@whooshbang/contracts 2.5.0 → 3.0.0

package/openapi/generated/whooshbang-v1.bundle.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.1",
   "info": {
     "title": "WhooshBang API",
-    "version": "2.5.0",
+    "version": "3.0.0",
     "description": "The V1 contract for human organization/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none organization for administration. A project credential selects one organization,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one organization and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
     "termsOfService": "https://flowxo.com/terms",
     "contact": {
@@ -2397,7 +2397,7 @@
         "x-required-scopes": ["projects:write"],
         "x-organization-membership": "required",
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -3070,7 +3070,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -3225,7 +3225,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -3306,7 +3306,7 @@
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "canonical_rgba_png_after_validation",
@@ -3428,7 +3428,7 @@
           "bound_subscriber"
         ],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -3856,7 +3856,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -3962,7 +3962,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -4099,7 +4099,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -4207,7 +4207,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -4265,7 +4265,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -4428,7 +4428,7 @@
         "security": [{ "machineCredential": [] }],
         "x-required-scopes": ["machine-events:ack"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -4599,7 +4599,7 @@
       },
       "post": {
         "operationId": "createCustomerEndpoint",
-        "summary": "Create an inactive customer endpoint and reveal its signing secret once",
+        "summary": "Create an active customer endpoint and reveal its signing secret once",
         "description": "Validates the final normalized public HTTPS destination before storing it.\nThe initial response includes the new signing secret. An equivalent\nidempotent replay returns the same logical endpoint without the secret;\ndifferent input for the same key returns `idempotency_conflict`.\n",
         "tags": ["Customer endpoints"],
         "security": [
@@ -4610,7 +4610,7 @@
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "final_normalized_url_and_validated_request",
@@ -4679,7 +4679,7 @@
             }
           },
           "201": {
-            "description": "Newly created unverified endpoint and its one-time signing secret.",
+            "description": "Newly active endpoint, recorded signed ping result, and its one-time signing secret.",
             "headers": {
               "WhooshBang-Diagnostic-Id": {
                 "$ref": "#/components/headers/DiagnosticId"
@@ -4766,7 +4766,7 @@
       ],
       "post": {
         "operationId": "verifyCustomerEndpoint",
-        "summary": "Send a signed challenge and activate the endpoint only after a signed echo",
+        "summary": "Send a signed test ping and record whether the receiver returns 2xx",
         "tags": ["Customer endpoints"],
         "security": [
           { "clerkSession": [] },
@@ -4810,7 +4810,7 @@
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "endpoint_and_validated_request",
@@ -5158,7 +5158,7 @@
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -5649,7 +5649,7 @@
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "selected_connection",
@@ -6259,7 +6259,7 @@
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "exact_request_body",
@@ -7045,7 +7045,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -7473,7 +7473,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -7606,7 +7606,7 @@
             "in": "query",
             "required": false,
             "description": "Only current members of the static group with this key, in the\nenvironment asked about. Combines with every other filter, so `q`\nsearches within the group.\n",
-            "schema": { "$ref": "#/components/schemas/DeveloperKey" }
+            "schema": { "$ref": "#/components/schemas/GroupKey" }
           },
           {
             "name": "created_after",
@@ -7681,7 +7681,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -7876,7 +7876,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -7942,12 +7942,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "get": {
@@ -8038,12 +8033,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "get": {
@@ -8125,12 +8115,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         },
         {
           "name": "subscriber_id",
@@ -8200,12 +8185,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "post": {
@@ -8216,7 +8196,7 @@
         "security": [{ "bearerCredential": [] }],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request_and_group_key",
@@ -8492,7 +8472,7 @@
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -8741,7 +8721,7 @@
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -8821,15 +8801,18 @@
       ],
       "get": {
         "operationId": "getMessageInEnvironment",
+        "x-notification-scopes": ["notifications:self", "notifications:team"],
         "summary": "Inspect a message in a named project environment",
-        "description": "The environment-scoped form of `getMessage`, including the same bounded\nlong poll. Inspection acknowledges, consumes, retries, and replays\nnothing.\n",
+        "description": "The environment-scoped form of `getMessage`, including the same bounded\nlong poll. Inspection acknowledges, consumes, retries, and replays\nnothing.\nNotification grants can read only current operator recipients in their\naudience: self means the signed-in person; team includes current\nteammates with access to this project. Customer subscribers and retired\nmemberships are hidden with 404, including during a held poll.\n",
         "parameters": [
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
         "security": [
           { "clerkSession": [] },
-          { "bearerGrant": [] },
+          { "bearerGrant": ["messages:read"] },
+          { "bearerGrant": ["notifications:self"] },
+          { "bearerGrant": ["notifications:team"] },
           { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
@@ -8896,14 +8879,17 @@
       ],
       "get": {
         "operationId": "getInteractionInEnvironment",
+        "x-notification-scopes": ["notifications:self", "notifications:team"],
         "summary": "Inspect an interaction response in a named project environment",
-        "description": "The environment-scoped form of `getInteraction`, including the same\nbounded long poll and the same retained-answer semantics.\n",
+        "description": "The environment-scoped form of `getInteraction`, including the same\nbounded long poll and the same retained-answer semantics.\nNotification grants can read only current operator recipients in their\naudience: self means the signed-in person; team includes current\nteammates with access to this project. Customer subscribers and retired\nmemberships are hidden with 404, including during a held poll.\n",
         "parameters": [
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
         "security": [
-          { "bearerGrant": [] },
+          { "bearerGrant": ["messages:read"] },
+          { "bearerGrant": ["notifications:self"] },
+          { "bearerGrant": ["notifications:team"] },
           { "bearerOrganizationCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
@@ -9094,7 +9080,7 @@
         ],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_organization", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -9175,7 +9161,7 @@
         ],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -9383,7 +9369,7 @@
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -9525,7 +9511,7 @@
             "in": "query",
             "required": false,
             "description": "Only current members of the static group with this key, in the\nenvironment asked about. Combines with every other filter, so `q`\nsearches within the group.\n",
-            "schema": { "$ref": "#/components/schemas/DeveloperKey" }
+            "schema": { "$ref": "#/components/schemas/GroupKey" }
           },
           {
             "name": "created_after",
@@ -9605,7 +9591,7 @@
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -9920,7 +9906,7 @@
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request",
@@ -9988,12 +9974,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "get": {
@@ -10104,12 +10085,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "get": {
@@ -10199,12 +10175,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         },
         {
           "name": "subscriber_id",
@@ -10288,12 +10259,7 @@
           "name": "group_key",
           "in": "path",
           "required": true,
-          "schema": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 63,
-            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-          }
+          "schema": { "$ref": "#/components/schemas/GroupKey" }
         }
       ],
       "post": {
@@ -10309,7 +10275,7 @@
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_project_environment", "operation_id", "key"],
           "equivalence": "validated_request_and_group_key",
@@ -10811,7 +10777,7 @@
         ],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
-          "required": true,
+          "required": false,
           "retention_seconds": 604800,
           "scope": ["authenticated_environment", "operation_id", "key"],
           "equivalence": "validated_request_after_documented_defaults",
@@ -10885,118 +10851,635 @@
           "429": { "$ref": "#/components/responses/RateLimited" }
         }
       }
-    }
-  },
-  "components": {
-    "securitySchemes": {
-      "clerkSession": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "Clerk session JWT",
-        "description": "A verified human session whose active Clerk organization selects exactly\none WhooshBang organization. Every administration operation rechecks the\nprojected organization membership; session identity never selects a project\nor environment from request data.\n"
-      },
-      "bearerGrant": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "OAuth 2.0 access token",
-        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting organization member. It selects exactly one organization and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. A project\ncredential can name no project but its own; an organization credential names\none per call the same way this does.\n"
-      },
-      "bearerOrganizationCredential": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "wb_oc1.ocred_<16-byte-base64url>.<32-byte-base64url-secret>",
-        "description": "Selects exactly one organization and nothing below it. It names no project\nand no environment, so it authenticates only operations whose path does,\nand its authority there is the intersection of its scopes with the\nproject-credential vocabulary — never wider than a project credential\nwould have been for the same project environment. A path naming a\nproject outside its organization is refused with `credential_organization_mismatch`\nrather than a bare scope failure. `organization:read` is the one scope it can\nhold that a project credential cannot, and it authorizes only the\norganization's project directory: listing the organization's projects and reading\none, which is the organization-wide question a project credential cannot ask\nand the reason a `--project <slug>` selector can work at all. It is\nrequired *in addition to* each of those operations' own\n`x-required-scopes`, never instead of them.\nCredentials cannot be read after creation.\n"
-      },
-      "bearerCredential": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "wb_pc1.pcred_<16-byte-base64url>.<32-byte-base64url-secret>",
-        "description": "Selects exactly one organization, project, and `test` or `live` environment.\nCredentials cannot be read after creation. Except for explicitly\nsynthetic creation/rotation reveal fixtures, complete bearer values\nmust never appear in fixtures, errors, logs, metrics, or inspection\nsurfaces.\n"
-      },
-      "machineCredential": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "wb_mc1.mcred_<16-byte-base64url>.<32-byte-base64url-secret>",
-        "description": "A locally generated runtime credential bound server-side to exactly one\nproject/environment, machine client, notifier, subscriber, binding, and\nevent stream. Project credentials cannot use machine-only endpoints.\nRevoked credentials fail before resource lookup.\n"
-      },
-      "recipientSessionCapability": {
-        "type": "apiKey",
-        "in": "header",
-        "name": "WhooshBang-Recipient-Capability",
-        "description": "A creation-only, short-lived capability bound server-side to one exact\norganization, project, environment, subscriber, configuration revision,\npresenting origin, and registered return destination. It is accepted\nonly on the `/v1/recipient-session` browser surface and never as bearer\nauthority on an ordinary application route.\n"
-      }
     },
-    "parameters": {
-      "IdempotencyKey": {
-        "name": "Idempotency-Key",
-        "in": "header",
-        "required": true,
-        "description": "Visible ASCII key retained for seven days from first acceptance.\nEquivalent replay returns the original status and logical resource;\nmaterially different validated input returns `idempotency_conflict`.\n",
-        "schema": { "$ref": "#/components/schemas/IdempotencyKey" }
-      },
-      "SubscriptionLinkId": {
-        "name": "subscription_link_id",
-        "in": "path",
-        "required": true,
-        "description": "Opaque subscription-link identity; never authorization.",
-        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-      },
-      "ProjectId": {
-        "name": "project_id",
-        "in": "path",
-        "required": true,
-        "description": "Opaque project identity; never authorization.",
-        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-      },
-      "EnvironmentId": {
-        "name": "environment_id",
-        "in": "path",
-        "required": true,
-        "description": "Opaque project-environment identity; never authorization.",
-        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
-      },
-      "ApiCredentialId": {
-        "name": "credential_id",
-        "in": "path",
-        "required": true,
-        "description": "Canonical opaque project credential identity; never a readable secret.",
-        "schema": { "$ref": "#/components/schemas/ApiCredentialId" }
-      },
-      "OrganizationCredentialId": {
-        "name": "organization_credential_id",
-        "in": "path",
-        "required": true,
-        "description": "Canonical opaque organization credential identity; never a readable secret.",
-        "schema": { "$ref": "#/components/schemas/OrganizationCredentialId" }
-      },
-      "ApiCredentialAfterCursor": {
-        "name": "after",
-        "in": "query",
-        "required": false,
-        "description": "Opaque cursor returned by the previous credential page.",
-        "schema": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 256,
-          "pattern": "^[A-Za-z0-9_-]+$"
+    "/v1/operator-messages": {
+      "post": {
+        "operationId": "sendOperatorMessageWithCredential",
+        "summary": "sendOperatorMessage",
+        "description": "Message a current teammate by name or operator ID. Personal callers may omit recipient or use me. Shared credentials must name a recipient. Runtime machine credentials report recipient_required for omitted or me; named operator sends are forbidden because runtime authority remains subscriber-bound.",
+        "tags": ["Operators"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateOperatorMessageRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OperatorMessageResult"
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
         }
-      },
-      "ApiCredentialPageLimit": {
-        "name": "limit",
-        "in": "query",
-        "required": false,
-        "description": "Maximum credential metadata records returned in one page.",
-        "schema": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 100,
-          "default": 50
+      }
+    },
+    "/v1/operators/broadcasts": {
+      "post": {
+        "operationId": "broadcastOperatorsWithCredential",
+        "summary": "broadcastOperators",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateGroupBroadcastRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorBroadcast" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
         }
-      },
-      "ListAfterCursor": {
-        "name": "after",
-        "in": "query",
-        "required": false,
+      }
+    },
+    "/v1/operators/broadcasts/{broadcast_id}": {
+      "get": {
+        "operationId": "getOperatorBroadcastWithCredential",
+        "summary": "getOperatorBroadcast",
+        "description": "Membership-derived operator messaging. Only the authenticated human can manage personal preferences.",
+        "tags": ["Operators"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          {
+            "name": "broadcast_id",
+            "in": "path",
+            "required": true,
+            "schema": { "type": "string" }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Authorized result.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/OperatorBroadcast" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" }
+        }
+      }
+    },
+    "/v1/customer-endpoints": {
+      "get": {
+        "operationId": "listCustomerEndpointsWithCredential",
+        "summary": "List safe customer-endpoint health metadata",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ListAfterCursor" },
+          { "$ref": "#/components/parameters/ListPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Safe endpoint lifecycle and health metadata without URLs or protected content.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointCollection"
+                },
+                "examples": {
+                  "endpoints": {
+                    "value": {
+                      "items": [
+                        {
+                          "id": "endpoint_11111111111111111111111111111111",
+                          "project_id": "project_synthetic_alpha",
+                          "environment_id": "environment_test_synthetic_alpha",
+                          "environment": "test",
+                          "status": "active",
+                          "verification_status": "verified",
+                          "event_types": [
+                            "interaction.received",
+                            "message.delivered"
+                          ],
+                          "secret_version": 2,
+                          "health": "failing",
+                          "created_at": "2026-08-06T12:00:00.000Z",
+                          "updated_at": "2026-08-06T14:00:00.000Z",
+                          "verification_attempted_at": "2026-08-06T12:05:00.000Z",
+                          "verified_at": "2026-08-06T12:05:00.000Z",
+                          "rotated_at": "2026-08-06T13:00:00.000Z",
+                          "last_success_at": "2026-08-06T13:30:00.000Z",
+                          "last_failure": {
+                            "at": "2026-08-06T14:00:00.000Z",
+                            "category": "network_failure"
+                          },
+                          "diagnostic_id": "diag_endpoint_list_001"
+                        }
+                      ],
+                      "total": 1,
+                      "page": 1,
+                      "page_size": 50
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      },
+      "post": {
+        "operationId": "createCustomerEndpointWithCredential",
+        "summary": "Create an active customer endpoint and reveal its signing secret once",
+        "description": "Creates an active endpoint and sends a signed diagnostic ping. A 2xx acknowledges the ping; no echo handshake is required. SSRF destination validation applies.",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "x-idempotency": {
+          "required": false,
+          "retention_seconds": 604800,
+          "scope": ["authenticated_environment", "operation_id", "key"],
+          "equivalence": "final_normalized_url_and_validated_request",
+          "replay_retention_extends": false
+        },
+        "x-secret-reveal": {
+          "responses": 1,
+          "replayable": false,
+          "later_reads": "metadata_only"
+        },
+        "parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateCustomerEndpointRequest"
+              },
+              "examples": {
+                "createEndpoint": {
+                  "value": {
+                    "url": "https://events.example.com/whooshbang",
+                    "event_types": [
+                      "interaction.received",
+                      "message.delivered"
+                    ],
+                    "local_test": false
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Equivalent replay returning safe endpoint metadata without the secret.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointMutationResult"
+                },
+                "examples": {
+                  "replayed": {
+                    "value": {
+                      "endpoint": {
+                        "id": "endpoint_11111111111111111111111111111111",
+                        "project_id": "project_synthetic_alpha",
+                        "environment_id": "environment_test_synthetic_alpha",
+                        "environment": "test",
+                        "status": "unverified",
+                        "verification_status": "pending",
+                        "event_types": [
+                          "interaction.received",
+                          "message.delivered"
+                        ],
+                        "secret_version": 1,
+                        "health": "never_delivered",
+                        "created_at": "2026-08-06T12:00:00.000Z",
+                        "updated_at": "2026-08-06T12:00:00.000Z",
+                        "diagnostic_id": "diag_endpoint_replay_001"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Newly active endpoint, recorded signed ping result, and its one-time signing secret.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointMutationResult"
+                },
+                "examples": {
+                  "created": {
+                    "value": {
+                      "endpoint": {
+                        "id": "endpoint_11111111111111111111111111111111",
+                        "project_id": "project_synthetic_alpha",
+                        "environment_id": "environment_test_synthetic_alpha",
+                        "environment": "test",
+                        "status": "unverified",
+                        "verification_status": "pending",
+                        "event_types": [
+                          "interaction.received",
+                          "message.delivered"
+                        ],
+                        "secret_version": 1,
+                        "health": "never_delivered",
+                        "created_at": "2026-08-06T12:00:00.000Z",
+                        "updated_at": "2026-08-06T12:00:00.000Z",
+                        "diagnostic_id": "diag_endpoint_create_001"
+                      },
+                      "secret": "whsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "409": { "$ref": "#/components/responses/Conflict" },
+          "503": { "$ref": "#/components/responses/ProviderRetryable" }
+        }
+      }
+    },
+    "/v1/customer-endpoints/{endpoint_id}": {
+      "parameters": [{ "$ref": "#/components/parameters/CustomerEndpointId" }],
+      "get": {
+        "operationId": "getCustomerEndpointWithCredential",
+        "summary": "Read safe lifecycle and health metadata for one endpoint",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:read"],
+        "responses": {
+          "200": {
+            "description": "Safe endpoint metadata.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/CustomerEndpoint" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      }
+    },
+    "/v1/customer-endpoints/{endpoint_id}/verify": {
+      "parameters": [{ "$ref": "#/components/parameters/CustomerEndpointId" }],
+      "post": {
+        "operationId": "verifyCustomerEndpointWithCredential",
+        "summary": "Send a signed test ping and record whether the receiver returns 2xx",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "responses": {
+          "200": {
+            "description": "Verified active endpoint metadata.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/CustomerEndpoint" }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "502": { "$ref": "#/components/responses/ProviderTerminal" },
+          "503": { "$ref": "#/components/responses/ProviderRetryable" }
+        }
+      }
+    },
+    "/v1/customer-endpoints/{endpoint_id}/rotate": {
+      "parameters": [{ "$ref": "#/components/parameters/CustomerEndpointId" }],
+      "post": {
+        "operationId": "rotateCustomerEndpointWithCredential",
+        "summary": "Create a new signing version with bounded old/new overlap",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "x-idempotency": {
+          "required": false,
+          "retention_seconds": 604800,
+          "scope": ["authenticated_environment", "operation_id", "key"],
+          "equivalence": "endpoint_and_validated_request",
+          "replay_retention_extends": false
+        },
+        "x-secret-reveal": {
+          "responses": 1,
+          "replayable": false,
+          "later_reads": "metadata_only"
+        },
+        "parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RotateCustomerEndpointRequest"
+              },
+              "examples": { "rotate": { "value": { "overlap_seconds": 3600 } } }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Equivalent replay without another secret reveal.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointMutationResult"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Rotated endpoint and one-time new secret.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointMutationResult"
+                },
+                "examples": {
+                  "rotated": {
+                    "value": {
+                      "endpoint": {
+                        "id": "endpoint_11111111111111111111111111111111",
+                        "project_id": "project_synthetic_alpha",
+                        "environment_id": "environment_test_synthetic_alpha",
+                        "environment": "test",
+                        "status": "active",
+                        "verification_status": "verified",
+                        "event_types": [
+                          "interaction.received",
+                          "message.delivered"
+                        ],
+                        "secret_version": 2,
+                        "health": "healthy",
+                        "created_at": "2026-08-06T12:00:00.000Z",
+                        "updated_at": "2026-08-06T13:00:00.000Z",
+                        "verification_attempted_at": "2026-08-06T12:05:00.000Z",
+                        "verified_at": "2026-08-06T12:05:00.000Z",
+                        "rotated_at": "2026-08-06T13:00:00.000Z",
+                        "last_success_at": "2026-08-06T12:30:00.000Z",
+                        "diagnostic_id": "diag_endpoint_rotate_001"
+                      },
+                      "secret": "whsec_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "409": { "$ref": "#/components/responses/EndpointRotationConflict" }
+        }
+      }
+    },
+    "/v1/customer-endpoints/{endpoint_id}/{action}": {
+      "parameters": [
+        { "$ref": "#/components/parameters/CustomerEndpointId" },
+        {
+          "name": "action",
+          "in": "path",
+          "required": true,
+          "schema": { "type": "string", "enum": ["pause", "resume", "disable"] }
+        }
+      ],
+      "post": {
+        "operationId": "transitionCustomerEndpointWithCredential",
+        "summary": "Pause, resume, or terminally disable an endpoint",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:write"],
+        "x-repeat-semantics": {
+          "same_target": "idempotent",
+          "secret_returned": false
+        },
+        "responses": {
+          "200": {
+            "description": "Updated safe endpoint metadata.",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/CustomerEndpoint" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        },
+        "description": "Creates an active endpoint and sends a signed diagnostic ping. A 2xx acknowledges the ping; no echo handshake is required. SSRF destination validation applies."
+      }
+    },
+    "/v1/customer-endpoints/{endpoint_id}/attempts": {
+      "parameters": [{ "$ref": "#/components/parameters/CustomerEndpointId" }],
+      "get": {
+        "operationId": "listCustomerEndpointAttemptsWithCredential",
+        "summary": "Inspect protected content-free delivery diagnostics",
+        "tags": ["Customer endpoints"],
+        "security": [{ "bearerCredential": [] }],
+        "x-required-scopes": ["messages:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ListAfterCursor" },
+          { "$ref": "#/components/parameters/ListPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Safe status, timing, and failure categories only.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerEndpointAttemptCollection"
+                },
+                "examples": {
+                  "attempts": {
+                    "value": {
+                      "endpoint_id": "endpoint_11111111111111111111111111111111",
+                      "attempts": [
+                        {
+                          "id": "ceattempt_11111111111111111111111111111111",
+                          "event_id": "evt_interaction_received_synthetic",
+                          "attempt": 1,
+                          "status": "terminal_failed",
+                          "diagnostic_code": "network_failure",
+                          "started_at": "2026-08-06T14:00:00.000Z",
+                          "completed_at": "2026-08-06T14:00:01.000Z",
+                          "created_at": "2026-08-06T14:00:00.000Z"
+                        }
+                      ],
+                      "total": 1,
+                      "page": 1,
+                      "page_size": 50
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "clerkSession": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "Clerk session JWT",
+        "description": "A verified human session whose active Clerk organization selects exactly\none WhooshBang organization. Every administration operation rechecks the\nprojected organization membership; session identity never selects a project\nor environment from request data.\n"
+      },
+      "bearerGrant": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "OAuth 2.0 access token",
+        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting organization member. It selects exactly one organization and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. A project\ncredential can name no project but its own; an organization credential names\none per call the same way this does.\n"
+      },
+      "bearerOrganizationCredential": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "wb_oc1.ocred_<16-byte-base64url>.<32-byte-base64url-secret>",
+        "description": "Selects exactly one organization and nothing below it. It names no project\nand no environment, so it authenticates only operations whose path does,\nand its authority there is the intersection of its scopes with the\nproject-credential vocabulary — never wider than a project credential\nwould have been for the same project environment. A path naming a\nproject outside its organization is refused with `credential_organization_mismatch`\nrather than a bare scope failure. `organization:read` is the one scope it can\nhold that a project credential cannot, and it authorizes only the\norganization's project directory: listing the organization's projects and reading\none, which is the organization-wide question a project credential cannot ask\nand the reason a `--project <slug>` selector can work at all. It is\nrequired *in addition to* each of those operations' own\n`x-required-scopes`, never instead of them.\nCredentials cannot be read after creation.\n"
+      },
+      "bearerCredential": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "wb_pc1.pcred_<16-byte-base64url>.<32-byte-base64url-secret>",
+        "description": "Selects exactly one organization, project, and `test` or `live` environment.\nCredentials cannot be read after creation. Except for explicitly\nsynthetic creation/rotation reveal fixtures, complete bearer values\nmust never appear in fixtures, errors, logs, metrics, or inspection\nsurfaces.\n"
+      },
+      "machineCredential": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "wb_mc1.mcred_<16-byte-base64url>.<32-byte-base64url-secret>",
+        "description": "A locally generated runtime credential bound server-side to exactly one\nproject/environment, machine client, notifier, subscriber, binding, and\nevent stream. Project credentials cannot use machine-only endpoints.\nRevoked credentials fail before resource lookup.\n"
+      },
+      "recipientSessionCapability": {
+        "type": "apiKey",
+        "in": "header",
+        "name": "WhooshBang-Recipient-Capability",
+        "description": "A creation-only, short-lived capability bound server-side to one exact\norganization, project, environment, subscriber, configuration revision,\npresenting origin, and registered return destination. It is accepted\nonly on the `/v1/recipient-session` browser surface and never as bearer\nauthority on an ordinary application route.\n"
+      }
+    },
+    "parameters": {
+      "IdempotencyKey": {
+        "name": "Idempotency-Key",
+        "in": "header",
+        "required": false,
+        "description": "Optional visible ASCII key retained for seven days from first acceptance.\nA retry with the same key returns the original result and never acts twice.\nWithout a key each request is new.\nEquivalent replay returns the original status and logical resource;\nmaterially different validated input returns `idempotency_conflict`.\n",
+        "schema": { "$ref": "#/components/schemas/IdempotencyKey" }
+      },
+      "SubscriptionLinkId": {
+        "name": "subscription_link_id",
+        "in": "path",
+        "required": true,
+        "description": "Opaque subscription-link identity; never authorization.",
+        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+      },
+      "ProjectId": {
+        "name": "project_id",
+        "in": "path",
+        "required": true,
+        "description": "Opaque project identity; never authorization.",
+        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+      },
+      "EnvironmentId": {
+        "name": "environment_id",
+        "in": "path",
+        "required": true,
+        "description": "Opaque project-environment identity; never authorization.",
+        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+      },
+      "ApiCredentialId": {
+        "name": "credential_id",
+        "in": "path",
+        "required": true,
+        "description": "Canonical opaque project credential identity; never a readable secret.",
+        "schema": { "$ref": "#/components/schemas/ApiCredentialId" }
+      },
+      "OrganizationCredentialId": {
+        "name": "organization_credential_id",
+        "in": "path",
+        "required": true,
+        "description": "Canonical opaque organization credential identity; never a readable secret.",
+        "schema": { "$ref": "#/components/schemas/OrganizationCredentialId" }
+      },
+      "ApiCredentialAfterCursor": {
+        "name": "after",
+        "in": "query",
+        "required": false,
+        "description": "Opaque cursor returned by the previous credential page.",
+        "schema": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[A-Za-z0-9_-]+$"
+        }
+      },
+      "ApiCredentialPageLimit": {
+        "name": "limit",
+        "in": "query",
+        "required": false,
+        "description": "Maximum credential metadata records returned in one page.",
+        "schema": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 100,
+          "default": 50
+        }
+      },
+      "ListAfterCursor": {
+        "name": "after",
+        "in": "query",
+        "required": false,
         "description": "Opaque cursor returned by the previous page of this list.",
         "schema": {
           "type": "string",
@@ -11304,13 +11787,13 @@
       "CreateOperatorMessageRequest": {
         "type": "object",
         "description": "Send to a teammate by exact name or operator ID, or use me. Omitted recipient means the verified authenticated human only. Shared and service credentials must name a recipient. Preferred channel, service-email billing and marketing restrictions still apply.",
-        "required": ["content"],
+        "required": [],
         "properties": {
           "recipient": { "type": "string", "minLength": 1, "maxLength": 128 },
-          "content": { "$ref": "#/components/schemas/MessageContent" },
+          "content": { "$ref": "#/components/schemas/MessageContentInput" },
           "expires_at": {
             "$ref": "#/components/schemas/Timestamp",
-            "description": "Optional server-authoritative expiry no more than 24 hours after acceptance."
+            "description": "Optional server-authoritative expiry after acceptance, through year 9999. Omit for 24 hours."
           },
           "correlation_id": {
             "type": "string",
@@ -11327,7 +11810,31 @@
             "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
           }
         },
-        "additionalProperties": false
+        "additionalProperties": false,
+        "allOf": [
+          {
+            "anyOf": [
+              {
+                "required": ["content"],
+                "properties": {
+                  "content": {
+                    "$ref": "#/components/schemas/MessageContentInput"
+                  }
+                },
+                "additionalProperties": true
+              },
+              {
+                "required": ["interaction"],
+                "properties": {
+                  "interaction": {
+                    "$ref": "#/components/schemas/InteractionSendRequest"
+                  }
+                },
+                "additionalProperties": true
+              }
+            ]
+          }
+        ]
       },
       "OperatorMessageResult": {
         "type": "object",
@@ -15181,7 +15688,7 @@
       "CreateCustomerEndpointRequest": {
         "type": "object",
         "description": "Creates one project/environment endpoint. The service validates the final normalized destination and never returns it from health or diagnostic reads.",
-        "required": ["url", "event_types"],
+        "required": ["url"],
         "properties": {
           "url": {
             "type": "string",
@@ -15207,12 +15714,13 @@
       },
       "RotateCustomerEndpointRequest": {
         "type": "object",
-        "required": ["overlap_seconds"],
+        "required": [],
         "properties": {
           "overlap_seconds": {
             "type": "integer",
             "minimum": 60,
-            "maximum": 86400
+            "maximum": 86400,
+            "default": 86400
           }
         },
         "additionalProperties": false
@@ -15269,7 +15777,13 @@
           "last_failure": {
             "$ref": "#/components/schemas/CustomerEndpointFailure"
           },
-          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" },
+          "pause_reason": {
+            "type": "string",
+            "enum": ["customer", "sustained_failure", "probe_failed"]
+          },
+          "next_probe_at": { "$ref": "#/components/schemas/Timestamp" },
+          "recovery_pending": { "type": "boolean" }
         },
         "additionalProperties": false
       },
@@ -15713,7 +16227,7 @@
       "CreateSubscriptionLinkRequest": {
         "type": "object",
         "description": "Creates one project- and environment-scoped, single-use authorization link.",
-        "required": ["subscriber_id", "channels"],
+        "required": ["subscriber_id"],
         "properties": {
           "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
           "notifier_id": {
@@ -15729,7 +16243,7 @@
           },
           "connection_id": {
             "$ref": "#/components/schemas/OpaqueIdentifier",
-            "description": "The exact channel connection to authorize. Required for Slack. For Telegram or email, omission resolves an unambiguous default or sole compatible connection; it never selects an arbitrary fallback."
+            "description": "Optional exact connection. Otherwise the default or only compatible connection is used."
           },
           "address": {
             "$ref": "#/components/schemas/EmailAddress",
@@ -15764,16 +16278,6 @@
           {
             "if": { "properties": { "address": {} }, "required": ["address"] },
             "then": { "properties": { "channels": { "const": ["email"] } } }
-          },
-          {
-            "if": {
-              "properties": { "channels": { "const": ["slack"] } },
-              "required": ["channels"]
-            },
-            "then": {
-              "required": ["connection_id"],
-              "properties": { "connection_id": {} }
-            }
           }
         ],
         "additionalProperties": false
@@ -15892,9 +16396,14 @@
       "CreateMessageRequest": {
         "type": "object",
         "description": "Creates one logical message for one subscriber and one resolved channel binding.",
-        "required": ["to", "content"],
+        "required": ["to"],
         "properties": {
-          "to": { "$ref": "#/components/schemas/MessageTarget" },
+          "to": {
+            "oneOf": [
+              { "$ref": "#/components/schemas/MessageTarget" },
+              { "$ref": "#/components/schemas/OpaqueIdentifier" }
+            ]
+          },
           "notifier_id": {
             "allOf": [{ "$ref": "#/components/schemas/OpaqueIdentifier" }],
             "default": "default"
@@ -15907,10 +16416,10 @@
             "allOf": [{ "$ref": "#/components/schemas/OpaqueIdentifier" }],
             "description": "Optional channel connection to send through, from the environment's connections. The subscriber must be connected through it; the service never substitutes another connection or provider. A connection the subscriber has not connected through is refused as `subscriber_not_connected` when they are connected through another, and as an unchosen send would be (`subscriber_unbound` or `preferred_binding_unavailable`) when no connected channel can take the message. Omitted, the service chooses: the subscriber's preferred channel when they set one, otherwise the default connection when they are connected there, otherwise the connection they connected through most recently. The accepted message's `binding.connection_id` records the connection used. Implies `delivery_target: connection`."
           },
-          "content": { "$ref": "#/components/schemas/MessageContent" },
+          "content": { "$ref": "#/components/schemas/MessageContentInput" },
           "expires_at": {
             "$ref": "#/components/schemas/Timestamp",
-            "description": "Optional server-authoritative expiry no more than 24 hours after acceptance."
+            "description": "Optional server-authoritative expiry after acceptance, through year 9999. Omit for 24 hours."
           },
           "correlation_id": {
             "type": "string",
@@ -15936,6 +16445,28 @@
             "then": {
               "properties": { "delivery_target": { "const": "connection" } }
             }
+          },
+          {
+            "anyOf": [
+              {
+                "required": ["content"],
+                "properties": {
+                  "content": {
+                    "$ref": "#/components/schemas/MessageContentInput"
+                  }
+                },
+                "additionalProperties": true
+              },
+              {
+                "required": ["interaction"],
+                "properties": {
+                  "interaction": {
+                    "$ref": "#/components/schemas/InteractionSendRequest"
+                  }
+                },
+                "additionalProperties": true
+              }
+            ]
           }
         ],
         "additionalProperties": false
@@ -16469,7 +17000,9 @@
               "type": {
                 "const": "https://whooshbang.flowxo.com/problems/idempotency_key_required"
               },
-              "title": { "const": "Idempotency key required" },
+              "title": {
+                "enum": ["Invalid idempotency key", "Idempotency key required"]
+              },
               "status": { "const": 400 },
               "code": { "const": "idempotency_key_required" },
               "retryable": { "const": false }
@@ -16782,7 +17315,7 @@
         "additionalProperties": false
       },
       "InteractionSendRequest": {
-        "description": "Send-time interaction. Choose expires_in_seconds or expires_at; omit both for 24 hours from server acceptance. Idempotent replays retain the original resolved deadline.",
+        "description": "Options infer select; otherwise confirm. Typed replies require type: input. Omit expiry for 24 hours.",
         "oneOf": [
           { "$ref": "#/components/schemas/ConfirmInteractionSendRequest" },
           { "$ref": "#/components/schemas/SelectInteractionSendRequest" },
@@ -18065,9 +18598,6 @@
             "description": "Atomically create or resolve one subscriber and assert existing consent for an exact customer-owned email connection and domain. No verification message is sent. Revocation, suppression, recipient pause, holds and unhealthy authority take precedence. An omitted source is recorded as customer.",
             "required": [
               "subscriber_id",
-              "notifier_id",
-              "connection_id",
-              "domain_id",
               "address",
               "consented",
               "consented_at"
@@ -18077,7 +18607,8 @@
                 "$ref": "#/components/schemas/OpaqueIdentifier"
               },
               "notifier_id": {
-                "$ref": "#/components/schemas/OpaqueIdentifier"
+                "$ref": "#/components/schemas/OpaqueIdentifier",
+                "default": "default"
               },
               "connection_id": {
                 "$ref": "#/components/schemas/OpaqueIdentifier"
@@ -18104,9 +18635,6 @@
             "description": "Enroll an application-verified user for service email. This is relationship evidence, never consent or WhooshBang mailbox verification. An existing prior-consent binding with the same subscriber, address, notifier, connection and domain is reused with its original evidence and status.",
             "required": [
               "subscriber_id",
-              "notifier_id",
-              "connection_id",
-              "domain_id",
               "address",
               "basis",
               "source",
@@ -18117,7 +18645,8 @@
                 "$ref": "#/components/schemas/OpaqueIdentifier"
               },
               "notifier_id": {
-                "$ref": "#/components/schemas/OpaqueIdentifier"
+                "$ref": "#/components/schemas/OpaqueIdentifier",
+                "default": "default"
               },
               "connection_id": {
                 "$ref": "#/components/schemas/OpaqueIdentifier"
@@ -18159,7 +18688,7 @@
             "type": "array",
             "maxItems": 50,
             "uniqueItems": true,
-            "items": { "$ref": "#/components/schemas/DeveloperKey" }
+            "items": { "$ref": "#/components/schemas/GroupKey" }
           }
         },
         "additionalProperties": false
@@ -18231,7 +18760,7 @@
             "maxItems": 200,
             "uniqueItems": true,
             "description": "The keys of the static groups this subscriber belongs to in the environment asked about. Present when one subscriber is read.",
-            "items": { "$ref": "#/components/schemas/DeveloperKey" }
+            "items": { "$ref": "#/components/schemas/GroupKey" }
           },
           "last_activity_at": {
             "$ref": "#/components/schemas/Timestamp",
@@ -18413,9 +18942,9 @@
       "CreateSubscriberGroupRequest": {
         "type": "object",
         "description": "Creates one static, developer-managed subscriber group.",
-        "required": ["key", "display_name"],
+        "required": ["key"],
         "properties": {
-          "key": { "$ref": "#/components/schemas/DeveloperKey" },
+          "key": { "$ref": "#/components/schemas/GroupKey" },
           "display_name": {
             "type": "string",
             "minLength": 1,
@@ -18428,8 +18957,8 @@
       "UpdateSubscriberGroupRequest": {
         "type": "object",
         "description": "Renames or redescribes an active group. Its key and static membership model cannot change.",
-        "required": ["row_version"],
-        "minProperties": 2,
+        "required": [],
+        "minProperties": 1,
         "properties": {
           "row_version": { "type": "integer", "minimum": 1 },
           "display_name": {
@@ -18439,7 +18968,14 @@
           },
           "description": { "type": ["string", "null"], "maxLength": 500 }
         },
-        "additionalProperties": false
+        "additionalProperties": false,
+        "anyOf": [
+          {
+            "required": ["display_name"],
+            "properties": { "display_name": {} }
+          },
+          { "required": ["description"], "properties": { "description": {} } }
+        ]
       },
       "SubscriberGroup": {
         "type": "object",
@@ -18466,7 +19002,7 @@
           "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
           "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
           "environment": { "$ref": "#/components/schemas/Environment" },
-          "key": { "$ref": "#/components/schemas/DeveloperKey" },
+          "key": { "$ref": "#/components/schemas/GroupKey" },
           "display_name": {
             "type": "string",
             "minLength": 1,
@@ -18533,7 +19069,7 @@
         ],
         "properties": {
           "group_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "group_key": { "$ref": "#/components/schemas/DeveloperKey" },
+          "group_key": { "$ref": "#/components/schemas/GroupKey" },
           "subscriber_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
           "subscriber_name": {
             "type": "string",
@@ -18574,7 +19110,7 @@
         "type": "object",
         "required": ["group_key", "membership_revision", "items"],
         "properties": {
-          "group_key": { "$ref": "#/components/schemas/DeveloperKey" },
+          "group_key": { "$ref": "#/components/schemas/GroupKey" },
           "membership_revision": { "type": "integer", "minimum": 0 },
           "items": {
             "type": "array",
@@ -18598,14 +19134,17 @@
       "CreateGroupBroadcastRequest": {
         "type": "object",
         "description": "Creates one group broadcast using the existing ordinary message envelope. The group target comes only from the path.",
-        "required": ["content"],
+        "required": [],
         "properties": {
           "notifier_id": {
             "allOf": [{ "$ref": "#/components/schemas/OpaqueIdentifier" }],
             "default": "default"
           },
-          "content": { "$ref": "#/components/schemas/MessageContent" },
-          "expires_at": { "$ref": "#/components/schemas/Timestamp" },
+          "content": { "$ref": "#/components/schemas/MessageContentInput" },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "Optional server-authoritative expiry after acceptance, through year 9999. Omit for 24 hours."
+          },
           "correlation_id": {
             "type": "string",
             "minLength": 1,
@@ -18621,7 +19160,31 @@
             "description": "Omitted means service. Marketing refuses service-only bindings before charging and at every delayed dispatch."
           }
         },
-        "additionalProperties": false
+        "additionalProperties": false,
+        "allOf": [
+          {
+            "anyOf": [
+              {
+                "required": ["content"],
+                "properties": {
+                  "content": {
+                    "$ref": "#/components/schemas/MessageContentInput"
+                  }
+                },
+                "additionalProperties": true
+              },
+              {
+                "required": ["interaction"],
+                "properties": {
+                  "interaction": {
+                    "$ref": "#/components/schemas/InteractionSendRequest"
+                  }
+                },
+                "additionalProperties": true
+              }
+            ]
+          }
+        ]
       },
       "GroupBroadcast": {
         "type": "object",
@@ -18649,7 +19212,7 @@
           "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
           "environment": { "$ref": "#/components/schemas/Environment" },
           "group_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
-          "group_key": { "$ref": "#/components/schemas/DeveloperKey" },
+          "group_key": { "$ref": "#/components/schemas/GroupKey" },
           "audience_revision": { "type": "integer", "minimum": 0 },
           "status": {
             "type": "string",
@@ -18905,6 +19468,61 @@
         },
         "additionalProperties": false
       },
+      "NotificationImageInput": {
+        "type": "object",
+        "description": "One optional provider-neutral illustrative image. The notification content remains complete without the pixels.",
+        "required": ["asset_id"],
+        "properties": {
+          "asset_id": {
+            "$ref": "#/components/schemas/NotificationImageAssetId"
+          },
+          "purpose": { "const": "illustration", "default": "illustration" },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000,
+            "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$",
+            "x-max-utf8-bytes": 4000,
+            "description": "Optional accessible description preserved by every adapter. Omit it for a decorative illustration; notification text must remain complete without the image."
+          }
+        },
+        "additionalProperties": false
+      },
+      "TextContentInput": {
+        "type": "object",
+        "required": ["text"],
+        "properties": {
+          "type": { "const": "text" },
+          "format": {
+            "type": "string",
+            "enum": ["plain", "markdown"],
+            "description": "Text format. Omitted means plain text. Markdown supports headings, paragraphs, emphasis, strong emphasis, code, lists, quotes and safe HTTP(S) links; raw HTML and remote images are never executed or fetched."
+          },
+          "text": {
+            "description": "The complete notification content. This remains authoritative and sufficient when an adapter cannot render optional structure.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 8192,
+            "x-max-utf8-bytes": 8192
+          },
+          "title": {
+            "description": "An optional semantic title. The adapter chooses its native presentation.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
+          },
+          "sections": {
+            "description": "Optional ordered semantic sections that enhance, but never replace, the complete text.",
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 12,
+            "items": { "$ref": "#/components/schemas/StructuredTextSection" }
+          },
+          "image": { "$ref": "#/components/schemas/NotificationImageInput" }
+        },
+        "additionalProperties": false
+      },
       "DocumentSectionBlock": {
         "description": "One prose section in an ordered portable document.",
         "type": "object",
@@ -19038,10 +19656,10 @@
           { "$ref": "#/components/schemas/DocumentDetailsBlock" }
         ]
       },
-      "DocumentContent": {
+      "DocumentContentInput": {
         "description": "An authoritative ordered portable notification document that every delivery adapter renders faithfully.",
         "type": "object",
-        "required": ["type", "blocks"],
+        "required": ["blocks"],
         "properties": {
           "type": { "const": "document" },
           "title": {
@@ -19058,34 +19676,22 @@
             "maxItems": 24,
             "items": { "$ref": "#/components/schemas/DocumentBlock" }
           },
-          "image": { "$ref": "#/components/schemas/NotificationImage" }
+          "image": { "$ref": "#/components/schemas/NotificationImageInput" }
         },
         "additionalProperties": false
       },
-      "MessageContent": {
-        "oneOf": [
-          { "$ref": "#/components/schemas/TextContent" },
-          { "$ref": "#/components/schemas/DocumentContent" }
-        ]
-      },
-      "MetadataValue": {
+      "MessageContentInput": {
         "oneOf": [
-          { "type": "string" },
-          { "type": "number" },
-          { "type": "boolean" },
-          { "type": "null" }
+          {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 8192,
+            "x-max-utf8-bytes": 8192
+          },
+          { "$ref": "#/components/schemas/TextContentInput" },
+          { "$ref": "#/components/schemas/DocumentContentInput" }
         ]
       },
-      "Metadata": {
-        "type": "object",
-        "description": "Bounded customer correlation data. Do not include secrets or personal data.",
-        "maxProperties": 20,
-        "propertyNames": { "minLength": 1, "maxLength": 64 },
-        "additionalProperties": {
-          "$ref": "#/components/schemas/MetadataValue"
-        },
-        "x-max-json-bytes": 4096
-      },
       "InteractionPrompt": {
         "type": "string",
         "minLength": 1,
@@ -19098,14 +19704,14 @@
       },
       "InteractionCorrelationId": {
         "type": "string",
-        "minLength": 8,
+        "minLength": 1,
         "maxLength": 128,
         "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
         "description": "Caller-owned opaque correlation returned as data, never treated as execution authority."
       },
       "ConfirmInteractionSendRequest": {
         "type": "object",
-        "required": ["type", "prompt"],
+        "required": ["prompt"],
         "properties": {
           "type": { "const": "confirm" },
           "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
@@ -19134,30 +19740,55 @@
           "properties": { "expires_at": {}, "expires_in_seconds": {} }
         }
       },
-      "InteractionOption": {
-        "type": "object",
-        "required": ["value", "label"],
-        "properties": {
-          "value": {
+      "InteractionOptionInput": {
+        "oneOf": [
+          {
             "type": "string",
             "minLength": 1,
-            "maxLength": 128,
-            "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
-            "description": "Opaque customer data. It is never interpreted as a command."
+            "maxLength": 120,
+            "pattern": "^[^\\u0000-\\u001F\\u007F]+$"
           },
-          "label": { "type": "string", "minLength": 1, "maxLength": 120 },
-          "intent": {
-            "type": "string",
-            "enum": ["accept", "destructive", "informational", "neutral"],
-            "default": "neutral",
-            "description": "What choosing this option does, so a channel can present it accordingly. Describes consequence rather than appearance: a channel renders `accept` green where it can, `destructive` red, `informational` prominent, and `neutral` plainly. A channel that cannot colour a control ignores this and the option still renders. Omitted means `neutral`."
+          {
+            "type": "object",
+            "required": ["label"],
+            "properties": {
+              "value": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128,
+                "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+                "description": "Defaults to label. Opaque customer data, never a command."
+              },
+              "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+              "intent": {
+                "type": "string",
+                "enum": ["accept", "destructive", "informational", "neutral"],
+                "default": "neutral",
+                "description": "What choosing this option does, so a channel can present it accordingly. Describes consequence rather than appearance: a channel renders `accept` green where it can, `destructive` red, `informational` prominent, and `neutral` plainly. A channel that cannot colour a control ignores this and the option still renders. Omitted means `neutral`."
+              }
+            },
+            "additionalProperties": false,
+            "allOf": [
+              {
+                "if": { "properties": { "value": {} }, "required": ["value"] },
+                "else": {
+                  "properties": {
+                    "label": {
+                      "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            ],
+            "$comment": "The conditional constraint applies only when the label is used as the value. Keep the TypeScript input shape explicit because the generator omits object properties for conditional schemas.",
+            "x-typescript-type": "{ label: string; value?: string; intent?: \"accept\" | \"destructive\" | \"informational\" | \"neutral\" }"
           }
-        },
-        "additionalProperties": false
+        ]
       },
       "SelectInteractionSendRequest": {
         "type": "object",
-        "required": ["type", "prompt", "options"],
+        "required": ["prompt", "options"],
         "properties": {
           "type": { "const": "select" },
           "prompt": { "$ref": "#/components/schemas/InteractionPrompt" },
@@ -19165,7 +19796,7 @@
             "type": "array",
             "minItems": 2,
             "maxItems": 6,
-            "items": { "$ref": "#/components/schemas/InteractionOption" },
+            "items": { "$ref": "#/components/schemas/InteractionOptionInput" },
             "x-unique-property": "value"
           },
           "expires_at": {
@@ -19212,6 +19843,24 @@
           "properties": { "expires_at": {}, "expires_in_seconds": {} }
         }
       },
+      "MetadataValue": {
+        "oneOf": [
+          { "type": "string" },
+          { "type": "number" },
+          { "type": "boolean" },
+          { "type": "null" }
+        ]
+      },
+      "Metadata": {
+        "type": "object",
+        "description": "Bounded customer correlation data. Do not include secrets or personal data.",
+        "maxProperties": 20,
+        "propertyNames": { "minLength": 1, "maxLength": 64 },
+        "additionalProperties": {
+          "$ref": "#/components/schemas/MetadataValue"
+        },
+        "x-max-json-bytes": 4096
+      },
       "HighestProvenProviderState": {
         "type": "string",
         "enum": ["none", "provider_accepted"],
@@ -19275,12 +19924,12 @@
         "type": "string",
         "enum": ["open", "answered", "expired", "cancelled", "retired"]
       },
-      "DeveloperKey": {
+      "GroupKey": {
         "type": "string",
         "minLength": 1,
         "maxLength": 63,
-        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-        "description": "A stable, lowercase developer key used by registered return destinations and subscriber groups."
+        "pattern": "^[A-Za-z0-9]+(?:[-_][A-Za-z0-9]+)*$",
+        "description": "A stable, case-sensitive subscriber group key. Existing keys are preserved exactly."
       },
       "BroadcastAggregate": {
         "type": "object",
@@ -20614,6 +21263,36 @@
           }
         ]
       },
+      "DocumentContent": {
+        "description": "An authoritative ordered portable notification document that every delivery adapter renders faithfully.",
+        "type": "object",
+        "required": ["type", "blocks"],
+        "properties": {
+          "type": { "const": "document" },
+          "title": {
+            "description": "An optional semantic document title. The adapter chooses its native presentation.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "x-max-utf8-bytes": 800
+          },
+          "blocks": {
+            "description": "The complete portable document in exact authored order.",
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 24,
+            "items": { "$ref": "#/components/schemas/DocumentBlock" }
+          },
+          "image": { "$ref": "#/components/schemas/NotificationImage" }
+        },
+        "additionalProperties": false
+      },
+      "MessageContent": {
+        "oneOf": [
+          { "$ref": "#/components/schemas/TextContent" },
+          { "$ref": "#/components/schemas/DocumentContent" }
+        ]
+      },
       "RecipientBrand": {
         "type": "object",
         "description": "Constrained recipient-facing brand tokens. Arbitrary markup, CSS, scripts, remote assets, fonts, and tracking inputs are structurally absent.",
@@ -20644,6 +21323,13 @@
         "pattern": "^https?://[^/?#*\\s]+(?::[0-9]{1,5})?/?$",
         "description": "One exact scheme, host, and optional port, in any spelling that means that same origin. A trailing slash, an uppercase host, and an explicitly written default port are accepted and stored in canonical form. Paths, queries, fragments, credentials, and wildcards are forbidden; HTTP is accepted only for localhost or synthetic .test configuration."
       },
+      "DeveloperKey": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 63,
+        "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+        "description": "A stable, lowercase developer key used by registered return destinations and subscriber groups."
+      },
       "RegisteredReturnUrl": {
         "type": "string",
         "format": "uri",
@@ -20799,7 +21485,7 @@
       "provider-capabilities-v1.schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "$id": "https://whooshbang.flowxo.com/schemas/provider-capabilities-v1.schema.json",
-        "x-contract-version": "2.5.0",
+        "x-contract-version": "3.0.0",
         "title": "ProviderCapabilitiesV1",
         "description": "Provider-neutral, renderer-facing delivery and interaction capabilities with explicit degradation.",
         "type": "object",
@@ -21008,7 +21694,7 @@
         "description": "How many of a day's messages fall in one group. `key` is a `MessageState` when grouping by state, a `Channel` when grouping by channel, and a channel connection id when grouping by connection. Groups with no messages are omitted, and a list holds at most the 200 largest groups, largest first.",
         "required": ["key", "count"],
         "properties": {
-          "key": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "key": { "$ref": "#/components/schemas/GroupKey" },
           "count": { "type": "integer", "minimum": 1 }
         },
         "additionalProperties": false
@@ -21082,6 +21768,27 @@
         },
         "additionalProperties": false
       },
+      "InteractionOption": {
+        "type": "object",
+        "required": ["value", "label"],
+        "properties": {
+          "value": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
+            "description": "Opaque customer data. It is never interpreted as a command."
+          },
+          "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+          "intent": {
+            "type": "string",
+            "enum": ["accept", "destructive", "informational", "neutral"],
+            "default": "neutral",
+            "description": "What choosing this option does, so a channel can present it accordingly. Describes consequence rather than appearance: a channel renders `accept` green where it can, `destructive` red, `informational` prominent, and `neutral` plainly. A channel that cannot colour a control ignores this and the option still renders. Omitted means `neutral`."
+          }
+        },
+        "additionalProperties": false
+      },
       "SelectInteractionRequest": {
         "type": "object",
         "required": ["type", "prompt", "options", "expires_at"],
@@ -21166,9 +21873,9 @@
               "idempotencyKeyRequired": {
                 "value": {
                   "type": "https://whooshbang.flowxo.com/problems/idempotency_key_required",
-                  "title": "Idempotency key required",
+                  "title": "Invalid idempotency key",
                   "status": 400,
-                  "detail": "Provide an Idempotency-Key containing 8 to 255 visible ASCII characters.",
+                  "detail": "Idempotency-Key must be 8 to 255 visible ASCII characters.",
                   "code": "idempotency_key_required",
                   "diagnostic_id": "diag_idem_required_001",
                   "retryable": false
@@ -21334,15 +22041,15 @@
                   "type": "https://whooshbang.flowxo.com/problems/replay_unavailable",
                   "title": "Replay unavailable",
                   "status": 409,
-                  "detail": "Customer event replay is not enabled for this project environment.",
+                  "detail": "Replay is available only after the latest delivery sequence reaches terminal failure.",
                   "code": "replay_unavailable",
-                  "diagnostic_id": "diag_replay_unavailable_rollout_001",
+                  "diagnostic_id": "diag_replay_unavailable_not_terminal_001",
                   "retryable": false,
                   "field_errors": [
                     {
                       "field": "/",
-                      "code": "rollout_disabled",
-                      "detail": "Customer event replay is not enabled for this project environment."
+                      "code": "not_terminal",
+                      "detail": "Replay is available only after the latest delivery sequence reaches terminal failure."
                     }
                   ]
                 }
@@ -21580,5 +22287,5 @@
       }
     }
   },
-  "x-contract-version": "2.5.0"
+  "x-contract-version": "3.0.0"
 }