@whooshbang/contracts 1.0.0-rc.21 → 1.0.0-rc.23

package/schemas/whooshbang-v1.schema.json

@@ -1,12 +1,18 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://whooshbang.flowxo.com/schemas/whooshbang-v1.schema.json",
-  "x-contract-version": "1.0.0-rc.21",
+  "x-contract-version": "1.0.0-rc.23",
   "title": "WhooshBangV1ContractDocument",
   "description": "Public request, resource, summary, and Problem Details models for the WhooshBang V1 REST API.",
   "anyOf": [
     {
-      "$ref": "#/$defs/AccountProjection"
+      "$ref": "#/$defs/OrganizationProjection"
+    },
+    {
+      "$ref": "#/$defs/CloseOrganizationRequest"
+    },
+    {
+      "$ref": "#/$defs/OrganizationClosureResult"
     },
     {
       "$ref": "#/$defs/CreateProjectRequest"
@@ -14,6 +20,12 @@
     {
       "$ref": "#/$defs/Project"
     },
+    {
+      "$ref": "#/$defs/UpdateProjectRequest"
+    },
+    {
+      "$ref": "#/$defs/PrivacyMode"
+    },
     {
       "$ref": "#/$defs/ProjectCollection"
     },
@@ -42,22 +54,22 @@
       "$ref": "#/$defs/ApiCredentialRotation"
     },
     {
-      "$ref": "#/$defs/CreateAccountCredentialRequest"
+      "$ref": "#/$defs/CreateOrganizationCredentialRequest"
     },
     {
-      "$ref": "#/$defs/RotateAccountCredentialRequest"
+      "$ref": "#/$defs/RotateOrganizationCredentialRequest"
     },
     {
-      "$ref": "#/$defs/AccountCredential"
+      "$ref": "#/$defs/OrganizationCredential"
     },
     {
-      "$ref": "#/$defs/AccountCredentialCollection"
+      "$ref": "#/$defs/OrganizationCredentialCollection"
     },
     {
-      "$ref": "#/$defs/AccountCredentialSecretReveal"
+      "$ref": "#/$defs/OrganizationCredentialSecretReveal"
     },
     {
-      "$ref": "#/$defs/AccountCredentialRotation"
+      "$ref": "#/$defs/OrganizationCredentialRotation"
     },
     {
       "$ref": "#/$defs/CreateCustomerEndpointRequest"
@@ -182,6 +194,9 @@
     {
       "$ref": "#/$defs/Subscriber"
     },
+    {
+      "$ref": "#/$defs/SubscriberDataExport"
+    },
     {
       "$ref": "#/$defs/CreateRecipientGroupRequest"
     },
@@ -317,22 +332,22 @@
       },
       "x-max-json-bytes": 4096
     },
-    "AccountRole": {
+    "OrganizationRole": {
       "type": "string",
       "enum": ["admin", "member"],
       "description": "The stable WhooshBang authorization role projected from the current Clerk organization membership."
     },
-    "AccountMembershipSummary": {
+    "OrganizationMembershipSummary": {
       "type": "object",
       "required": ["role"],
       "properties": {
         "role": {
-          "$ref": "#/$defs/AccountRole"
+          "$ref": "#/$defs/OrganizationRole"
         }
       },
       "additionalProperties": false
     },
-    "AccountProjection": {
+    "OrganizationProjection": {
       "type": "object",
       "description": "The current Clerk organization projected as a WhooshBang tenant. Clerk organization and user identifiers are not public fields.",
       "required": [
@@ -358,7 +373,7 @@
           "enum": ["active", "suspended"]
         },
         "membership": {
-          "$ref": "#/$defs/AccountMembershipSummary"
+          "$ref": "#/$defs/OrganizationMembershipSummary"
         },
         "created_at": {
           "$ref": "#/$defs/Timestamp"
@@ -372,9 +387,62 @@
       },
       "additionalProperties": false
     },
+    "CloseOrganizationRequest": {
+      "type": "object",
+      "description": "Exact, explicit confirmation that the current organization administrator intends to close the whole organization.",
+      "required": ["confirmation"],
+      "properties": {
+        "confirmation": {
+          "type": "string",
+          "const": "close-organization"
+        }
+      },
+      "additionalProperties": false
+    },
+    "OrganizationClosureProviderAction": {
+      "type": "object",
+      "description": "One provider-owned resource the customer must retire outside WhooshBang after organization closure. It contains safe identifiers only, never provider credentials.",
+      "required": ["provider", "action", "connection_id"],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "enum": ["telegram", "slack"]
+        },
+        "action": {
+          "type": "string",
+          "enum": ["revoke_bot_token", "delete_provider_application"]
+        },
+        "connection_id": {
+          "$ref": "#/$defs/OpaqueIdentifier"
+        }
+      },
+      "additionalProperties": false
+    },
+    "OrganizationClosureResult": {
+      "type": "object",
+      "description": "Terminal organization-closure result. Repeating closure returns the same closed_at and any provider-owned resources that still require manual retirement.",
+      "required": ["status", "closed_at", "provider_actions_required"],
+      "properties": {
+        "status": {
+          "type": "string",
+          "const": "closed"
+        },
+        "closed_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "provider_actions_required": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/OrganizationClosureProviderAction"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
     "CreateProjectRequest": {
       "type": "object",
-      "description": "Creates one project inside the account selected by the authenticated human session.",
+      "description": "Creates one project inside the organization selected by the authenticated human session.",
       "required": ["name", "slug"],
       "properties": {
         "name": {
@@ -392,6 +460,10 @@
           "$ref": "#/$defs/RecipientLanguage",
           "default": "en",
           "description": "The application fallback locale for recipient-owned surfaces when no session, subscriber, or supported provider locale is available."
+        },
+        "privacy_mode": {
+          "$ref": "#/$defs/PrivacyMode",
+          "default": "minimal"
         }
       },
       "additionalProperties": false
@@ -452,10 +524,10 @@
     },
     "Project": {
       "type": "object",
-      "description": "An account-scoped application project with its complete test/live bootstrap.",
+      "description": "An organization-scoped application project with its complete test/live bootstrap.",
       "required": [
         "id",
-        "account_id",
+        "organization_id",
         "name",
         "slug",
         "status",
@@ -463,13 +535,14 @@
         "environments",
         "created_at",
         "updated_at",
-        "diagnostic_id"
+        "diagnostic_id",
+        "privacy_mode"
       ],
       "properties": {
         "id": {
           "$ref": "#/$defs/OpaqueIdentifier"
         },
-        "account_id": {
+        "organization_id": {
           "$ref": "#/$defs/OpaqueIdentifier"
         },
         "name": {
@@ -507,13 +580,16 @@
         },
         "diagnostic_id": {
           "$ref": "#/$defs/DiagnosticId"
+        },
+        "privacy_mode": {
+          "$ref": "#/$defs/PrivacyMode"
         }
       },
       "additionalProperties": false
     },
     "ProjectCollection": {
       "type": "object",
-      "description": "A stable page of projects inside the authenticated account.",
+      "description": "A stable page of projects inside the authenticated organization.",
       "required": ["items"],
       "properties": {
         "items": {
@@ -761,7 +837,7 @@
         "connections:write",
         "connections:read"
       ],
-      "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an account authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
+      "description": "One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an organization authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy."
     },
     "ApiCredentialScopeSet": {
       "type": "array",
@@ -946,25 +1022,25 @@
       },
       "additionalProperties": false
     },
-    "AccountCredentialId": {
+    "OrganizationCredentialId": {
       "type": "string",
-      "pattern": "^acred_[A-Za-z0-9_-]{21}[AQgw]$",
-      "description": "acred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes."
+      "pattern": "^ocred_[A-Za-z0-9_-]{21}[AQgw]$",
+      "description": "ocred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes."
     },
-    "AccountCredentialPrefix": {
+    "OrganizationCredentialPrefix": {
       "type": "string",
-      "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{8}$",
-      "description": "A safe display prefix containing the account-credential format marker and first eight base64url identity characters, never secret bytes."
+      "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{8}$",
+      "description": "A safe display prefix containing the organization-credential format marker and first eight base64url identity characters, never secret bytes."
     },
-    "AccountCredentialSecret": {
+    "OrganizationCredentialSecret": {
       "type": "string",
-      "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
+      "pattern": "^wb_oc1\\.ocred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
       "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
     },
-    "AccountCredentialScope": {
+    "OrganizationCredentialScope": {
       "type": "string",
       "enum": [
-        "account:read",
+        "organization:read",
         "projects:write",
         "projects:read",
         "messages:write",
@@ -977,20 +1053,20 @@
         "connections:write",
         "connections:read"
       ],
-      "description": "One account-credential capability. `account:read` is the account's project directory — listing the account's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the account. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An account credential is therefore never wider than a project credential would have been for the same project environment."
+      "description": "One organization-credential capability. `organization:read` is the organization's project directory — listing the organization's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the organization. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An organization credential is therefore never wider than a project credential would have been for the same project environment."
     },
-    "AccountCredentialScopeSet": {
+    "OrganizationCredentialScopeSet": {
       "type": "array",
       "minItems": 1,
       "maxItems": 12,
       "uniqueItems": true,
       "items": {
-        "$ref": "#/$defs/AccountCredentialScope"
+        "$ref": "#/$defs/OrganizationCredentialScope"
       }
     },
-    "CreateAccountCredentialRequest": {
+    "CreateOrganizationCredentialRequest": {
       "type": "object",
-      "description": "Creates one credential against the whole account rather than one project environment.",
+      "description": "Creates one credential against the whole organization rather than one project environment.",
       "required": ["label", "scopes"],
       "properties": {
         "label": {
@@ -999,12 +1075,12 @@
           "maxLength": 100
         },
         "scopes": {
-          "$ref": "#/$defs/AccountCredentialScopeSet"
+          "$ref": "#/$defs/OrganizationCredentialScopeSet"
         }
       },
       "additionalProperties": false
     },
-    "RotateAccountCredentialRequest": {
+    "RotateOrganizationCredentialRequest": {
       "type": "object",
       "description": "Creates a replacement with the same label and scopes and schedules terminal revocation of the replaced credential after the declared overlap.",
       "required": ["overlap_seconds"],
@@ -1017,9 +1093,9 @@
       },
       "additionalProperties": false
     },
-    "AccountCredential": {
+    "OrganizationCredential": {
       "type": "object",
-      "description": "Safe account-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.",
+      "description": "Safe organization-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.",
       "required": [
         "id",
         "prefix",
@@ -1031,10 +1107,10 @@
       ],
       "properties": {
         "id": {
-          "$ref": "#/$defs/AccountCredentialId"
+          "$ref": "#/$defs/OrganizationCredentialId"
         },
         "prefix": {
-          "$ref": "#/$defs/AccountCredentialPrefix"
+          "$ref": "#/$defs/OrganizationCredentialPrefix"
         },
         "label": {
           "type": "string",
@@ -1042,7 +1118,7 @@
           "maxLength": 100
         },
         "scopes": {
-          "$ref": "#/$defs/AccountCredentialScopeSet"
+          "$ref": "#/$defs/OrganizationCredentialScopeSet"
         },
         "created_by": {
           "$ref": "#/$defs/OpaqueIdentifier",
@@ -1092,16 +1168,16 @@
       ],
       "additionalProperties": false
     },
-    "AccountCredentialCollection": {
+    "OrganizationCredentialCollection": {
       "type": "object",
-      "description": "A stable page of safe account-credential metadata for one account.",
+      "description": "A stable page of safe organization-credential metadata for one organization.",
       "required": ["items"],
       "properties": {
         "items": {
           "type": "array",
           "maxItems": 100,
           "items": {
-            "$ref": "#/$defs/AccountCredential"
+            "$ref": "#/$defs/OrganizationCredential"
           }
         },
         "next_cursor": {
@@ -1122,30 +1198,30 @@
       },
       "additionalProperties": false
     },
-    "AccountCredentialSecretReveal": {
+    "OrganizationCredentialSecretReveal": {
       "type": "object",
       "description": "The creation-only response. The secret is emitted in this response exactly once and is never available from list, rotate-target, revoke, or later read responses.",
       "required": ["credential", "secret"],
       "properties": {
         "credential": {
-          "$ref": "#/$defs/AccountCredential"
+          "$ref": "#/$defs/OrganizationCredential"
         },
         "secret": {
-          "$ref": "#/$defs/AccountCredentialSecret"
+          "$ref": "#/$defs/OrganizationCredentialSecret"
         }
       },
       "additionalProperties": false
     },
-    "AccountCredentialRotation": {
+    "OrganizationCredentialRotation": {
       "type": "object",
       "description": "A creation-only replacement secret plus safe metadata for the credential it replaces.",
       "required": ["credential", "replaced_credential"],
       "properties": {
         "credential": {
-          "$ref": "#/$defs/AccountCredentialSecretReveal"
+          "$ref": "#/$defs/OrganizationCredentialSecretReveal"
         },
         "replaced_credential": {
-          "$ref": "#/$defs/AccountCredential"
+          "$ref": "#/$defs/OrganizationCredential"
         }
       },
       "additionalProperties": false
@@ -1590,7 +1666,7 @@
     },
     "RecipientSession": {
       "type": "object",
-      "description": "A browser-safe projection for the exact subscriber selected when the session was created. Account, project, environment, subscriber, origin, resolved return URL, provider identity, credentials, and group state are structurally absent.",
+      "description": "A browser-safe projection for the exact subscriber selected when the session was created. Organization, project, environment, subscriber, origin, resolved return URL, provider identity, credentials, and group state are structurally absent.",
       "required": [
         "id",
         "capability_prefix",
@@ -1969,6 +2045,115 @@
       },
       "additionalProperties": false
     },
+    "SubscriberDataExportRecord": {
+      "type": "object",
+      "description": "One semantic record held about the subscriber. The source names the durable store or recovered semantic value; data contains plaintext business fields and excludes custody metadata and secrets.",
+      "required": ["source", "data"],
+      "properties": {
+        "source": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 96,
+          "pattern": "^[a-z][a-z0-9_.-]*$"
+        },
+        "data": {
+          "type": "object",
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "SubscriberDataExportExcludedControllerData": {
+      "type": "object",
+      "description": "A category deliberately outside the customer-controller artifact because WhooshBang is controller for it.",
+      "required": ["category", "controller", "access"],
+      "properties": {
+        "category": {
+          "type": "string",
+          "enum": ["consent_lifecycle_audit", "service_logs"]
+        },
+        "controller": {
+          "type": "string",
+          "const": "whooshbang"
+        },
+        "access": {
+          "type": "string",
+          "const": "separate_recipient_request_required"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SubscriberDataExport": {
+      "type": "object",
+      "description": "A complete customer-controller access artifact for one subscriber across every environment in one project. provided_by_subscriber is the Article 20 portable subset; all three record groups together are the Article 15 access copy. WhooshBang-controller records are named but never mixed into the customer export.",
+      "required": [
+        "format",
+        "generated_at",
+        "controller_scope",
+        "project_id",
+        "environment_ids",
+        "subscriber_id",
+        "provided_by_subscriber",
+        "provided_by_customer",
+        "derived_by_service",
+        "excluded_controller_data"
+      ],
+      "properties": {
+        "format": {
+          "type": "string",
+          "const": "whooshbang.subscriber-data-export.v1"
+        },
+        "generated_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "controller_scope": {
+          "type": "string",
+          "const": "customer"
+        },
+        "project_id": {
+          "$ref": "#/$defs/OpaqueIdentifier"
+        },
+        "environment_ids": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/OpaqueIdentifier"
+          }
+        },
+        "subscriber_id": {
+          "$ref": "#/$defs/OpaqueIdentifier"
+        },
+        "provided_by_subscriber": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/SubscriberDataExportRecord"
+          }
+        },
+        "provided_by_customer": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/SubscriberDataExportRecord"
+          }
+        },
+        "derived_by_service": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/SubscriberDataExportRecord"
+          }
+        },
+        "excluded_controller_data": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/SubscriberDataExportExcludedControllerData"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
     "CreateRecipientGroupRequest": {
       "type": "object",
       "description": "Creates one static, developer-managed recipient group.",
@@ -3237,7 +3422,7 @@
         },
         "delivery_target": {
           "$ref": "#/$defs/MessageDeliveryTarget",
-          "description": "Optional routing override. Omit for notifier-default connection delivery, except reserved simulator destinations retained for compatibility."
+          "description": "Optional routing override. Simulator delivery and the reserved test: subscriber prefix are test-environment-only; live requests are refused with 400 request_invalid. Omit for notifier-default connection delivery or the reserved test-environment simulator default."
         },
         "connection_id": {
           "allOf": [{ "$ref": "#/$defs/OpaqueIdentifier" }],
@@ -3828,6 +4013,7 @@
         "environment_mismatch",
         "idempotency_key_required",
         "idempotency_conflict",
+        "privacy_operation_in_progress",
         "project_slug_conflict",
         "request_invalid",
         "replay_unavailable",
@@ -3845,7 +4031,7 @@
         "resource_not_found",
         "resource_expired",
         "cancellation_too_late",
-        "credential_account_mismatch",
+        "credential_organization_mismatch",
         "endpoint_rotation_conflict",
         "rate_limited",
         "provider_retryable",
@@ -4253,6 +4439,26 @@
             }
           }
         },
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "const": "https://whooshbang.flowxo.com/problems/privacy_operation_in_progress"
+            },
+            "title": {
+              "const": "Privacy operation in progress"
+            },
+            "status": {
+              "const": 409
+            },
+            "code": {
+              "const": "privacy_operation_in_progress"
+            },
+            "retryable": {
+              "const": true
+            }
+          }
+        },
         {
           "type": "object",
           "properties": {
@@ -4557,16 +4763,16 @@
           "type": "object",
           "properties": {
             "type": {
-              "const": "https://whooshbang.flowxo.com/problems/credential_account_mismatch"
+              "const": "https://whooshbang.flowxo.com/problems/credential_organization_mismatch"
             },
             "title": {
-              "const": "Credential account mismatch"
+              "const": "Credential organization mismatch"
             },
             "status": {
               "const": 403
             },
             "code": {
-              "const": "credential_account_mismatch"
+              "const": "credential_organization_mismatch"
             },
             "retryable": {
               "const": false
@@ -4656,16 +4862,16 @@
       ],
       "additionalProperties": false
     },
-    "AccountScope": {
+    "OrganizationScope": {
       "type": "string",
       "enum": ["projects:write", "projects:read"],
-      "description": "One account-level capability. Only a human session or an OAuth grant can hold one: a project credential lives inside a project and can never create or enumerate its siblings."
+      "description": "One organization-level capability. Only a human session or an OAuth grant can hold one: a project credential lives inside a project and can never create or enumerate its siblings."
     },
     "OAuthScope": {
-      "description": "A scope an OAuth grant may carry. Project-level scopes are the credential vocabulary unchanged; account-level scopes exist only here and on a human session.",
+      "description": "A scope an OAuth grant may carry. Project-level scopes are the credential vocabulary unchanged; organization-level scopes exist only here and on a human session.",
       "oneOf": [
         {
-          "$ref": "#/$defs/AccountScope"
+          "$ref": "#/$defs/OrganizationScope"
         },
         {
           "$ref": "#/$defs/ApiCredentialScope"
@@ -4708,7 +4914,7 @@
         "failed",
         "expired"
       ],
-      "description": "How far a guided setup has reached, which is the only thing a caller can act on while a connection is still `pending`. `awaiting_handoff` waits for the administrator to open the link on the Telegram account that will own the bot; `awaiting_creation` means that account is bound and the bot does not exist yet; `provisioning` means the bot exists and WhooshBang is installing delivery on it. `failed` and `expired` end the attempt without ending the connection \u2014 another attempt can be started on the same `pending` connection \u2014 and neither withdraws a bot Telegram has already created, because no provider API can delete one."
+      "description": "How far a guided setup has reached, which is the only thing a caller can act on while a connection is still `pending`. `awaiting_handoff` waits for the administrator to open the link on the Telegram account that will own the bot; `awaiting_creation` means that Telegram account is bound and the bot does not exist yet; `provisioning` means the bot exists and WhooshBang is installing delivery on it. `failed` and `expired` end the attempt without ending the connection \u2014 another attempt can be started on the same `pending` connection \u2014 and neither withdraws a bot Telegram has already created, because no provider API can delete one."
     },
     "HostedChannelConnectionSetupStatus": {
       "type": "string",
@@ -4877,7 +5083,7 @@
           "format": "uri",
           "pattern": "^https://[^\\s]+$",
           "maxLength": 2048,
-          "description": "The link the administrator opens to put their own Telegram account behind this setup; for Telegram it is `https://t.me/<manager>?start=<payload>`. It is a capability for exactly one setup session and nothing else: it names no account, no project, and no environment, it stops working at `expires_at`, and only the first Telegram account to open it is bound. It is not credential material, so displaying it costs nothing beyond letting whoever sees it first become the owner of the bot this setup creates. After `expired` or `failed` it binds nothing, and restarting the setup issues a new one rather than reviving this."
+          "description": "The link the administrator opens to put their own Telegram account behind this setup; for Telegram it is `https://t.me/<manager>?start=<payload>`. It is a capability for exactly one setup session and nothing else: it names no organization, no project, and no environment, it stops working at `expires_at`, and only the first Telegram account to open it is bound. It is not credential material, so displaying it costs nothing beyond letting whoever sees it first become the owner of the bot this setup creates. After `expired` or `failed` it binds nothing, and restarting the setup issues a new one rather than reviving this."
         },
         "expires_at": {
           "$ref": "#/$defs/Timestamp",
@@ -4891,7 +5097,7 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 200,
-          "description": "Why this attempt ended, in terms the administrator can act on. Absent when there is nothing both safe and useful to say: an attempt refused because that Telegram account already holds a live setup says only that, because naming the account, project, or environment holding the other one would disclose another customer."
+          "description": "Why this attempt ended, in terms the administrator can act on. Absent when there is nothing both safe and useful to say: an attempt refused because that Telegram account already holds a live setup says only that, because naming the organization, project, or environment holding the other one would disclose another customer."
         }
       },
       "additionalProperties": false
@@ -4981,7 +5187,7 @@
           "format": "uri",
           "pattern": "^https://api\\.slack\\.com/apps\\?[^\\s]+$",
           "maxLength": 8192,
-          "description": "Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no account, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing."
+          "description": "Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no organization, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing."
         },
         "expires_at": {
           "$ref": "#/$defs/Timestamp",
@@ -5364,7 +5570,7 @@
       "additionalProperties": false
     },
     "CreateChannelConnectionRequest": {
-      "description": "Selects the provider identity this environment will send through, discriminated on `mode`, and naming the provider it is for. The two customer-owned modes differ only in where the bot comes from: `customer_byok` connects one the customer already has, and `customer_managed` has Telegram create a new one on the administrator's own account. Neither supersedes the other, because a bot that already exists can never be adopted into managed mode \u2014 the manager that may act for a bot is fixed when the bot is created.",
+      "description": "Selects the provider identity this environment will send through, discriminated on `mode`, and naming the provider it is for. The two customer-owned modes differ only in where the bot comes from: `customer_byok` connects one the customer already has, and `customer_managed` has Telegram create a new one on the administrator's own Telegram account. Neither supersedes the other, because a bot that already exists can never be adopted into managed mode \u2014 the manager that may act for a bot is fixed when the bot is created.",
       "oneOf": [
         {
           "type": "object",
@@ -5796,7 +6002,7 @@
     },
     "CustomerOwnedSlackAppManifest": {
       "type": "object",
-      "description": "The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.\n\nIt exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no account, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.",
+      "description": "The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.\n\nIt exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no organization, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.",
       "required": [
         "creation_url",
         "app_name",
@@ -6013,6 +6219,22 @@
         { "$ref": "#/$defs/TelegramConnectionIdentity" },
         { "$ref": "#/$defs/SlackConnectionIdentity" }
       ]
+    },
+    "PrivacyMode": {
+      "type": "string",
+      "enum": ["minimal", "standard", "private"],
+      "description": "Project profile collection policy. minimal (the default for new and existing projects) keeps recipient language only; standard permits messenger profile data; private retains delivery routing and the customer-supplied subscriber identifier, with no profile data. Lowering collection erases existing fields the new mode disallows."
+    },
+    "UpdateProjectRequest": {
+      "type": "object",
+      "description": "Sets the project privacy policy. Moving from standard to minimal erases stored identifying profile data; moving to private also erases recipient language. Increasing collection does not restore erased data.",
+      "required": ["privacy_mode"],
+      "properties": {
+        "privacy_mode": {
+          "$ref": "#/$defs/PrivacyMode"
+        }
+      },
+      "additionalProperties": false
     }
   }
 }