@waratahlabs/canopy 0.5.0

package/schemas/threat-composer-v1.schema.json

@@ -0,0 +1,966 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "Threat Composer data exchange format schema for importing/exporting threat modeling data. This schema defines the complete structure for threat modeling sessions including application info, architecture diagrams, data flows, threats, mitigations, and assumptions. Files conforming to this schema should use the .tc.json file extension and can be imported/exported through the Threat Composer application. When generating or validating threat model data, ensure all optional fields are included when available (and additive) to provide comprehensive threat modeling coverage. For more information about Threat Composer and threat modeling best practices, visit: https://github.com/awslabs/threat-composer",
+  "type": "object",
+  "properties": {
+    "schema": {
+      "description": "Schema version identifier",
+      "type": "number",
+      "maximum": 1
+    },
+    "applicationInfo": {
+      "description": "Information about the application being threat modeled",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "Application name. Plain-text",
+          "type": "string",
+          "maxLength": 200
+        },
+        "description": {
+          "description": "Markdown detailed description of the application. Start your headers from H3 maximum",
+          "type": "string",
+          "maxLength": 100000
+        }
+      },
+      "additionalProperties": false
+    },
+    "architecture": {
+      "description": "System architecture information about the application being threat modeled",
+      "type": "object",
+      "properties": {
+        "description": {
+          "description": "Markdown detailed description of the application architecture. Start your headers from H3 maximum",
+          "type": "string",
+          "maxLength": 100000
+        },
+        "image": {
+          "description": "Architecture diagram image. Image URL or base64 encoded image data. Supports image/* MIME types, though browser rendering compatibility varies by format. For URLs: maximum 2048 characters. For base64: maximum 1000000 characters (approximately 750KB for typical images due to base64 encoding overhead). Common formats (PNG/JPG/GIF) are automatically compressed, making original file size limits difficult to specify precisely. The constraint applies to the resulting base64 string length rather than the original file size.",
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "dataflow": {
+      "description": "Data flow information about the application being threat modeled",
+      "type": "object",
+      "properties": {
+        "description": {
+          "description": "Markdown detailed description of the application data flows. Start your headers from H3 maximum",
+          "type": "string",
+          "maxLength": 100000
+        },
+        "image": {
+          "description": "Data-flow diagram image. Image URL or base64 encoded image data. Supports image/* MIME types, though browser rendering compatibility varies by format. For URLs: maximum 2048 characters. For base64: maximum 1000000 characters (approximately 750KB for typical images due to base64 encoding overhead). Common formats (PNG/JPG/GIF) are automatically compressed, making original file size limits difficult to specify precisely. The constraint applies to the resulting base64 string length rather than the original file size.",
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "assumptions": {
+      "description": "Assumptions about the design, threats and migations of the application being threat modeled",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "description": "UUID v4 identifier",
+            "type": "string",
+            "maxLength": 36
+          },
+          "numericId": {
+            "description": "Numeric identifier for display purposes",
+            "type": "number"
+          },
+          "displayOrder": {
+            "description": "Order for displaying threats",
+            "type": "number"
+          },
+          "metadata": {
+            "description": "Additional metadata as key-value pairs",
+            "type": "array",
+            "items": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "Comments"
+                    },
+                    "value": {
+                      "description": "Comment value",
+                      "type": "string",
+                      "maxLength": 1000
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "maxLength": 50,
+                      "pattern": "^custom:.*"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                }
+              ]
+            }
+          },
+          "tags": {
+            "description": "Categorization tags",
+            "type": "array",
+            "items": {
+              "description": "Tag value",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 30
+            }
+          },
+          "content": {
+            "description": "Assumption. Plain-text",
+            "type": "string",
+            "maxLength": 1000
+          }
+        },
+        "required": [
+          "id",
+          "numericId",
+          "content"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "mitigations": {
+      "description": "Mitigations for the application being threat modeled",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "description": "UUID v4 identifier",
+            "type": "string",
+            "maxLength": 36
+          },
+          "numericId": {
+            "description": "Numeric identifier for display purposes",
+            "type": "number"
+          },
+          "displayOrder": {
+            "description": "Order for displaying threats",
+            "type": "number"
+          },
+          "metadata": {
+            "description": "Additional metadata as key-value pairs for mitigations",
+            "type": "array",
+            "items": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "Comments"
+                    },
+                    "value": {
+                      "description": "Comment value",
+                      "type": "string",
+                      "maxLength": 1000
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "maxLength": 50,
+                      "pattern": "^custom:.*"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "source"
+                    },
+                    "value": {
+                      "description": "Source type indicating type of pack",
+                      "type": "string",
+                      "enum": [
+                        "mitigationPack"
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "mitigationPackId"
+                    },
+                    "value": {
+                      "description": "Identifier for the mitigation pack",
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 30
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "mitigationPackMitigationId"
+                    },
+                    "value": {
+                      "description": "UUID v4 identifier for the specific mitigation within the pack",
+                      "type": "string",
+                      "maxLength": 36
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                }
+              ]
+            }
+          },
+          "tags": {
+            "description": "Categorization tags",
+            "type": "array",
+            "items": {
+              "description": "Tag value",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 30
+            }
+          },
+          "content": {
+            "description": "Mitigation. Plain-text",
+            "type": "string",
+            "maxLength": 1000
+          },
+          "status": {
+            "description": "Status of the mitigation",
+            "type": "string",
+            "enum": [
+              "mitigationIdentified",
+              "mitigationInProgress",
+              "mitigationResolved",
+              "mitigationResolvedWillNotAction"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "numericId",
+          "content"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "assumptionLinks": {
+      "description": "Links between assumptions and threats/mitigations",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "type": {
+            "anyOf": [
+              {
+                "type": "string",
+                "const": "Mitigation"
+              },
+              {
+                "type": "string",
+                "const": "Threat"
+              }
+            ]
+          },
+          "assumptionId": {
+            "description": "UUID for the assumption",
+            "type": "string",
+            "minLength": 36,
+            "maxLength": 36
+          },
+          "linkedId": {
+            "description": "UUID of the linked threat or mitigation",
+            "type": "string",
+            "minLength": 36,
+            "maxLength": 36
+          }
+        },
+        "required": [
+          "type",
+          "assumptionId",
+          "linkedId"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "mitigationLinks": {
+      "description": "Links between mitigations and threats",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "mitigationId": {
+            "description": "UUID for the mitigation",
+            "type": "string",
+            "minLength": 36,
+            "maxLength": 36
+          },
+          "linkedId": {
+            "description": "UUID of the linked threat or assumption",
+            "type": "string",
+            "minLength": 36,
+            "maxLength": 36
+          }
+        },
+        "required": [
+          "mitigationId",
+          "linkedId"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "threats": {
+      "description": "Threats for the application being threat modeled",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "description": "UUID v4 identifier",
+            "type": "string",
+            "maxLength": 36
+          },
+          "numericId": {
+            "description": "Numeric identifier for display purposes",
+            "type": "number"
+          },
+          "displayOrder": {
+            "description": "Order for displaying threats",
+            "type": "number"
+          },
+          "metadata": {
+            "description": "Additional metadata as key-value pairs for threats",
+            "type": "array",
+            "items": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "Comments"
+                    },
+                    "value": {
+                      "description": "Comment value",
+                      "type": "string",
+                      "maxLength": 1000
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "maxLength": 50,
+                      "pattern": "^custom:.*"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "source"
+                    },
+                    "value": {
+                      "description": "Source type indicating type of pack",
+                      "type": "string",
+                      "enum": [
+                        "threatPack"
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "STRIDE"
+                    },
+                    "value": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "enum": [
+                          "S",
+                          "T",
+                          "R",
+                          "I",
+                          "D",
+                          "E"
+                        ]
+                      }
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "Priority"
+                    },
+                    "value": {
+                      "type": "string",
+                      "enum": [
+                        "High",
+                        "Medium",
+                        "Low"
+                      ]
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "threatPackId"
+                    },
+                    "value": {
+                      "description": "Identifier for the threat pack",
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 30
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "threatPackThreatId"
+                    },
+                    "value": {
+                      "description": "UUID v4 identifier for the specific threat within the pack",
+                      "type": "string",
+                      "maxLength": 36
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "const": "threatPackMitigationCandidateId"
+                    },
+                    "value": {
+                      "description": "UUID v4 identifier for the mitigation candidate from the threat pack",
+                      "type": "string",
+                      "maxLength": 36
+                    }
+                  },
+                  "required": [
+                    "key",
+                    "value"
+                  ],
+                  "additionalProperties": false
+                }
+              ]
+            }
+          },
+          "tags": {
+            "description": "Categorization tags",
+            "type": "array",
+            "items": {
+              "description": "Tag value",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 30
+            }
+          },
+          "threatSource": {
+            "description": "The entity taking action. For example: An actor (a useful default), An internet-based actor, An internal or external actor.",
+            "type": "string",
+            "maxLength": 200
+          },
+          "prerequisites": {
+            "description": "Conditions or requirements that must be met for a threat source's action to be viable. For example: -with access to another user's token. -who has administrator access -with user permissions - in a mitm position -with a network path to the API. If no prerequistes known return empty string, if know return but first word must be lower case",
+            "type": "string",
+            "maxLength": 200
+          },
+          "threatAction": {
+            "description": "The action being performed by the threat source. For example: -spoof another user -tamper with data stored in the database -make thousands of concurrent requests. first word must be lower case",
+            "type": "string",
+            "maxLength": 200
+          },
+          "threatImpact": {
+            "description": "What impact this has on the system.The direct impact of a successful threat action. For example: - unauthorized access to the user's bank account information -modifying the username for the all-time high score. -a web application being unable to handle other user requests.if know return but first word must be lower case",
+            "type": "string",
+            "maxLength": 200
+          },
+          "impactedGoal": {
+            "description": "The information security or business objective that is negatively affected.  This is most commonly the CIA triad: -confidentiality, -integrity, -availability. If not known return empty string in array, else strings in array first word must be lower case",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 200
+            }
+          },
+          "impactedAssets": {
+            "description": "List of assets affected by this threat. If not known return empty string in array, else strings in array first word must be lower case",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 200
+            }
+          },
+          "statement": {
+            "description": "concatenate the above as follows into a one of the following permutations based on if the default is available or not - trim any repated white space into a single white space: 1/ A/an [threat_source] [prerequisites] can [threat_action], 2/ A/an [threat_source] [prerequisites] can [threat_action], which leads to [threat_impact], 3/ A/an [threat_source] [prerequisites] can [threat_action], resulting in reduced [impacted_goal], 4/ A/An [threat_source] [prerequisites] can [threat_action], which leads to [threat_impact], resulting in reduced [impacted_goal], 5/ A/An [threat_source] [prerequisites] can [threat_action], negatively impacting [impacted_assets], 6/ A/An [threat_source] [prerequisites] can [threat_action], which leads to [threat_impact], negatively impacting [impacted_assets], 7/ A/An [threat_source] [prerequisites] can [threat_action], resulting in reduced [impacted_goal] of [impacted_assets], 8/ A/An [threat_source] [prerequisites] can [threat_action], which leads to [threat_impact], resulting in reduced [impacted_goal] of [impacted_assets]",
+            "type": "string",
+            "maxLength": 1400
+          },
+          "customTemplate": {
+            "description": "Custom template used for threat statement generation. Example: A [threatSource] [prerequisites] can [threatAction]",
+            "type": "string",
+            "maxLength": 200
+          },
+          "status": {
+            "description": "Status of the threat",
+            "type": "string",
+            "enum": [
+              "threatIdentified",
+              "threatResolved",
+              "threatResolvedNotUseful"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "numericId"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "brainstorm": {
+      "description": "Brainstorm data for this threat model. Including: assumptions, mitigitations, threat sources, threat prerequisites, threat actions, threat impacts, impacted goals, and impacted assets",
+      "type": "object",
+      "properties": {
+        "assumptions": {
+          "description": "Assumptions about the design, threats and migations of the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for assumption. Assumption about the design, threats and migations of the application being threat modeled. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "threatSources": {
+          "description": "Brainstormed threat sources for the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for threat source. The entity taking action. For example: An actor (a useful default), An internet-based actor, An internal or external actor. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "threatPrerequisites": {
+          "description": "Brainstormed prerequisites for threats against the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for threat prerequisite. Conditions or requirements that must be met for a threat source's action to be viable. For example: -with access to another user's token. -who has administrator access -with user permissions - in a mitm position -with a network path to the API. If no prerequistes known return empty string, if know return but first word must be lower case. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "threatActions": {
+          "description": "Brainstormed threat actions against the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for threat action. The action being performed by the threat source. For example: -spoof another user -tamper with data stored in the database -make thousands of concurrent requests. first word must be lower case. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "threatImpacts": {
+          "description": "Brainstormed threat impacts for the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for threat impact. What impact this has on the system.The direct impact of a successful threat action. For example: - unauthorized access to the user's bank account information -modifying the username for the all-time high score. -a web application being unable to handle other user requests.if know return but first word must be lower case. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "assets": {
+          "description": "Brainstormed assets for the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for asset. List of assets affected by this threat. If not known return empty string in array, else strings in array first word must be lower case. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "mitigations": {
+          "description": "Mitigations for the application being threat modeled",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "description": "UUID v4 identifier",
+                "type": "string",
+                "maxLength": 36
+              },
+              "content": {
+                "description": "Brainstorm item for mitigation. Mitigation for the application being threat modeled. Plain-text",
+                "type": "string",
+                "maxLength": 200
+              },
+              "createdAt": {
+                "description": "ISO 8601 UTC timestamp when the item was created (e.g., \"2024-01-15T14:30:45.123Z\")",
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "createdBy": {
+                "description": "Identifier of who created this item (user email, ID, display name, or \"ai-agent\"). AI agents should use \"ai-agent\" as the default value.",
+                "type": "string",
+                "maxLength": 50
+              },
+              "groupId": {
+                "description": "UUID v4 identifier of the group this item belongs to. If not provided, item is not grouped.",
+                "type": "string",
+                "maxLength": 36
+              }
+            },
+            "required": [
+              "id",
+              "content",
+              "createdAt"
+            ],
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "schema"
+  ],
+  "additionalProperties": false
+}