@whooshbang/contracts 1.0.0-rc.21 → 1.0.0-rc.23

package/openapi/generated/whooshbang-v1.bundle.json

@@ -2,8 +2,8 @@
   "openapi": "3.1.1",
   "info": {
     "title": "WhooshBang API",
-    "version": "1.0.0-rc.21",
-    "description": "The V1 contract for human account/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none account for administration. A project credential selects one account,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one account and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
+    "version": "1.0.0-rc.23",
+    "description": "The V1 contract for human organization/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none organization for administration. A project credential selects one organization,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one organization and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
     "termsOfService": "https://flowxo.com/terms",
     "contact": {
       "name": "WhooshBang Support",
@@ -21,20 +21,20 @@
   "security": [{ "bearerCredential": [] }],
   "tags": [
     {
-      "name": "Account",
-      "description": "The current Clerk organization projected as a WhooshBang account."
+      "name": "Organization",
+      "description": "The current Clerk organization projected as a WhooshBang organization."
     },
     {
       "name": "Projects",
-      "description": "Account-scoped applications with transactionally bootstrapped test/live environments."
+      "description": "Organization-scoped applications with transactionally bootstrapped test/live environments."
     },
     {
       "name": "API credentials",
       "description": "Human-administered, environment-scoped bearer credentials with one-time secret reveal."
     },
     {
-      "name": "Account credentials",
-      "description": "Human-administered, account-scoped bearer credentials that name their project and environment per call."
+      "name": "Organization credentials",
+      "description": "Human-administered, organization-scoped bearer credentials that name their project and environment per call."
     },
     {
       "name": "Subscription links",
@@ -82,17 +82,17 @@
     }
   ],
   "paths": {
-    "/v1/account": {
+    "/v1/organization": {
       "get": {
-        "operationId": "getAccount",
-        "summary": "Read the current account projection",
-        "description": "Returns the WhooshBang account selected by the verified Clerk\norganization session and the caller's projected role. Clerk organization\nand user identifiers are never public response fields.\n",
-        "tags": ["Account"],
+        "operationId": "getOrganization",
+        "summary": "Read the current organization projection",
+        "description": "Returns the WhooshBang organization selected by the verified Clerk\norganization session and the caller's projected role. Clerk organization\nand user identifiers are never public response fields.\n",
+        "tags": ["Organization"],
         "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "responses": {
           "200": {
-            "description": "The current account projection.",
+            "description": "The current organization projection.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -100,17 +100,19 @@
             },
             "content": {
               "application/json": {
-                "schema": { "$ref": "#/components/schemas/AccountProjection" },
+                "schema": {
+                  "$ref": "#/components/schemas/OrganizationProjection"
+                },
                 "examples": {
-                  "projectedAccount": {
+                  "projectedOrganization": {
                     "value": {
-                      "id": "account_synthetic_001",
+                      "id": "organization_synthetic_001",
                       "name": "Synthetic Organization",
                       "status": "active",
                       "membership": { "role": "admin" },
                       "created_at": "2026-07-28T12:00:00Z",
                       "updated_at": "2026-07-28T12:00:00Z",
-                      "diagnostic_id": "diag_account_synthetic_001"
+                      "diagnostic_id": "diag_organization_synthetic_001"
                     }
                   }
                 }
@@ -123,14 +125,61 @@
         }
       }
     },
-    "/v1/account/credentials": {
+    "/v1/organization/close": {
+      "post": {
+        "operationId": "closeOrganization",
+        "summary": "Close the current customer organization",
+        "description": "Terminally closes the organization selected by the verified Clerk\norganization session. Only an administrator may close it. OAuth grants\nand API credentials are deliberately excluded: delegated authority must\nnot be able to erase the organization that granted it.\n\nThe request requires the exact confirmation `close-organization`. Repeating a\ncompleted closure is safe and returns the original `closed_at`. The\nresult names provider-owned resources the administrator must still retire\noutside WhooshBang, such as revoking a customer-managed Telegram bot token\nin BotFather; no provider credential is returned.\n",
+        "tags": ["Organization"],
+        "security": [{ "clerkSession": [] }],
+        "x-organization-membership": "required",
+        "x-required-membership-role": "admin",
+        "x-repeat-semantics": {
+          "same_target": "idempotent",
+          "secret_returned": false
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CloseOrganizationRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The organization is closed, with any manual provider retirement still required.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrganizationClosureResult"
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "409": { "$ref": "#/components/responses/Conflict" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/organization/credentials": {
       "get": {
-        "operationId": "listAccountCredentials",
-        "summary": "List safe account credential metadata",
-        "description": "Returns only credentials owned by the account selected by the verified\nClerk organization session. Secrets and digest material are never\nreturned.\n",
-        "tags": ["Account credentials"],
+        "operationId": "listOrganizationCredentials",
+        "summary": "List safe organization credential metadata",
+        "description": "Returns only credentials owned by the organization selected by the verified\nClerk organization session. Secrets and digest material are never\nreturned.\n",
+        "tags": ["Organization credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "parameters": [
           { "$ref": "#/components/parameters/ApiCredentialAfterCursor" },
           { "$ref": "#/components/parameters/ApiCredentialPageLimit" },
@@ -138,7 +187,7 @@
         ],
         "responses": {
           "200": {
-            "description": "A stable page of safe account credential metadata.",
+            "description": "A stable page of safe organization credential metadata.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -147,18 +196,18 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AccountCredentialCollection"
+                  "$ref": "#/components/schemas/OrganizationCredentialCollection"
                 },
                 "examples": {
-                  "accountCredentials": {
+                  "organizationCredentials": {
                     "value": {
                       "items": [
                         {
-                          "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
-                          "prefix": "wb_ac1.acred_AAAAAAAA",
+                          "id": "ocred_AAAAAAAAAAAAAAAAAAAAAA",
+                          "prefix": "wb_oc1.ocred_AAAAAAAA",
                           "label": "Synthetic release automation",
                           "scopes": [
-                            "account:read",
+                            "organization:read",
                             "messages:write",
                             "messages:read"
                           ],
@@ -185,12 +234,12 @@
         }
       },
       "post": {
-        "operationId": "createAccountCredential",
-        "summary": "Create an account-scoped API credential",
-        "description": "Creates one credential against the whole account. It names no project\nand no environment: a request names them in its path, and the\ncredential's authority on that path is the intersection of its scopes\nwith the project-credential vocabulary, so it is never wider than a\nproject credential would have been for the same project environment.\nThe complete bearer secret appears only in this creation response. It\ncannot be read later and is never replayed from an idempotency cache.\n",
-        "tags": ["Account credentials"],
+        "operationId": "createOrganizationCredential",
+        "summary": "Create an organization-scoped API credential",
+        "description": "Creates one credential against the whole organization. It names no project\nand no environment: a request names them in its path, and the\ncredential's authority on that path is the intersection of its scopes\nwith the project-credential vocabulary, so it is never wider than a\nproject credential would have been for the same project environment.\nThe complete bearer secret appears only in this creation response. It\ncannot be read later and is never replayed from an idempotency cache.\n",
+        "tags": ["Organization credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-secret-reveal": {
           "responses": 1,
           "replayable": false,
@@ -201,14 +250,14 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateAccountCredentialRequest"
+                "$ref": "#/components/schemas/CreateOrganizationCredentialRequest"
               },
               "examples": {
-                "createAccountCredential": {
+                "createOrganizationCredential": {
                   "value": {
                     "label": "Release automation",
                     "scopes": [
-                      "account:read",
+                      "organization:read",
                       "messages:write",
                       "messages:read"
                     ]
@@ -229,17 +278,17 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AccountCredentialSecretReveal"
+                  "$ref": "#/components/schemas/OrganizationCredentialSecretReveal"
                 },
                 "examples": {
-                  "createdAccountCredential": {
+                  "createdOrganizationCredential": {
                     "value": {
                       "credential": {
-                        "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
-                        "prefix": "wb_ac1.acred_AAAAAAAA",
+                        "id": "ocred_AAAAAAAAAAAAAAAAAAAAAA",
+                        "prefix": "wb_oc1.ocred_AAAAAAAA",
                         "label": "Synthetic release automation",
                         "scopes": [
-                          "account:read",
+                          "organization:read",
                           "messages:write",
                           "messages:read"
                         ],
@@ -247,7 +296,7 @@
                         "created_at": "2026-07-25T17:45:00Z",
                         "status": "active"
                       },
-                      "secret": "wb_ac1.acred_AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+                      "secret": "wb_oc1.ocred_AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
                     }
                   }
                 }
@@ -262,15 +311,17 @@
         }
       }
     },
-    "/v1/account/credentials/{account_credential_id}/rotate": {
-      "parameters": [{ "$ref": "#/components/parameters/AccountCredentialId" }],
+    "/v1/organization/credentials/{organization_credential_id}/rotate": {
+      "parameters": [
+        { "$ref": "#/components/parameters/OrganizationCredentialId" }
+      ],
       "post": {
-        "operationId": "rotateAccountCredential",
-        "summary": "Rotate an account-scoped API credential",
-        "description": "Creates one replacement with the same label and scopes. The complete new\nbearer secret appears only in this response. The replaced credential\nremains active for the explicitly declared overlap, from zero through\n86400 seconds, then becomes terminally revoked. A revoked credential\ncannot be rotated. Missing and out-of-account credentials use the same\nnon-enumerating `404`.\n",
-        "tags": ["Account credentials"],
+        "operationId": "rotateOrganizationCredential",
+        "summary": "Rotate an organization-scoped API credential",
+        "description": "Creates one replacement with the same label and scopes. The complete new\nbearer secret appears only in this response. The replaced credential\nremains active for the explicitly declared overlap, from zero through\n86400 seconds, then becomes terminally revoked. A revoked credential\ncannot be rotated. Missing and out-of-organization credentials use the same\nnon-enumerating `404`.\n",
+        "tags": ["Organization credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-secret-reveal": {
           "responses": 1,
           "replayable": false,
@@ -281,10 +332,10 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RotateAccountCredentialRequest"
+                "$ref": "#/components/schemas/RotateOrganizationCredentialRequest"
               },
               "examples": {
-                "rotateAccountCredential": {
+                "rotateOrganizationCredential": {
                   "value": { "overlap_seconds": 3600 }
                 }
               }
@@ -302,18 +353,18 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AccountCredentialRotation"
+                  "$ref": "#/components/schemas/OrganizationCredentialRotation"
                 },
                 "examples": {
-                  "rotatedAccountCredential": {
+                  "rotatedOrganizationCredential": {
                     "value": {
                       "credential": {
                         "credential": {
-                          "id": "acred_BBBBBBBBBBBBBBBBBBBBBA",
-                          "prefix": "wb_ac1.acred_BBBBBBBB",
+                          "id": "ocred_BBBBBBBBBBBBBBBBBBBBBA",
+                          "prefix": "wb_oc1.ocred_BBBBBBBB",
                           "label": "Synthetic release automation",
                           "scopes": [
-                            "account:read",
+                            "organization:read",
                             "messages:write",
                             "messages:read"
                           ],
@@ -321,14 +372,14 @@
                           "created_at": "2026-07-25T17:45:00Z",
                           "status": "active"
                         },
-                        "secret": "wb_ac1.acred_BBBBBBBBBBBBBBBBBBBBBA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA"
+                        "secret": "wb_oc1.ocred_BBBBBBBBBBBBBBBBBBBBBA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA"
                       },
                       "replaced_credential": {
-                        "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
-                        "prefix": "wb_ac1.acred_AAAAAAAA",
+                        "id": "ocred_AAAAAAAAAAAAAAAAAAAAAA",
+                        "prefix": "wb_oc1.ocred_AAAAAAAA",
                         "label": "Synthetic release automation",
                         "scopes": [
-                          "account:read",
+                          "organization:read",
                           "messages:write",
                           "messages:read"
                         ],
@@ -352,15 +403,17 @@
         }
       }
     },
-    "/v1/account/credentials/{account_credential_id}/revoke": {
-      "parameters": [{ "$ref": "#/components/parameters/AccountCredentialId" }],
+    "/v1/organization/credentials/{organization_credential_id}/revoke": {
+      "parameters": [
+        { "$ref": "#/components/parameters/OrganizationCredentialId" }
+      ],
       "post": {
-        "operationId": "revokeAccountCredential",
-        "summary": "Revoke an account-scoped API credential",
-        "description": "Immediately and terminally revokes the selected credential. Repeating\nthe request for the same visible credential is safe and returns the\nsame revoked metadata without revealing secret or digest material.\nMissing and out-of-account credentials use the same non-enumerating\n`404`.\n",
-        "tags": ["Account credentials"],
+        "operationId": "revokeOrganizationCredential",
+        "summary": "Revoke an organization-scoped API credential",
+        "description": "Immediately and terminally revokes the selected credential. Repeating\nthe request for the same visible credential is safe and returns the\nsame revoked metadata without revealing secret or digest material.\nMissing and out-of-organization credentials use the same non-enumerating\n`404`.\n",
+        "tags": ["Organization credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-repeat-semantics": {
           "same_target": "idempotent",
           "secret_returned": false
@@ -375,15 +428,17 @@
             },
             "content": {
               "application/json": {
-                "schema": { "$ref": "#/components/schemas/AccountCredential" },
+                "schema": {
+                  "$ref": "#/components/schemas/OrganizationCredential"
+                },
                 "examples": {
-                  "revokedAccountCredential": {
+                  "revokedOrganizationCredential": {
                     "value": {
-                      "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
-                      "prefix": "wb_ac1.acred_AAAAAAAA",
+                      "id": "ocred_AAAAAAAAAAAAAAAAAAAAAA",
+                      "prefix": "wb_oc1.ocred_AAAAAAAA",
                       "label": "Synthetic release automation",
                       "scopes": [
-                        "account:read",
+                        "organization:read",
                         "messages:write",
                         "messages:read"
                       ],
@@ -408,16 +463,16 @@
     "/v1/projects": {
       "get": {
         "operationId": "listProjects",
-        "summary": "List projects in the current account",
-        "description": "Returns only projects owned by the account selected by the verified\nClerk organization session. Every project includes its complete test/live\nenvironment and default-notifier bootstrap.\n",
+        "summary": "List projects in the current organization",
+        "description": "Returns only projects owned by the organization selected by the verified\nClerk organization session. Every project includes its complete test/live\nenvironment and default-notifier bootstrap.\n",
         "tags": ["Projects"],
         "security": [
           { "clerkSession": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "parameters": [
           { "$ref": "#/components/parameters/ProjectAfterCursor" },
           { "$ref": "#/components/parameters/ProjectPageLimit" },
@@ -425,7 +480,7 @@
         ],
         "responses": {
           "200": {
-            "description": "A stable page of projects in the current account.",
+            "description": "A stable page of projects in the current organization.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -440,7 +495,7 @@
                       "items": [
                         {
                           "id": "project_synthetic_001",
-                          "account_id": "account_synthetic_001",
+                          "organization_id": "organization_synthetic_001",
                           "name": "Synthetic Alerts",
                           "slug": "synthetic-alerts",
                           "status": "active",
@@ -475,7 +530,8 @@
                           ],
                           "created_at": "2026-07-28T12:05:00Z",
                           "updated_at": "2026-07-28T12:05:00Z",
-                          "diagnostic_id": "diag_project_synthetic_001"
+                          "diagnostic_id": "diag_project_synthetic_001",
+                          "privacy_mode": "minimal"
                         }
                       ],
                       "page": 1,
@@ -496,15 +552,15 @@
       "post": {
         "operationId": "createProject",
         "summary": "Create a project and its default environments",
-        "description": "Creates one project inside the authenticated account. The project, its\n`test` and `live` environments, and one `Default` notifier per\nenvironment are one atomic logical resource. Equivalent replay returns\nthe original `201` response without extending idempotency retention.\n",
+        "description": "Creates one project inside the authenticated organization. The project, its\n`test` and `live` environments, and one `Default` notifier per\nenvironment are one atomic logical resource. Equivalent replay returns\nthe original `201` response without extending idempotency retention.\n",
         "tags": ["Projects"],
         "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-idempotency": {
           "required": true,
           "retention_seconds": 604800,
-          "scope": ["authenticated_account", "operation_id", "key"],
+          "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
           "replay_retention_extends": false
         },
@@ -541,7 +597,7 @@
                   "createdProject": {
                     "value": {
                       "id": "project_synthetic_001",
-                      "account_id": "account_synthetic_001",
+                      "organization_id": "organization_synthetic_001",
                       "name": "Synthetic Alerts",
                       "slug": "synthetic-alerts",
                       "status": "active",
@@ -576,7 +632,8 @@
                       ],
                       "created_at": "2026-07-28T12:05:00Z",
                       "updated_at": "2026-07-28T12:05:00Z",
-                      "diagnostic_id": "diag_project_synthetic_001"
+                      "diagnostic_id": "diag_project_synthetic_001",
+                      "privacy_mode": "minimal"
                     }
                   }
                 }
@@ -595,16 +652,16 @@
       "parameters": [{ "$ref": "#/components/parameters/ProjectId" }],
       "get": {
         "operationId": "getProject",
-        "summary": "Read one project in the current account",
-        "description": "Returns the complete project bootstrap. An absent project and a project\noutside the authenticated account use the same non-enumerating `404`.\n",
+        "summary": "Read one project in the current organization",
+        "description": "Returns the complete project bootstrap. An absent project and a project\noutside the authenticated organization use the same non-enumerating `404`.\n",
         "tags": ["Projects"],
         "security": [
           { "clerkSession": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "responses": {
           "200": {
             "description": "The current project and its two environments.",
@@ -620,7 +677,7 @@
                   "project": {
                     "value": {
                       "id": "project_synthetic_001",
-                      "account_id": "account_synthetic_001",
+                      "organization_id": "organization_synthetic_001",
                       "name": "Synthetic Alerts",
                       "slug": "synthetic-alerts",
                       "status": "active",
@@ -655,7 +712,8 @@
                       ],
                       "created_at": "2026-07-28T12:05:00Z",
                       "updated_at": "2026-07-28T12:05:00Z",
-                      "diagnostic_id": "diag_project_synthetic_001"
+                      "diagnostic_id": "diag_project_synthetic_001",
+                      "privacy_mode": "minimal"
                     }
                   }
                 }
@@ -667,6 +725,51 @@
           "404": { "$ref": "#/components/responses/NotFound" },
           "429": { "$ref": "#/components/responses/RateLimited" }
         }
+      },
+      "patch": {
+        "operationId": "updateProject",
+        "summary": "Set a project's privacy policy",
+        "description": "Changes profile collection for both project environments. minimal is the\ndefault for new and existing projects. standard permits messenger profiles;\nminimal keeps recipient language only; private keeps delivery routing and\nthe customer-supplied subscriber identifier, with no profile data.\nMoving standard to minimal erases existing identifying profile fields.\nMoving to private also erases recipient language. Increasing collection\ndoes not restore erased data. The operation is naturally idempotent.\nAn absent project and one outside the organization return the same 404.\n",
+        "tags": ["Projects"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": [] },
+          { "bearerCredential": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
+        "x-required-scopes": ["projects:write"],
+        "x-organization-membership": "required",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/UpdateProjectRequest" },
+              "examples": {
+                "updateProject": { "value": { "privacy_mode": "private" } }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The project after changing its privacy policy and clearing disallowed profile fields.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/Project" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
       }
     },
     "/v1/projects/{project_id}/recipient-copy-overrides": {
@@ -674,7 +777,7 @@
       "get": {
         "operationId": "listRecipientCopyOverrides",
         "summary": "List sparse recipient-copy overrides for one project",
-        "description": "Returns only customer-authored overrides for the project in the\nauthenticated account. Missing values are intentionally absent and use\nWhooshBang's complete shipped catalog at render time. An optional\ncanonical language filter preserves the project + language + string\naddress without applying locale negotiation.\n",
+        "description": "Returns only customer-authored overrides for the project in the\nauthenticated organization. Missing values are intentionally absent and use\nWhooshBang's complete shipped catalog at render time. An optional\ncanonical language filter preserves the project + language + string\naddress without applying locale negotiation.\n",
         "tags": ["Projects"],
         "security": [
           { "clerkSession": [] },
@@ -682,7 +785,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "parameters": [
           {
             "name": "language",
@@ -745,7 +848,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "requestBody": {
           "required": true,
           "content": {
@@ -790,7 +893,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "responses": {
           "204": {
             "description": "The shipped catalog value is effective at this address."
@@ -811,10 +914,10 @@
       "get": {
         "operationId": "listApiCredentials",
         "summary": "List safe API credential metadata",
-        "description": "Returns only credentials in the selected project environment owned by\nthe account selected by the verified Clerk organization session.\nSecrets and digest material are never returned. An absent or\nout-of-account project or environment uses the same non-enumerating\n`404`.\n",
+        "description": "Returns only credentials in the selected project environment owned by\nthe organization selected by the verified Clerk organization session.\nSecrets and digest material are never returned. An absent or\nout-of-organization project or environment uses the same non-enumerating\n`404`.\n",
         "tags": ["API credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "parameters": [
           { "$ref": "#/components/parameters/ApiCredentialAfterCursor" },
           { "$ref": "#/components/parameters/ApiCredentialPageLimit" },
@@ -878,7 +981,7 @@
         "description": "Creates one credential in the selected project environment. The complete\nbearer secret appears only in this creation response. It cannot be read\nlater and is never replayed from an idempotency cache. If a client loses\nthis response, it lists safe metadata and creates then revokes a\nreplacement.\n",
         "tags": ["API credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-secret-reveal": {
           "responses": 1,
           "replayable": false,
@@ -967,7 +1070,7 @@
         "description": "Creates one replacement with the same label and scopes. The complete new\nbearer secret appears only in this response. The replaced credential\nremains active for the explicitly declared overlap, from zero through\n86400 seconds, then becomes terminally revoked. A revoked credential\ncannot be rotated. Missing and out-of-scope credentials use the same\nnon-enumerating `404`.\n",
         "tags": ["API credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-secret-reveal": {
           "responses": 1,
           "replayable": false,
@@ -1067,7 +1170,7 @@
         "description": "Immediately and terminally revokes the selected credential. Repeating\nthe request for the same visible credential is safe and returns the\nsame revoked metadata without revealing secret or digest material.\nMissing and out-of-scope credentials use the same non-enumerating `404`.\n",
         "tags": ["API credentials"],
         "security": [{ "clerkSession": [] }],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "x-repeat-semantics": {
           "same_target": "idempotent",
           "secret_returned": false
@@ -1356,7 +1459,7 @@
         "security": [
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -1447,7 +1550,7 @@
         "security": [
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-repeat-semantics": {
@@ -1469,7 +1572,7 @@
       "post": {
         "operationId": "createMessage",
         "summary": "Create an asynchronous message",
-        "description": "Durably accepts one logical text message for one subscriber and one\nresolved channel binding. `202` proves API acceptance only; it does not\nclaim provider acceptance or end-device delivery.\n",
+        "description": "Durably accepts one logical text message for one subscriber and one\nresolved channel binding. `202` proves API acceptance only; it does not\nclaim provider acceptance or end-device delivery.\nThe reserved `test:` subscriber prefix and `delivery_target: simulator`\nare test-environment-only. Live sends are refused before acceptance or\nidempotent replay with `400 request_invalid`; reserved subscriber IDs\ncarry a field error at `/to/subscriber_id`.\n",
         "tags": ["Messages"],
         "security": [{ "bearerCredential": [] }, { "machineCredential": [] }],
         "x-required-scopes": ["messages:write"],
@@ -2010,7 +2113,7 @@
       "post": {
         "operationId": "createMachineClient",
         "summary": "Create a destination-bound machine client",
-        "description": "Creates one machine client in the project/environment selected by the\nproject credential. The notifier, subscriber, and active binding become\nimmutable authorization bounds. The response never contains a readable\nsecret or digest.\n",
+        "description": "Creates one machine client in the project/environment selected by the\nproject credential. The notifier, subscriber, and active binding become\nimmutable authorization bounds. The response never contains a readable\nsecret or digest.\nLive environments reject the reserved `test:` subscriber prefix with\n`400 request_invalid` and a field error at `/subscriber_id` before creation.\n",
         "tags": ["Machine clients"],
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
@@ -2585,7 +2688,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "parameters": [
@@ -2659,7 +2762,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -2793,7 +2896,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "responses": {
@@ -2825,7 +2928,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "responses": {
@@ -2859,7 +2962,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -2963,7 +3066,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-repeat-semantics": {
@@ -3000,7 +3103,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "parameters": [
@@ -3061,7 +3164,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -3136,7 +3239,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "parameters": [
@@ -3146,7 +3249,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Connections owned by exactly this account, project, and environment.",
+            "description": "Connections owned by exactly this organization, project, and environment.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -3201,13 +3304,13 @@
       "post": {
         "operationId": "createChannelConnection",
         "summary": "Select a provider identity for this environment",
-        "description": "Creates a connection in `pending`. An equivalent idempotent replay\nreturns the same connection; different input for the same key returns\n`idempotency_conflict`.\n\n`whooshbang_shared` names a disclosed WhooshBang-owned identity.\n`customer_byok` supplies the customer's own provider credential and\ncarries no identity field: `provider_identity_digest` is unique across\nevery tenant, so an endpoint that digested a client-supplied identity\nwould answer \"already claimed\" for a bot the caller does not own — an\noracle for whether any given bot is connected to WhooshBang by anyone.\nThe identity is derived server-side from a provider-validated `getMe`\non the submitted credential instead.\n\n`customer_managed` supplies no credential at all. Telegram creates a\nbrand new bot on the administrator's own account and hands WhooshBang\nits token server to server, so the token never reaches a browser, a\nclipboard, this request, or any response. The connection is returned\n`pending` with a `setup` carrying the link the administrator opens and\nthe moment it stops working; poll the connection, or read\n`setup.status`, to follow the attempt. Creating a bot is a person-only\naction, so a connection whose administrator never returns simply\nexpires — and a bot Telegram already created outlives it, because no\nprovider API can delete a bot.\n\nEverything that can go wrong in a managed setup after this call\nreturns is reported on `setup` rather than as a refusal here, because\nby then the connection exists and the failing party is a person this\nrequest has already answered. A lapsed link is `expired`; an attempt\nTelegram or WhooshBang could not complete is `failed` with a\n`failure_reason`. Both are recoverable through\n`restartChannelConnectionSetup` on the same connection.\n\nThe Problem vocabulary is closed, so each refusal reuses a published\ncode and is distinguished by `field_errors[].code`:\n\n- the provider answered and rejected the credential —\n  `request_invalid` 400, `provider_credential_invalid` at `/credential`;\n- the identity already has a webhook and `confirm_webhook_takeover` was\n  not sent — `request_invalid` 400, `webhook_takeover_required` at\n  `/confirm_webhook_takeover`. This is a warning, not a prohibition:\n  repeating the request with the confirmation connects the identity\n  whoever owns the endpoint it currently delivers to;\n- the webhook it already has belongs to another WhooshBang connection —\n  `request_invalid` 400, `whooshbang_connection_takeover_required` at\n  `/confirm_webhook_takeover`. Separate from the code above because the\n  consequence is separate: confirming this one **disables** the other\n  connection, which would otherwise go on reporting itself healthy while\n  receiving nothing;\n- the identity is already connected, by this account or any other —\n  `idempotency_conflict` 409, `provider_identity_claimed` at `/`, which\n  reports only that the identity the submitted credential proves is in\n  use and never that some other identity is;\n- the provider could not be reached and the outcome is genuinely\n  unknown — `provider_outcome_unknown` 502, no automatic retry;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
+        "description": "Creates a connection in `pending`. An equivalent idempotent replay\nreturns the same connection; different input for the same key returns\n`idempotency_conflict`.\n\n`whooshbang_shared` names a disclosed WhooshBang-owned identity.\n`customer_byok` supplies the customer's own provider credential and\ncarries no identity field: `provider_identity_digest` is unique across\nevery tenant, so an endpoint that digested a client-supplied identity\nwould answer \"already claimed\" for a bot the caller does not own — an\noracle for whether any given bot is connected to WhooshBang by anyone.\nThe identity is derived server-side from a provider-validated `getMe`\non the submitted credential instead.\n\n`customer_managed` supplies no credential at all. Telegram creates a\nbrand new bot on the administrator's own Telegram account and hands WhooshBang\nits token server to server, so the token never reaches a browser, a\nclipboard, this request, or any response. The connection is returned\n`pending` with a `setup` carrying the link the administrator opens and\nthe moment it stops working; poll the connection, or read\n`setup.status`, to follow the attempt. Creating a bot is a person-only\naction, so a connection whose administrator never returns simply\nexpires — and a bot Telegram already created outlives it, because no\nprovider API can delete a bot.\n\nEverything that can go wrong in a managed setup after this call\nreturns is reported on `setup` rather than as a refusal here, because\nby then the connection exists and the failing party is a person this\nrequest has already answered. A lapsed link is `expired`; an attempt\nTelegram or WhooshBang could not complete is `failed` with a\n`failure_reason`. Both are recoverable through\n`restartChannelConnectionSetup` on the same connection.\n\nThe Problem vocabulary is closed, so each refusal reuses a published\ncode and is distinguished by `field_errors[].code`:\n\n- the provider answered and rejected the credential —\n  `request_invalid` 400, `provider_credential_invalid` at `/credential`;\n- the identity already has a webhook and `confirm_webhook_takeover` was\n  not sent — `request_invalid` 400, `webhook_takeover_required` at\n  `/confirm_webhook_takeover`. This is a warning, not a prohibition:\n  repeating the request with the confirmation connects the identity\n  whoever owns the endpoint it currently delivers to;\n- the webhook it already has belongs to another WhooshBang connection —\n  `request_invalid` 400, `whooshbang_connection_takeover_required` at\n  `/confirm_webhook_takeover`. Separate from the code above because the\n  consequence is separate: confirming this one **disables** the other\n  connection, which would otherwise go on reporting itself healthy while\n  receiving nothing;\n- the identity is already connected, by this organization or any other —\n  `idempotency_conflict` 409, `provider_identity_claimed` at `/`, which\n  reports only that the identity the submitted credential proves is in\n  use and never that some other identity is;\n- the provider could not be reached and the outcome is genuinely\n  unknown — `provider_outcome_unknown` 502, no automatic retry;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
         "tags": ["Channel connections"],
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
@@ -3397,7 +3500,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -3476,7 +3579,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -3529,7 +3632,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3590,7 +3693,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3659,7 +3762,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
@@ -3703,13 +3806,13 @@
       "post": {
         "operationId": "restartChannelConnectionSetup",
         "summary": "Start a fresh setup on a connection that never finished one",
-        "description": "Issues a new guided setup for a `customer_managed` connection whose\nsetup expired, failed, or was simply abandoned. Nothing was ever\nprovisioned under it, no identity was claimed, and no subscriber ever\nconsented to anything through it, so nothing is lost.\n\n**Telegram reuses the connection and answers `200`.** A fresh `setup`\nappears on the same resource.\n\n**Customer-owned Slack replaces the connection and answers `201`.** The\nabandoned connection is archived and a new one is returned, carrying a\nnew `app_setup` and a new creation link. The connection cannot be\nreused, because Slack bakes this deployment's request URLs into the app\nat the moment it is created and they are not ours to change afterwards:\na second setup on one connection would mean two Slack apps answering to\none address. **Read `id` on the response** — the connection you were\npolling is now archived. A Slack app the previous attempt already\ncreated is not withdrawn and cannot be; it is the customer's, and they\ndelete it in Slack when they are ready.\n\nEntering the three app-specific values again is not a restart, and does\nnot need one. `rotate-credential` replaces them on the connection that\nalready exists.\n\nRestart takes no body. The suggested identity recorded when the\nconnection was created is what the new attempt proposes again, so a\ncaller resuming a half-finished setup cannot accidentally rename a bot\nan administrator was already looking at. A different suggestion means\na different connection.\n\nRepeating the call is safe. A setup that is still live is returned as\nit stands rather than being replaced, so two dashboard tabs converge\non one session instead of racing to strand each other's link, and only\na session that can no longer be used is exchanged for a new one.\n\nA bot the previous attempt already created is not withdrawn and cannot\nbe: Telegram exposes no way to delete a bot. The administrator keeps it\nin their own account until they retire it in BotFather, and a restart\nwalks them through creating another rather than pretending the first\nnever happened.\n\nRefusals reuse the closed Problem vocabulary and differ by\n`field_errors[].code`:\n\n- the connection did not come from guided setup, so there is no setup\n  to restart — `idempotency_conflict` 409, `setup_not_managed` at `/`;\n- the connection already finished setup, or is archived, so restarting\n  would offer a second identity for something subscribers may already\n  be bound to — `idempotency_conflict` 409,\n  `invalid_connection_transition` at `/`;\n- the provider could not be reached, so whether a new session exists is\n  genuinely unknown — `provider_outcome_unknown` 502; read the\n  connection before calling again;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
+        "description": "Issues a new guided setup for a `customer_managed` connection whose\nsetup expired, failed, or was simply abandoned. Nothing was ever\nprovisioned under it, no identity was claimed, and no subscriber ever\nconsented to anything through it, so nothing is lost.\n\n**Telegram reuses the connection and answers `200`.** A fresh `setup`\nappears on the same resource.\n\n**Customer-owned Slack replaces the connection and answers `201`.** The\nabandoned connection is archived and a new one is returned, carrying a\nnew `app_setup` and a new creation link. The connection cannot be\nreused, because Slack bakes this deployment's request URLs into the app\nat the moment it is created and they are not ours to change afterwards:\na second setup on one connection would mean two Slack apps answering to\none address. **Read `id` on the response** — the connection you were\npolling is now archived. A Slack app the previous attempt already\ncreated is not withdrawn and cannot be; it is the customer's, and they\ndelete it in Slack when they are ready.\n\nEntering the three app-specific values again is not a restart, and does\nnot need one. `rotate-credential` replaces them on the connection that\nalready exists.\n\nRestart takes no body. The suggested identity recorded when the\nconnection was created is what the new attempt proposes again, so a\ncaller resuming a half-finished setup cannot accidentally rename a bot\nan administrator was already looking at. A different suggestion means\na different connection.\n\nRepeating the call is safe. A setup that is still live is returned as\nit stands rather than being replaced, so two dashboard tabs converge\non one session instead of racing to strand each other's link, and only\na session that can no longer be used is exchanged for a new one.\n\nA bot the previous attempt already created is not withdrawn and cannot\nbe: Telegram exposes no way to delete a bot. The administrator keeps it\nin their own Telegram account until they retire it in BotFather, and a restart\nwalks them through creating another rather than pretending the first\nnever happened.\n\nRefusals reuse the closed Problem vocabulary and differ by\n`field_errors[].code`:\n\n- the connection did not come from guided setup, so there is no setup\n  to restart — `idempotency_conflict` 409, `setup_not_managed` at `/`;\n- the connection already finished setup, or is archived, so restarting\n  would offer a second identity for something subscribers may already\n  be bound to — `idempotency_conflict` 409,\n  `invalid_connection_transition` at `/`;\n- the provider could not be reached, so whether a new session exists is\n  genuinely unknown — `provider_outcome_unknown` 502; read the\n  connection before calling again;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
         "tags": ["Channel connections"],
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-repeat-semantics": {
@@ -3834,7 +3937,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -3946,7 +4049,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -4013,7 +4116,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -4074,13 +4177,13 @@
       "get": {
         "operationId": "getChannelConnectionAppManifest",
         "summary": "Read the generated app configuration a customer-owned setup will create",
-        "description": "Returns the exact configuration WhooshBang generated for this\ncustomer-owned Slack setup — the scopes it will ask for, the request\nURLs it will point at, the literal manifest document, and the same\nprefilled creation link the setup already carries.\n\nIt exists so the owner can read what they are about to approve, and a\nreviewer can check it, without opening Slack or decoding a URL. It\ncarries configuration only: no account, project, or environment, no\ncredential, and no provider-native identifier.\n\nOnly a `customer_managed` Slack connection has one. Every other\nprovider and mode answers `404`, because a manifest they do not have is\nnot a manifest that is empty.\n",
+        "description": "Returns the exact configuration WhooshBang generated for this\ncustomer-owned Slack setup — the scopes it will ask for, the request\nURLs it will point at, the literal manifest document, and the same\nprefilled creation link the setup already carries.\n\nIt exists so the owner can read what they are about to approve, and a\nreviewer can check it, without opening Slack or decoding a URL. It\ncarries configuration only: no organization, project, or environment, no\ncredential, and no provider-native identifier.\n\nOnly a `customer_managed` Slack connection has one. Every other\nprovider and mode answers `404`, because a manifest they do not have is\nnot a manifest that is empty.\n",
         "tags": ["Channel connections"],
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -4187,7 +4290,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "parameters": [
@@ -4268,7 +4371,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
@@ -4364,7 +4467,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -4425,7 +4528,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "parameters": [
@@ -4435,7 +4538,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Routes owned by exactly this account, project, and environment.",
+            "description": "Routes owned by exactly this organization, project, and environment.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -4484,7 +4587,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -4566,7 +4669,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -4624,7 +4727,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "responses": {
           "200": {
             "description": "Current constrained project recipient experience.",
@@ -4668,7 +4771,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "requestBody": {
           "required": true,
           "content": {
@@ -4725,7 +4828,7 @@
           { "bearerCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "parameters": [
           {
             "name": "WhooshBang-Recipient-Experience-Version",
@@ -4779,10 +4882,10 @@
           { "clerkSession": [] },
           { "bearerGrant": [] },
           { "bearerCredential": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "responses": {
           "200": {
             "description": "Current revisioned environment recipient experience.",
@@ -4828,10 +4931,10 @@
           { "clerkSession": [] },
           { "bearerGrant": [] },
           { "bearerCredential": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
-        "x-account-membership": "required",
+        "x-organization-membership": "required",
         "requestBody": {
           "required": true,
           "content": {
@@ -4880,7 +4983,7 @@
       "post": {
         "operationId": "createRecipientSession",
         "summary": "Create one attenuated recipient browser session",
-        "description": "The authenticated project credential supplies account, project, and\nenvironment. The request supplies only one subscriber, optional locale,\noptional registered return key, and bounded expiry. The response is the\nonly reveal of the browser capability and contains no resolved return\nURL, provider identity, group state, or application credential.\n",
+        "description": "The authenticated project credential supplies organization, project, and\nenvironment. The request supplies only one subscriber, optional locale,\noptional registered return key, and bounded expiry. The response is the\nonly reveal of the browser capability and contains no resolved return\nURL, provider identity, group state, or application credential.\n",
         "tags": ["Recipient experience"],
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
@@ -4983,7 +5086,7 @@
       "delete": {
         "operationId": "revokeRecipientSession",
         "summary": "Revoke one recipient browser session",
-        "description": "Immediately and terminally ends the session selected inside the\nauthenticated project environment. The browser capability stops\nworking, and any independently issued provider handoff that has not\nalready been consumed stops yielding an authorization link.\n\nRepeating the request is safe. An already revoked, absent, or\nout-of-scope session produces the same empty response, so this route\ncannot be used to enumerate session identifiers across environments or\naccounts.\n",
+        "description": "Immediately and terminally ends the session selected inside the\nauthenticated project environment. The browser capability stops\nworking, and any independently issued provider handoff that has not\nalready been consumed stops yielding an authorization link.\n\nRepeating the request is safe. An already revoked, absent, or\nout-of-scope session produces the same empty response, so this route\ncannot be used to enumerate session identifiers across environments or\norganizations.\n",
         "tags": ["Recipient experience"],
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
@@ -5332,7 +5435,7 @@
                   "value": {
                     "subscriber_id": "user_123",
                     "locale": "es",
-                    "groups": ["account-updates", "trial-users"]
+                    "groups": ["organization-updates", "trial-users"]
                   }
                 }
               }
@@ -5471,7 +5574,7 @@
                   "value": {
                     "key": "trial-users",
                     "display_name": "Trial users",
-                    "description": "Accounts currently evaluating Acme."
+                    "description": "Organizations currently evaluating Acme."
                   }
                 }
               }
@@ -5492,7 +5595,7 @@
                       "environment": "test",
                       "key": "trial-users",
                       "display_name": "Trial users",
-                      "description": "Accounts currently evaluating Acme.",
+                      "description": "Organizations currently evaluating Acme.",
                       "status": "active",
                       "membership_revision": 1,
                       "row_version": 1,
@@ -6002,14 +6105,17 @@
       "post": {
         "operationId": "createSubscriptionLinkInEnvironment",
         "summary": "Create a subscription link in a named project environment",
-        "description": "The environment-scoped form of `createSubscriptionLink`, for a caller\nwhose authority selects an account rather than a project. Behavior,\nrequest, and response are identical; the path names the scope the\ncredential form takes from its bearer, and the service checks it\nagainst the granting person's membership before acting.\n",
+        "description": "The environment-scoped form of `createSubscriptionLink`, for a caller\nwhose authority selects an organization rather than a project. Behavior,\nrequest, and response are identical; the path names the scope the\ncredential form takes from its bearer, and the service checks it\nagainst the granting person's membership before acting.\n",
         "tags": ["Subscription links"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
           "required": true,
           "retention_seconds": 604800,
-          "scope": ["authenticated_account", "operation_id", "key"],
+          "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
           "replay_retention_extends": false
         },
@@ -6086,7 +6192,10 @@
         "summary": "Inspect a subscription link in a named project environment",
         "description": "The environment-scoped form of `getSubscriptionLink`. A link outside the\nnamed environment is absent, exactly as it is for a credential.\n",
         "tags": ["Subscription links"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
           "200": {
@@ -6154,14 +6263,17 @@
       "post": {
         "operationId": "createMessageInEnvironment",
         "summary": "Create an asynchronous message in a named project environment",
-        "description": "The environment-scoped form of `createMessage`. The path names the\naccount, project, and environment the credential form takes from its\nbearer; test and live remain a property of the named environment and are\nnever selected by the request body.\n",
+        "description": "The environment-scoped form of `createMessage`. The path names the\norganization, project, and environment the credential form takes from its\nbearer; test and live remain a property of the named environment and are\nnever selected by the request body.\n",
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
           "required": true,
           "retention_seconds": 604800,
-          "scope": ["authenticated_account", "operation_id", "key"],
+          "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
           "replay_retention_extends": false
         },
@@ -6245,7 +6357,10 @@
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["messages:read"],
         "responses": {
           "200": {
@@ -6316,7 +6431,10 @@
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["messages:read"],
         "responses": {
           "200": {
@@ -6364,12 +6482,15 @@
         "summary": "Create a destination-bound machine client in a named project environment",
         "description": "The environment-scoped form of `createMachineClient`. Scope remains the\nexact bound destination; the path only names where the client is created.\n",
         "tags": ["Machine clients"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
           "required": true,
           "retention_seconds": 604800,
-          "scope": ["authenticated_account", "operation_id", "key"],
+          "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
           "replay_retention_extends": false
         },
@@ -6442,7 +6563,10 @@
         "summary": "Register a machine-credential digest in a named project environment",
         "description": "The environment-scoped form of `registerMachineCredential`. Registers\nonly the credential ID and SHA-256 digest; the path only names where the\nowning machine client lives. Request and response shapes are that\noperation's exactly, including its published examples.\n",
         "tags": ["Machine clients"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
           "required": true,
@@ -6508,7 +6632,10 @@
         "summary": "Inspect provider-neutral capabilities for a named project environment",
         "description": "The environment-scoped form of `getCapabilities`. The vocabulary is\nprovider-neutral and identical; the path names the environment whose\nactive degradation is reported.\n",
         "tags": ["Capabilities"],
-        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "security": [
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
         "x-required-scopes": ["capabilities:read"],
         "responses": {
           "200": {
@@ -6590,13 +6717,13 @@
       "post": {
         "operationId": "createSubscriberInEnvironment",
         "summary": "Create a subscriber and initial memberships in a named project environment",
-        "description": "The environment-scoped form of `createSubscriber`, for a caller whose\nauthority selects an account rather than a project. Behavior, request,\nand response are identical; the path names the scope the credential\nform takes from its bearer, and the service checks it against the\npresenting session or grant before acting.\n",
+        "description": "The environment-scoped form of `createSubscriber`, for a caller whose\nauthority selects an organization rather than a project. Behavior, request,\nand response are identical; the path names the scope the credential\nform takes from its bearer, and the service checks it against the\npresenting session or grant before acting.\n",
         "tags": ["Subscribers"],
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
@@ -6619,7 +6746,7 @@
                   "value": {
                     "subscriber_id": "user_123",
                     "locale": "es",
-                    "groups": ["account-updates", "trial-users"]
+                    "groups": ["organization-updates", "trial-users"]
                   }
                 }
               }
@@ -6674,7 +6801,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
@@ -6692,6 +6819,97 @@
         }
       }
     },
+    "/v1/projects/{project_id}/subscribers/{subscriber_id}": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        {
+          "name": "subscriber_id",
+          "in": "path",
+          "required": true,
+          "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        }
+      ],
+      "delete": {
+        "operationId": "eraseSubscriber",
+        "summary": "Erase one subscriber across the project",
+        "description": "Erases the person represented by this customer-supplied subscriber id\nacross both project environments. Personal content, answers, identities,\nand identifiers are removed while non-identifying delivery and usage\nshells remain. Pending work and old capabilities cannot restore or send\ndata for the erased person.\n\nRepeating the operation is safe, including when the subscriber is already\nabsent. Project-environment credentials cannot call this project-wide\noperation. A provider action that has already begun returns\n`privacy_operation_in_progress` rather than claiming erasure won the race;\nretry after that operation finishes.\n",
+        "tags": ["Subscribers"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
+        "x-required-scopes": [
+          "subscriptions:write",
+          "messages:write",
+          "machine-clients:write"
+        ],
+        "x-organization-membership": "required",
+        "x-repeat-semantics": {
+          "same_target": "idempotent",
+          "secret_returned": false
+        },
+        "responses": {
+          "204": {
+            "description": "The subscriber's personal data is erased or was already absent."
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "409": { "$ref": "#/components/responses/Conflict" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/subscribers/{subscriber_id}/data-export": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        {
+          "name": "subscriber_id",
+          "in": "path",
+          "required": true,
+          "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        }
+      ],
+      "get": {
+        "operationId": "getSubscriberDataExport",
+        "summary": "Export all customer-controlled data held for one subscriber",
+        "description": "Returns one complete, machine-readable artifact across every environment\nin the project. `provided_by_subscriber` is the Article 20 portable subset;\nthe three provenance sections together provide the Article 15 access copy.\nWhooshBang-controller audit and service log data is identified as excluded\nand requires a separate recipient request. Project-environment credentials\ncannot call this project-wide operation.\n",
+        "tags": ["Subscribers"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": [] },
+          { "bearerOrganizationCredential": [] }
+        ],
+        "x-required-scopes": [
+          "subscriptions:read",
+          "messages:read",
+          "machine-clients:read"
+        ],
+        "x-organization-membership": "required",
+        "responses": {
+          "200": {
+            "description": "Complete project-wide customer-controller subscriber data export.",
+            "headers": {
+              "Content-Disposition": {
+                "schema": { "type": "string" },
+                "description": "Fixed safe attachment filename."
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SubscriberDataExport"
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      }
+    },
     "/v1/projects/{project_id}/environments/{environment_id}/recipient-groups": {
       "parameters": [
         { "$ref": "#/components/parameters/ProjectId" },
@@ -6706,7 +6924,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "parameters": [
@@ -6759,7 +6977,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
@@ -6782,7 +7000,7 @@
                   "value": {
                     "key": "trial-users",
                     "display_name": "Trial users",
-                    "description": "Accounts currently evaluating Acme."
+                    "description": "Organizations currently evaluating Acme."
                   }
                 }
               }
@@ -6803,7 +7021,7 @@
                       "environment": "test",
                       "key": "trial-users",
                       "display_name": "Trial users",
-                      "description": "Accounts currently evaluating Acme.",
+                      "description": "Organizations currently evaluating Acme.",
                       "status": "active",
                       "membership_revision": 1,
                       "row_version": 1,
@@ -6848,7 +7066,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
@@ -6874,7 +7092,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "requestBody": {
@@ -6912,7 +7130,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -6955,7 +7173,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "parameters": [
@@ -7056,7 +7274,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -7100,7 +7318,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -7139,7 +7357,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -7238,7 +7456,7 @@
           { "clerkSession": [] },
           { "bearerCredential": [] },
           { "bearerGrant": [] },
-          { "bearerAccountCredential": [] }
+          { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "responses": {
@@ -7291,25 +7509,25 @@
         "type": "http",
         "scheme": "bearer",
         "bearerFormat": "Clerk session JWT",
-        "description": "A verified human session whose active Clerk organization selects exactly\none WhooshBang account. Every administration operation rechecks the\nprojected account membership; session identity never selects a project\nor environment from request data.\n"
+        "description": "A verified human session whose active Clerk organization selects exactly\none WhooshBang organization. Every administration operation rechecks the\nprojected organization membership; session identity never selects a project\nor environment from request data.\n"
       },
       "bearerGrant": {
         "type": "http",
         "scheme": "bearer",
         "bearerFormat": "OAuth 2.0 access token",
-        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting account member. It selects exactly one account and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. A project\ncredential can name no project but its own; an account credential names\none per call the same way this does.\n"
+        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting organization member. It selects exactly one organization and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. A project\ncredential can name no project but its own; an organization credential names\none per call the same way this does.\n"
       },
-      "bearerAccountCredential": {
+      "bearerOrganizationCredential": {
         "type": "http",
         "scheme": "bearer",
-        "bearerFormat": "wb_ac1.acred_<16-byte-base64url>.<32-byte-base64url-secret>",
-        "description": "Selects exactly one account and nothing below it. It names no project\nand no environment, so it authenticates only operations whose path does,\nand its authority there is the intersection of its scopes with the\nproject-credential vocabulary — never wider than a project credential\nwould have been for the same project environment. A path naming a\nproject outside its account is refused with `credential_account_mismatch`\nrather than a bare scope failure. `account:read` is the one scope it can\nhold that a project credential cannot, and it authorizes only the\naccount's project directory: listing the account's projects and reading\none, which is the account-wide question a project credential cannot ask\nand the reason a `--project <slug>` selector can work at all. It is\nrequired *in addition to* each of those operations' own\n`x-required-scopes`, never instead of them.\nCredentials cannot be read after creation.\n"
+        "bearerFormat": "wb_oc1.ocred_<16-byte-base64url>.<32-byte-base64url-secret>",
+        "description": "Selects exactly one organization and nothing below it. It names no project\nand no environment, so it authenticates only operations whose path does,\nand its authority there is the intersection of its scopes with the\nproject-credential vocabulary — never wider than a project credential\nwould have been for the same project environment. A path naming a\nproject outside its organization is refused with `credential_organization_mismatch`\nrather than a bare scope failure. `organization:read` is the one scope it can\nhold that a project credential cannot, and it authorizes only the\norganization's project directory: listing the organization's projects and reading\none, which is the organization-wide question a project credential cannot ask\nand the reason a `--project <slug>` selector can work at all. It is\nrequired *in addition to* each of those operations' own\n`x-required-scopes`, never instead of them.\nCredentials cannot be read after creation.\n"
       },
       "bearerCredential": {
         "type": "http",
         "scheme": "bearer",
         "bearerFormat": "wb_pc1.pcred_<16-byte-base64url>.<32-byte-base64url-secret>",
-        "description": "Selects exactly one account, project, and `test` or `live` environment.\nCredentials cannot be read after creation. Except for explicitly\nsynthetic creation/rotation reveal fixtures, complete bearer values\nmust never appear in fixtures, errors, logs, metrics, or inspection\nsurfaces.\n"
+        "description": "Selects exactly one organization, project, and `test` or `live` environment.\nCredentials cannot be read after creation. Except for explicitly\nsynthetic creation/rotation reveal fixtures, complete bearer values\nmust never appear in fixtures, errors, logs, metrics, or inspection\nsurfaces.\n"
       },
       "machineCredential": {
         "type": "http",
@@ -7321,7 +7539,7 @@
         "type": "apiKey",
         "in": "header",
         "name": "WhooshBang-Recipient-Capability",
-        "description": "A creation-only, short-lived capability bound server-side to one exact\naccount, project, environment, subscriber, configuration revision,\npresenting origin, and registered return destination. It is accepted\nonly on the `/v1/recipient-session` browser surface and never as bearer\nauthority on an ordinary application route.\n"
+        "description": "A creation-only, short-lived capability bound server-side to one exact\norganization, project, environment, subscriber, configuration revision,\npresenting origin, and registered return destination. It is accepted\nonly on the `/v1/recipient-session` browser surface and never as bearer\nauthority on an ordinary application route.\n"
       }
     },
     "parameters": {
@@ -7360,12 +7578,12 @@
         "description": "Canonical opaque project credential identity; never a readable secret.",
         "schema": { "$ref": "#/components/schemas/ApiCredentialId" }
       },
-      "AccountCredentialId": {
-        "name": "account_credential_id",
+      "OrganizationCredentialId": {
+        "name": "organization_credential_id",
         "in": "path",
         "required": true,
-        "description": "Canonical opaque account credential identity; never a readable secret.",
-        "schema": { "$ref": "#/components/schemas/AccountCredentialId" }
+        "description": "Canonical opaque organization credential identity; never a readable secret.",
+        "schema": { "$ref": "#/components/schemas/OrganizationCredentialId" }
       },
       "ApiCredentialAfterCursor": {
         "name": "after",
@@ -7767,7 +7985,7 @@
         "additionalProperties": false
       },
       "CreateChannelConnectionRequest": {
-        "description": "Selects the provider identity this environment will send through, discriminated on `mode`, and naming the provider it is for. The two customer-owned modes differ only in where the bot comes from: `customer_byok` connects one the customer already has, and `customer_managed` has Telegram create a new one on the administrator's own account. Neither supersedes the other, because a bot that already exists can never be adopted into managed mode — the manager that may act for a bot is fixed when the bot is created.",
+        "description": "Selects the provider identity this environment will send through, discriminated on `mode`, and naming the provider it is for. The two customer-owned modes differ only in where the bot comes from: `customer_byok` connects one the customer already has, and `customer_managed` has Telegram create a new one on the administrator's own Telegram account. Neither supersedes the other, because a bot that already exists can never be adopted into managed mode — the manager that may act for a bot is fixed when the bot is created.",
         "oneOf": [
           {
             "type": "object",
@@ -8145,7 +8363,7 @@
       },
       "CustomerOwnedSlackAppManifest": {
         "type": "object",
-        "description": "The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.\n\nIt exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no account, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.",
+        "description": "The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.\n\nIt exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no organization, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.",
         "required": [
           "creation_url",
           "app_name",
@@ -8303,7 +8521,7 @@
         "pattern": "^[!-~]+$",
         "description": "Visible ASCII, scoped by authenticated environment, operation ID, and key, and retained for seven days from first acceptance."
       },
-      "AccountProjection": {
+      "OrganizationProjection": {
         "type": "object",
         "description": "The current Clerk organization projected as a WhooshBang tenant. Clerk organization and user identifiers are not public fields.",
         "required": [
@@ -8320,7 +8538,7 @@
           "name": { "type": "string", "minLength": 1, "maxLength": 100 },
           "status": { "type": "string", "enum": ["active", "suspended"] },
           "membership": {
-            "$ref": "#/components/schemas/AccountMembershipSummary"
+            "$ref": "#/components/schemas/OrganizationMembershipSummary"
           },
           "created_at": { "$ref": "#/components/schemas/Timestamp" },
           "updated_at": { "$ref": "#/components/schemas/Timestamp" },
@@ -8328,9 +8546,23 @@
         },
         "additionalProperties": false
       },
+      "UpdateProjectRequest": {
+        "type": "object",
+        "description": "Sets the project privacy policy. Moving from standard to minimal erases stored identifying profile data; moving to private also erases recipient language. Increasing collection does not restore erased data.",
+        "required": ["privacy_mode"],
+        "properties": {
+          "privacy_mode": { "$ref": "#/components/schemas/PrivacyMode" }
+        },
+        "additionalProperties": false
+      },
+      "PrivacyMode": {
+        "type": "string",
+        "enum": ["minimal", "standard", "private"],
+        "description": "Project profile collection policy. minimal (the default for new and existing projects) keeps recipient language only; standard permits messenger profile data; private retains delivery routing and the customer-supplied subscriber identifier, with no profile data. Lowering collection erases existing fields the new mode disallows."
+      },
       "CreateProjectRequest": {
         "type": "object",
-        "description": "Creates one project inside the account selected by the authenticated human session.",
+        "description": "Creates one project inside the organization selected by the authenticated human session.",
         "required": ["name", "slug"],
         "properties": {
           "name": { "type": "string", "minLength": 1, "maxLength": 100 },
@@ -8344,6 +8576,10 @@
             "$ref": "#/components/schemas/RecipientLanguage",
             "default": "en",
             "description": "The application fallback locale for recipient-owned surfaces when no session, subscriber, or supported provider locale is available."
+          },
+          "privacy_mode": {
+            "$ref": "#/components/schemas/PrivacyMode",
+            "default": "minimal"
           }
         },
         "additionalProperties": false
@@ -8384,10 +8620,10 @@
       },
       "Project": {
         "type": "object",
-        "description": "An account-scoped application project with its complete test/live bootstrap.",
+        "description": "An organization-scoped application project with its complete test/live bootstrap.",
         "required": [
           "id",
-          "account_id",
+          "organization_id",
           "name",
           "slug",
           "status",
@@ -8395,11 +8631,14 @@
           "environments",
           "created_at",
           "updated_at",
-          "diagnostic_id"
+          "diagnostic_id",
+          "privacy_mode"
         ],
         "properties": {
           "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "account_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "organization_id": {
+            "$ref": "#/components/schemas/OpaqueIdentifier"
+          },
           "name": { "type": "string", "minLength": 1, "maxLength": 100 },
           "slug": {
             "type": "string",
@@ -8420,13 +8659,14 @@
           },
           "created_at": { "$ref": "#/components/schemas/Timestamp" },
           "updated_at": { "$ref": "#/components/schemas/Timestamp" },
-          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" },
+          "privacy_mode": { "$ref": "#/components/schemas/PrivacyMode" }
         },
         "additionalProperties": false
       },
       "ProjectCollection": {
         "type": "object",
-        "description": "A stable page of projects inside the authenticated account.",
+        "description": "A stable page of projects inside the authenticated organization.",
         "required": ["items"],
         "properties": {
           "items": {
@@ -8638,17 +8878,19 @@
         },
         "additionalProperties": false
       },
-      "CreateAccountCredentialRequest": {
+      "CreateOrganizationCredentialRequest": {
         "type": "object",
-        "description": "Creates one credential against the whole account rather than one project environment.",
+        "description": "Creates one credential against the whole organization rather than one project environment.",
         "required": ["label", "scopes"],
         "properties": {
           "label": { "type": "string", "minLength": 1, "maxLength": 100 },
-          "scopes": { "$ref": "#/components/schemas/AccountCredentialScopeSet" }
+          "scopes": {
+            "$ref": "#/components/schemas/OrganizationCredentialScopeSet"
+          }
         },
         "additionalProperties": false
       },
-      "RotateAccountCredentialRequest": {
+      "RotateOrganizationCredentialRequest": {
         "type": "object",
         "description": "Creates a replacement with the same label and scopes and schedules terminal revocation of the replaced credential after the declared overlap.",
         "required": ["overlap_seconds"],
@@ -8661,14 +8903,14 @@
         },
         "additionalProperties": false
       },
-      "AccountCredentialId": {
+      "OrganizationCredentialId": {
         "type": "string",
-        "pattern": "^acred_[A-Za-z0-9_-]{21}[AQgw]$",
-        "description": "acred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes."
+        "pattern": "^ocred_[A-Za-z0-9_-]{21}[AQgw]$",
+        "description": "ocred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes."
       },
-      "AccountCredential": {
+      "OrganizationCredential": {
         "type": "object",
-        "description": "Safe account-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.",
+        "description": "Safe organization-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.",
         "required": [
           "id",
           "prefix",
@@ -8679,11 +8921,13 @@
           "status"
         ],
         "properties": {
-          "id": { "$ref": "#/components/schemas/AccountCredentialId" },
-          "prefix": { "$ref": "#/components/schemas/AccountCredentialPrefix" },
+          "id": { "$ref": "#/components/schemas/OrganizationCredentialId" },
+          "prefix": {
+            "$ref": "#/components/schemas/OrganizationCredentialPrefix"
+          },
           "label": { "type": "string", "minLength": 1, "maxLength": 100 },
           "scopes": {
-            "$ref": "#/components/schemas/AccountCredentialScopeSet"
+            "$ref": "#/components/schemas/OrganizationCredentialScopeSet"
           },
           "created_by": {
             "$ref": "#/components/schemas/OpaqueIdentifier",
@@ -8716,15 +8960,15 @@
         ],
         "additionalProperties": false
       },
-      "AccountCredentialCollection": {
+      "OrganizationCredentialCollection": {
         "type": "object",
-        "description": "A stable page of safe account-credential metadata for one account.",
+        "description": "A stable page of safe organization-credential metadata for one organization.",
         "required": ["items"],
         "properties": {
           "items": {
             "type": "array",
             "maxItems": 100,
-            "items": { "$ref": "#/components/schemas/AccountCredential" }
+            "items": { "$ref": "#/components/schemas/OrganizationCredential" }
           },
           "next_cursor": {
             "type": "string",
@@ -8738,26 +8982,30 @@
         },
         "additionalProperties": false
       },
-      "AccountCredentialSecretReveal": {
+      "OrganizationCredentialSecretReveal": {
         "type": "object",
         "description": "The creation-only response. The secret is emitted in this response exactly once and is never available from list, rotate-target, revoke, or later read responses.",
         "required": ["credential", "secret"],
         "properties": {
-          "credential": { "$ref": "#/components/schemas/AccountCredential" },
-          "secret": { "$ref": "#/components/schemas/AccountCredentialSecret" }
+          "credential": {
+            "$ref": "#/components/schemas/OrganizationCredential"
+          },
+          "secret": {
+            "$ref": "#/components/schemas/OrganizationCredentialSecret"
+          }
         },
         "additionalProperties": false
       },
-      "AccountCredentialRotation": {
+      "OrganizationCredentialRotation": {
         "type": "object",
         "description": "A creation-only replacement secret plus safe metadata for the credential it replaces.",
         "required": ["credential", "replaced_credential"],
         "properties": {
           "credential": {
-            "$ref": "#/components/schemas/AccountCredentialSecretReveal"
+            "$ref": "#/components/schemas/OrganizationCredentialSecretReveal"
           },
           "replaced_credential": {
-            "$ref": "#/components/schemas/AccountCredential"
+            "$ref": "#/components/schemas/OrganizationCredential"
           }
         },
         "additionalProperties": false
@@ -9284,7 +9532,7 @@
           },
           "delivery_target": {
             "$ref": "#/components/schemas/MessageDeliveryTarget",
-            "description": "Optional routing override. Omit for notifier-default connection delivery, except reserved simulator destinations retained for compatibility."
+            "description": "Optional routing override. Simulator delivery and the reserved test: subscriber prefix are test-environment-only; live requests are refused with 400 request_invalid. Omit for notifier-default connection delivery or the reserved test-environment simulator default."
           },
           "connection_id": {
             "allOf": [{ "$ref": "#/components/schemas/OpaqueIdentifier" }],
@@ -9824,6 +10072,18 @@
               "retryable": { "const": false }
             }
           },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "const": "https://whooshbang.flowxo.com/problems/privacy_operation_in_progress"
+              },
+              "title": { "const": "Privacy operation in progress" },
+              "status": { "const": 409 },
+              "code": { "const": "privacy_operation_in_progress" },
+              "retryable": { "const": true }
+            }
+          },
           {
             "type": "object",
             "properties": {
@@ -10008,11 +10268,11 @@
             "type": "object",
             "properties": {
               "type": {
-                "const": "https://whooshbang.flowxo.com/problems/credential_account_mismatch"
+                "const": "https://whooshbang.flowxo.com/problems/credential_organization_mismatch"
               },
-              "title": { "const": "Credential account mismatch" },
+              "title": { "const": "Credential organization mismatch" },
               "status": { "const": 403 },
-              "code": { "const": "credential_account_mismatch" },
+              "code": { "const": "credential_organization_mismatch" },
               "retryable": { "const": false }
             }
           },
@@ -10734,7 +10994,7 @@
       },
       "RecipientSession": {
         "type": "object",
-        "description": "A browser-safe projection for the exact subscriber selected when the session was created. Account, project, environment, subscriber, origin, resolved return URL, provider identity, credentials, and group state are structurally absent.",
+        "description": "A browser-safe projection for the exact subscriber selected when the session was created. Organization, project, environment, subscriber, origin, resolved return URL, provider identity, credentials, and group state are structurally absent.",
         "required": [
           "id",
           "capability_prefix",
@@ -10962,6 +11222,92 @@
         },
         "additionalProperties": false
       },
+      "SubscriberDataExport": {
+        "type": "object",
+        "description": "A complete customer-controller access artifact for one subscriber across every environment in one project. provided_by_subscriber is the Article 20 portable subset; all three record groups together are the Article 15 access copy. WhooshBang-controller records are named but never mixed into the customer export.",
+        "required": [
+          "format",
+          "generated_at",
+          "controller_scope",
+          "project_id",
+          "environment_ids",
+          "subscriber_id",
+          "provided_by_subscriber",
+          "provided_by_customer",
+          "derived_by_service",
+          "excluded_controller_data"
+        ],
+        "properties": {
+          "format": {
+            "type": "string",
+            "const": "whooshbang.subscriber-data-export.v1"
+          },
+          "generated_at": { "$ref": "#/components/schemas/Timestamp" },
+          "controller_scope": { "type": "string", "const": "customer" },
+          "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "environment_ids": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+          },
+          "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "provided_by_subscriber": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/SubscriberDataExportRecord"
+            }
+          },
+          "provided_by_customer": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/SubscriberDataExportRecord"
+            }
+          },
+          "derived_by_service": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/SubscriberDataExportRecord"
+            }
+          },
+          "excluded_controller_data": {
+            "type": "array",
+            "minItems": 2,
+            "maxItems": 2,
+            "uniqueItems": true,
+            "items": {
+              "$ref": "#/components/schemas/SubscriberDataExportExcludedControllerData"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
+      "CloseOrganizationRequest": {
+        "type": "object",
+        "description": "Exact, explicit confirmation that the current organization administrator intends to close the whole organization.",
+        "required": ["confirmation"],
+        "properties": {
+          "confirmation": { "type": "string", "const": "close-organization" }
+        },
+        "additionalProperties": false
+      },
+      "OrganizationClosureResult": {
+        "type": "object",
+        "description": "Terminal organization-closure result. Repeating closure returns the same closed_at and any provider-owned resources that still require manual retirement.",
+        "required": ["status", "closed_at", "provider_actions_required"],
+        "properties": {
+          "status": { "type": "string", "const": "closed" },
+          "closed_at": { "$ref": "#/components/schemas/Timestamp" },
+          "provider_actions_required": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": {
+              "$ref": "#/components/schemas/OrganizationClosureProviderAction"
+            }
+          }
+        },
+        "additionalProperties": false
+      },
       "CreateRecipientGroupRequest": {
         "type": "object",
         "description": "Creates one static, developer-managed recipient group.",
@@ -11191,16 +11537,16 @@
         },
         "additionalProperties": false
       },
-      "AccountRole": {
+      "OrganizationRole": {
         "type": "string",
         "enum": ["admin", "member"],
         "description": "The stable WhooshBang authorization role projected from the current Clerk organization membership."
       },
-      "AccountMembershipSummary": {
+      "OrganizationMembershipSummary": {
         "type": "object",
         "required": ["role"],
         "properties": {
-          "role": { "$ref": "#/components/schemas/AccountRole" }
+          "role": { "$ref": "#/components/schemas/OrganizationRole" }
         },
         "additionalProperties": false
       },
@@ -11219,6 +11565,7 @@
           "environment_mismatch",
           "idempotency_key_required",
           "idempotency_conflict",
+          "privacy_operation_in_progress",
           "project_slug_conflict",
           "request_invalid",
           "replay_unavailable",
@@ -11236,7 +11583,7 @@
           "resource_not_found",
           "resource_expired",
           "cancellation_too_late",
-          "credential_account_mismatch",
+          "credential_organization_mismatch",
           "endpoint_rotation_conflict",
           "rate_limited",
           "provider_retryable",
@@ -11355,15 +11702,29 @@
           }
         ]
       },
-      "AccountCredentialPrefix": {
+      "OrganizationClosureProviderAction": {
+        "type": "object",
+        "description": "One provider-owned resource the customer must retire outside WhooshBang after organization closure. It contains safe identifiers only, never provider credentials.",
+        "required": ["provider", "action", "connection_id"],
+        "properties": {
+          "provider": { "type": "string", "enum": ["telegram", "slack"] },
+          "action": {
+            "type": "string",
+            "enum": ["revoke_bot_token", "delete_provider_application"]
+          },
+          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+        },
+        "additionalProperties": false
+      },
+      "OrganizationCredentialPrefix": {
         "type": "string",
-        "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{8}$",
-        "description": "A safe display prefix containing the account-credential format marker and first eight base64url identity characters, never secret bytes."
+        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{8}$",
+        "description": "A safe display prefix containing the organization-credential format marker and first eight base64url identity characters, never secret bytes."
       },
-      "AccountCredentialScope": {
+      "OrganizationCredentialScope": {
         "type": "string",
         "enum": [
-          "account:read",
+          "organization:read",
           "projects:write",
           "projects:read",
           "messages:write",
@@ -11376,14 +11737,14 @@
           "connections:write",
           "connections:read"
         ],
-        "description": "One account-credential capability. `account:read` is the account's project directory — listing the account's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the account. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An account credential is therefore never wider than a project credential would have been for the same project environment."
+        "description": "One organization-credential capability. `organization:read` is the organization's project directory — listing the organization's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the organization. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An organization credential is therefore never wider than a project credential would have been for the same project environment."
       },
-      "AccountCredentialScopeSet": {
+      "OrganizationCredentialScopeSet": {
         "type": "array",
         "minItems": 1,
         "maxItems": 12,
         "uniqueItems": true,
-        "items": { "$ref": "#/components/schemas/AccountCredentialScope" }
+        "items": { "$ref": "#/components/schemas/OrganizationCredentialScope" }
       },
       "ListPageSize": {
         "type": "integer",
@@ -11396,9 +11757,9 @@
         "minimum": 0,
         "description": "How many records the list holds in total, not only on this page. Counted while the page was read, so a write landing between the count and the page can leave it a record or two out of step with `items`. That is noise on an inspection surface; it never changes which records a page addresses."
       },
-      "AccountCredentialSecret": {
+      "OrganizationCredentialSecret": {
         "type": "string",
-        "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
+        "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
         "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
       },
       "Environment": {
@@ -11432,7 +11793,7 @@
           "connections:write",
           "connections:read"
         ],
-        "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an account authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
+        "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an organization authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
       },
       "ApiCredentialScopeSet": {
         "type": "array",
@@ -12060,7 +12421,7 @@
           "failed",
           "expired"
         ],
-        "description": "How far a guided setup has reached, which is the only thing a caller can act on while a connection is still `pending`. `awaiting_handoff` waits for the administrator to open the link on the Telegram account that will own the bot; `awaiting_creation` means that account is bound and the bot does not exist yet; `provisioning` means the bot exists and WhooshBang is installing delivery on it. `failed` and `expired` end the attempt without ending the connection — another attempt can be started on the same `pending` connection — and neither withdraws a bot Telegram has already created, because no provider API can delete one."
+        "description": "How far a guided setup has reached, which is the only thing a caller can act on while a connection is still `pending`. `awaiting_handoff` waits for the administrator to open the link on the Telegram account that will own the bot; `awaiting_creation` means that Telegram account is bound and the bot does not exist yet; `provisioning` means the bot exists and WhooshBang is installing delivery on it. `failed` and `expired` end the attempt without ending the connection — another attempt can be started on the same `pending` connection — and neither withdraws a bot Telegram has already created, because no provider API can delete one."
       },
       "SuggestedBotUsername": {
         "type": "string",
@@ -12087,7 +12448,7 @@
             "format": "uri",
             "pattern": "^https://[^\\s]+$",
             "maxLength": 2048,
-            "description": "The link the administrator opens to put their own Telegram account behind this setup; for Telegram it is `https://t.me/<manager>?start=<payload>`. It is a capability for exactly one setup session and nothing else: it names no account, no project, and no environment, it stops working at `expires_at`, and only the first Telegram account to open it is bound. It is not credential material, so displaying it costs nothing beyond letting whoever sees it first become the owner of the bot this setup creates. After `expired` or `failed` it binds nothing, and restarting the setup issues a new one rather than reviving this."
+            "description": "The link the administrator opens to put their own Telegram account behind this setup; for Telegram it is `https://t.me/<manager>?start=<payload>`. It is a capability for exactly one setup session and nothing else: it names no organization, no project, and no environment, it stops working at `expires_at`, and only the first Telegram account to open it is bound. It is not credential material, so displaying it costs nothing beyond letting whoever sees it first become the owner of the bot this setup creates. After `expired` or `failed` it binds nothing, and restarting the setup issues a new one rather than reviving this."
           },
           "expires_at": {
             "$ref": "#/components/schemas/Timestamp",
@@ -12101,7 +12462,7 @@
             "type": "string",
             "minLength": 1,
             "maxLength": 200,
-            "description": "Why this attempt ended, in terms the administrator can act on. Absent when there is nothing both safe and useful to say: an attempt refused because that Telegram account already holds a live setup says only that, because naming the account, project, or environment holding the other one would disclose another customer."
+            "description": "Why this attempt ended, in terms the administrator can act on. Absent when there is nothing both safe and useful to say: an attempt refused because that Telegram account already holds a live setup says only that, because naming the organization, project, or environment holding the other one would disclose another customer."
           }
         },
         "additionalProperties": false
@@ -12389,7 +12750,7 @@
             "format": "uri",
             "pattern": "^https://api\\.slack\\.com/apps\\?[^\\s]+$",
             "maxLength": 8192,
-            "description": "Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no account, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing."
+            "description": "Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no organization, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing."
           },
           "expires_at": {
             "$ref": "#/components/schemas/Timestamp",
@@ -12783,7 +13144,7 @@
       "provider-capabilities-v1.schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "$id": "https://whooshbang.flowxo.com/schemas/provider-capabilities-v1.schema.json",
-        "x-contract-version": "1.0.0-rc.21",
+        "x-contract-version": "1.0.0-rc.23",
         "title": "ProviderCapabilitiesV1",
         "description": "Provider-neutral, renderer-facing delivery and interaction capabilities with explicit degradation.",
         "type": "object",
@@ -12986,6 +13347,38 @@
           }
         },
         "additionalProperties": false
+      },
+      "SubscriberDataExportRecord": {
+        "type": "object",
+        "description": "One semantic record held about the subscriber. The source names the durable store or recovered semantic value; data contains plaintext business fields and excludes custody metadata and secrets.",
+        "required": ["source", "data"],
+        "properties": {
+          "source": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 96,
+            "pattern": "^[a-z][a-z0-9_.-]*$"
+          },
+          "data": { "type": "object", "additionalProperties": true }
+        },
+        "additionalProperties": false
+      },
+      "SubscriberDataExportExcludedControllerData": {
+        "type": "object",
+        "description": "A category deliberately outside the customer-controller artifact because WhooshBang is controller for it.",
+        "required": ["category", "controller", "access"],
+        "properties": {
+          "category": {
+            "type": "string",
+            "enum": ["consent_lifecycle_audit", "service_logs"]
+          },
+          "controller": { "type": "string", "const": "whooshbang" },
+          "access": {
+            "type": "string",
+            "const": "separate_recipient_request_required"
+          }
+        },
+        "additionalProperties": false
       }
     },
     "responses": {
@@ -13145,7 +13538,7 @@
         }
       },
       "Conflict": {
-        "description": "An idempotency key, project slug, credential identity, existing\nacknowledgement, or resource state conflicts with the authorized\naccount or request.\n",
+        "description": "An idempotency key, project slug, credential identity, existing\nacknowledgement, or resource state conflicts with the authorized\norganization or request.\n",
         "headers": {
           "WhooshBang-Diagnostic-Id": {
             "$ref": "#/components/headers/DiagnosticId"
@@ -13171,7 +13564,7 @@
                   "type": "https://whooshbang.flowxo.com/problems/project_slug_conflict",
                   "title": "Project slug conflict",
                   "status": 409,
-                  "detail": "That project slug is already used in this account.",
+                  "detail": "That project slug is already used in this organization.",
                   "code": "project_slug_conflict",
                   "diagnostic_id": "diag_project_slug_conflict_001",
                   "retryable": false,
@@ -13435,5 +13828,5 @@
       }
     }
   },
-  "x-contract-version": "1.0.0-rc.21"
+  "x-contract-version": "1.0.0-rc.23"
 }