+      tags: [Portal]
+      operationId: favoritePortalApplication
+      responses:
+        "200":
+          description: Favorited application.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/IdentityApplicationEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    delete:
+      tags: [Portal]
+      operationId: unfavoritePortalApplication
+      responses:
+        "204": { description: Application removed from favorites. }
+        "401": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+  /portal/recent:
+    get:
+      tags: [Portal]
+      operationId: listPortalRecentLaunches
+      parameters:
+        - name: limit
+          in: query
+          schema: { type: integer, minimum: 1, maximum: 100, default: 10 }
+      responses:
+        "200":
+          description: Recent application launches for the current principal.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/IdentityApplicationLaunchListEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+  /portal/security:
+    get:
+      tags: [Portal]
+      operationId: getPortalSecuritySummary
+      responses:
+        "200":
+          description: Current principal security summary.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/PortalSecuritySummaryEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
   /identity/applications:
     get:
       tags: [Identity]
@@ -12426,6 +13777,10 @@ paths:
       responses:
         "201":
           description: Created OIDC client.
+          headers:
+            Cache-Control:
+              description: Always no-store when the response includes a client secret.
+              schema: { type: string }
           content:
             application/json:
               schema: { $ref: "#/components/schemas/OIDCClientCreatedEnvelope" }
@@ -12465,6 +13820,25 @@ paths:
       responses:
         "204": { description: OIDC client deleted. }
         "404": { $ref: "#/components/responses/IdentityError" }
+  /identity/oidc-clients/{oidcClientID}/secret/reveal:
+    parameters:
+      - $ref: "#/components/parameters/OIDCClientID"
+    post:
+      tags: [Identity]
+      operationId: revealIdentityOIDCClientSecret
+      responses:
+        "200":
+          description: Decrypted OIDC client secret for an authorized administrator. The response must not be cached.
+          headers:
+            Cache-Control:
+              description: Always `no-store` for secret responses.
+              schema: { type: string }
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/OIDCClientSecretRevealEnvelope" }
+        "403": { $ref: "#/components/responses/IdentityError" }
+        "404": { $ref: "#/components/responses/IdentityError" }
+        "409": { $ref: "#/components/responses/IdentityError" }
   /identity/saml/login-sources:
     get:
       tags: [Identity]
@@ -12966,6 +14340,16 @@ components:
       in: path
       required: true
       schema: { type: string, minLength: 1, maxLength: 128 }
+    UserID:
+      name: userID
+      in: path
+      required: true
+      schema: { type: string, minLength: 1, maxLength: 128 }
+    TeamID:
+      name: teamID
+      in: path
+      required: true
+      schema: { type: string, minLength: 1, maxLength: 128 }
     ScopeGrantID:
       name: scopeGrantID
       in: path
@@ -12976,6 +14360,16 @@ components:
       in: path
       required: true
       schema: { type: string, minLength: 1, maxLength: 128 }
+    PortalApplicationID:
+      name: applicationID
+      in: path
+      required: true
+      schema: { type: string, minLength: 1, maxLength: 128 }
+    BrowserHandoffID:
+      name: browserHandoffID
+      in: path
+      required: true
+      schema: { type: string, minLength: 1, maxLength: 128 }
     IdentityProviderID:
       name: identityProviderID
       in: path
@@ -13275,6 +14669,14 @@ components:
         type: string
         minLength: 1
         maxLength: 128
+    AlertRuleID:
+      name: ruleID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+        maxLength: 128
     ObservabilityDataSourceIDQuery:
       name: dataSourceId
       in: query
@@ -13590,6 +14992,14 @@ components:
       required: true
       schema:
         type: string
+    AttemptID:
+      name: attemptID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+        maxLength: 128
     PluginID:
       name: pluginID
       in: path
@@ -13949,7 +15359,36 @@ components:
       additionalProperties: false
     IdentityResourceStatus:
       type: string
-      enum: [active, disabled]
+      enum: [active, draft, enabled, disabled, maintenance]
+    IdentityApplicationProviderType:
+      type: string
+      enum: [link, oidc, proxy, saml]
+    IdentityApplicationAssignmentSubjectType:
+      type: string
+      enum: [user, role, team, tag]
+    IdentityApplicationAssignmentEffect:
+      type: string
+      enum: [allow, deny]
+    IdentityApplicationAssignment:
+      type: object
+      required: [id, applicationId, subjectType, subjectId, effect, createdAt]
+      properties:
+        id: { type: string }
+        applicationId: { type: string }
+        subjectType: { $ref: "#/components/schemas/IdentityApplicationAssignmentSubjectType" }
+        subjectId: { type: string }
+        effect: { $ref: "#/components/schemas/IdentityApplicationAssignmentEffect" }
+        createdBy: { type: string }
+        createdAt: { type: string, format: date-time }
+      additionalProperties: false
+    IdentityApplicationAssignmentInput:
+      type: object
+      required: [subjectType, subjectId, effect]
+      properties:
+        subjectType: { $ref: "#/components/schemas/IdentityApplicationAssignmentSubjectType" }
+        subjectId: { type: string, minLength: 1 }
+        effect: { $ref: "#/components/schemas/IdentityApplicationAssignmentEffect" }
+      additionalProperties: false
     IdentityApplication:
       type: object
       required: [id, name, slug, status, createdAt, updatedAt]
@@ -13958,8 +15397,24 @@ components:
         name: { type: string }
         slug: { type: string }
         description: { type: string }
+        iconUrl: { type: string, format: uri }
+        category: { type: string }
+        tags: { type: array, items: { type: string } }
         launchUrl: { type: string, format: uri }
+        providerId: { type: string }
+        providerType: { $ref: "#/components/schemas/IdentityApplicationProviderType" }
+        portalVisible: { type: boolean }
+        featured: { type: boolean }
+        sortOrder: { type: integer }
         status: { $ref: "#/components/schemas/IdentityResourceStatus" }
+        metadata: { type: object, additionalProperties: true }
+        assignments:
+          type: array
+          items: { $ref: "#/components/schemas/IdentityApplicationAssignment" }
+        favorite: { type: boolean }
+        lastLaunchedAt: { type: string, format: date-time }
+        createdBy: { type: string }
+        updatedBy: { type: string }
         createdAt: { type: string, format: date-time }
         updatedAt: { type: string, format: date-time }
       additionalProperties: false
@@ -13970,8 +15425,20 @@ components:
         name: { type: string, minLength: 1, maxLength: 200 }
         slug: { type: string, pattern: "^[a-z0-9][a-z0-9-]*$" }
         description: { type: string, maxLength: 2000 }
+        iconUrl: { type: string, format: uri }
+        category: { type: string }
+        tags: { type: array, items: { type: string } }
         launchUrl: { type: string, format: uri }
+        providerId: { type: string }
+        providerType: { $ref: "#/components/schemas/IdentityApplicationProviderType" }
+        portalVisible: { type: boolean }
+        featured: { type: boolean }
+        sortOrder: { type: integer }
         status: { $ref: "#/components/schemas/IdentityResourceStatus" }
+        metadata: { type: object, additionalProperties: true }
+        assignments:
+          type: array
+          items: { $ref: "#/components/schemas/IdentityApplicationAssignmentInput" }
       additionalProperties: false
     IdentityApplicationEnvelope:
       type: object
@@ -13985,6 +15452,125 @@ components:
       properties:
         items: { type: array, items: { $ref: "#/components/schemas/IdentityApplication" } }
       additionalProperties: false
+    IdentityApplicationLaunch:
+      type: object
+      required: [id, applicationId, userId, providerType, result, createdAt]
+      properties:
+        id: { type: string }
+        applicationId: { type: string }
+        applicationName: { type: string }
+        userId: { type: string }
+        providerId: { type: string }
+        providerType: { $ref: "#/components/schemas/IdentityApplicationProviderType" }
+        result: { type: string }
+        reason: { type: string }
+        launchUrl: { type: string, format: uri-reference }
+        sourceIp: { type: string }
+        userAgent: { type: string }
+        createdAt: { type: string, format: date-time }
+      additionalProperties: false
+    IdentityApplicationLaunchListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items: { type: array, items: { $ref: "#/components/schemas/IdentityApplicationLaunch" } }
+      additionalProperties: false
+    PortalSecuritySummary:
+      type: object
+      required: [principal, mfaEnabled, linkedSources, activeSession]
+      properties:
+        principal: { $ref: "#/components/schemas/Principal" }
+        mfaEnabled: { type: boolean }
+        linkedSources: { type: array, items: { type: string } }
+        activeSession: { type: integer, minimum: 0 }
+        recentLoginAt: { type: string, format: date-time }
+      additionalProperties: false
+    PortalSecuritySummaryEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/PortalSecuritySummary" }
+      additionalProperties: false
+    PortalBootstrap:
+      type: object
+      required: [principal, applications, favorites, recent, categories, security]
+      properties:
+        principal: { $ref: "#/components/schemas/Principal" }
+        applications: { type: array, items: { $ref: "#/components/schemas/IdentityApplication" } }
+        favorites: { type: array, items: { $ref: "#/components/schemas/IdentityApplication" } }
+        recent: { type: array, items: { $ref: "#/components/schemas/IdentityApplicationLaunch" } }
+        categories: { type: array, items: { type: string } }
+        security: { $ref: "#/components/schemas/PortalSecuritySummary" }
+      additionalProperties: false
+    PortalBootstrapEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/PortalBootstrap" }
+      additionalProperties: false
+    PortalApplicationListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items: { type: array, items: { $ref: "#/components/schemas/IdentityApplication" } }
+      additionalProperties: false
+    PortalLaunchRequest:
+      type: object
+      properties:
+        surface: { type: string, enum: [web, desktop] }
+      additionalProperties: false
+    PortalLaunchDecision:
+      type: object
+      required: [application, launchUrl, providerType, decision]
+      properties:
+        application: { $ref: "#/components/schemas/IdentityApplication" }
+        launchUrl: { type: string, format: uri-reference }
+        providerType: { $ref: "#/components/schemas/IdentityApplicationProviderType" }
+        decision: { type: string, enum: [allow] }
+        handoffExpiresAt: { type: string, format: date-time }
+      additionalProperties: false
+    PortalLaunchDecisionEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/PortalLaunchDecision" }
+      additionalProperties: false
+    BrowserHandoffApplication:
+      type: object
+      required: [id, name]
+      properties:
+        id: { type: string }
+        name: { type: string }
+        iconUrl: { type: string, format: uri }
+      additionalProperties: false
+    BrowserHandoff:
+      type: object
+      required: [application, accountName, status, expiresAt]
+      properties:
+        application: { $ref: "#/components/schemas/BrowserHandoffApplication" }
+        accountName: { type: string }
+        status: { type: string, enum: [pending] }
+        expiresAt: { type: string, format: date-time }
+      additionalProperties: false
+    BrowserHandoffEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/BrowserHandoff" }
+      additionalProperties: false
+    BrowserHandoffCompletion:
+      type: object
+      required: [status, destinationUrl]
+      properties:
+        status: { type: string, enum: [completed] }
+        destinationUrl: { type: string, format: uri-reference }
+      additionalProperties: false
+    BrowserHandoffCompletionEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/BrowserHandoffCompletion" }
+      additionalProperties: false
     IdentityProviderType:
       type: string
       enum: [oidc, proxy, saml]
@@ -14021,6 +15607,9 @@ components:
         providerId: { type: string }
         clientId: { type: string }
         clientType: { type: string, enum: [public, confidential] }
+        clientSecretAvailable:
+          type: boolean
+          description: True when the confidential client secret can be revealed by an authorized administrator.
         redirectUris:
           type: array
           description: Strict-match absolute HTTP or HTTPS redirect URIs. HTTPS is recommended for production deployments.
@@ -14052,10 +15641,11 @@ components:
     OIDCClientInput:
       allOf:
         - type: object
-          required: [clientId]
           properties:
             providerId: { type: string }
-            clientId: { type: string }
+            clientId:
+              type: string
+              description: On create, an omitted or blank value is generated by the server. On update, it preserves the current Client ID.
             clientType: { type: string, enum: [public, confidential] }
             clientSecret: { type: string, minLength: 16, writeOnly: true }
             redirectUris:
@@ -14099,7 +15689,9 @@ components:
       required: [client]
       properties:
         client: { $ref: "#/components/schemas/OIDCClient" }
-        clientSecret: { type: string, writeOnly: true }
+        clientSecret:
+          type: string
+          description: Generated or supplied client secret returned after creation. The same value can later be retrieved through the reveal action.
       additionalProperties: false
     OIDCClientCreatedEnvelope:
       type: object
@@ -14119,6 +15711,20 @@ components:
       properties:
         items: { type: array, items: { $ref: "#/components/schemas/OIDCClient" } }
       additionalProperties: false
+    OIDCClientSecretReveal:
+      type: object
+      required: [clientId, clientSecret, revealedAt]
+      properties:
+        clientId: { type: string }
+        clientSecret: { type: string }
+        revealedAt: { type: string, format: date-time }
+      additionalProperties: false
+    OIDCClientSecretRevealEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/OIDCClientSecretReveal" }
+      additionalProperties: false
     SAMLServiceProvider:
       type: object
       required: [entityId, acsUrls, nameIdFormat, wantAuthnRequestsSigned, wantAssertionsSigned, attributeMappings]
@@ -14700,7 +16306,7 @@ components:
       additionalProperties: false
     SystemIntegrationCategory:
       type: string
-      enum: [identity, source_control, project_management, configuration, ci_cd, code_quality, api_gateway, monitoring, messaging, ai, cloud, other]
+      enum: [identity, source_control, project_management, configuration, ci_cd, code_quality, api_gateway, monitoring, messaging, ai, cloud, storage, other]
       x-enum-varnames:
         - SystemIntegrationCategoryIdentity
         - SystemIntegrationCategorySourceControl
@@ -14713,13 +16319,15 @@ components:
         - SystemIntegrationCategoryMessaging
         - SystemIntegrationCategoryAI
         - SystemIntegrationCategoryCloud
+        - SystemIntegrationCategoryStorage
         - SystemIntegrationCategoryOther
     SystemIntegrationHealthStatus:
       type: string
-      enum: [unknown, healthy, unhealthy]
+      enum: [unknown, healthy, degraded, unhealthy]
       x-enum-varnames:
         - SystemIntegrationHealthStatusUnknown
         - SystemIntegrationHealthStatusHealthy
+        - SystemIntegrationHealthStatusDegraded
         - SystemIntegrationHealthStatusUnhealthy
     SystemIntegrationTestStatus:
       type: string
@@ -14778,7 +16386,7 @@ components:
           type: string
           pattern: "^[a-z][a-z0-9._-]*$"
           maxLength: 128
-          description: Extensible provider key such as gitlab, github, gitea, or zadig.
+          description: Extensible provider key such as gitlab, github, gitea, zadig, or s3.
         name:
           type: string
           minLength: 1
@@ -15760,6 +17368,7 @@ components:
     ScopeGrantEffect:
       type: string
       enum: [allow, deny]
+      x-enum-varnames: [Allow, Deny]
     ScopeGrant:
       type: object
       required: [id, subjectType, subjectId, businessLineId, scopeType, role, effect, enabled, createdAt, updatedAt]
@@ -15805,12 +17414,27 @@ components:
     ScopeGrantInput:
       type: object
       required: [subjectType, subjectId, role, enabled]
+      if:
+        properties:
+          scopeType:
+            enum: [legacy, delivery]
+      then:
+        required: [businessLineId]
+      else:
+        if:
+          properties:
+            scopeType:
+              const: platform
+          required: [scopeType]
+        then:
+          required: [clusterIds]
       properties:
         id: { type: string, minLength: 1 }
         subjectType: { $ref: "#/components/schemas/ScopeGrantSubjectType" }
         subjectId: { type: string, minLength: 1 }
         businessLineId:
           type: string
+          minLength: 1
           description: Required when scopeType is legacy or delivery.
         environmentIds:
           type: array
@@ -18415,7 +20039,7 @@ components:
       properties:
         url:
           type: string
-          pattern: "^data:image/(jpeg|png|x-icon|webp);base64,"
+          pattern: "^data:image/(jpeg|png|svg\\+xml|x-icon|webp);base64,"
       additionalProperties: false
     BrandingAssetUploadEnvelope:
       type: object
@@ -20123,6 +21747,12 @@ components:
           type: string
         phone:
           type: string
+        avatarUrl:
+          type: string
+          maxLength: 700000
+        avatarFit:
+          type: string
+          enum: [cover, contain, fill]
         status:
           type: string
         roles:
@@ -20155,6 +21785,43 @@ components:
           type: string
           format: date-time
       additionalProperties: true
+    UpdateProfileRequest:
+      type: object
+      required: [displayName, email]
+      properties:
+        displayName:
+          type: string
+        email:
+          type: string
+          format: email
+        phone:
+          type: string
+        avatarUrl:
+          type: string
+          maxLength: 700000
+        avatarFit:
+          type: string
+          enum: [cover, contain, fill]
+      additionalProperties: false
+    ChangePasswordRequest:
+      type: object
+      required: [currentPassword, newPassword]
+      properties:
+        currentPassword:
+          type: string
+          minLength: 1
+        newPassword:
+          type: string
+          minLength: 8
+      additionalProperties: false
+    PasswordChangeResult:
+      type: object
+      required: [status]
+      properties:
+        status:
+          type: string
+          const: ok
+      additionalProperties: false
     TokenSet:
       type: object
       required: [accessToken, refreshToken, tokenType, expiresIn, expiresAt]
@@ -20236,6 +21903,67 @@ components:
         code:
           type: string
       additionalProperties: false
+    DesktopAuthAttemptCreateRequest:
+      type: object
+      required: [providerId, redirectUri, codeChallenge, codeChallengeMethod]
+      properties:
+        providerId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        redirectUri:
+          type: string
+          format: uri
+          minLength: 1
+          maxLength: 2048
+          pattern: '^http://127\.0\.0\.1:(?:(?:10(?:2[4-9]|[3-9][0-9])|1[1-9][0-9]{2}|[2-9][0-9]{3})|(?:[1-5][0-9]{4})|(?:6[0-4][0-9]{3})|(?:65[0-4][0-9]{2})|(?:655[0-2][0-9])|(?:6553[0-5]))/callback/[A-Za-z0-9_-]{16,128}$'
+        codeChallenge:
+          type: string
+          minLength: 43
+          maxLength: 43
+          pattern: "^[A-Za-z0-9_-]{43}$"
+        codeChallengeMethod:
+          type: string
+          enum: [S256]
+      additionalProperties: false
+    DesktopAuthAttempt:
+      type: object
+      required: [attemptId, authorizationUrl, expiresAt]
+      properties:
+        attemptId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        authorizationUrl:
+          type: string
+          format: uri
+          minLength: 1
+          maxLength: 2048
+        expiresAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    DesktopAuthAttemptEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/DesktopAuthAttempt"
+      additionalProperties: false
+    DesktopAuthAttemptExchangeRequest:
+      type: object
+      required: [code, codeVerifier]
+      properties:
+        code:
+          type: string
+          minLength: 1
+          maxLength: 512
+        codeVerifier:
+          type: string
+          minLength: 43
+          maxLength: 128
+          pattern: "^[A-Za-z0-9._~-]+$"
+      additionalProperties: false
     StreamTicketRequest:
       type: object
       required: [path]
@@ -20549,11 +22277,44 @@ components:
         config:
           $ref: "#/components/schemas/BuildSourceConfig"
       additionalProperties: false
+    BuildRepositoryBinding:
+      type: object
+      required: [repositoryId]
+      properties:
+        repositoryId:
+          type: string
+        checkoutPath:
+          type: string
+        defaultBranch:
+          type: string
+        allowCommitSelection:
+          type: boolean
+          default: false
+        submodules:
+          type: boolean
+          default: false
+      additionalProperties: false
+    BuildRepositoryRefInput:
+      type: object
+      required: [repositoryId, refType, refName]
+      properties:
+        repositoryId:
+          type: string
+        refType:
+          type: string
+          enum: [branch, tag, commit]
+        refName:
+          type: string
+      additionalProperties: false
     BuildSourceConfig:
       type: object
       properties:
         repositoryId:
           type: string
+        repositoryBindings:
+          type: array
+          items:
+            $ref: "#/components/schemas/BuildRepositoryBinding"
         dockerfilePath:
           type: string
         contextDir:
@@ -21134,6 +22895,21 @@ components:
         enabled:
           type: boolean
       additionalProperties: false
+    ApplicationWorkflowInput:
+      type: object
+      required: [name, definition, enabled]
+      properties:
+        name:
+          type: string
+          minLength: 1
+        description:
+          type: string
+        definition:
+          type: object
+          additionalProperties: true
+        enabled:
+          type: boolean
+      additionalProperties: false
     ApplicationEnvironment:
       type: object
       required: [id, applicationId, environmentId, createdAt, updatedAt]
@@ -21150,6 +22926,14 @@ components:
           type: string
         environmentKey:
           type: string
+        alias:
+          type: string
+        clusterId:
+          type: string
+        namespace:
+          type: string
+        registryId:
+          type: string
         strategyProfileId:
           type: string
         promotionPolicyId:
@@ -21187,6 +22971,14 @@ components:
           type: string
         environmentId:
           type: string
+        alias:
+          type: string
+        clusterId:
+          type: string
+        namespace:
+          type: string
+        registryId:
+          type: string
         strategyProfileId:
           type: string
         promotionPolicyId:
@@ -21912,6 +23704,9 @@ components:
           type: string
         requiresApproval:
           type: boolean
+        status:
+          type: string
+          enum: [available, unavailable]
         resourceSelector:
           $ref: "#/components/schemas/ResourceSelector"
         targets:
@@ -21982,6 +23777,10 @@ components:
           type: string
         refName:
           type: string
+        repositoryRefs:
+          type: array
+          items:
+            $ref: "#/components/schemas/BuildRepositoryRefInput"
         imageTag:
           type: string
         releaseName:
@@ -22030,6 +23829,96 @@ components:
         relatedIds:
           $ref: "#/components/schemas/ApplicationDeliveryActionRelatedIDs"
       additionalProperties: false
+    ManifestPackageRenderer:
+      type: string
+      enum: [raw_yaml, kustomize]
+      x-enum-varnames: [ManifestPackageRendererRawYAML, ManifestPackageRendererKustomize]
+    ManifestPackageStatus:
+      type: string
+      enum: [draft, published]
+      x-enum-varnames: [ManifestPackageStatusDraft, ManifestPackageStatusPublished]
+    ManifestPackageBinding:
+      type: object
+      required: [applicationEnvironmentId, environmentKey, clusterId, namespace]
+      properties:
+        id: { type: string }
+        applicationEnvironmentId: { type: string, minLength: 1 }
+        environmentKey: { type: string, minLength: 1 }
+        clusterId: { type: string, minLength: 1 }
+        namespace: { type: string, minLength: 1 }
+        overlay:
+          type: object
+          additionalProperties: { type: string }
+        status: { type: string }
+      additionalProperties: false
+    ManifestPackage:
+      type: object
+      required: [id, name, applicationId, renderer, status, currentRevision, files, bindings, createdAt, updatedAt]
+      properties:
+        id: { type: string, minLength: 1 }
+        name: { type: string, minLength: 1 }
+        description: { type: string }
+        applicationId: { type: string, minLength: 1 }
+        serviceId:
+          type: string
+          nullable: true
+        businessLineId: { type: string }
+        renderer: { $ref: "#/components/schemas/ManifestPackageRenderer" }
+        status: { $ref: "#/components/schemas/ManifestPackageStatus" }
+        currentRevision: { type: integer, minimum: 0 }
+        files:
+          type: array
+          items: { $ref: "#/components/schemas/ManifestFile" }
+        bindings:
+          type: array
+          items: { $ref: "#/components/schemas/ManifestPackageBinding" }
+        createdBy: { type: string }
+        updatedBy: { type: string }
+        createdAt: { type: string, format: date-time }
+        updatedAt: { type: string, format: date-time }
+      additionalProperties: false
+    ManifestPackageInput:
+      type: object
+      required: [name, applicationId, renderer, files, bindings]
+      properties:
+        name: { type: string, minLength: 1 }
+        description: { type: string }
+        applicationId: { type: string, minLength: 1 }
+        serviceId:
+          type: string
+          nullable: true
+        businessLineId: { type: string }
+        renderer: { $ref: "#/components/schemas/ManifestPackageRenderer" }
+        files:
+          type: array
+          items: { $ref: "#/components/schemas/ManifestFile" }
+        bindings:
+          type: array
+          items: { $ref: "#/components/schemas/ManifestPackageBinding" }
+      additionalProperties: false
+    ManifestPackagePage:
+      type: object
+      required: [items, total, page, pageSize]
+      properties:
+        items:
+          type: array
+          items: { $ref: "#/components/schemas/ManifestPackage" }
+        total: { type: integer, minimum: 0 }
+        page: { type: integer, minimum: 0 }
+        pageSize: { type: integer, minimum: 0 }
+      additionalProperties: false
+    ManifestPackageEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/ManifestPackage" }
+      additionalProperties: false
+    ManifestPackagePageEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/ManifestPackagePage" }
+      additionalProperties: false
     ManifestSourceMode:
       type: string
       enum: [soha_managed, git_synced]
@@ -23129,6 +25018,15 @@ components:
           items:
             $ref: "#/components/schemas/ApplicationEnvironment"
       additionalProperties: false
+    DeliveryEnvironmentListEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          type: array
+          items:
+            $ref: "#/components/schemas/DeliveryEnvironment"
+      additionalProperties: false
     BuildTemplateEnvelope:
       type: object
       required: [data]
@@ -29498,6 +31396,192 @@ components:
             pattern: "^[a-z][a-z0-9._-]*$"
             maxLength: 128
       additionalProperties: false
+    AlertRuleType:
+      type: string
+      enum: [metrics, logs, traces, external_passthrough]
+      x-enum-varnames:
+        - AlertRuleTypeMetrics
+        - AlertRuleTypeLogs
+        - AlertRuleTypeTraces
+        - AlertRuleTypeExternalPassthrough
+    AlertRuleStringMap:
+      type: object
+      additionalProperties:
+        type: string
+    AlertRuleInput:
+      type: object
+      required: [name, ruleType]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+          minLength: 1
+        ruleType:
+          $ref: "#/components/schemas/AlertRuleType"
+        datasourceSelector:
+          $ref: "#/components/schemas/GenericObject"
+        querySpec:
+          $ref: "#/components/schemas/GenericObject"
+        thresholdSpec:
+          $ref: "#/components/schemas/GenericObject"
+        forSeconds:
+          type: integer
+        groupBy:
+          type: array
+          items:
+            type: string
+        labels:
+          $ref: "#/components/schemas/AlertRuleStringMap"
+        annotations:
+          $ref: "#/components/schemas/AlertRuleStringMap"
+        notificationPolicyId:
+          type: string
+        healingPolicyIds:
+          type: array
+          items:
+            type: string
+        enabled:
+          type: boolean
+      additionalProperties: false
+    AlertRule:
+      type: object
+      required: [id, name, ruleType, forSeconds, enabled, createdAt, updatedAt]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        ruleType:
+          $ref: "#/components/schemas/AlertRuleType"
+        datasourceSelector:
+          $ref: "#/components/schemas/GenericObject"
+        querySpec:
+          $ref: "#/components/schemas/GenericObject"
+        thresholdSpec:
+          $ref: "#/components/schemas/GenericObject"
+        forSeconds:
+          type: integer
+        groupBy:
+          type: array
+          items:
+            type: string
+        labels:
+          $ref: "#/components/schemas/AlertRuleStringMap"
+        annotations:
+          $ref: "#/components/schemas/AlertRuleStringMap"
+        notificationPolicyId:
+          type: string
+        healingPolicyIds:
+          type: array
+          items:
+            type: string
+        enabled:
+          type: boolean
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    AlertRuleEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/AlertRule"
+      additionalProperties: false
+    AlertRuleListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/AlertRule"
+      additionalProperties: false
+    AlertRuleTestResult:
+      type: object
+      required: [matched, executedAt]
+      properties:
+        ruleId:
+          type: string
+        ruleType:
+          $ref: "#/components/schemas/AlertRuleType"
+        state:
+          type: string
+        summary:
+          type: string
+        matched:
+          type: boolean
+        samples:
+          type: array
+          items:
+            $ref: "#/components/schemas/GenericObject"
+        dataSources:
+          type: array
+          items:
+            type: string
+        errors:
+          type: array
+          items:
+            type: string
+        querySnapshot:
+          $ref: "#/components/schemas/ObservabilityQuerySnapshot"
+        notificationPreview:
+          type: array
+          items:
+            $ref: "#/components/schemas/GenericObject"
+        executedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    AlertRuleTestResultEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/AlertRuleTestResult"
+      additionalProperties: false
+    AlertRuleRun:
+      type: object
+      required: [id, ruleId, status, matched, durationMs, createdAt, updatedAt]
+      properties:
+        id:
+          type: string
+        ruleId:
+          type: string
+        status:
+          type: string
+        summary:
+          type: string
+        matched:
+          type: boolean
+        durationMs:
+          type: integer
+        error:
+          type: string
+        result:
+          $ref: "#/components/schemas/GenericObject"
+        querySnapshot:
+          $ref: "#/components/schemas/ObservabilityQuerySnapshot"
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    AlertRuleRunListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/AlertRuleRun"
+      additionalProperties: false
     ObservabilityDataSource:
       type: object
       required: [id, name, backendType, enabled, scope, queryBudget, redactionPolicy, config, credentialKeys, validationStatus, createdAt, updatedAt]
@@ -29836,6 +31920,11 @@ components:
       properties:
         sourceMode:
           $ref: "#/components/schemas/LogSourceMode"
+        dataSourceId:
+          type: string
+          minLength: 1
+          maxLength: 200
+          description: Optional Soha-managed durable log data source. Existing permission and scope checks still apply.
         selector:
           $ref: "#/components/schemas/LogSourceSelector"
         from:
@@ -33307,6 +35396,18 @@ components:
         category:
           type: string
           maxLength: 50
+        tenantId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        workspaceId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        visibility:
+          $ref: "#/components/schemas/SoftwarePackageVisibility"
+        status:
+          $ref: "#/components/schemas/SoftwarePackageStatus"
         version:
           type: string
           minLength: 1
@@ -33332,6 +35433,14 @@ components:
         downloadPath:
           type: string
           pattern: "^/api/v1/software/packages/[^/]+/download$"
+        downloadCount:
+          type: integer
+          format: int64
+          minimum: 0
+        storageIntegrationId:
+          type: string
+          minLength: 1
+          maxLength: 128
         createdAt:
           type: string
           format: date-time
@@ -33339,6 +35448,41 @@ components:
           type: string
           format: date-time
       additionalProperties: false
+    SoftwarePackageDownloadRecord:
+      type: object
+      required: [id, actorId, downloadedAt, durationMs]
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 128
+        actorId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        actorName:
+          type: string
+          maxLength: 200
+        downloadedAt:
+          type: string
+          format: date-time
+        durationMs:
+          type: integer
+          format: int64
+          minimum: 0
+        sourceIp:
+          type: string
+          maxLength: 64
+      additionalProperties: false
+    SoftwarePackageDownloadRecordListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/SoftwarePackageDownloadRecord"
+      additionalProperties: false
     SoftwarePackageEnvelope:
       type: object
       required: [data]
@@ -33378,6 +35522,16 @@ components:
         category:
           type: string
           maxLength: 50
+        tenantId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        workspaceId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        visibility:
+          $ref: "#/components/schemas/SoftwarePackageVisibility"
         version:
           type: string
           minLength: 1
@@ -33388,6 +35542,10 @@ components:
         arch:
           type: string
           pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        storageIntegrationId:
+          type: string
+          minLength: 1
+          maxLength: 128
         file:
           type: string
           format: binary
@@ -33413,6 +35571,16 @@ components:
         category:
           type: string
           maxLength: 50
+        tenantId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        workspaceId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        visibility:
+          $ref: "#/components/schemas/SoftwarePackageVisibility"
         version:
           type: string
           minLength: 1
@@ -33423,6 +35591,10 @@ components:
         arch:
           type: string
           pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        storageIntegrationId:
+          type: string
+          minLength: 1
+          maxLength: 128
         url:
           type: string
           format: uri
@@ -33433,6 +35605,20 @@ components:
           minLength: 1
           maxLength: 255
       additionalProperties: false
+    SoftwarePackageVisibility:
+      type: string
+      enum: [workspace, tenant, restricted]
+      x-enum-varnames:
+        - SoftwarePackageVisibilityWorkspace
+        - SoftwarePackageVisibilityTenant
+        - SoftwarePackageVisibilityRestricted
+    SoftwarePackageStatus:
+      type: string
+      enum: [ready, quarantined, deleted]
+      x-enum-varnames:
+        - SoftwarePackageStatusReady
+        - SoftwarePackageStatusQuarantined
+        - SoftwarePackageStatusDeleted
     SoftwareStorage:
       type: object
       required: [backend, objectCount, totalBytes, items]
@@ -33441,6 +35627,30 @@ components:
           type: string
           minLength: 1
           maxLength: 64
+        integrationId:
+          type: string
+          minLength: 1
+          maxLength: 128
+        providerType:
+          type: string
+          minLength: 1
+          maxLength: 128
+        endpoint:
+          type: string
+          format: uri
+          maxLength: 2048
+        bucket:
+          type: string
+          minLength: 1
+          maxLength: 255
+        region:
+          type: string
+          maxLength: 128
+        healthStatus:
+          $ref: "#/components/schemas/SystemIntegrationHealthStatus"
+        lastCheckedAt:
+          type: string
+          format: date-time
         objectCount:
           type: integer
           format: int64