@opensoha/contracts 0.1.5 → 0.1.7

package/openapi/soha-api.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.5
+  version: 0.1.7
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -34,6 +34,8 @@ tags:
   - name: Compute
   - name: MCP
   - name: Plugins
+  - name: Software
+  - name: Access
   - name: Identity
   - name: Directory
 paths:
@@ -1303,6 +1305,93 @@ paths:
                 $ref: "#/components/schemas/ApplicationEnvironmentEnvelope"
         "400":
           $ref: "#/components/responses/Error"
+  /application-environments/target-candidates:
+    get:
+      tags: [Delivery]
+      operationId: listApplicationEnvironmentTargetCandidates
+      parameters:
+        - name: clusterId
+          in: query
+          required: true
+          schema:
+            type: string
+            minLength: 1
+        - name: namespace
+          in: query
+          required: true
+          schema:
+            type: string
+            minLength: 1
+        - name: search
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 200
+            default: 100
+      responses:
+        "200":
+          description: Discoverable Kubernetes workloads and their related resources.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesImportCandidateListEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /application-environments/imports:
+    post:
+      tags: [Delivery]
+      operationId: importKubernetesServices
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesServiceImportRequest"
+      responses:
+        "200":
+          description: Idempotent Kubernetes service import result.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesServiceImportResultEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+  /application-environments/helm-release-imports:
+    post:
+      tags: [Delivery]
+      operationId: importHelmReleases
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/HelmReleaseImportRequest"
+      responses:
+        "200":
+          description: Idempotent Helm release import result.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/HelmReleaseImportResultEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
   /application-environments/{applicationEnvironmentID}:
     get:
       tags: [Delivery]
@@ -1369,6 +1458,88 @@ paths:
                 $ref: "#/components/schemas/ApplicationEnvironmentDeliveryDetailEnvelope"
         "404":
           $ref: "#/components/responses/Error"
+  /registries:
+    get:
+      tags: [Delivery]
+      operationId: listRegistryConnections
+      parameters:
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 200
+      responses:
+        "200":
+          description: Registry connections visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RegistryConnectionListEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+    post:
+      tags: [Delivery]
+      operationId: createRegistryConnection
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RegistryConnectionInput"
+      responses:
+        "201":
+          description: Created registry connection.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RegistryConnectionEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /registries/{connectionID}:
+    put:
+      tags: [Delivery]
+      operationId: updateRegistryConnection
+      parameters:
+        - $ref: "#/components/parameters/RegistryConnectionID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RegistryConnectionInput"
+      responses:
+        "200":
+          description: Updated registry connection.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RegistryConnectionEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+    delete:
+      tags: [Delivery]
+      operationId: deleteRegistryConnection
+      parameters:
+        - $ref: "#/components/parameters/RegistryConnectionID"
+      responses:
+        "200":
+          description: Deleted registry connection.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OperationStatus"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /build-templates:
     get:
       tags: [Delivery]
@@ -2737,6 +2908,66 @@ paths:
                 $ref: "#/components/schemas/ClusterCapabilityMatrixEnvelope"
         "403":
           $ref: "#/components/responses/Error"
+  /clusters/{clusterID}/agent-installation:
+    post:
+      tags: [Platform]
+      operationId: createClusterAgentInstallation
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+      responses:
+        "200":
+          description: Short-lived Kubernetes manifest URL and kubectl command for installing the cluster Agent.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AgentInstallationEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+  /kubernetes/agent-installations/{installTicket}/manifest.yaml:
+    get:
+      tags: [Platform]
+      operationId: downloadKubernetesAgentInstallationManifest
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/AgentInstallTicket"
+      responses:
+        "200":
+          description: Complete Kubernetes Agent installation manifest. The download URL is short-lived.
+          content:
+            application/yaml:
+              schema:
+                type: string
+        "404":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
+  /agent-sessions/connect:
+    get:
+      tags: [Platform]
+      operationId: connectClusterAgentSession
+      description: >
+        Upgrades to the soha-agent-tunnel.v1 WebSocket subprotocol. The Agent
+        initiates this connection and carries multiplexed HTTP and stream traffic
+        over the resulting session.
+      security:
+        - agentBearerAuth: []
+      parameters:
+        - $ref: "#/components/parameters/ClusterIDQuery"
+      responses:
+        "101":
+          description: WebSocket session established.
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
   /clusters/{clusterID}/logs/query:
     post:
       tags: [Platform]
@@ -3020,120 +3251,230 @@ paths:
                 $ref: "#/components/schemas/ObservabilityProviderListEnvelope"
         "403":
           $ref: "#/components/responses/Error"
-  /observability/metrics/query:
-    post:
+  /observability/dashboards:
+    get:
       tags: [Observability]
-      operationId: queryObservabilityMetrics
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/ObservabilityMetricQueryInput"
+      operationId: listObservabilityDashboards
       responses:
         "200":
-          description: Normalized metric series from an authorized configured provider.
+          description: Dashboards visible to the current principal.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ObservabilityMetricQueryEnvelope"
-        "400":
-          $ref: "#/components/responses/Error"
+                $ref: "#/components/schemas/ObservabilityDashboardListEnvelope"
         "403":
           $ref: "#/components/responses/Error"
-        "404":
-          $ref: "#/components/responses/Error"
-        "503":
+  /observability/metrics/data-sources:
+    get:
+      tags: [Observability]
+      operationId: listObservabilityMetricDataSources
+      responses:
+        "200":
+          description: Enabled Prometheus data sources available for metric dashboards.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityMetricDataSourceListEnvelope"
+        "403":
           $ref: "#/components/responses/Error"
-  /observability/traces/query:
+  /observability/dashboards/imports:
     post:
       tags: [Observability]
-      operationId: queryObservabilityTraces
+      operationId: importGrafanaDashboard
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: "#/components/schemas/ObservabilityTraceQueryInput"
+              $ref: "#/components/schemas/ObservabilityGrafanaDashboardImportInput"
       responses:
-        "200":
-          description: Normalized trace spans from an authorized configured provider.
+        "201":
+          description: Imported native dashboard and explicit compatibility warnings.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ObservabilityTraceQueryEnvelope"
+                $ref: "#/components/schemas/ObservabilityDashboardImportResultEnvelope"
         "400":
           $ref: "#/components/responses/Error"
         "403":
           $ref: "#/components/responses/Error"
         "404":
           $ref: "#/components/responses/Error"
-        "503":
-          $ref: "#/components/responses/Error"
-  /observability/data-sources:
+  /observability/dashboards/{dashboardID}:
     get:
       tags: [Observability]
-      operationId: listObservabilityDataSources
+      operationId: getObservabilityDashboard
+      parameters:
+        - $ref: "#/components/parameters/DashboardID"
       responses:
         "200":
-          description: Permission-filtered log data sources with credentials redacted.
+          description: Dashboard detail including normalized panels and targets.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ObservabilityDataSourceListEnvelope"
+                $ref: "#/components/schemas/ObservabilityDashboardEnvelope"
         "403":
           $ref: "#/components/responses/Error"
-    post:
+        "404":
+          $ref: "#/components/responses/Error"
+    delete:
       tags: [Observability]
-      operationId: createObservabilityDataSource
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/ObservabilityDataSourceInput"
+      operationId: deleteObservabilityDashboard
+      parameters:
+        - $ref: "#/components/parameters/DashboardID"
       responses:
-        "201":
-          description: Log data source created with credentials redacted.
+        "200":
+          description: Dashboard deleted.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ObservabilityDataSourceEnvelope"
-        "400":
-          $ref: "#/components/responses/Error"
+                $ref: "#/components/schemas/OperationStatus"
         "403":
           $ref: "#/components/responses/Error"
-  /observability/data-sources/{dataSourceID}:
-    put:
+        "404":
+          $ref: "#/components/responses/Error"
+  /observability/dashboards/{dashboardID}/panels/{panelID}/query:
+    post:
       tags: [Observability]
-      operationId: updateObservabilityDataSource
+      operationId: queryObservabilityDashboardPanel
       parameters:
-        - $ref: "#/components/parameters/DataSourceID"
+        - $ref: "#/components/parameters/DashboardID"
+        - $ref: "#/components/parameters/DashboardPanelID"
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: "#/components/schemas/ObservabilityDataSourceInput"
+              $ref: "#/components/schemas/ObservabilityDashboardPanelQueryInput"
       responses:
         "200":
-          description: Log data source updated with credentials redacted.
+          description: Normalized metric series for the persisted dashboard panel targets.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ObservabilityDataSourceEnvelope"
+                $ref: "#/components/schemas/ObservabilityMetricQueryEnvelope"
         "400":
           $ref: "#/components/responses/Error"
         "403":
           $ref: "#/components/responses/Error"
         "404":
           $ref: "#/components/responses/Error"
-  /observability/data-sources/{dataSourceID}/validate:
+        "503":
+          $ref: "#/components/responses/Error"
+  /observability/metrics/query:
     post:
       tags: [Observability]
-      operationId: validateObservabilityDataSource
-      parameters:
-        - $ref: "#/components/parameters/DataSourceID"
+      operationId: queryObservabilityMetrics
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ObservabilityMetricQueryInput"
+      responses:
+        "200":
+          description: Normalized metric series from an authorized configured provider.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityMetricQueryEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "503":
+          $ref: "#/components/responses/Error"
+  /observability/traces/query:
+    post:
+      tags: [Observability]
+      operationId: queryObservabilityTraces
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ObservabilityTraceQueryInput"
+      responses:
+        "200":
+          description: Normalized trace spans from an authorized configured provider.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityTraceQueryEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "503":
+          $ref: "#/components/responses/Error"
+  /observability/data-sources:
+    get:
+      tags: [Observability]
+      operationId: listObservabilityDataSources
+      responses:
+        "200":
+          description: Permission-filtered log data sources with credentials redacted.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityDataSourceListEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+    post:
+      tags: [Observability]
+      operationId: createObservabilityDataSource
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ObservabilityDataSourceInput"
+      responses:
+        "201":
+          description: Log data source created with credentials redacted.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityDataSourceEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /observability/data-sources/{dataSourceID}:
+    put:
+      tags: [Observability]
+      operationId: updateObservabilityDataSource
+      parameters:
+        - $ref: "#/components/parameters/DataSourceID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ObservabilityDataSourceInput"
+      responses:
+        "200":
+          description: Log data source updated with credentials redacted.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ObservabilityDataSourceEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+  /observability/data-sources/{dataSourceID}/validate:
+    post:
+      tags: [Observability]
+      operationId: validateObservabilityDataSource
+      parameters:
+        - $ref: "#/components/parameters/DataSourceID"
       responses:
         "200":
           description: Current data-source validation and backend health result.
@@ -6132,6 +6473,166 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/MarketplacePluginEnvelope"
+  /software/packages:
+    get:
+      tags: [Software]
+      operationId: listSoftwarePackages
+      parameters:
+        - name: platform
+          in: query
+          required: false
+          schema:
+            type: string
+            maxLength: 64
+        - name: arch
+          in: query
+          required: false
+          schema:
+            type: string
+            maxLength: 64
+        - name: cursor
+          in: query
+          required: false
+          schema:
+            type: string
+            maxLength: 256
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 200
+      responses:
+        "200":
+          description: Software packages visible to the current principal.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SoftwarePackageListEnvelope"
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+    post:
+      tags: [Software]
+      operationId: uploadSoftwarePackage
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: "#/components/schemas/SoftwarePackageUploadRequest"
+      responses:
+        "201":
+          description: Software package uploaded and published.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SoftwarePackageEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+        "413":
+          $ref: "#/components/responses/Error"
+  /software/packages/import:
+    post:
+      tags: [Software]
+      operationId: importSoftwarePackage
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SoftwarePackageURLImportRequest"
+      responses:
+        "201":
+          description: Software package downloaded from the source URL and published.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SoftwarePackageEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+        "413":
+          $ref: "#/components/responses/Error"
+  /software/storage:
+    get:
+      tags: [Software]
+      operationId: getSoftwareStorage
+      parameters:
+        - name: cursor
+          in: query
+          required: false
+          schema:
+            type: string
+            maxLength: 256
+        - name: limit
+          in: query
+          required: false
+          schema:
+            type: integer
+            minimum: 1
+            maximum: 200
+      responses:
+        "200":
+          description: Managed software storage summary and object records.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SoftwareStorageEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+  /software/packages/{packageID}:
+    delete:
+      tags: [Software]
+      operationId: deleteSoftwarePackage
+      parameters:
+        - $ref: "#/components/parameters/SoftwarePackageID"
+      responses:
+        "204":
+          description: Software package deleted.
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+  /software/packages/{packageID}/download:
+    get:
+      tags: [Software]
+      operationId: downloadSoftwarePackage
+      parameters:
+        - $ref: "#/components/parameters/SoftwarePackageID"
+      responses:
+        "200":
+          description: Software package binary.
+          content:
+            application/octet-stream:
+              schema:
+                type: string
+                format: binary
+        "401":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /plugins/installed:
     get:
       tags: [Plugins]
@@ -7420,31 +7921,117 @@ paths:
         "400": { $ref: "#/components/responses/Error" }
         "401": { $ref: "#/components/responses/Error" }
         "403": { $ref: "#/components/responses/Error" }
-  /identity/capabilities:
+  /access/permissions:
     get:
-      tags: [Identity]
-      operationId: getIdentityRuntimeCapabilities
+      tags: [Access]
+      operationId: getPermissionCatalog
       responses:
         "200":
-          description: Identity protocol and runtime capability truth.
+          description: Canonical permission definitions and compatibility metadata.
           content:
             application/json:
-              schema: { $ref: "#/components/schemas/IdentityRuntimeCapabilityEnvelope" }
-        "403": { $ref: "#/components/responses/IdentityError" }
-  /identity/applications:
+              schema: { $ref: "#/components/schemas/PermissionCatalogEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+  /access/roles:
     get:
-      tags: [Identity]
-      operationId: listIdentityApplications
+      tags: [Access]
+      operationId: listAccessRoles
       responses:
         "200":
-          description: Identity applications.
+          description: Access roles.
           content:
             application/json:
-              schema: { $ref: "#/components/schemas/IdentityApplicationListEnvelope" }
-        "403": { $ref: "#/components/responses/IdentityError" }
+              schema: { $ref: "#/components/schemas/AccessRoleListEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
     post:
-      tags: [Identity]
-      operationId: createIdentityApplication
+      tags: [Access]
+      operationId: createAccessRole
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/AccessRoleInput" }
+      responses:
+        "201":
+          description: Created access role.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/AccessRoleEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+  /access/roles/{accessRoleID}:
+    parameters:
+      - $ref: "#/components/parameters/AccessRoleID"
+    get:
+      tags: [Access]
+      operationId: getAccessRole
+      responses:
+        "200":
+          description: Access role detail.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/AccessRoleEnvelope" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Access]
+      operationId: updateAccessRole
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/AccessRoleInput" }
+      responses:
+        "200":
+          description: Updated access role.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/AccessRoleEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    delete:
+      tags: [Access]
+      operationId: deleteAccessRole
+      responses:
+        "200":
+          description: Access role deleted.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/AccessRoleDeleteResult" }
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+  /identity/capabilities:
+    get:
+      tags: [Identity]
+      operationId: getIdentityRuntimeCapabilities
+      responses:
+        "200":
+          description: Identity protocol and runtime capability truth.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/IdentityRuntimeCapabilityEnvelope" }
+        "403": { $ref: "#/components/responses/IdentityError" }
+  /identity/applications:
+    get:
+      tags: [Identity]
+      operationId: listIdentityApplications
+      responses:
+        "200":
+          description: Identity applications.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/IdentityApplicationListEnvelope" }
+        "403": { $ref: "#/components/responses/IdentityError" }
+    post:
+      tags: [Identity]
+      operationId: createIdentityApplication
       requestBody:
         required: true
         content:
@@ -8214,12 +8801,21 @@ components:
       type: http
       scheme: bearer
       description: Runtime execution runner token.
+    agentBearerAuth:
+      type: http
+      scheme: bearer
+      description: Per-cluster Agent session token provisioned through the installation manifest.
     sohaXAPIKey:
       type: apiKey
       in: header
       name: x-api-key
       description: Anthropic-style Soha PAT/SAT credential header for native relay endpoints.
   parameters:
+    AccessRoleID:
+      name: accessRoleID
+      in: path
+      required: true
+      schema: { type: string, minLength: 1, maxLength: 128 }
     IdentityApplicationID:
       name: identityApplicationID
       in: path
@@ -8329,6 +8925,21 @@ components:
       schema:
         type: string
         minLength: 1
+    ClusterIDQuery:
+      name: clusterId
+      in: query
+      required: true
+      schema:
+        type: string
+        minLength: 1
+    AgentInstallTicket:
+      name: installTicket
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 16
+        maxLength: 1024
     DataSourceID:
       name: dataSourceID
       in: path
@@ -8337,6 +8948,22 @@ components:
         type: string
         minLength: 1
         maxLength: 128
+    DashboardID:
+      name: dashboardID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+        maxLength: 128
+    DashboardPanelID:
+      name: panelID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+        maxLength: 128
     ComputeCursor:
       name: cursor
       in: query
@@ -8539,6 +9166,13 @@ components:
       required: true
       schema:
         type: string
+    RegistryConnectionID:
+      name: connectionID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
     BundleID:
       name: bundleID
       in: path
@@ -8625,6 +9259,14 @@ components:
         type: string
         minLength: 1
         maxLength: 128
+    SoftwarePackageID:
+      name: packageID
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+        maxLength: 128
     AIMemoryID:
       name: memoryID
       in: path
@@ -10425,6 +11067,166 @@ components:
           items:
             $ref: "#/components/schemas/AnyValue"
       additionalProperties: false
+    PermissionRiskLevel:
+      type: string
+      enum: [read, mutate, execute, high]
+      x-enum-varnames: [PermissionRiskLevelRead, PermissionRiskLevelMutate, PermissionRiskLevelExecute, PermissionRiskLevelHigh]
+    PermissionApprovalPolicy:
+      type: string
+      enum: [never, eligible, required]
+      x-enum-varnames: [PermissionApprovalPolicyNever, PermissionApprovalPolicyEligible, PermissionApprovalPolicyRequired]
+    PermissionStatus:
+      type: string
+      enum: [active, legacy]
+      x-enum-varnames: [PermissionStatusActive, PermissionStatusLegacy]
+    PermissionScopeKind:
+      type: string
+      enum: [tenant, workspace, cluster, namespace, project, resource, owner]
+      x-enum-varnames: [PermissionScopeKindTenant, PermissionScopeKindWorkspace, PermissionScopeKindCluster, PermissionScopeKindNamespace, PermissionScopeKindProject, PermissionScopeKindResource, PermissionScopeKindOwner]
+    PermissionDefinition:
+      type: object
+      required: [key, domain, resource, action, displayName, riskLevel, scopeKinds, approvalPolicy, status, assignable]
+      properties:
+        key: { type: string, pattern: "^[a-z][a-z0-9_-]*(?:\\.[a-z][a-z0-9_-]*)+$" }
+        domain: { type: string, pattern: "^[a-z][a-z0-9_-]*$" }
+        resource: { type: string, pattern: "^[a-z][a-z0-9_.-]*$" }
+        action: { type: string, pattern: "^[a-z][a-z0-9_-]*$" }
+        displayName: { type: string, minLength: 1 }
+        riskLevel: { $ref: "#/components/schemas/PermissionRiskLevel" }
+        scopeKinds:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items: { $ref: "#/components/schemas/PermissionScopeKind" }
+        approvalPolicy: { $ref: "#/components/schemas/PermissionApprovalPolicy" }
+        status: { $ref: "#/components/schemas/PermissionStatus" }
+        assignable: { type: boolean }
+        legacyAliases: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
+        legacyCapabilities:
+          type: array
+          uniqueItems: true
+          description: Migration-only role-global action aliases accepted by this exact permission.
+          items: { type: string, pattern: "^[a-z][a-z0-9_-]*$" }
+        replacedBy: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
+      additionalProperties: false
+    PermissionCatalog:
+      type: object
+      required: [schemaVersion, catalogVersion, contentHash, permissions]
+      properties:
+        schemaVersion: { type: string, const: authorization.opensoha.io/v1 }
+        catalogVersion: { type: string, pattern: "^[0-9]+\\.[0-9]+\\.[0-9]+$" }
+        contentHash: { type: string, pattern: "^sha256:[a-f0-9]{64}$" }
+        permissions:
+          type: array
+          minItems: 1
+          items: { $ref: "#/components/schemas/PermissionDefinition" }
+      additionalProperties: false
+    PermissionCatalogEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/PermissionCatalog" }
+      additionalProperties: false
+    AccessRole:
+      type: object
+      required: [id, name, scope, capabilities, permissionKeys, userCount]
+      properties:
+        id: { type: string, minLength: 1 }
+        name: { type: string, minLength: 1 }
+        scope: { type: string, minLength: 1 }
+        capabilities:
+          type: array
+          uniqueItems: true
+          deprecated: true
+          description: Legacy role-global action aliases retained only for migration.
+          items: { type: string, minLength: 1 }
+        permissionKeys:
+          type: array
+          uniqueItems: true
+          items: { type: string, minLength: 1 }
+        userCount: { type: integer, minimum: 0 }
+      additionalProperties: false
+    AccessRoleInput:
+      type: object
+      required: [name, scope, permissionKeys]
+      properties:
+        id: { type: string, minLength: 1 }
+        name: { type: string, minLength: 1 }
+        scope: { type: string, minLength: 1 }
+        capabilities:
+          type: array
+          uniqueItems: true
+          deprecated: true
+          description: Legacy role-global action aliases; new role editors must send an empty array.
+          items: { type: string, minLength: 1 }
+        permissionKeys:
+          type: array
+          uniqueItems: true
+          items: { type: string, minLength: 1 }
+      additionalProperties: false
+    AccessRoleEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data: { $ref: "#/components/schemas/AccessRole" }
+      additionalProperties: false
+    AccessRoleListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items: { type: array, items: { $ref: "#/components/schemas/AccessRole" } }
+      additionalProperties: false
+    AccessRoleDeleteResult:
+      type: object
+      required: [status]
+      properties:
+        status: { type: string, const: ok }
+      additionalProperties: false
+    AuthorizationDecisionStatus:
+      type: string
+      enum: [allow, deny, approval_required]
+      x-enum-varnames: [AuthorizationDecisionStatusAllow, AuthorizationDecisionStatusDeny, AuthorizationDecisionStatusApprovalRequired]
+    AuthorizationResource:
+      type: object
+      required: [type]
+      properties:
+        type: { type: string, minLength: 1 }
+        id: { type: string }
+        tenantId: { type: string }
+        workspaceId: { type: string }
+        clusterId: { type: string }
+        namespace: { type: string }
+        projectId: { type: string }
+        owner: { type: string }
+        labels: { type: object, additionalProperties: { type: string } }
+      additionalProperties: false
+    AuthorizationEffectiveScope:
+      type: object
+      properties:
+        tenantIds: { type: array, uniqueItems: true, items: { type: string } }
+        workspaceIds: { type: array, uniqueItems: true, items: { type: string } }
+        clusterIds: { type: array, uniqueItems: true, items: { type: string } }
+        namespaces: { type: array, uniqueItems: true, items: { type: string } }
+        projectIds: { type: array, uniqueItems: true, items: { type: string } }
+        resourceKinds: { type: array, uniqueItems: true, items: { type: string } }
+        labelSelector: { type: string }
+      additionalProperties: false
+    AuthorizationDecision:
+      type: object
+      required: [status, permissionKey, action, resource, reasonCode, policyVersion]
+      properties:
+        status: { $ref: "#/components/schemas/AuthorizationDecisionStatus" }
+        permissionKey: { type: string, minLength: 1 }
+        action: { type: string, minLength: 1 }
+        resource: { $ref: "#/components/schemas/AuthorizationResource" }
+        effectiveScope: { $ref: "#/components/schemas/AuthorizationEffectiveScope" }
+        reasonCode: { type: string, minLength: 1 }
+        policyVersion: { type: string, minLength: 1 }
+        allowedActions:
+          type: array
+          uniqueItems: true
+          items: { type: string, minLength: 1 }
+      additionalProperties: false
     ComputeDomain:
       type: string
       enum: [virtualization, container_runtime, agent]
@@ -13836,7 +14638,7 @@ components:
       additionalProperties: false
     ApplicationInput:
       type: object
-      required: [name, key, group, language, enabled]
+      required: [name, key, enabled]
       properties:
         id:
           type: string
@@ -14196,6 +14998,87 @@ components:
         enabled:
           type: boolean
       additionalProperties: false
+    RegistryConnectionMetadata:
+      type: object
+      required: [secretConfigured, secretStorage]
+      properties:
+        secretConfigured:
+          type: boolean
+        secretStorage:
+          type: string
+      additionalProperties: false
+    RegistryConnection:
+      type: object
+      required: [id, name, registryType, endpoint, insecure, metadata, createdAt, updatedAt]
+      properties:
+        id:
+          type: string
+          minLength: 1
+        name:
+          type: string
+          minLength: 1
+        registryType:
+          type: string
+          minLength: 1
+        endpoint:
+          type: string
+          minLength: 1
+        namespace:
+          type: string
+        username:
+          type: string
+        insecure:
+          type: boolean
+        metadata:
+          $ref: "#/components/schemas/RegistryConnectionMetadata"
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    RegistryConnectionInput:
+      type: object
+      required: [name, registryType, endpoint]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+          minLength: 1
+        registryType:
+          type: string
+          minLength: 1
+        endpoint:
+          type: string
+          minLength: 1
+        namespace:
+          type: string
+        username:
+          type: string
+        secret:
+          type: string
+          writeOnly: true
+        insecure:
+          type: boolean
+      additionalProperties: false
+    RegistryConnectionEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/RegistryConnection"
+      additionalProperties: false
+    RegistryConnectionListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/RegistryConnection"
+      additionalProperties: false
     WorkflowTemplate:
       type: object
       required: [id, key, name, enabled, createdAt, updatedAt]
@@ -14297,22 +15180,298 @@ components:
           type: string
         strategyProfileId:
           type: string
-        promotionPolicyId:
+        promotionPolicyId:
+          type: string
+        artifactPolicyId:
+          type: string
+        workflowTemplateId:
+          type: string
+        buildPolicy:
+          $ref: "#/components/schemas/BuildPolicy"
+        releasePolicy:
+          $ref: "#/components/schemas/ReleasePolicy"
+        resourceSelector:
+          $ref: "#/components/schemas/ResourceSelector"
+        targets:
+          type: array
+          items:
+            $ref: "#/components/schemas/ReleaseTargetInput"
+      additionalProperties: false
+    KubernetesRelatedResource:
+      type: object
+      required: [kind, name]
+      properties:
+        kind:
+          type: string
+          enum: [Service, Ingress, HorizontalPodAutoscaler]
+        name:
+          type: string
+          minLength: 1
+      additionalProperties: false
+    KubernetesImportCandidate:
+      type: object
+      required: [clusterId, namespace, workloadKind, workloadName, desiredReplicas, readyReplicas, relatedResources]
+      properties:
+        clusterId:
+          type: string
+          minLength: 1
+        namespace:
+          type: string
+          minLength: 1
+        workloadKind:
+          type: string
+          enum: [Deployment, StatefulSet, DaemonSet]
+        workloadName:
+          type: string
+          minLength: 1
+        desiredReplicas:
+          type: integer
+          minimum: 0
+        readyReplicas:
+          type: integer
+          minimum: 0
+        containers:
+          type: array
+          uniqueItems: true
+          items:
+            type: string
+        labels:
+          type: object
+          additionalProperties:
+            type: string
+        relatedResources:
+          type: array
+          items:
+            $ref: "#/components/schemas/KubernetesRelatedResource"
+      additionalProperties: false
+    KubernetesImportCandidateListEnvelope:
+      type: object
+      required: [items, truncated]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/KubernetesImportCandidate"
+        truncated:
+          type: boolean
+      additionalProperties: false
+    KubernetesWorkloadImportInput:
+      type: object
+      required: [workloadKind, workloadName]
+      properties:
+        workloadKind:
+          type: string
+          enum: [Deployment, StatefulSet, DaemonSet]
+        workloadName:
+          type: string
+          minLength: 1
+      additionalProperties: false
+    KubernetesServiceImportRequest:
+      type: object
+      required: [clusterId, namespace, applicationKey, applicationName, environmentKey, environmentName, ownershipMode, workloads]
+      properties:
+        clusterId:
+          type: string
+          minLength: 1
+        namespace:
+          type: string
+          minLength: 1
+        applicationKey:
+          type: string
+          minLength: 1
+        applicationName:
+          type: string
+          minLength: 1
+        environmentKey:
+          type: string
+          minLength: 1
+        environmentName:
+          type: string
+          minLength: 1
+        ownershipMode:
+          type: string
+          enum: [observe_only, managed]
+        workloads:
+          type: array
+          minItems: 1
+          maxItems: 100
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadImportInput"
+      additionalProperties: false
+    KubernetesImportEntityRef:
+      type: object
+      required: [id, key, name, created]
+      properties:
+        id:
+          type: string
+        key:
+          type: string
+        name:
+          type: string
+        created:
+          type: boolean
+      additionalProperties: false
+    KubernetesImportedService:
+      type: object
+      required: [id, key, name, workloadKind, workloadName, created]
+      properties:
+        id:
+          type: string
+        key:
+          type: string
+        name:
+          type: string
+        workloadKind:
+          type: string
+          enum: [Deployment, StatefulSet, DaemonSet]
+        workloadName:
+          type: string
+        created:
+          type: boolean
+      additionalProperties: false
+    KubernetesImportedTarget:
+      type: object
+      required: [id, workloadKind, workloadName, created]
+      properties:
+        id:
+          type: string
+        workloadKind:
+          type: string
+          enum: [Deployment, StatefulSet, DaemonSet]
+        workloadName:
+          type: string
+        created:
+          type: boolean
+      additionalProperties: false
+    KubernetesServiceImportResult:
+      type: object
+      required: [application, environment, applicationEnvironmentId, applicationEnvironmentCreated, ownershipMode, services, targets]
+      properties:
+        application:
+          $ref: "#/components/schemas/KubernetesImportEntityRef"
+        environment:
+          $ref: "#/components/schemas/KubernetesImportEntityRef"
+        applicationEnvironmentId:
+          type: string
+        applicationEnvironmentCreated:
+          type: boolean
+        ownershipMode:
+          type: string
+          enum: [observe_only, managed]
+        services:
+          type: array
+          items:
+            $ref: "#/components/schemas/KubernetesImportedService"
+        targets:
+          type: array
+          items:
+            $ref: "#/components/schemas/KubernetesImportedTarget"
+      additionalProperties: false
+    KubernetesServiceImportResultEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/KubernetesServiceImportResult"
+      additionalProperties: false
+    HelmReleaseImportInput:
+      type: object
+      required: [releaseName]
+      properties:
+        releaseName:
+          type: string
+          minLength: 1
+      additionalProperties: false
+    HelmReleaseImportRequest:
+      type: object
+      required: [clusterId, namespace, applicationKey, applicationName, environmentKey, environmentName, ownershipMode, releases]
+      properties:
+        clusterId:
+          type: string
+          minLength: 1
+        namespace:
+          type: string
+          minLength: 1
+        applicationKey:
+          type: string
+          minLength: 1
+        applicationName:
+          type: string
+          minLength: 1
+        environmentKey:
+          type: string
+          minLength: 1
+        environmentName:
+          type: string
+          minLength: 1
+        ownershipMode:
+          type: string
+          enum: [observe_only, managed]
+        releases:
+          type: array
+          minItems: 1
+          maxItems: 100
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/HelmReleaseImportInput"
+      additionalProperties: false
+    HelmImportedService:
+      type: object
+      required: [id, key, name, releaseName, created]
+      properties:
+        id:
+          type: string
+        key:
+          type: string
+        name:
+          type: string
+        releaseName:
+          type: string
+        created:
+          type: boolean
+      additionalProperties: false
+    HelmImportedTarget:
+      type: object
+      required: [id, releaseName, created]
+      properties:
+        id:
+          type: string
+        releaseName:
           type: string
-        artifactPolicyId:
+        created:
+          type: boolean
+      additionalProperties: false
+    HelmReleaseImportResult:
+      type: object
+      required: [application, environment, applicationEnvironmentId, applicationEnvironmentCreated, ownershipMode, services, targets]
+      properties:
+        application:
+          $ref: "#/components/schemas/KubernetesImportEntityRef"
+        environment:
+          $ref: "#/components/schemas/KubernetesImportEntityRef"
+        applicationEnvironmentId:
           type: string
-        workflowTemplateId:
+        applicationEnvironmentCreated:
+          type: boolean
+        ownershipMode:
           type: string
-        buildPolicy:
-          $ref: "#/components/schemas/BuildPolicy"
-        releasePolicy:
-          $ref: "#/components/schemas/ReleasePolicy"
-        resourceSelector:
-          $ref: "#/components/schemas/ResourceSelector"
+          enum: [observe_only, managed]
+        services:
+          type: array
+          items:
+            $ref: "#/components/schemas/HelmImportedService"
         targets:
           type: array
           items:
-            $ref: "#/components/schemas/ReleaseTargetInput"
+            $ref: "#/components/schemas/HelmImportedTarget"
+      additionalProperties: false
+    HelmReleaseImportResultEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/HelmReleaseImportResult"
       additionalProperties: false
     BuildTemplate:
       type: object
@@ -14820,6 +15979,10 @@ components:
           type: string
         containerName:
           type: string
+        valuesContent:
+          type: string
+          maxLength: 1048576
+          description: Complete Helm values YAML used when the selected target is a managed Helm release.
         variables:
           type: object
           additionalProperties: true
@@ -16796,120 +17959,369 @@ components:
         notes:
           type: array
           items:
-            type: string
+            type: string
+      additionalProperties: false
+    ClusterCapabilityMatrixEntry:
+      type: object
+      required: [key, label, category, riskLevel, requiresApproval, direct, agent]
+      properties:
+        key:
+          type: string
+        label:
+          type: string
+        category:
+          type: string
+        requiredScopes:
+          type: array
+          items:
+            type: string
+        riskLevel:
+          $ref: "#/components/schemas/RiskLevel"
+        requiresApproval:
+          type: boolean
+        docsUrl:
+          type: string
+        direct:
+          $ref: "#/components/schemas/ClusterCapabilityModeSupport"
+        agent:
+          $ref: "#/components/schemas/ClusterCapabilityModeSupport"
+      additionalProperties: false
+    ClusterCapabilityMatrixEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/ClusterCapabilityMatrixEntry"
+      additionalProperties: false
+    AgentInstallation:
+      type: object
+      required: [clusterId, manifestUrl, command, expiresAt]
+      properties:
+        clusterId:
+          type: string
+          minLength: 1
+        manifestUrl:
+          type: string
+          format: uri
+        command:
+          type: string
+          minLength: 1
+        expiresAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    AgentInstallationEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/AgentInstallation"
+      additionalProperties: false
+    ObservabilityProviderSignal:
+      type: string
+      enum: [logs, metrics, traces, profiles]
+      x-enum-varnames:
+        - ObservabilityProviderSignalLogs
+        - ObservabilityProviderSignalMetrics
+        - ObservabilityProviderSignalTraces
+        - ObservabilityProviderSignalProfiles
+    ObservabilityProviderRuntimeMode:
+      type: string
+      enum: [builtin, external-http, managed-container]
+      x-enum-varnames:
+        - ObservabilityProviderRuntimeModeBuiltin
+        - ObservabilityProviderRuntimeModeExternalHTTP
+        - ObservabilityProviderRuntimeModeManagedContainer
+    ObservabilityProviderStatus:
+      type: string
+      enum: [supported, degraded, unsupported]
+      x-enum-varnames:
+        - ObservabilityProviderStatusSupported
+        - ObservabilityProviderStatusDegraded
+        - ObservabilityProviderStatusUnsupported
+    ObservabilityProviderDefinition:
+      type: object
+      required: [providerKey, displayName, protocolVersion, signals, capabilities, runtimeMode, builtIn, status]
+      properties:
+        providerKey:
+          type: string
+          pattern: "^[a-z][a-z0-9._-]*$"
+          maxLength: 128
+          description: Required when backendType is provider.
+        displayName:
+          type: string
+          minLength: 1
+          maxLength: 200
+        description:
+          type: string
+          maxLength: 1000
+        protocolVersion:
+          type: string
+          pattern: "^v[1-9][0-9]*$"
+        signals:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/ObservabilityProviderSignal"
+        capabilities:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            type: string
+            pattern: "^[a-z][a-z0-9_-]*(\\.[a-z][a-z0-9_-]*)+$"
+        runtimeMode:
+          $ref: "#/components/schemas/ObservabilityProviderRuntimeMode"
+        builtIn:
+          type: boolean
+        status:
+          $ref: "#/components/schemas/ObservabilityProviderStatus"
+        statusReason:
+          type: string
+          maxLength: 500
+        pluginId:
+          type: string
+          maxLength: 200
+        configSchemaRef:
+          type: string
+          maxLength: 512
+      additionalProperties: false
+    ObservabilityProviderListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/ObservabilityProviderDefinition"
+      additionalProperties: false
+    ObservabilityDashboardSource:
+      type: string
+      enum: [grafana]
+      x-enum-varnames:
+        - ObservabilityDashboardSourceGrafana
+    ObservabilityDashboardPanelType:
+      type: string
+      enum: [timeseries, stat, text, row]
+      x-enum-varnames:
+        - ObservabilityDashboardPanelTypeTimeseries
+        - ObservabilityDashboardPanelTypeStat
+        - ObservabilityDashboardPanelTypeText
+        - ObservabilityDashboardPanelTypeRow
+    ObservabilityDashboardPanelLayout:
+      type: object
+      required: [x, y, w, h]
+      properties:
+        x:
+          type: integer
+          minimum: 0
+          maximum: 23
+        y:
+          type: integer
+          minimum: 0
+        w:
+          type: integer
+          minimum: 1
+          maximum: 24
+        h:
+          type: integer
+          minimum: 1
+          maximum: 100
+      additionalProperties: false
+    ObservabilityDashboardTarget:
+      type: object
+      required: [refId, expression]
+      properties:
+        refId:
+          type: string
+          minLength: 1
+          maxLength: 16
+        expression:
+          type: string
+          minLength: 1
+          maxLength: 8192
+        legend:
+          type: string
+          maxLength: 256
+      additionalProperties: false
+    ObservabilityDashboardPanel:
+      type: object
+      required: [id, title, type, layout, targets, queryable]
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 128
+        title:
+          type: string
+          minLength: 1
+          maxLength: 200
+        type:
+          $ref: "#/components/schemas/ObservabilityDashboardPanelType"
+        layout:
+          $ref: "#/components/schemas/ObservabilityDashboardPanelLayout"
+        targets:
+          type: array
+          maxItems: 8
+          items:
+            $ref: "#/components/schemas/ObservabilityDashboardTarget"
+        queryable:
+          type: boolean
+        markdown:
+          type: string
+          maxLength: 32768
+      additionalProperties: false
+    ObservabilityDashboard:
+      type: object
+      required: [id, name, source, tags, panels, createdAt, updatedAt]
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 128
+        name:
+          type: string
+          minLength: 1
+          maxLength: 200
+        source:
+          $ref: "#/components/schemas/ObservabilityDashboardSource"
+        sourceSchemaVersion:
+          type: integer
+          minimum: 0
+        dataSourceId:
+          type: string
+          maxLength: 200
+        tags:
+          type: array
+          maxItems: 50
+          uniqueItems: true
+          items:
+            type: string
+            minLength: 1
+            maxLength: 100
+        panels:
+          type: array
+          maxItems: 200
+          items:
+            $ref: "#/components/schemas/ObservabilityDashboardPanel"
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    ObservabilityDashboardEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/ObservabilityDashboard"
+      additionalProperties: false
+    ObservabilityDashboardListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/ObservabilityDashboard"
       additionalProperties: false
-    ClusterCapabilityMatrixEntry:
+    ObservabilityGrafanaDashboardImportInput:
       type: object
-      required: [key, label, category, riskLevel, requiresApproval, direct, agent]
+      required: [json, dataSourceId]
       properties:
-        key:
+        json:
           type: string
-        label:
+          minLength: 2
+          maxLength: 2097152
+          description: Grafana Classic dashboard JSON or a V1 resource whose spec contains the Classic dashboard model.
+        dataSourceId:
           type: string
-        category:
+          minLength: 1
+          maxLength: 200
+          description: Enabled Soha Prometheus data source used by every imported queryable panel.
+      additionalProperties: false
+    ObservabilityMetricDataSource:
+      type: object
+      required: [id, name]
+      properties:
+        id:
           type: string
-        requiredScopes:
-          type: array
-          items:
-            type: string
-        riskLevel:
-          $ref: "#/components/schemas/RiskLevel"
-        requiresApproval:
-          type: boolean
-        docsUrl:
+          minLength: 1
+          maxLength: 200
+        name:
           type: string
-        direct:
-          $ref: "#/components/schemas/ClusterCapabilityModeSupport"
-        agent:
-          $ref: "#/components/schemas/ClusterCapabilityModeSupport"
+          minLength: 1
+          maxLength: 200
       additionalProperties: false
-    ClusterCapabilityMatrixEnvelope:
+    ObservabilityMetricDataSourceListEnvelope:
       type: object
       required: [items]
       properties:
         items:
           type: array
           items:
-            $ref: "#/components/schemas/ClusterCapabilityMatrixEntry"
+            $ref: "#/components/schemas/ObservabilityMetricDataSource"
       additionalProperties: false
-    ObservabilityProviderSignal:
-      type: string
-      enum: [logs, metrics, traces, profiles]
-      x-enum-varnames:
-        - ObservabilityProviderSignalLogs
-        - ObservabilityProviderSignalMetrics
-        - ObservabilityProviderSignalTraces
-        - ObservabilityProviderSignalProfiles
-    ObservabilityProviderRuntimeMode:
-      type: string
-      enum: [builtin, external-http, managed-container]
-      x-enum-varnames:
-        - ObservabilityProviderRuntimeModeBuiltin
-        - ObservabilityProviderRuntimeModeExternalHTTP
-        - ObservabilityProviderRuntimeModeManagedContainer
-    ObservabilityProviderStatus:
-      type: string
-      enum: [supported, degraded, unsupported]
-      x-enum-varnames:
-        - ObservabilityProviderStatusSupported
-        - ObservabilityProviderStatusDegraded
-        - ObservabilityProviderStatusUnsupported
-    ObservabilityProviderDefinition:
+    ObservabilityDashboardImportWarning:
       type: object
-      required: [providerKey, displayName, protocolVersion, signals, capabilities, runtimeMode, builtIn, status]
+      required: [code, message]
       properties:
-        providerKey:
+        code:
           type: string
-          pattern: "^[a-z][a-z0-9._-]*$"
-          maxLength: 128
-          description: Required when backendType is provider.
-        displayName:
+          enum: [unsupported_panel_type, skipped_target, unsupported_variable, datasource_rebound, unsupported_feature]
+        message:
           type: string
           minLength: 1
-          maxLength: 200
-        description:
-          type: string
-          maxLength: 1000
-        protocolVersion:
-          type: string
-          pattern: "^v[1-9][0-9]*$"
-        signals:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            $ref: "#/components/schemas/ObservabilityProviderSignal"
-        capabilities:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            type: string
-            pattern: "^[a-z][a-z0-9_-]*(\\.[a-z][a-z0-9_-]*)+$"
-        runtimeMode:
-          $ref: "#/components/schemas/ObservabilityProviderRuntimeMode"
-        builtIn:
-          type: boolean
-        status:
-          $ref: "#/components/schemas/ObservabilityProviderStatus"
-        statusReason:
-          type: string
           maxLength: 500
-        pluginId:
+        panelId:
           type: string
-          maxLength: 200
-        configSchemaRef:
-          type: string
-          maxLength: 512
+          maxLength: 128
       additionalProperties: false
-    ObservabilityProviderListEnvelope:
+    ObservabilityDashboardImportResult:
       type: object
-      required: [items]
+      required: [dashboard, warnings, importedPanelCount, skippedPanelCount]
       properties:
-        items:
+        dashboard:
+          $ref: "#/components/schemas/ObservabilityDashboard"
+        warnings:
           type: array
+          maxItems: 500
           items:
-            $ref: "#/components/schemas/ObservabilityProviderDefinition"
+            $ref: "#/components/schemas/ObservabilityDashboardImportWarning"
+        importedPanelCount:
+          type: integer
+          minimum: 1
+        skippedPanelCount:
+          type: integer
+          minimum: 0
+      additionalProperties: false
+    ObservabilityDashboardImportResultEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/ObservabilityDashboardImportResult"
+      additionalProperties: false
+    ObservabilityDashboardPanelQueryInput:
+      type: object
+      required: [timeFrom, timeTo]
+      properties:
+        timeFrom:
+          type: string
+          format: date-time
+        timeTo:
+          type: string
+          format: date-time
+        stepSeconds:
+          type: integer
+          minimum: 1
+          maximum: 3600
+          default: 60
       additionalProperties: false
     ObservabilityQueryScope:
       type: object
@@ -20515,6 +21927,188 @@ components:
         installed:
           type: boolean
       additionalProperties: false
+    SoftwarePackage:
+      type: object
+      required:
+        [id, softwareId, name, publisher, version, platform, arch, fileName, sizeBytes, sha256, downloadPath, createdAt, updatedAt]
+      properties:
+        id:
+          type: string
+          minLength: 1
+          maxLength: 128
+        softwareId:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        name:
+          type: string
+          minLength: 1
+          maxLength: 100
+        description:
+          type: string
+          maxLength: 500
+        publisher:
+          type: string
+          minLength: 1
+          maxLength: 100
+        category:
+          type: string
+          maxLength: 50
+        version:
+          type: string
+          minLength: 1
+          maxLength: 64
+        platform:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        arch:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        fileName:
+          type: string
+          minLength: 1
+          maxLength: 255
+        sizeBytes:
+          type: integer
+          format: int64
+          minimum: 1
+          maximum: 4294967296
+        sha256:
+          type: string
+          pattern: "^[0-9a-f]{64}$"
+        downloadPath:
+          type: string
+          pattern: "^/api/v1/software/packages/[^/]+/download$"
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    SoftwarePackageEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/SoftwarePackage"
+      additionalProperties: false
+    SoftwarePackageListEnvelope:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/SoftwarePackage"
+        nextCursor:
+          type: string
+      additionalProperties: false
+    SoftwarePackageUploadRequest:
+      type: object
+      required: [softwareId, name, publisher, version, platform, arch, file]
+      properties:
+        softwareId:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        name:
+          type: string
+          minLength: 1
+          maxLength: 100
+        description:
+          type: string
+          maxLength: 500
+        publisher:
+          type: string
+          minLength: 1
+          maxLength: 100
+        category:
+          type: string
+          maxLength: 50
+        version:
+          type: string
+          minLength: 1
+          maxLength: 64
+        platform:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        arch:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        file:
+          type: string
+          format: binary
+      additionalProperties: false
+    SoftwarePackageURLImportRequest:
+      type: object
+      required: [softwareId, name, publisher, version, platform, arch, url]
+      properties:
+        softwareId:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        name:
+          type: string
+          minLength: 1
+          maxLength: 100
+        description:
+          type: string
+          maxLength: 500
+        publisher:
+          type: string
+          minLength: 1
+          maxLength: 100
+        category:
+          type: string
+          maxLength: 50
+        version:
+          type: string
+          minLength: 1
+          maxLength: 64
+        platform:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        arch:
+          type: string
+          pattern: "^[a-z0-9][a-z0-9._-]{0,63}$"
+        url:
+          type: string
+          format: uri
+          pattern: "^https://"
+          maxLength: 2048
+        fileName:
+          type: string
+          minLength: 1
+          maxLength: 255
+      additionalProperties: false
+    SoftwareStorage:
+      type: object
+      required: [backend, objectCount, totalBytes, items]
+      properties:
+        backend:
+          type: string
+          minLength: 1
+          maxLength: 64
+        objectCount:
+          type: integer
+          format: int64
+          minimum: 0
+        totalBytes:
+          type: integer
+          format: int64
+          minimum: 0
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/SoftwarePackage"
+        nextCursor:
+          type: string
+      additionalProperties: false
+    SoftwareStorageEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/SoftwareStorage"
+      additionalProperties: false
     InstalledPlugin:
       type: object
       required: [id, name, version, publisher, type, status, source, manifest, checksumStatus, installedBy, installedAt, updatedAt]