{ "openapi": "3.1.0", "info": { "title": "ORBIS.ID", "version": "0.1.0", "summary": "Issuance, presentation and verification of selectively-disclosable credentials, over open standards.", "description": "This document is GENERATED from the server’s own dispatch code — `scripts/gen-routes.ts` scans\nadmin-server.ts, backoffice-api.ts, directory.ts, demo-bridge.ts, issuer-server.ts and\nverifier-server.ts and CI fails if this document and those files disagree.\n\nWhere a response shape could not be read off the source with confidence it is marked\n`x-orbis-undocumented` with the reason, rather than guessed. Treat that marker as binding: ORBIS\nhas not promised that shape.\n\nAUTHENTICATION PLANES DO NOT MIX. Operator bearers authenticate the control plane; holder JWS\n(`typ orbis-holder+jwt`) authenticates the wallet plane; OID4VCI access tokens authenticate exactly\none credential collection. A credential of one plane is never accepted on another.\n\nVERSIONING. Every operation carries `x-orbis-stability`. `promised` means ORBIS has committed to\nits shape under `/v1` and owes it indefinitely on the terms in `x-orbis-versioning.policy`.\n`unpromised` means the shape may change — most of those are the Back Office SPA’s own view models,\nwhich are excluded from `/v1` by design. VERIFICATION IS NEVER VERSIONED BY ORBIS: did:web\ndocuments, issuer metadata, status lists and the OID4VP exchange are versioned by the standards\nthat define them and stay at their standard addresses forever.\n\nPresence of an operation here means only that this deployment mounts that route." }, "servers": [ { "url": "https://orbis.id", "description": "This deployment" } ], "tags": [ { "name": "Trust artifacts" }, { "name": "Issuance — OID4VCI" }, { "name": "Presentation — OID4VP" }, { "name": "Hosted verification" }, { "name": "Tenants" }, { "name": "Credential types" }, { "name": "Deposit rail" }, { "name": "Wallet bridge (holder)" }, { "name": "Holder directory" }, { "name": "Holder onboarding" }, { "name": "Membership & governance" }, { "name": "Operator console" }, { "name": "Back office" }, { "name": "Operator sign-in" }, { "name": "Human surfaces (HTML)" }, { "name": "Partner onboarding (public)" } ], "components": { "securitySchemes": { "operatorBearer": { "type": "http", "scheme": "bearer", "description": "An operator session (`POST /api/login` or the Entra bridge), a tenant-scoped operator token from the provisioning ceremony, or the break-glass owner token. Roles are re-resolved from the operators table on EVERY request." }, "holderJws": { "type": "apiKey", "in": "header", "name": "Authorization", "description": "`Holder ` — a compact ES256 JWS made by the device key, `typ orbis-holder+jwt`, public JWK in the header, `aud` = this origin, plus `iat` (5-minute freshness) and a single-use `jti`. The member identity IS the RFC 7638 thumbprint of that key. No shared secret exists on this plane." }, "oid4vciAccessToken": { "type": "http", "scheme": "bearer", "description": "The single-use access token from `POST /token`. Authorises exactly one credential collection." }, "entraSession": { "type": "apiKey", "in": "cookie", "name": "session", "description": "Microsoft Entra browser sign-in. Present only on deployments configured for Entra." } } }, "paths": { "/": { "get": { "summary": "Public front page", "operationId": "get", "tags": [ "Human surfaces (HTML)" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/.well-known/did.json": { "get": { "summary": "Platform did:web document", "operationId": "get_well_known_did_json", "tags": [ "Trust artifacts" ], "description": "The root issuer identity. Resolving `did:web:` means fetching this file. CORS-open: a browser-based verifier must be able to read it from any origin.", "x-orbis-undocumented": "The exact DID-document JSON is produced by `Issuer.didDocument()` (wrap-don’t-touch issuance internals). Consume it with a did:web resolver rather than against a shape pinned here.", "responses": { "200": { "description": "DID document with the issuer verification method (ES256 / P-256 JWK)." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/.well-known/oauth-authorization-server": { "get": { "summary": "OAuth 2.0 authorization server metadata (RFC 8414)", "operationId": "get_well_known_oauth_authorization_server", "tags": [ "Issuance — OID4VCI" ], "description": "OID4VCI 1.0 §12.2.3 defers token issuance to an authorization server; ORBIS is its own. Advertises the pre-authorized_code grant and the token endpoint.", "responses": { "200": { "description": "AS metadata.", "content": { "application/json": { "schema": { "type": "object", "properties": { "issuer": { "type": "string" }, "token_endpoint": { "type": "string" }, "response_types_supported": { "type": "array", "items": { "type": "string" } }, "grant_types_supported": { "type": "array", "items": { "type": "string" } }, "pre-authorized_grant_anonymous_access_supported": { "type": "boolean" }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string" } }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string" } }, "authorization_details_types_supported": { "type": "array", "items": { "type": "string" } } } } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/.well-known/openid-credential-issuer": { "get": { "summary": "OID4VCI credential issuer metadata", "operationId": "get_well_known_openid_credential_issuer", "tags": [ "Issuance — OID4VCI" ], "description": "OpenID4VCI 1.0 §12.2.2. Lists `credential_configurations_supported` — one entry per credential type this issuer offers, with its `vct`, claim paths, binding methods and signing algorithms. Also served per tenant at `/t/{tenant}/.well-known/openid-credential-issuer`.", "responses": { "200": { "description": "Issuer metadata.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credential_issuer": { "type": "string", "description": "This issuer’s base URL." }, "authorization_servers": { "type": "array", "items": { "type": "string" } }, "credential_endpoint": { "type": "string" }, "display": { "type": "array", "items": { "type": "object" }, "description": "Issuer branding, when the org set any." }, "credential_configurations_supported": { "type": "object", "additionalProperties": { "type": "object", "properties": { "format": { "const": "dc+sd-jwt" }, "vct": { "type": "string" }, "claims": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "string" } } } } }, "cryptographic_binding_methods_supported": { "type": "array", "items": { "type": "string" } }, "credential_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } }, "proof_types_supported": { "type": "object" } } } } }, "required": [ "credential_issuer", "credential_endpoint", "credential_configurations_supported" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/.well-known/security.txt": { "get": { "summary": "Security contact (RFC 9116)", "operationId": "get_well_known_security_txt", "tags": [ "Trust artifacts" ], "description": "Where to report a vulnerability, in the one place a researcher actually looks. Plain text per RFC 9116, with a required Expires so the contact cannot rot silently. Public and unauthenticated by definition — but NOT a verification-plane artifact: nothing is verified against it, so it carries no CORS promise (see verification-plane.ts).", "x-orbis-undocumented": "The response is not JSON. It is the plain-text field format defined by RFC 9116, whose grammar is normative there — pinning a JSON schema here would publish a WORSE specification than the RFC and invite implementers to follow the wrong one. Parse it per RFC 9116 §2.", "responses": { "200": { "description": "The security.txt policy record." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/admin": { "get": { "summary": "Back Office", "operationId": "get_admin", "tags": [ "Human surfaces (HTML)" ], "description": "As `/console`.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "entraSession": [] } ], "x-orbis-auth": "entra-session", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/admin/", "x-orbis-stability": "unpromised" } }, "/api/admin/activity": { "get": { "summary": "GET /api/admin/activity", "operationId": "get_api_admin_activity", "tags": [ "Back office" ], "description": "Back Office data plane. Section `audit`, read access. Roles: analyst, auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "audit:read", "x-orbis-stability": "unpromised" } }, "/api/admin/analytics": { "get": { "summary": "GET /api/admin/analytics", "operationId": "get_api_admin_analytics", "tags": [ "Back office" ], "description": "Back Office data plane. Section `analytics`, read access. Roles: analyst, auditor, owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "analytics:read", "x-orbis-stability": "unpromised" } }, "/api/admin/approvals": { "get": { "summary": "GET /api/admin/approvals", "operationId": "get_api_admin_approvals", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, read access. Roles: auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/approvals", "operationId": "post_api_admin_approvals", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, write access. Roles: ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:write", "x-orbis-stability": "unpromised" } }, "/api/admin/approvals/{approvalId}": { "get": { "summary": "GET /api/admin/approvals/{approvalId}", "operationId": "get_api_admin_approvals_approvalId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, read access. Roles: auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "approvalId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:read", "x-orbis-stability": "unpromised" } }, "/api/admin/approvals/{approvalId}/approve": { "post": { "summary": "POST /api/admin/approvals/{approvalId}/approve", "operationId": "post_api_admin_approvals_approvalId_approve", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, write access. Roles: ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "approvalId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:write", "x-orbis-stability": "unpromised" } }, "/api/admin/approvals/{approvalId}/reject": { "post": { "summary": "POST /api/admin/approvals/{approvalId}/reject", "operationId": "post_api_admin_approvals_approvalId_reject", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, write access. Roles: ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "approvalId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:write", "x-orbis-stability": "unpromised" } }, "/api/admin/approvals/{approvalId}/withdraw": { "post": { "summary": "POST /api/admin/approvals/{approvalId}/withdraw", "operationId": "post_api_admin_approvals_approvalId_withdraw", "tags": [ "Back office" ], "description": "Back Office data plane. Section `approvals`, write access. Roles: ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "approvalId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "approvals:write", "x-orbis-stability": "unpromised" } }, "/api/admin/audit": { "get": { "summary": "GET /api/admin/audit", "operationId": "get_api_admin_audit", "tags": [ "Back office" ], "description": "Back Office data plane. Section `audit`, read access. Roles: analyst, auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "audit:read", "x-orbis-stability": "unpromised" } }, "/api/admin/audit/{seq}": { "get": { "summary": "GET /api/admin/audit/{seq}", "operationId": "get_api_admin_audit_seq", "tags": [ "Back office" ], "description": "Back Office data plane. Section `audit`, read access. Roles: analyst, auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "seq", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "audit:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/accountability/attest": { "post": { "summary": "POST /api/admin/compliance/accountability/attest", "operationId": "post_api_admin_compliance_accountability_attest", "tags": [ "Back office" ], "description": "Back Office data plane. No section gate: any of the six back-office roles may call it, subject to the handler’s own checks. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/accountability/attestations": { "get": { "summary": "GET /api/admin/compliance/accountability/attestations", "operationId": "get_api_admin_compliance_accountability_attestations", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/accountability/role-history": { "get": { "summary": "GET /api/admin/compliance/accountability/role-history", "operationId": "get_api_admin_compliance_accountability_role_history", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/accountability/role-separation": { "get": { "summary": "GET /api/admin/compliance/accountability/role-separation", "operationId": "get_api_admin_compliance_accountability_role_separation", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/dsar/export": { "post": { "summary": "POST /api/admin/compliance/dsar/export", "operationId": "post_api_admin_compliance_dsar_export", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/dsar/lookup": { "post": { "summary": "POST /api/admin/compliance/dsar/lookup", "operationId": "post_api_admin_compliance_dsar_lookup", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/dsar/negative-response": { "post": { "summary": "POST /api/admin/compliance/dsar/negative-response", "operationId": "post_api_admin_compliance_dsar_negative_response", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/dsar/requests": { "get": { "summary": "GET /api/admin/compliance/dsar/requests", "operationId": "get_api_admin_compliance_dsar_requests", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/erasure/requests": { "get": { "summary": "GET /api/admin/compliance/erasure/requests", "operationId": "get_api_admin_compliance_erasure_requests", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/compliance/erasure/requests", "operationId": "post_api_admin_compliance_erasure_requests", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/erasure/requests/{requestId}": { "get": { "summary": "GET /api/admin/compliance/erasure/requests/{requestId}", "operationId": "get_api_admin_compliance_erasure_requests_requestId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "requestId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/erasure/requests/{requestId}/refuse": { "post": { "summary": "POST /api/admin/compliance/erasure/requests/{requestId}/refuse", "operationId": "post_api_admin_compliance_erasure_requests_requestId_refuse", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "requestId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/erasure/requests/{requestId}/verify": { "post": { "summary": "POST /api/admin/compliance/erasure/requests/{requestId}/verify", "operationId": "post_api_admin_compliance_erasure_requests_requestId_verify", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "requestId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/incidents": { "get": { "summary": "GET /api/admin/compliance/incidents", "operationId": "get_api_admin_compliance_incidents", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/compliance/incidents", "operationId": "post_api_admin_compliance_incidents", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/incidents/{incidentId}": { "get": { "summary": "GET /api/admin/compliance/incidents/{incidentId}", "operationId": "get_api_admin_compliance_incidents_incidentId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/compliance/incidents/{incidentId}", "operationId": "post_api_admin_compliance_incidents_incidentId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/incidents/{incidentId}/affected-scope": { "get": { "summary": "GET /api/admin/compliance/incidents/{incidentId}/affected-scope", "operationId": "get_api_admin_compliance_incidents_incidentId_affected_scope", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/meta-inventory": { "get": { "summary": "GET /api/admin/compliance/meta-inventory", "operationId": "get_api_admin_compliance_meta_inventory", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/program": { "get": { "summary": "GET /api/admin/compliance/program", "operationId": "get_api_admin_compliance_program", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/retention/purge-run": { "post": { "summary": "POST /api/admin/compliance/retention/purge-run", "operationId": "post_api_admin_compliance_retention_purge_run", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/retention/rules": { "get": { "summary": "GET /api/admin/compliance/retention/rules", "operationId": "get_api_admin_compliance_retention_rules", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/compliance/retention/rules", "operationId": "post_api_admin_compliance_retention_rules", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/ropa": { "get": { "summary": "GET /api/admin/compliance/ropa", "operationId": "get_api_admin_compliance_ropa", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/ropa/purposes": { "get": { "summary": "GET /api/admin/compliance/ropa/purposes", "operationId": "get_api_admin_compliance_ropa_purposes", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:read", "x-orbis-stability": "unpromised" } }, "/api/admin/compliance/ropa/type-purpose": { "post": { "summary": "POST /api/admin/compliance/ropa/type-purpose", "operationId": "post_api_admin_compliance_ropa_type_purpose", "tags": [ "Back office" ], "description": "Back Office data plane. Section `compliance`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "compliance:write", "x-orbis-stability": "unpromised" } }, "/api/admin/credential": { "get": { "summary": "GET /api/admin/credential", "operationId": "get_api_admin_credential", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/credential-type": { "get": { "summary": "GET /api/admin/credential-type", "operationId": "get_api_admin_credential_type", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/credential-types": { "get": { "summary": "GET /api/admin/credential-types", "operationId": "get_api_admin_credential_types", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/credentials": { "get": { "summary": "GET /api/admin/credentials", "operationId": "get_api_admin_credentials", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/holder": { "get": { "summary": "GET /api/admin/holder", "operationId": "get_api_admin_holder", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/holders": { "get": { "summary": "GET /api/admin/holders", "operationId": "get_api_admin_holders", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/contracts": { "get": { "summary": "GET /api/admin/integration/contracts", "operationId": "get_api_admin_integration_contracts", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/contracts/handshake": { "post": { "summary": "POST /api/admin/integration/contracts/handshake", "operationId": "post_api_admin_integration_contracts_handshake", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deliveries": { "get": { "summary": "GET /api/admin/integration/deliveries", "operationId": "get_api_admin_integration_deliveries", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deliveries/{deliveryId}": { "get": { "summary": "GET /api/admin/integration/deliveries/{deliveryId}", "operationId": "get_api_admin_integration_deliveries_deliveryId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "deliveryId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deliveries/{deliveryId}/redrive": { "post": { "summary": "POST /api/admin/integration/deliveries/{deliveryId}/redrive", "operationId": "post_api_admin_integration_deliveries_deliveryId_redrive", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "deliveryId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deposits": { "get": { "summary": "GET /api/admin/integration/deposits", "operationId": "get_api_admin_integration_deposits", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deposits/{depositId}": { "get": { "summary": "GET /api/admin/integration/deposits/{depositId}", "operationId": "get_api_admin_integration_deposits_depositId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "depositId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/deposits/integrity": { "get": { "summary": "GET /api/admin/integration/deposits/integrity", "operationId": "get_api_admin_integration_deposits_integrity", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/key-options": { "get": { "summary": "GET /api/admin/integration/key-options", "operationId": "get_api_admin_integration_key_options", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/provisioning": { "get": { "summary": "GET /api/admin/integration/provisioning", "operationId": "get_api_admin_integration_provisioning", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/integration/provisioning", "operationId": "post_api_admin_integration_provisioning", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/provisioning/{requestId}": { "get": { "summary": "GET /api/admin/integration/provisioning/{requestId}", "operationId": "get_api_admin_integration_provisioning_requestId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "requestId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/provisioning/{requestId}/reject": { "post": { "summary": "POST /api/admin/integration/provisioning/{requestId}/reject", "operationId": "post_api_admin_integration_provisioning_requestId_reject", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "requestId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/tokens": { "get": { "summary": "GET /api/admin/integration/tokens", "operationId": "get_api_admin_integration_tokens", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/integration/tokens", "operationId": "post_api_admin_integration_tokens", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/tokens/{tokenId}/revoke": { "post": { "summary": "POST /api/admin/integration/tokens/{tokenId}/revoke", "operationId": "post_api_admin_integration_tokens_tokenId_revoke", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "tokenId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/tokens/{tokenId}/rotate": { "post": { "summary": "POST /api/admin/integration/tokens/{tokenId}/rotate", "operationId": "post_api_admin_integration_tokens_tokenId_rotate", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "tokenId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/webhooks": { "get": { "summary": "GET /api/admin/integration/webhooks", "operationId": "get_api_admin_integration_webhooks", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/integration/webhooks", "operationId": "post_api_admin_integration_webhooks", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/webhooks/{webhookId}": { "get": { "summary": "GET /api/admin/integration/webhooks/{webhookId}", "operationId": "get_api_admin_integration_webhooks_webhookId", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "webhookId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/webhooks/{webhookId}/active": { "post": { "summary": "POST /api/admin/integration/webhooks/{webhookId}/active", "operationId": "post_api_admin_integration_webhooks_webhookId_active", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "webhookId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/webhooks/{webhookId}/rotate-secret": { "post": { "summary": "POST /api/admin/integration/webhooks/{webhookId}/rotate-secret", "operationId": "post_api_admin_integration_webhooks_webhookId_rotate_secret", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "webhookId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:write", "x-orbis-stability": "unpromised" } }, "/api/admin/integration/webhooks/coverage": { "get": { "summary": "GET /api/admin/integration/webhooks/coverage", "operationId": "get_api_admin_integration_webhooks_coverage", "tags": [ "Back office" ], "description": "Back Office data plane. Section `integration`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "integration:read", "x-orbis-stability": "unpromised" } }, "/api/admin/me": { "get": { "summary": "GET /api/admin/me", "operationId": "get_api_admin_me", "tags": [ "Back office" ], "description": "Back Office data plane. No section gate: any of the six back-office roles may call it, subject to the handler’s own checks. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/offboarding": { "get": { "summary": "GET /api/admin/offboarding", "operationId": "get_api_admin_offboarding", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/audit": { "get": { "summary": "GET /api/admin/ops/audit", "operationId": "get_api_admin_ops_audit", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/azure": { "get": { "summary": "GET /api/admin/ops/azure", "operationId": "get_api_admin_ops_azure", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/backup": { "post": { "summary": "POST /api/admin/ops/backup", "operationId": "post_api_admin_ops_backup", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/backup-drills": { "get": { "summary": "GET /api/admin/ops/backup-drills", "operationId": "get_api_admin_ops_backup_drills", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/backups": { "get": { "summary": "GET /api/admin/ops/backups", "operationId": "get_api_admin_ops_backups", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/comms-health": { "get": { "summary": "GET /api/admin/ops/comms-health", "operationId": "get_api_admin_ops_comms_health", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/demo-hygiene": { "get": { "summary": "GET /api/admin/ops/demo-hygiene", "operationId": "get_api_admin_ops_demo_hygiene", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/did-drift": { "get": { "summary": "GET /api/admin/ops/did-drift", "operationId": "get_api_admin_ops_did_drift", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/expiry": { "get": { "summary": "GET /api/admin/ops/expiry", "operationId": "get_api_admin_ops_expiry", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/expiry-dates": { "post": { "summary": "POST /api/admin/ops/expiry-dates", "operationId": "post_api_admin_ops_expiry_dates", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/fixtures": { "post": { "summary": "POST /api/admin/ops/fixtures", "operationId": "post_api_admin_ops_fixtures", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/health": { "get": { "summary": "GET /api/admin/ops/health", "operationId": "get_api_admin_ops_health", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/keys": { "get": { "summary": "GET /api/admin/ops/keys", "operationId": "get_api_admin_ops_keys", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/revocations": { "get": { "summary": "GET /api/admin/ops/revocations", "operationId": "get_api_admin_ops_revocations", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/revoke": { "post": { "summary": "POST /api/admin/ops/revoke", "operationId": "post_api_admin_ops_revoke", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/rotation": { "get": { "summary": "GET /api/admin/ops/rotation", "operationId": "get_api_admin_ops_rotation", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/status-integrity": { "get": { "summary": "GET /api/admin/ops/status-integrity", "operationId": "get_api_admin_ops_status_integrity", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/status-lists": { "get": { "summary": "GET /api/admin/ops/status-lists", "operationId": "get_api_admin_ops_status_lists", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/status-lists/{issuerDid}": { "get": { "summary": "GET /api/admin/ops/status-lists/{issuerDid}", "operationId": "get_api_admin_ops_status_lists_issuerDid", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "issuerDid", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/stuck-transactions": { "get": { "summary": "GET /api/admin/ops/stuck-transactions", "operationId": "get_api_admin_ops_stuck_transactions", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/trust": { "get": { "summary": "GET /api/admin/ops/trust", "operationId": "get_api_admin_ops_trust", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/trust/add": { "post": { "summary": "POST /api/admin/ops/trust/add", "operationId": "post_api_admin_ops_trust_add", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/trust/restore": { "post": { "summary": "POST /api/admin/ops/trust/restore", "operationId": "post_api_admin_ops_trust_restore", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/trust/suspend": { "post": { "summary": "POST /api/admin/ops/trust/suspend", "operationId": "post_api_admin_ops_trust_suspend", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/ops/wire-funnels": { "get": { "summary": "GET /api/admin/ops/wire-funnels", "operationId": "get_api_admin_ops_wire_funnels", "tags": [ "Back office" ], "description": "Back Office data plane. Section `operations`, read access. Roles: auditor, ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "operations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs": { "get": { "summary": "GET /api/admin/orgs", "operationId": "get_api_admin_orgs", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/orgs", "operationId": "post_api_admin_orgs", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}": { "get": { "summary": "GET /api/admin/orgs/{slug}", "operationId": "get_api_admin_orgs_slug", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/admins": { "get": { "summary": "GET /api/admin/orgs/{slug}/admins", "operationId": "get_api_admin_orgs_slug_admins", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/orgs/{slug}/admins", "operationId": "post_api_admin_orgs_slug_admins", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/admins/remove": { "post": { "summary": "POST /api/admin/orgs/{slug}/admins/remove", "operationId": "post_api_admin_orgs_slug_admins_remove", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/domain": { "get": { "summary": "GET /api/admin/orgs/{slug}/domain", "operationId": "get_api_admin_orgs_slug_domain", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/orgs/{slug}/domain", "operationId": "post_api_admin_orgs_slug_domain", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/domain/activate": { "post": { "summary": "POST /api/admin/orgs/{slug}/domain/activate", "operationId": "post_api_admin_orgs_slug_domain_activate", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/domain/document": { "get": { "summary": "GET /api/admin/orgs/{slug}/domain/document", "operationId": "get_api_admin_orgs_slug_domain_document", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/domain/revoke": { "post": { "summary": "POST /api/admin/orgs/{slug}/domain/revoke", "operationId": "post_api_admin_orgs_slug_domain_revoke", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/domain/verify": { "post": { "summary": "POST /api/admin/orgs/{slug}/domain/verify", "operationId": "post_api_admin_orgs_slug_domain_verify", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/lifecycle": { "get": { "summary": "GET /api/admin/orgs/{slug}/lifecycle", "operationId": "get_api_admin_orgs_slug_lifecycle", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/reactivate": { "post": { "summary": "POST /api/admin/orgs/{slug}/reactivate", "operationId": "post_api_admin_orgs_slug_reactivate", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/{slug}/suspend": { "post": { "summary": "POST /api/admin/orgs/{slug}/suspend", "operationId": "post_api_admin_orgs_slug_suspend", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "slug", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/admin/orgs/preview-branding": { "post": { "summary": "POST /api/admin/orgs/preview-branding", "operationId": "post_api_admin_orgs_preview_branding", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" } }, "/api/admin/partners": { "get": { "summary": "GET /api/admin/partners", "operationId": "get_api_admin_partners", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/partners", "operationId": "post_api_admin_partners", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:write", "x-orbis-stability": "unpromised" } }, "/api/admin/partners/{id}": { "get": { "summary": "GET /api/admin/partners/{id}", "operationId": "get_api_admin_partners_id", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:read", "x-orbis-stability": "unpromised" } }, "/api/admin/partners/{id}/link-tenant": { "post": { "summary": "POST /api/admin/partners/{id}/link-tenant", "operationId": "post_api_admin_partners_id_link_tenant", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:write", "x-orbis-stability": "unpromised" } }, "/api/admin/partners/{id}/stage": { "post": { "summary": "POST /api/admin/partners/{id}/stage", "operationId": "post_api_admin_partners_id_stage", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, write access. Roles: ops, owner. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "ops", "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:write", "x-orbis-stability": "unpromised" } }, "/api/admin/partners/portfolio": { "get": { "summary": "GET /api/admin/partners/portfolio", "operationId": "get_api_admin_partners_portfolio", "tags": [ "Back office" ], "description": "Back Office data plane. Section `partners`, read access. Roles: auditor, ops, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "ops", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "partners:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/coin-ledger": { "get": { "summary": "GET /api/admin/people/coin-ledger", "operationId": "get_api_admin_people_coin_ledger", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/consent": { "get": { "summary": "GET /api/admin/people/consent", "operationId": "get_api_admin_people_consent", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/economy": { "get": { "summary": "GET /api/admin/people/economy", "operationId": "get_api_admin_people_economy", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/governance": { "get": { "summary": "GET /api/admin/people/governance", "operationId": "get_api_admin_people_governance", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/people/governance", "operationId": "post_api_admin_people_governance", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/members": { "get": { "summary": "GET /api/admin/people/members", "operationId": "get_api_admin_people_members", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators": { "get": { "summary": "GET /api/admin/people/operators", "operationId": "get_api_admin_people_operators", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/people/operators", "operationId": "post_api_admin_people_operators", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}": { "get": { "summary": "GET /api/admin/people/operators/{username}", "operationId": "get_api_admin_people_operators_username", "tags": [ "Back office" ], "description": "Back Office data plane. Section `people`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "people:read", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/enable": { "post": { "summary": "POST /api/admin/people/operators/{username}/enable", "operationId": "post_api_admin_people_operators_username_enable", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/entra": { "post": { "summary": "POST /api/admin/people/operators/{username}/entra", "operationId": "post_api_admin_people_operators_username_entra", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/password": { "post": { "summary": "POST /api/admin/people/operators/{username}/password", "operationId": "post_api_admin_people_operators_username_password", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/remove": { "post": { "summary": "POST /api/admin/people/operators/{username}/remove", "operationId": "post_api_admin_people_operators_username_remove", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/roles": { "post": { "summary": "POST /api/admin/people/operators/{username}/roles", "operationId": "post_api_admin_people_operators_username_roles", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/people/operators/{username}/suspend": { "post": { "summary": "POST /api/admin/people/operators/{username}/suspend", "operationId": "post_api_admin_people_operators_username_suspend", "tags": [ "Back office" ], "description": "Back Office data plane. Owner only — an endpoint-specific escalation on top of the section matrix. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "username", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-stability": "unpromised" } }, "/api/admin/search": { "get": { "summary": "GET /api/admin/search", "operationId": "get_api_admin_search", "tags": [ "Back office" ], "description": "Back Office data plane. Section `audit`, read access. Roles: analyst, auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "audit:read", "x-orbis-stability": "unpromised" } }, "/api/admin/support/credential/{statusIndex}": { "get": { "summary": "GET /api/admin/support/credential/{statusIndex}", "operationId": "get_api_admin_support_credential_statusIndex", "tags": [ "Back office" ], "description": "Back Office data plane. Section `support`, read access. Roles: auditor, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "statusIndex", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "support:read", "x-orbis-stability": "unpromised" } }, "/api/admin/support/lookup": { "get": { "summary": "GET /api/admin/support/lookup", "operationId": "get_api_admin_support_lookup", "tags": [ "Back office" ], "description": "Back Office data plane. Section `support`, read access. Roles: auditor, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "support:read", "x-orbis-stability": "unpromised" } }, "/api/admin/support/timeline/{subject}": { "get": { "summary": "GET /api/admin/support/timeline/{subject}", "operationId": "get_api_admin_support_timeline_subject", "tags": [ "Back office" ], "description": "Back Office data plane. Section `support`, read access. Roles: auditor, owner, support. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "parameters": [ { "name": "subject", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "support:read", "x-orbis-stability": "unpromised" } }, "/api/admin/today": { "get": { "summary": "GET /api/admin/today", "operationId": "get_api_admin_today", "tags": [ "Back office" ], "description": "Back Office data plane. Section `today`, read access. Roles: analyst, auditor, ops, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "analyst", "auditor", "ops", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "today:read", "x-orbis-stability": "unpromised" } }, "/api/admin/types": { "get": { "summary": "GET /api/admin/types", "operationId": "get_api_admin_types", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, read access. Roles: auditor, owner, support, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "auditor", "owner", "support", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:read", "x-orbis-stability": "unpromised" }, "post": { "summary": "POST /api/admin/types", "operationId": "post_api_admin_types", "tags": [ "Back office" ], "description": "Back Office data plane. Section `organizations`, write access. Roles: owner, tenant-admin. The legacy `issuer` and `verifier` roles have no back-office access and are refused everywhere under `/api/admin/*`.", "x-orbis-undocumented": "Response shape is internal to the ORBIS Back Office SPA and is not a stable partner contract. It is deliberately not published rather than guessed. Every mutation in this section returns `{ ok: true, auditSeq, … }` (backoffice-api.ts, \"mutation-response\" convention); the rest of the body may change without notice.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/backoffice-api.ts", "x-orbis-section": "organizations:write", "x-orbis-stability": "unpromised" } }, "/api/compliance": { "get": { "summary": "Compliance summary", "operationId": "get_api_compliance", "tags": [ "Operator console" ], "x-orbis-undocumented": "Operator console view model. It changes with the console and is not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/login": { "post": { "summary": "Exchange operator credentials for a session bearer", "operationId": "post_api_login", "tags": [ "Operator sign-in" ], "description": "CLOSED when Microsoft Entra is configured on the deployment — a sign-in boundary with a bypass beside it is not a boundary. The break-glass owner token is unaffected. Sessions last 12 hours and are re-resolved from the operators table on every request, so a demoted, suspended or removed operator loses access immediately.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string", "description": "Normalised to trimmed lowercase." }, "password": { "type": "string" } }, "required": [ "username", "password" ] } } } }, "responses": { "200": { "description": "A session bearer plus the caller’s roles.", "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" }, "username": { "type": "string" }, "role": { "type": "string" }, "xfinRoles": { "type": "array", "items": { "type": "string" } }, "platformRoles": { "type": "array", "items": { "type": "string" } } }, "required": [ "token", "username", "role" ] } } } }, "401": { "description": "`invalid_credentials`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "`operator_suspended`, or `entra_only` when this deployment signs in with Microsoft.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/members/enroll": { "post": { "summary": "Enroll a member (operator plane)", "operationId": "post_api_members_enroll", "tags": [ "Membership & governance" ], "x-orbis-undocumented": "Operator console view model. The holder-proven enrollment path, and the one with a published contract, is `POST /member/enroll`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/members/update": { "post": { "summary": "Update a member record", "operationId": "post_api_members_update", "tags": [ "Membership & governance" ], "x-orbis-undocumented": "Operator console view model, consumed only by the ORBIS console SPA. Not published as a partner contract, and not guessed at either — build against the standards-defined surfaces instead.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/offers": { "post": { "summary": "Create a credential offer", "operationId": "post_api_offers", "tags": [ "Issuance — OID4VCI" ], "description": "Returns the `openid4vc://` offer URI to render as a QR. Claim VALUES are strictly typed against the registered type: `number`/`money` must be JSON numbers (a numeric STRING is refused, never coerced), `money` must be a whole number of minor units (never a float — sign is unconstrained, a refund is legitimately negative), `bool` must be a JSON boolean, `array(text)` an array of strings, `array(object)` an array of objects, and `enum` must be one of the registered options.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string", "description": "Empty or absent for the root platform." }, "typeId": { "type": "string", "description": "Defaults to `verified-business-member`." }, "subject": { "type": "object", "description": "Claim key → value. May also be supplied as top-level members of the body." } }, "required": [] } } } }, "responses": { "200": { "description": "The offer.", "content": { "application/json": { "schema": { "type": "object", "properties": { "offerUri": { "type": "string", "description": "Render as a QR for the wallet to scan." } }, "required": [ "offerUri" ] } } } }, "400": { "description": "`invalid_subject` — `error_description` names the claim and why.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "404": { "description": "`unknown_tenant` or `unknown_type`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/offers" } }, "/api/operators/roles": { "post": { "summary": "Grant xFIN / platform financial roles", "operationId": "post_api_operators_roles", "tags": [ "Operator console" ], "description": "Owner only, and deliberately narrower than the rest of team management: granting financial roles is never delegated to a tenant-scoped caller. Holding both sides of the maker/checker pair is collapsed at grant time — separation of duties.", "x-orbis-undocumented": "Console surface. The authoritative view of a grant is what `POST /api/login` and `GET /api/state` return for that operator.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/org-channels": { "get": { "summary": "Organization comms channels (read)", "operationId": "get_api_org_channels", "tags": [ "Operator console" ], "parameters": [ { "name": "tenant", "in": "query", "required": false, "description": "Filter to one organization. A tenant-scoped caller may not name another.", "schema": { "type": "string" } } ], "x-orbis-undocumented": "Back-office read surface; signed consent receipts are masked in this listing by design (bulk-export law).", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/org-channels/{tenant}/{accountId}/accept": { "post": { "summary": "Apply an accept decision to an org channel", "operationId": "post_api_org_channels_tenant_accountId_accept", "tags": [ "Operator console" ], "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Operator/ops relay surface for the comms-consent track.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/org-channels/{tenant}/{accountId}/decline": { "post": { "summary": "Apply a decline decision to an org channel", "operationId": "post_api_org_channels_tenant_accountId_decline", "tags": [ "Operator console" ], "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Operator/ops relay surface for the comms-consent track.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/org-channels/{tenant}/{accountId}/revoke": { "post": { "summary": "Apply a revoke decision to an org channel", "operationId": "post_api_org_channels_tenant_accountId_revoke", "tags": [ "Operator console" ], "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Operator/ops relay surface for the comms-consent track.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/applications": { "post": { "summary": "Apply to become an ORBIS.ID partner", "operationId": "post_api_partners_applications", "tags": [ "Partner onboarding (public)" ], "description": "PUBLIC and unauthenticated — the one thing a party outside ORBIS can start on its own. Creates a single record in stage `applied` and NOTHING else: it grants no tenant, no token, no scope and no stage, and it cannot advance itself. Every capability grant stays an operator action.\n\nAnti-abuse on this route: body capped at 8 KiB (enforced while reading), STRICT schema (an unknown field is refused, not ignored), per-field length and control-character bounds, and restart-safe per-caller rate limits (2/min, 3/hour, 10/day) answering 429 with `Retry-After`. A field whose NAME looks like a secret, token or key is refused outright — ORBIS never collects credentials on a public surface. Deliberately NOT CORS-open: it is a same-origin form post, not an integration endpoint.\n\nAccepts `application/json` or `application/x-www-form-urlencoded`; a form post is answered with an HTML page and a JSON post with JSON, from the same decision.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "organizationName": { "type": "string", "description": "Legal name of the applying organization. ≤120 chars." }, "profile": { "type": "string", "enum": [ "issuer", "relying-party", "wallet", "data-partner" ] }, "website": { "type": "string", "description": "Public https website. Private, loopback and link-local hosts are refused." }, "contactName": { "type": "string", "description": "Person ORBIS should talk to. ≤80 chars." }, "contactEmail": { "type": "string", "description": "Contact address. One of the two halves needed to read the status later." }, "jurisdiction": { "type": "string", "description": "Where the organization operates from. ≤60 chars." }, "useCase": { "type": "string", "description": "What they want to build, in their own words. 20–1200 chars." }, "volume": { "type": "string", "enum": [ "unknown", "pilot", "thousands", "hundreds-of-thousands", "millions" ] }, "didWebDomain": { "type": "string", "description": "Optional public domain for a future issuer identity. Hostname only." } }, "required": [ "organizationName", "profile", "website", "contactName", "contactEmail", "jurisdiction", "useCase" ] } } } }, "responses": { "201": { "description": "Recorded in stage `applied`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "reference": { "type": "string", "description": "Opaque application reference, `pa_…`. NOT a credential: on its own it opens nothing, and a status read also requires the contact email." }, "stage": { "const": "applied" }, "receivedAt": { "type": "string", "description": "ISO 8601." } } } } } }, "400": { "description": "Validation refused the body — `error` names the failure (`unknown_field`, `secret_field_refused`, `invalid_email`, …) and `message` says what to do.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "409": { "description": "An open application already exists for that contact; ORBIS keeps one rather than creating a competing record.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "413": { "description": "Body over 8 KiB, or an unsupported content type.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "422": { "description": "The operator side refused the application.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "Per-caller rate limit. `Retry-After` names the wait in seconds.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`partner_intake_unwired` — this deployment has no application storage behind the route. The input is validated and then discarded, and the response says so rather than returning a reference that would mean nothing.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/applications/status": { "post": { "summary": "Read your own partner application", "operationId": "post_api_partners_applications_status", "tags": [ "Partner onboarding (public)" ], "description": "PUBLIC, and requires BOTH the reference and the contact email the application was made with. An unknown reference, a wrong email and a mismatched pair are answered identically with 404 `not_found` — so this route cannot be used to discover who is applying to ORBIS. There is no route that lists partners, and references cannot be walked. Rate limited per caller (10/min, 120/day).\n\nNever returns an operator identity: \"who has it\" is a DESK, because a public page that named an individual operator would be both a privacy leak and a social-engineering target.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "reference": { "type": "string", "description": "`pa_…`, as shown when the application was made." }, "email": { "type": "string", "description": "The contact email the application was made with." } }, "required": [ "reference", "email" ] } } } }, "responses": { "200": { "description": "The application, as its own applicant may see it.", "content": { "application/json": { "schema": { "type": "object", "properties": { "reference": { "type": "string" }, "organizationName": { "type": "string" }, "profile": { "type": "string", "enum": [ "issuer", "relying-party", "wallet", "data-partner" ] }, "stage": { "type": "string", "enum": [ "applied", "reviewing", "sandbox", "certifying", "live", "suspended", "declined", "withdrawn" ] }, "stageSince": { "type": "string", "description": "ISO 8601." }, "blockers": { "type": [ "array", "null" ], "description": "null = the desk does not record blockers yet. Each blocker carries a concrete `fix`.", "items": { "type": "object", "properties": { "code": { "type": "string" }, "title": { "type": "string" }, "fix": { "type": "string" }, "who": { "type": "string", "enum": [ "partner", "orbis" ] } } } }, "owner": { "type": [ "object", "null" ], "description": "The desk holding it. Never a person.", "properties": { "desk": { "type": "string" } } }, "certification": { "type": [ "array", "null" ], "description": "null until the certification engine is wired. Each check carries evidence, and a fix when it failed.", "items": { "type": "object", "properties": { "id": { "type": "string" }, "title": { "type": "string" }, "proves": { "type": "string" }, "state": { "type": "string", "enum": [ "pass", "fail", "not-run" ] }, "evidence": { "type": [ "string", "null" ] }, "fix": { "type": [ "string", "null" ] } } } }, "history": { "type": [ "array", "null" ], "items": { "type": "object", "properties": { "stage": { "type": "string" }, "at": { "type": "string" } } } } } } } } }, "400": { "description": "The reference or the email is malformed. Both are required — the reference alone is not enough.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`not_found`. Identical for an unknown reference, a wrong email and a mismatched pair, by design.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "413": { "description": "Body over 8 KiB, or an unsupported content type.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "Per-caller rate limit. `Retry-After` names the wait in seconds.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`partner_intake_unwired` — no application storage on this deployment.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/keys": { "get": { "summary": "List this partner’s own keys", "operationId": "get_api_partners_keys", "tags": [ "Partner onboarding (public)" ], "description": "The partner’s live keys and the ceilings of their grant, so a portal can show what they are allowed to ask for. Never returns key material — only the last four characters of each token, which is the same hint the operator desk sees.", "x-orbis-undocumented": "Shape follows the partner portal and may change with it.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" }, "post": { "summary": "Mint a key inside the grant", "operationId": "post_api_partners_keys", "tags": [ "Partner onboarding (public)" ], "description": "Mints an operator token narrowed to the grant an owner attached at go-live: capabilities are a subset, the tenant comes from the grant and is not a request field, the rate class and lifetime are capped, and the active-key ceiling is enforced. A request outside the grant is REFUSED BY NAME rather than silently reduced. Returns the plaintext exactly once. Explicit-only capabilities are never mintable here, whatever the grant says.", "x-orbis-undocumented": "Shape follows the partner portal and may change with it.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/keys/{id}/revoke": { "post": { "summary": "Revoke one of this partner’s keys", "operationId": "post_api_partners_keys_id_revoke", "tags": [ "Partner onboarding (public)" ], "description": "Revokes immediately and frees a slot against the grant’s active-key ceiling. Same 404-not-403 rule as rotate.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Shape follows the partner portal and may change with it.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/keys/{id}/rotate": { "post": { "summary": "Rotate one of this partner’s keys", "operationId": "post_api_partners_keys_id_rotate", "tags": [ "Partner onboarding (public)" ], "description": "Mints a replacement carrying the same narrowing and revokes the old one. Refuses with 404 — not 403 — for a key outside this partner’s grant, because confirming that a key exists but belongs to somebody else is an enumeration oracle over other customers.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Shape follows the partner portal and may change with it.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/session/start": { "post": { "summary": "Begin a partner key-management session", "operationId": "post_api_partners_session_start", "tags": [ "Partner onboarding (public)" ], "description": "Sends a one-time code to the verified contact email of an approved partner application. Answers 202 with a challenge id IDENTICALLY whether or not the reference and email match a real application, and whether or not that application may hold keys — the response, and the absence of any hint in it, is what stops this endpoint being an enumeration oracle over who has applied to ORBIS. A code is only ever delivered to an address that actually applied.", "x-orbis-undocumented": "Sign-in shape follows the partner portal and may change with it; the body is deliberately not pinned as a contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" } }, "/api/partners/session/verify": { "post": { "summary": "Exchange the code for a session", "operationId": "post_api_partners_session_verify", "tags": [ "Partner onboarding (public)" ], "description": "Returns a short-lived bearer session bound to one partner. It is NOT an operator key: it carries no capability of its own, is accepted on no other surface, and can do exactly three things — mint, rotate and revoke keys inside that partner’s own grant. Single-use: the challenge is consumed either way.", "x-orbis-undocumented": "Sign-in shape follows the partner portal and may change with it; the body is deliberately not pinned as a contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/partner-keys-routes.ts", "x-orbis-stability": "unpromised" } }, "/api/products": { "get": { "summary": "Demo-bridge product catalogue", "operationId": "get_api_products", "tags": [ "Wallet bridge (holder)" ], "x-orbis-undocumented": "Demo-bridge surface; the wire shape is pinned by `docs/DEMO-SCOPE.md`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" }, "post": { "summary": "Create a demo-bridge product", "operationId": "post_api_products", "tags": [ "Wallet bridge (holder)" ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items` — the demo-bridge wire shape is pinned by `docs/DEMO-SCOPE.md`, which is the authority for this surface.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "unpromised" } }, "/api/proposals": { "post": { "summary": "Create a governance proposal", "operationId": "post_api_proposals", "tags": [ "Membership & governance" ], "x-orbis-undocumented": "Operator console view model, consumed only by the ORBIS console SPA. Not published as a partner contract, and not guessed at either — build against the standards-defined surfaces instead.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/proposals/vote": { "post": { "summary": "Cast a vote (operator plane)", "operationId": "post_api_proposals_vote", "tags": [ "Membership & governance" ], "x-orbis-undocumented": "Operator console view model. The holder-signed voting path, and the one with a published contract, is `POST /member/vote`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/qr": { "get": { "summary": "Render a string as an SVG QR code", "operationId": "get_api_qr", "tags": [ "Operator console" ], "description": "The one authenticated-plane route that is bearer-EXEMPT, because an `` tag cannot send an Authorization header.", "parameters": [ { "name": "data", "in": "query", "required": true, "description": "The string to encode.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "`image/svg+xml`, dark-on-light." }, "400": { "description": "`missing_data`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/requests": { "post": { "summary": "Create a presentation request (operator plane)", "operationId": "post_api_requests", "tags": [ "Presentation — OID4VP" ], "description": "The operator-authenticated twin of `POST /verify/request`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string" }, "typeId": { "type": "string" }, "claims": { "type": "array", "items": { "type": "string" } } } } } } }, "x-orbis-undocumented": "The success body extends the public handle with console display fields; use `POST /verify/request` for an integration.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`no_valid_claims`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "404": { "description": "`unknown_tenant` or `unknown_type`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/revoke": { "post": { "summary": "Revoke an issued credential", "operationId": "post_api_revoke", "tags": [ "Issuance — OID4VCI" ], "x-orbis-undocumented": "Request and response are the operator console’s own shape. The AUTHORITATIVE, public evidence of revocation is the signed status list at `/status/{seq}` — verify against that, not against this reply.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/state": { "get": { "summary": "Console state snapshot", "operationId": "get_api_state", "tags": [ "Operator console" ], "description": "Filtered server-side to the caller’s own organization when the session is tenant-scoped.", "x-orbis-undocumented": "The snapshot is the operator console’s view model and changes with the console. It is not a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/tenants": { "post": { "summary": "Provision a tenant issuer", "operationId": "post_api_tenants", "tags": [ "Tenants" ], "description": "Owner only. Mints the organization’s `did:web` identity and vault-held signing key, applies branding, and publishes its OID4VCI metadata. The slug is derived from the name. DEMO-TENANT LAW: a demonstration organization must carry a `demo-` slug prefix and a “ (Demo)” display-name suffix; the off-boarding and hygiene surfaces treat that namespace as sacred.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "The slug is `name` lowercased with non-alphanumerics collapsed to `-`." }, "profile": { "type": "object", "description": "Optional organization profile: legal name, address, contacts, logo, wallet branding." } }, "required": [ "name" ] } } } }, "responses": { "200": { "description": "Provisioned.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string" }, "name": { "type": "string" }, "did": { "type": "string" } }, "required": [ "slug", "name", "did" ] } } } }, "400": { "description": "`invalid_tenant` — a name is required and must yield a slug of at least 2 characters.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "409": { "description": "`tenant_exists` (the reserved slug `orbis` also 409s).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/tenants" } }, "/api/tenants/{tenant}/bills": { "post": { "summary": "Deposit a business event as a wallet item (contracts 0.3.0)", "operationId": "post_api_tenants_tenant_bills", "tags": [ "Deposit rail" ], "description": "The production deposit rail. ORBIS mints a tenant-signed attestation (`typ orbis-item+jwt`, bound to `externalRef` + `typeId`), then genuinely VERIFIES it and stores the check’s real outcome — a deposit whose attestation does not verify is kept as unverified, never silently upgraded and never dropped. `idempotencyKey` makes a replay a no-op. The tenant in the path is authoritative over the body; a tenant-scoped operator token may only deposit for its own organization.", "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string", "description": "Must equal the path segment." }, "accountId": { "type": "string", "description": "BARE RFC 7638 thumbprint of the holder’s device key." }, "typeId": { "type": "string", "description": "A credential type registered for this tenant." }, "externalRef": { "type": "string", "description": "The depositor’s own business-fact id." }, "claims": { "type": "object", "description": "The typed claim payload." }, "idempotencyKey": { "type": "string", "description": "e.g. `bill:`. A replay of the same key is a no-op." } }, "required": [ "tenant", "accountId", "typeId", "externalRef", "claims", "idempotencyKey" ] } } } }, "responses": { "200": { "description": "Deposited (or the idempotent replay of an earlier deposit).", "content": { "application/json": { "schema": { "type": "object", "properties": { "itemId": { "type": "string" }, "status": { "enum": [ "offered", "accepted" ] }, "statusIndex": { "type": [ "integer", "null" ] } }, "required": [ "itemId", "status", "statusIndex" ] } } } }, "400": { "description": "`invalid_request`, `invalid_account`, or `root_tenant_forbidden`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "No operator bearer.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "The bearer is scoped to a different organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_tenant`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "409": { "description": "`external_ref_conflict` — the deposit could not be stored and NO existing bill of yours matches it, so nothing was created. Retry with a fresh `externalRef`. This answer deliberately discloses nothing about any other organization’s items for the same holder.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/tenants/{tenant}/bills" } }, "/api/tenants/{tenant}/revoke": { "post": { "summary": "Revoke a credential issued by this organization", "operationId": "post_api_tenants_tenant_revoke", "tags": [ "Deposit rail" ], "description": "Sets the credential’s bit on the organization’s signed status list — the same mechanism, the same list and the same signature as the legacy `POST /api/revoke`; this route differs only in ADDRESS. Naming the tenant in the path is what lets a TENANT-SCOPED key call it, so revocation can be automated without an unscoped standing operator token existing anywhere (Open Rail Program §5 Phase 3). Two independent checks contain it: the caller’s key scope must match the path tenant, AND the credential must belong to that tenant. `statusIndex` is allocated PER ISSUER — every organization’s status list starts at 0 — so the same index legitimately exists under several organizations and is only meaningful together with its tenant. An index that does not name one of YOUR credentials answers `404 unknown_credential` — not 403, which would confirm to a scoped caller that some other organization holds that index. Revocation is irreversible; the authoritative evidence is the signed status list itself, at `/status/{seq}`.", "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "statusIndex": { "type": "integer", "description": "The credential’s index on this organization’s status list." } }, "required": [ "statusIndex" ] } } } }, "responses": { "200": { "description": "Revoked. The bit is set on the signed status list.", "content": { "application/json": { "schema": { "type": "object", "properties": { "revoked": { "type": "integer" }, "tenant": { "type": "string" } }, "required": [ "revoked", "tenant" ] } } } }, "400": { "description": "`invalid_request` (no `statusIndex`), `already_revoked`, or `revoke_failed`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "No operator bearer, or the key is revoked or past its expiry.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "The key is scoped to a different organization, or its capability set does not cover revocation.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_tenant`, or `unknown_credential` — including a credential that belongs to a DIFFERENT organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/tenants/update": { "post": { "summary": "Update an organization profile and branding", "operationId": "post_api_tenants_update", "tags": [ "Tenants" ], "description": "Re-applies branding to the live issuer, so new colours and logo appear in OID4VCI metadata immediately.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string" }, "name": { "type": "string" }, "profile": { "type": "object" } }, "required": [ "slug" ] } } } }, "responses": { "200": { "description": "Updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string" }, "name": { "type": "string" }, "did": { "type": "string" } }, "required": [ "slug", "name", "did" ] } } } }, "400": { "description": "`invalid_tenant`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "403": { "description": "A tenant-scoped caller may only edit its own organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_tenant`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/trust/remove": { "post": { "summary": "Remove an issuer from the trust registry", "operationId": "post_api_trust_remove", "tags": [ "Operator console" ], "x-orbis-undocumented": "Owner-only console surface. The published trust state is what verifiers actually consume.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/trust/restore": { "post": { "summary": "Restore an issuer to the trust registry", "operationId": "post_api_trust_restore", "tags": [ "Operator console" ], "x-orbis-undocumented": "Owner-only console view model. The trust state a verifier actually consumes is the published trust registry, not this reply.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/types": { "post": { "summary": "Register a credential type", "operationId": "post_api_types", "tags": [ "Credential types" ], "description": "Claim specs are strings: `key`, or `key:` where kind is `date`, `number`, `money`, `bool`, `array(text)`, `array(object)` or `enum(a|b|c)`. An unrecognised spec is a hard 400 — registering a SUBSET of the claims you asked for is never what a caller wanted. Claim keys preserve case and may not collide with the reserved SD-JWT members (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`, `cnf`, `vct`, `status`, `_sd`, `_sd_alg`).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "claims": { "type": "array", "items": { "type": "string", "description": "Claim spec." } }, "tenant": { "type": "string", "description": "Empty or absent for the root platform." } }, "required": [ "name", "claims" ] } } } }, "x-orbis-undocumented": "The 200 body is consumed by the operator console. It is not published as a partner contract; read the registered type back from `GET /.well-known/openid-credential-issuer` instead, which IS a standard.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "Unparseable or reserved claim specs, named in `error_description`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/types" } }, "/api/wallet/{accountId}/items": { "get": { "summary": "The wallet items held by an account", "operationId": "get_api_wallet_accountId_items", "tags": [ "Wallet bridge (holder)" ], "description": "Public + CORS-open, per-IP rate limited: the phone wallet calls this cross-origin. `accountId` is the RFC 7638 thumbprint of the device key. `fixtures: true` means this deployment is serving demonstration data — an honesty marker, never suppressed. READ-ONLY for a stranger: the response lists what the account already holds. Pending offers materialize (which SIGNS an attestation per approved product) only for an account that is already an enrolled member, so an anonymous caller naming an arbitrary accountId can never make an issuer key sign.", "parameters": [ { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "The wire shape of an ITEM is pinned by the demo-bridge contract in `docs/DEMO-SCOPE.md`, which is byte-frozen for the investor demo. It is referenced rather than restated here so the two can never diverge.", "responses": { "200": { "description": "The account’s items.", "content": { "application/json": { "schema": { "type": "object", "properties": { "accountId": { "type": "string" }, "fixtures": { "type": "boolean", "description": "True when fixture mode is on for this deployment." }, "items": { "type": "array", "items": { "type": "object" } } } } } } }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "`rate_limited`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "unpromised" } }, "/api/wallet/{accountId}/items/{itemId}/accept": { "post": { "summary": "Accept an offered item", "operationId": "post_api_wallet_accountId_items_itemId_accept", "tags": [ "Wallet bridge (holder)" ], "description": "The path account must equal the thumbprint of the signing device key, or the request is refused.", "parameters": [ { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "`account_mismatch` — the signature does not belong to the account in the path.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "`rate_limited`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/wallet/{accountId}/items/{itemId}/accept" } }, "/api/wallet/{accountId}/items/{itemId}/sharing": { "post": { "summary": "Set per-element sharing on a held item", "operationId": "post_api_wallet_accountId_items_itemId_sharing", "tags": [ "Wallet bridge (holder)" ], "parameters": [ { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "`account_mismatch`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/wallet/{accountId}/items/{itemId}/sharing" } }, "/api/wallets": { "post": { "summary": "Create a console-side test wallet", "operationId": "post_api_wallets", "tags": [ "Operator console" ], "x-orbis-undocumented": "Console rehearsal surface, not a holder wallet. Real custody lives in the ORBIS Wallet.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/wallets/accept": { "post": { "summary": "Console test wallet accepts an offer", "operationId": "post_api_wallets_accept", "tags": [ "Operator console" ], "x-orbis-undocumented": "Console rehearsal surface — a test wallet inside the operator console, not holder custody. Its shape is not a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/wallets/respond": { "post": { "summary": "Console test wallet answers a presentation request", "operationId": "post_api_wallets_respond", "tags": [ "Operator console" ], "x-orbis-undocumented": "Console rehearsal surface — a test wallet inside the operator console, not holder custody. Its shape is not a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/auth/api-token": { "get": { "summary": "Exchange an Entra sign-in for an operator API session", "operationId": "get_auth_api_token", "tags": [ "Operator sign-in" ], "description": "Bridges the Microsoft sign-in to the bearer every `/api/*` call needs. Answers 404 — a definite “no such door” — when the Entra gate is not configured, rather than falling through to the generic page.", "x-orbis-undocumented": "Sign-in helper consumed by the ORBIS console shell. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "entraSession": [] } ], "x-orbis-auth": "entra-session", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/auth/callback": { "get": { "summary": "Microsoft Entra redirect target", "operationId": "get_auth_callback", "tags": [ "Operator sign-in" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-conditional": "Served only when this deployment is configured for Microsoft Entra; otherwise the path 404s.", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/auth/login": { "get": { "summary": "Begin Microsoft Entra sign-in", "operationId": "get_auth_login", "tags": [ "Operator sign-in" ], "description": "Redirects to Microsoft. Password sign-in at `POST /api/login` is closed whenever this gate is configured.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-conditional": "Served only when this deployment is configured for Microsoft Entra; otherwise the path 404s.", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/auth/logout": { "get": { "summary": "End the Entra session", "operationId": "get_auth_logout", "tags": [ "Operator sign-in" ], "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "entraSession": [] } ], "x-orbis-auth": "entra-session", "x-orbis-conditional": "Served only when this deployment is configured for Microsoft Entra; otherwise the path 404s.", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/auth/whoami": { "get": { "summary": "Show the caller’s own Entra object id and link status", "operationId": "get_auth_whoami", "tags": [ "Operator sign-in" ], "description": "Lets an owner link an operator account without opening the Azure portal.", "x-orbis-undocumented": "Sign-in helper consumed by the ORBIS console shell. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "entraSession": [] } ], "x-orbis-auth": "entra-session", "x-orbis-conditional": "Served only when this deployment is configured for Microsoft Entra; otherwise the path 404s.", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/build": { "get": { "summary": "Build provenance of the running instance", "operationId": "get_build", "tags": [ "Trust artifacts" ], "description": "The commit this deployment was built from, the content digest recorded at build time, and the same digest RECOMPUTED from the files on disk right now — so a stranger can go from the running orbis.id back to a commit and check the two against each other. Public and unauthenticated by design; see /developers#provenance for the exact commands. NOT a verification-plane artifact — nothing is verified against it, so it carries no CORS promise and the rail invariants do not govern it (same position as security.txt). Read `attestation` before trusting `commit`: it states whether anything outside this server signs the claim.", "responses": { "200": { "description": "The provenance record. Always 200, including when it cannot be determined — a field that cannot be answered is null and `reason` says why, because a 500 tells a checker nothing.", "content": { "application/json": { "schema": { "type": "object", "required": [ "schema", "commit", "sourceDigest", "observedSourceDigest", "matches", "divergence", "attestation", "recipe" ], "properties": { "schema": { "type": "string", "const": "orbis-build-provenance/1" }, "commit": { "type": [ "string", "null" ], "description": "40-hex commit sha, or null when this artifact carries no build record." }, "sourceDigest": { "type": [ "string", "null" ], "description": "sha256: over the sorted `hash path` manifest, recorded at build time." }, "observedSourceDigest": { "type": [ "string", "null" ], "description": "The same digest recomputed from the deployed files at request time." }, "matches": { "type": [ "boolean", "null" ], "description": "True only when nothing is missing, changed or extra." }, "divergence": { "type": [ "object", "null" ], "description": "COUNTS only. Paths are deliberately not published.", "properties": { "missing": { "type": "integer", "description": "In the built manifest, absent on disk." }, "changed": { "type": "integer", "description": "Present in both, different bytes." }, "extra": { "type": "integer", "description": "On disk, in no commit that built this artifact." } } }, "attestation": { "type": "object", "properties": { "available": { "type": "boolean" }, "reason": { "type": "string" } } }, "recipe": { "type": "string", "format": "uri" }, "reason": { "type": "string", "description": "Present only when a field above is null." } } } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/capabilities": { "get": { "summary": "Public capability register", "operationId": "get_capabilities", "tags": [ "Human surfaces (HTML)" ], "description": "Every capability ORBIS.ID claims, with its real state (live, partial, in build, planned), what specifically is and is not implemented, and the method by which each state was established. Rendered from a single register that every public claim on the site must reference — a claim whose capability is not live carries its qualifier inline, linking here.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/capabilities/", "x-orbis-stability": "unpromised" } }, "/conformance/vectors": { "get": { "summary": "Open Rail conformance vector set", "operationId": "get_conformance_vectors", "tags": [ "Trust artifacts" ], "description": "The published conformance vectors: thirteen self-describing bundles of exactly what a stranger fetches to check a credential — a presentation, the issuer’s did:web document and a signed status list — each stating what it proves and the verdict a correct verifier MUST reach. Point your own implementation, in any language, at this document and prove it correct: no ORBIS account, no ORBIS code and no ORBIS permission. Using the `@orbis-id/verifier` package is OPTIONAL; this set is the contract. Permissionless and CORS-open, and never ORBIS-versioned — the credential formats are versioned by their standards and the set by its own `setVersion`. The BYTES are minted per process (fresh keys and salts) and are ephemeral by design; `digest` names the exact bytes so a conformance report stays citable.", "responses": { "200": { "description": "The vector set.", "content": { "application/json": { "schema": { "type": "object", "properties": { "schema": { "type": "string", "description": "Document shape, currently `orbis-open-rail-conformance/1`." }, "setVersion": { "type": "string", "description": "The CONTRACT version: which vectors exist and what each requires. Semver." }, "mintedAt": { "type": "string", "description": "When these bytes were produced (ISO 8601)." }, "digest": { "type": "string", "description": "base64url(SHA-256(canonical JSON of `vectors`))." }, "about": { "type": "string" }, "failureCodes": { "type": "object", "description": "The published failure taxonomy, one line per code.", "additionalProperties": { "type": "string" } }, "conformanceLevels": { "type": "object", "properties": { "level1": { "type": "string", "description": "Verdict must match. The binding contract." }, "level2": { "type": "string", "description": "Verdict, failure code and disclosed claims must match. Recommended, never required." } } }, "vectors": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Stable vector identifier, e.g. `revoked`." }, "about": { "type": "string", "description": "What this vector is." }, "proves": { "type": "string", "description": "What a correct answer proves about the implementation." }, "input": { "type": "object", "properties": { "presentation": { "type": "string", "description": "The `vp_token`." }, "didDocument": { "type": "object", "description": "The issuer’s published did:web document." }, "statusList": { "type": [ "object", "null" ], "description": "`{ uri, token }`, or null when the vector deliberately withholds it." }, "audience": { "type": "string" }, "nonce": { "type": "string" }, "expectedIssuer": { "type": "string" }, "expectedVct": { "type": "string" }, "requiredClaims": { "type": "array", "items": { "type": "string" } }, "now": { "type": "integer", "description": "The fixed evaluation instant, so `exp`-based vectors answer the same forever." } } }, "expect": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "accept", "reject", "indeterminate" ] }, "failure": { "type": [ "string", "null" ], "description": "A code from `failureCodes`; null when the verdict is accept." }, "claims": { "type": [ "object", "null" ], "description": "On accept: exactly the claims that must be readable." }, "withheld": { "type": "array", "items": { "type": "string" }, "description": "Claim names that must NOT appear in the result." } } } } } } } } } } }, "503": { "description": "The set could not be minted. Never cached — a transient failure must not make this document permanently unavailable.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/console": { "get": { "summary": "Identity Console", "operationId": "get_console", "tags": [ "Human surfaces (HTML)" ], "description": "The page loads unauthenticated at this layer; every call it makes is bearer-gated. Gated by Entra when configured.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "entraSession": [] } ], "x-orbis-auth": "entra-session", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/console/", "x-orbis-stability": "unpromised" } }, "/credential": { "post": { "summary": "Collect the credential", "operationId": "post_credential", "tags": [ "Issuance — OID4VCI" ], "description": "OID4VCI credential endpoint. The wallet proves possession of its device key with a `openid4vci-proof+jwt` JWT whose header carries the public JWK, addressed to this issuer and echoing the `c_nonce` from the token response. One credential per access token. Also served per tenant at `/t/{tenant}/credential`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "credential_configuration_id": { "type": "string", "description": "Must be a key of `credential_configurations_supported`." }, "proof": { "type": "object", "properties": { "proof_type": { "const": "jwt" }, "jwt": { "type": "string", "description": "ES256, typ `openid4vci-proof+jwt`." } }, "required": [ "proof_type", "jwt" ] } }, "required": [ "credential_configuration_id", "proof" ] } } } }, "responses": { "200": { "description": "The issued SD-JWT VC.", "content": { "application/json": { "schema": { "type": "object", "properties": { "credentials": { "type": "array", "items": { "type": "object", "properties": { "credential": { "type": "string", "description": "Compact SD-JWT VC." } } } } }, "required": [ "credentials" ] } } } }, "400": { "description": "`unsupported_credential_type` or `invalid_proof`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`invalid_token` — unknown, already used, or expired access token.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "oid4vciAccessToken": [] } ], "x-orbis-auth": "oid4vci-token", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/demo": { "get": { "summary": "Investor-demo console", "operationId": "get_demo", "tags": [ "Human surfaces (HTML)" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/demo/", "x-orbis-stability": "unpromised" } }, "/developers": { "get": { "summary": "Developer portal", "operationId": "get_developers", "tags": [ "Human surfaces (HTML)" ], "description": "Quickstarts, copy-pasteable curl for the four-step flow, the webhook signature recipe, and an honest live-vs-planned table. Renders this document.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-stability": "unpromised" } }, "/t/{tenant}/did.json": { "get": { "summary": "Tenant did:web document", "operationId": "get_t_tenant_did_json", "tags": [ "Trust artifacts" ], "description": "The per-tenant form. A tenant DID is `did:web::t:`, which resolves to `/t//did.json`. Reached only through the `/t/{tenant}` prefix — the bare path is not mounted.", "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "Same as the root DID document above.", "responses": { "200": { "description": "DID document for that tenant issuer." }, "404": { "description": "Unknown tenant.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/directory/listing": { "delete": { "summary": "Remove the holder’s own listing", "operationId": "delete_directory_listing", "tags": [ "Holder directory" ], "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`directory_unconfigured`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" }, "post": { "summary": "Create or update the holder’s own directory listing", "operationId": "post_directory_listing", "tags": [ "Holder directory" ], "description": "There is no anonymous directory access: every route here requires a holder signature.", "x-orbis-undocumented": "The listing body and response are defined by the CD directory contract (`docs/superpowers/specs/2026-07-18-cd-directory-api-contract.md`), which is the authority for this surface. They are not duplicated here, where they could drift out of step with it.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_display_name` and other field-level rejections.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "Per-holder and per-IP rate limits.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`directory_unconfigured` — this deployment has no `DIRECTORY_PEPPER`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/directory/listing/me": { "get": { "summary": "Read the holder’s own listing", "operationId": "get_directory_listing_me", "tags": [ "Holder directory" ], "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`directory_unconfigured`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/docs": { "get": { "summary": "How ORBIS.ID works", "operationId": "get_docs", "tags": [ "Human surfaces (HTML)" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/docs/", "x-orbis-stability": "unpromised" } }, "/for-business": { "get": { "summary": "For Business — audience page", "operationId": "get_for_business", "tags": [ "Human surfaces (HTML)" ], "description": "Plain-language explanation of what ORBIS.ID does for this audience. Every capability asserted is bound to the public capability register, and anything not live carries its qualifier inline.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/for-business/", "x-orbis-stability": "unpromised" } }, "/for-cities": { "get": { "summary": "For Cities — audience page", "operationId": "get_for_cities", "tags": [ "Human surfaces (HTML)" ], "description": "Plain-language explanation of what ORBIS.ID does for this audience. Every capability asserted is bound to the public capability register, and anything not live carries its qualifier inline.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/for-cities/", "x-orbis-stability": "unpromised" } }, "/for-government": { "get": { "summary": "For Government — audience page", "operationId": "get_for_government", "tags": [ "Human surfaces (HTML)" ], "description": "Plain-language explanation of what ORBIS.ID does for this audience. Every capability asserted is bound to the public capability register, and anything not live carries its qualifier inline.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/for-government/", "x-orbis-stability": "unpromised" } }, "/for-people": { "get": { "summary": "For People — audience page", "operationId": "get_for_people", "tags": [ "Human surfaces (HTML)" ], "description": "Plain-language explanation of what ORBIS.ID does for this audience. Every capability asserted is bound to the public capability register, and anything not live carries its qualifier inline.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/for-people/", "x-orbis-stability": "unpromised" } }, "/manifest": { "get": { "summary": "Tenant manifest (wallet white-label config)", "operationId": "get_manifest", "tags": [ "Trust artifacts" ], "description": "Republishes branding that is already public through each issuer’s OID4VCI display metadata, plus the root platform entry. CORS-open — the wallet fetches it cross-origin.", "responses": { "200": { "description": "Every tenant this deployment serves.", "content": { "application/json": { "schema": { "type": "object", "properties": { "tenants": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Tenant slug; `orbis` is the root platform entry." }, "name": { "type": "string" }, "did": { "type": "string" }, "primaryColor": { "type": [ "string", "null" ] }, "textColor": { "type": [ "string", "null" ] }, "logoUri": { "type": [ "string", "null" ] } } } } } } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/member/enroll": { "post": { "summary": "Enroll as a member using a verified presentation", "operationId": "post_member_enroll", "tags": [ "Membership & governance" ], "description": "Enrollment is proven by a COMPLETED presentation, not by a secret: the member id is derived from the RFC 7638 thumbprint of the `cnf.jwk` in the presented credential. Public + CORS-open.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "transactionId": { "type": "string", "description": "A transaction whose outcome is `ok: true`." }, "displayName": { "type": "string", "description": "Optional; capped at 60 characters." } }, "required": [ "transactionId" ] } } } }, "responses": { "200": { "description": "Enrolled, or already a member.", "content": { "application/json": { "schema": { "type": "object", "properties": { "alreadyMember": { "type": "boolean" }, "memberDid": { "type": "string", "description": "`did:jwk-thumbprint:`." }, "tenant": { "type": "string" }, "tier": { "type": "string" }, "orbisCoin": { "type": "integer" } } } } } }, "400": { "description": "`presentation_not_verified`, `unknown_vct`, or `no_holder_key`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/member/me": { "get": { "summary": "The holder’s own memberships and open proposals", "operationId": "get_member_me", "tags": [ "Membership & governance" ], "responses": { "200": { "description": "Memberships across tenants, plus the proposals those tenants have open.", "content": { "application/json": { "schema": { "type": "object", "properties": { "memberDid": { "type": "string" }, "memberships": { "type": "array", "items": { "type": "object", "properties": { "tenant": { "type": "string" }, "tier": { "type": "string" }, "orbisCoin": { "type": "integer" }, "joinedAt": { "type": "string" } } } }, "proposals": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "tenant": { "type": "string" }, "kind": { "type": "string" }, "title": { "type": "string" }, "body": { "type": "string" }, "closesAt": { "type": "string" }, "open": { "type": "boolean" }, "tally": { "type": "object" }, "myVote": { "type": [ "string", "null" ] } } } } } } } } }, "401": { "description": "`holder_auth_`: missing, malformed, bad_signature, stale, replayed or bad_audience.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1": "/v1/member/me" } }, "/member/vote": { "post": { "summary": "Cast a governance vote", "operationId": "post_member_vote", "tags": [ "Membership & governance" ], "description": "The voter is taken ONLY from the signature — never from the body.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "proposalId": { "type": "string" }, "choice": { "type": "string" } }, "required": [ "proposalId", "choice" ] } } } }, "x-orbis-undocumented": "Shares its handler with the operator vote route; the success body is not pinned as a holder-plane contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/onboard/start": { "post": { "summary": "Send an identifier-ownership code", "operationId": "post_onboard_start", "tags": [ "Holder onboarding" ], "description": "Public + CORS-open. Rate limited.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "channel": { "enum": [ "email", "sms" ] }, "address": { "type": "string", "description": "Email address, or E.164 phone number." } }, "required": [ "channel", "address" ] } } } }, "x-orbis-undocumented": "The 200 body comes from `src/admin/onboarding.ts`, a wrap-don’t-touch module. Its shape is not republished here; carry the value it returns straight into `POST /onboard/verify`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_channel` or `invalid_address`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "`rate_limited`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "502": { "description": "`delivery_failed`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "503": { "description": "`channel_not_configured` — this deployment has no sender for that channel.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/onboard/verify": { "post": { "summary": "Prove the code and receive a signed ownership attestation", "operationId": "post_onboard_verify", "tags": [ "Holder onboarding" ], "description": "The attestation binds the HASH of the identifier, never the plaintext, and is signed by the issuer key (`typ ownership+jwt`).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "challengeId": { "type": "string" }, "code": { "type": "string" } }, "required": [ "challengeId", "code" ] } } } }, "responses": { "200": { "description": "Ownership proven.", "content": { "application/json": { "schema": { "type": "object", "properties": { "verified": { "const": true }, "channel": { "enum": [ "email", "sms" ] }, "addressHash": { "type": "string" }, "attestation": { "type": "string", "description": "Compact JWS." } }, "required": [ "verified", "channel", "addressHash", "attestation" ] } } } }, "400": { "description": "The code was wrong, expired, or already used.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/openapi.json": { "get": { "summary": "This document", "operationId": "get_openapi_json", "tags": [ "Human surfaces (HTML)" ], "description": "OpenAPI 3.1, public and CORS-open, generated from the server’s own route table.", "responses": { "200": { "description": "The OpenAPI 3.1 document.", "content": { "application/json": { "schema": { "type": "object", "description": "An OpenAPI 3.1 document describing this deployment." } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-stability": "unpromised" } }, "/partners": { "get": { "summary": "Partners — start integrating", "operationId": "get_partners", "tags": [ "Human surfaces (HTML)" ], "description": "The partner-facing half of the onboarding pipeline: the four integration profiles, the eight-state machine the operator desk works from, what the platform proves before production, and the demo-namespace sandbox law. Rendered from the platform’s own profile and stage definitions, never a retyped copy.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/partners/", "x-orbis-stability": "unpromised" } }, "/partners/apply": { "get": { "summary": "Partner application form", "operationId": "get_partners_apply", "tags": [ "Human surfaces (HTML)" ], "description": "The intake form. Nine fields, no credential entry of any kind, and a full HTML form so the page works with JavaScript disabled. Submits to POST /api/partners/applications.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/partners/apply/", "x-orbis-stability": "unpromised" } }, "/partners/data-partner": { "get": { "summary": "Partner path — data partner", "operationId": "get_partners_data_partner", "tags": [ "Human surfaces (HTML)" ], "description": "The deposit rail and the webhook plane, with the signature recipe.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/partners/issuer": { "get": { "summary": "Partner path — issuer", "operationId": "get_partners_issuer", "tags": [ "Human surfaces (HTML)" ], "description": "What an issuer builds, what ORBIS needs, what gets proved, and the calls.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/partners/relying-party": { "get": { "summary": "Partner path — relying party / verifier", "operationId": "get_partners_relying_party", "tags": [ "Human surfaces (HTML)" ], "description": "States first that the open verification rail needs NO ORBIS account, then gives the calls that start working immediately. A relying party is never asked to apply for something it does not need.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/partners/status": { "get": { "summary": "Partner application status lookup", "operationId": "get_partners_status", "tags": [ "Human surfaces (HTML)" ], "description": "Look up ONE application with its reference and the contact email it was made with. Submits to POST /api/partners/applications/status.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/partners/status/", "x-orbis-stability": "unpromised" } }, "/partners/wallet": { "get": { "summary": "Partner path — wallet", "operationId": "get_partners_wallet", "tags": [ "Human surfaces (HTML)" ], "description": "OID4VCI/OID4VP conformance and holder-binding proof, with the calls.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/portal": { "get": { "summary": "The partner portal — where you are in the pipeline", "operationId": "get_portal", "tags": [ "Partner onboarding (public)" ], "description": "Rendered from the SAME eight stages the operator desk uses and /partners publishes; there is no portal-only status vocabulary. Rendered from the stage the session already carries rather than re-reading the application, because that read requires reference AND email and the pairing is the anti-enumeration property.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-also-serves": "/portal/", "x-orbis-stability": "unpromised" } }, "/portal/keys": { "get": { "summary": "The partner portal — your API keys", "operationId": "get_portal_keys", "tags": [ "Partner onboarding (public)" ], "description": "Live keys and expired keys in separate tables, because they demand different actions and mixing them is how somebody rotates the wrong one. The ceiling is counted against LIVE keys only: a dead key holding a slot would leave a partner unable to replace the very key that stopped working. Every role sees the last four characters of each token — the same hint the operator desk shows — but only a contact with the Admin role is offered mint, rotate or revoke.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/keys/mint": { "post": { "summary": "Issue a key from the portal", "operationId": "post_portal_keys_mint", "tags": [ "Partner onboarding (public)" ], "description": "The browser twin of POST /api/partners/keys, narrowed against the same stored grant. The secret is rendered ONCE, in the response body — never in a form value, a link, or any attribute, so it cannot survive into autofill, the back button, or a referrer. Admin role required, re-checked here and not merely hidden in the markup.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/keys/revoke": { "post": { "summary": "Revoke a key from the portal", "operationId": "post_portal_keys_revoke", "tags": [ "Partner onboarding (public)" ], "description": "Stops the key immediately. The record and its history are kept — revocation is not deletion, and the audit trail must still be able to answer what that key did. Admin role required.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/keys/rotate": { "post": { "summary": "Rotate a key from the portal", "operationId": "post_portal_keys_rotate", "tags": [ "Partner onboarding (public)" ], "description": "Issues a fresh secret and retires the old one at the same instant. Offered for expired keys too — that is how a partner brings a dead integration back without a support ticket. Admin role required.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/signin": { "get": { "summary": "The partner portal sign-in page", "operationId": "get_portal_signin", "tags": [ "Partner onboarding (public)" ], "description": "An HTML form. A partner signs in with their application reference and the contact email on it; the code goes to that address and nowhere else. The page is complete with JavaScript disabled — it is a real form post, because the session is a cookie and a bearer header cannot ride on a form.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" }, "post": { "summary": "Ask the portal for a sign-in code", "operationId": "post_portal_signin", "tags": [ "Partner onboarding (public)" ], "description": "Answers the SAME page whether or not the reference and email match an application. That is the property stopping this surface being an oracle for who has applied to ORBIS, and a page that said \"no such reference\" would hand back exactly what the API refuses to.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/signout": { "post": { "summary": "End the browser session", "operationId": "post_portal_signout", "tags": [ "Partner onboarding (public)" ], "description": "Closes the session server-side and clears the cookie. A POST, never a link — a GET would let any page sign a partner out with an embedded image.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/team": { "get": { "summary": "The partner portal — who is on this account", "operationId": "get_portal_team", "tags": [ "Partner onboarding (public)" ], "description": "Every contact who can sign in to the partner account, their role, and whether their address has been proven. No stage gate: a partner at any non-terminal stage has colleagues who need to reach the account, and making them wait for `live` would mean the colleague cannot help them get there. The sole Admin is rendered without destructive controls, because the server refuses those and a control guaranteed to fail is a lie.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/team/add": { "post": { "summary": "Add a contact to the partner account", "operationId": "post_portal_team_add", "tags": [ "Partner onboarding (public)" ], "description": "Admin role required. The new contact signs in with the account reference and their OWN address; the code goes there and nowhere else, so adding somebody grants no access to anything the adder can read.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/team/remove": { "post": { "summary": "Remove a contact from the partner account", "operationId": "post_portal_team_remove", "tags": [ "Partner onboarding (public)" ], "description": "Admin role required. REFUSES removing the last Admin — the second door. A removed contact who is signed in keeps their session until it expires; access ends with that session, not instantly.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/team/role": { "post": { "summary": "Change a contact’s role", "operationId": "post_portal_team_role", "tags": [ "Partner onboarding (public)" ], "description": "Admin role required. REFUSES demoting the last Admin — one of the two doors that make an account impossible to orphan. Takes effect at the contact’s next sign-in, because a role is read once when a session opens and a session lasts thirty minutes.", "responses": { "200": { "description": "HTML page." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/portal/verify": { "post": { "summary": "Exchange the code for a browser session", "operationId": "post_portal_verify", "tags": [ "Partner onboarding (public)" ], "description": "On success sets an HttpOnly, Secure, SameSite=Lax cookie carrying the same opaque session token the bearer surface uses, and redirects with 303 so the redirect becomes a GET. An expired or attempt-exhausted challenge returns the visitor to sign-in rather than a code box they can never satisfy.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/portal-routes.ts", "x-orbis-stability": "unpromised" } }, "/regulations": { "get": { "summary": "Regulations and GDPR operations", "operationId": "get_regulations", "tags": [ "Human surfaces (HTML)" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/regulations/", "x-orbis-stability": "unpromised" } }, "/oid4vp/request/{transactionId}": { "get": { "summary": "Authorization request object (DCQL query)", "operationId": "get_oid4vp_request_transactionId", "tags": [ "Presentation — OID4VP" ], "description": "OpenID4VP 1.0 cross-device flow. The wallet resolves the `request_uri` from the `openid4vp://` QR and reads the request object: `response_mode=direct_post`, the nonce, and a DCQL query naming the exact claims requested.", "parameters": [ { "name": "transactionId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "The request object.", "content": { "application/json": { "schema": { "type": "object", "properties": { "response_type": { "const": "vp_token" }, "response_mode": { "const": "direct_post" }, "client_id": { "type": "string", "description": "The caller-supplied `aud`, else this verifier’s own client id." }, "response_uri": { "type": "string" }, "nonce": { "type": "string" }, "state": { "type": "string", "description": "The transaction id." }, "dcql_query": { "type": "object", "description": "DCQL: one credential query, `format: dc+sd-jwt`, `meta.vct_values`, and a `claims[].path` per requested claim." } } } } } }, "404": { "description": "`unknown_transaction`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "410": { "description": "`request_expired` — the 5-minute request window closed.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vp/verifier-server.ts", "x-orbis-stability": "unpromised" } }, "/oid4vp/response": { "post": { "summary": "Wallet posts the presentation (direct_post)", "operationId": "post_oid4vp_response", "tags": [ "Presentation — OID4VP" ], "description": "The wallet posts `vp_token` + `state`. ORBIS runs the full server-side validation chain — trust anchor, issuer signature, holder binding, status, nonce and audience — and records the outcome for the relying party to poll.", "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "properties": { "vp_token": { "type": "string", "description": "JSON object keyed by DCQL credential query id (`vbm`), value an array of presentations." }, "state": { "type": "string", "description": "The transaction id from the request object." } }, "required": [ "vp_token", "state" ] } } } }, "x-orbis-undocumented": "The success body is consumed only by the wallet that posted it; it is not a relying-party contract. A relying party reads the outcome from `GET /verify/result/{transactionId}` instead.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_state`, `transaction_already_completed`, `request_expired`, `missing_vp_token` or `malformed_vp_token`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vp/verifier-server.ts", "x-orbis-stability": "unpromised" } }, "/standards": { "get": { "summary": "Standards and conformance", "operationId": "get_standards", "tags": [ "Human surfaces (HTML)" ], "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-also-serves": "/standards/", "x-orbis-stability": "unpromised" } }, "/status/{seq}": { "get": { "summary": "Signed status list by sequence (platform issuer)", "operationId": "get_status_seq", "tags": [ "Trust artifacts" ], "description": "The persisted status-list registry: sequence 2 and above, and a rolled-over list 1. Signed through the same issuer seam as `/status/1`, so the token shape is identical.", "parameters": [ { "name": "seq", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "The signed status list.", "content": { "application/statuslist+jwt": { "schema": { "type": "string", "description": "Compact JWS." } } } }, "404": { "description": "No such status list for this issuer.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/status/1": { "get": { "summary": "Signed status list (list 1, live)", "operationId": "get_status_1", "tags": [ "Trust artifacts" ], "description": "IETF Token Status List as a signed JWT (`application/statuslist+jwt`). A credential’s `status` claim points at a `(uri, idx)` pair here; a verifier fetches the list and checks the bit. Served by the wire issuer for a non-rolled-over list 1; every other sequence is served by the persisted registry route below. CORS-open.", "responses": { "200": { "description": "The signed status list.", "content": { "application/statuslist+jwt": { "schema": { "type": "string", "description": "Compact JWS. Decode it and read the bit at the credential’s `status.idx`." } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/t/{tenant}/status/{seq}": { "get": { "summary": "Signed status list by sequence (tenant issuer)", "operationId": "get_t_tenant_status_seq", "tags": [ "Trust artifacts" ], "description": "Per-tenant form of the status-list registry route.", "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "seq", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "The signed status list.", "content": { "application/statuslist+jwt": { "schema": { "type": "string", "description": "Compact JWS." } } } }, "404": { "description": "Unknown tenant, or no such status list.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/token": { "post": { "summary": "Redeem a pre-authorized code for an access token", "operationId": "post_token", "tags": [ "Issuance — OID4VCI" ], "description": "OID4VCI 1.0 pre-authorized code flow. Form-encoded, no client authentication. The code is single-use and expires. Also served per tenant at `/t/{tenant}/token`.", "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "properties": { "grant_type": { "const": "urn:ietf:params:oauth:grant-type:pre-authorized_code" }, "pre-authorized_code": { "type": "string", "description": "The code carried in the credential offer." } }, "required": [ "grant_type", "pre-authorized_code" ] } } } }, "responses": { "200": { "description": "Access token and the c_nonce the proof of possession must echo.", "content": { "application/json": { "schema": { "type": "object", "properties": { "access_token": { "type": "string" }, "token_type": { "const": "Bearer" }, "expires_in": { "type": "integer", "description": "Seconds; 300 in this implementation." }, "c_nonce": { "type": "string" }, "c_nonce_expires_in": { "type": "integer" } }, "required": [ "access_token", "token_type", "c_nonce" ] } } } }, "400": { "description": "`unsupported_grant_type`, or `invalid_grant` for an unknown, used or expired code.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/oid4vci/issuer-server.ts", "x-orbis-stability": "unpromised" } }, "/verify": { "get": { "summary": "Hosted verification page", "operationId": "get_verify", "tags": [ "Human surfaces (HTML)" ], "description": "Request a proof by QR and watch the validation chain run. Deliberately embeddable by any origin.", "responses": { "200": { "description": "HTML page." } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/verify/catalog": { "get": { "summary": "Credential types that can be requested", "operationId": "get_verify_catalog", "tags": [ "Hosted verification" ], "description": "What a relying party may ask for, across the root platform and every tenant. CORS-open.", "responses": { "200": { "description": "The catalogue.", "content": { "application/json": { "schema": { "type": "object", "properties": { "types": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "vct": { "type": "string", "description": "The credential type identifier presented in the SD-JWT VC." }, "tenant": { "type": "string", "description": "Empty string for the root platform." }, "claims": { "type": "array", "items": { "type": "string", "description": "Claim key." } } } } } } } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/verify/request": { "post": { "summary": "Create a presentation request", "operationId": "post_verify_request", "tags": [ "Hosted verification" ], "description": "Mint an `openid4vp://` request a holder can scan. Optionally bind it to YOUR nonce, audience and origin so the resulting key-binding JWT is provably meant for you. CORS-open — a relying party can drive this from the browser with no ORBIS account.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "vct": { "type": "string", "description": "A `vct` from `GET /verify/catalog`." }, "claims": { "type": "array", "items": { "type": "string" }, "description": "Subset of the type’s claims; omitted means all of them. Unknown keys are dropped." }, "nonce": { "type": "string", "description": "Replaces the server-generated nonce." }, "aud": { "type": "string", "description": "Becomes `client_id` in the request object AND the enforced key-binding audience." }, "origin": { "type": "string", "description": "Stored and echoed back on the outcome. NOT independently verified — this profile’s key-binding JWT carries no origin claim. Fold an origin you need enforced into `aud`." } }, "required": [ "vct" ] } } } }, "responses": { "200": { "description": "The request handle.", "content": { "application/json": { "schema": { "type": "object", "properties": { "requestUri": { "type": "string", "description": "`openid4vp://?request_uri=…` — render as a QR." }, "transactionId": { "type": "string" }, "resultToken": { "type": "string", "description": "SECRET read capability for `GET /verify/result/{transactionId}`, bound to this transaction. Send it as `Authorization: Bearer ` when you poll. Never put it in the QR, a URL, or anywhere a third party can read it — it is what stops a stranger reading your holder’s outcome." } }, "required": [ "requestUri", "transactionId", "resultToken" ] } } } }, "400": { "description": "`no_valid_claims`, or `invalid_binding` when nonce/aud/origin fail shape validation (the offending value is never echoed back).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_vct`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/verify/result/{transactionId}": { "get": { "summary": "Poll the outcome of a presentation", "operationId": "get_verify_result_transactionId", "tags": [ "Hosted verification" ], "description": "The honesty law in wire form: this returns a verified presentation ONLY after the cryptographic round-trip actually completed. `outcome` is `null` while the transaction is still open.\n\nSend `Authorization: Bearer ` — the token `POST /verify/request` returned to you. The outcome belongs to the relying party that minted the request; a poll without the right token reads `{\"outcome\":null}`, identical to an unknown transaction, so no credential is ever demanded and no stranger can read your holder’s presentation from a transaction id alone.\n\n`presentation.claims` carries EXACTLY the claims you requested. Holder-binding and issuer metadata (`cnf`, `status`, `iss`, `iat`, `vct`) are never served here: `cnf.jwk` is the holder’s device key, and its RFC 7638 thumbprint is that holder’s wallet account id.", "parameters": [ { "name": "transactionId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "The outcome, or null while open.", "content": { "application/json": { "schema": { "type": "object", "properties": { "outcome": { "oneOf": [ { "type": "null" }, { "type": "object", "properties": { "ok": { "const": false }, "error": { "type": "string", "description": "Which link of the chain failed." } }, "required": [ "ok", "error" ] }, { "type": "object", "properties": { "ok": { "const": true }, "presentation": { "type": "object", "description": "The verified presentation: `issuer`, and `claims` projected to exactly the claim keys this request asked for. Never the holder’s confirmation key." }, "presentedNonce": { "type": "string", "description": "The nonce actually enforced against the key-binding JWT." }, "presentedAud": { "type": "string", "description": "The audience actually enforced." }, "presentedOrigin": { "type": [ "string", "null" ], "description": "Echoed verbatim; never independently verified." } }, "required": [ "ok", "presentation" ] } ] } } } } } } }, "security": [], "x-orbis-auth": "public", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/directory/search/name": { "post": { "summary": "Search the directory by name", "operationId": "post_directory_search_name", "tags": [ "Holder directory" ], "description": "A search term may NEVER travel in the query string — this route refuses any request that carries one (`unsupported_query_string`), so a term cannot end up in infrastructure logs.", "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`unsupported_query_string`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "Rate limited.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/directory/search/community": { "post": { "summary": "Search the directory by community", "operationId": "post_directory_search_community", "tags": [ "Holder directory" ], "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`unsupported_query_string`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/directory/lookup": { "post": { "summary": "Look up a hashed directory entry", "operationId": "post_directory_lookup", "tags": [ "Holder directory" ], "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`unsupported_query_string`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/directory/descriptor": { "post": { "summary": "Fetch a directory descriptor", "operationId": "post_directory_descriptor", "tags": [ "Holder directory" ], "x-orbis-undocumented": "See `POST /directory/listing`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`unsupported_query_string`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/directory.ts", "x-orbis-stability": "unpromised" } }, "/api/products/{productId}/approve": { "post": { "summary": "Approve a demo-bridge product", "operationId": "post_api_products_productId_approve", "tags": [ "Wallet bridge (holder)" ], "parameters": [ { "name": "productId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items` — the demo-bridge wire shape is pinned by `docs/DEMO-SCOPE.md`, which is the authority for this surface.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "unpromised" } }, "/api/products/{productId}/require-channel": { "post": { "summary": "Require an org channel for a demo-bridge product", "operationId": "post_api_products_productId_require_channel", "tags": [ "Wallet bridge (holder)" ], "parameters": [ { "name": "productId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items` — the demo-bridge wire shape is pinned by `docs/DEMO-SCOPE.md`, which is the authority for this surface.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "unpromised" } }, "/api/demo/seed": { "post": { "summary": "Seed the demo-bridge catalogue", "operationId": "post_api_demo_seed", "tags": [ "Wallet bridge (holder)" ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items` — the demo-bridge wire shape is pinned by `docs/DEMO-SCOPE.md`, which is the authority for this surface.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "unpromised" } }, "/api/org-channels/request": { "post": { "summary": "Request an organization comms channel", "operationId": "post_api_org_channels_request", "tags": [ "Operator console" ], "x-orbis-undocumented": "Operator/ops simulation surface for the comms-consent track.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "403": { "description": "Scoped to another organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_tenant`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/operators": { "post": { "summary": "Create an operator account", "operationId": "post_api_operators", "tags": [ "Operator console" ], "description": "A tenant-scoped caller may only create operators inside its own organization, and never an owner.", "x-orbis-undocumented": "Team-management console view model, consumed only by the ORBIS console SPA. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/operators/remove": { "post": { "summary": "Remove an operator account", "operationId": "post_api_operators_remove", "tags": [ "Operator console" ], "description": "Owner only — deletion is deliberately not delegated; suspension is the reversible equivalent.", "x-orbis-undocumented": "Team-management console view model, consumed only by the ORBIS console SPA. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/operators/suspend": { "post": { "summary": "Suspend an operator account", "operationId": "post_api_operators_suspend", "tags": [ "Operator console" ], "x-orbis-undocumented": "Team-management console view model, consumed only by the ORBIS console SPA. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/operators/enable": { "post": { "summary": "Reinstate a suspended operator account", "operationId": "post_api_operators_enable", "tags": [ "Operator console" ], "x-orbis-undocumented": "Team-management console view model, consumed only by the ORBIS console SPA. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "tenant-admin" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/api/agent/activity": { "post": { "summary": "Report an agent’s own tool-call activity", "operationId": "post_api_agent_activity", "tags": [ "Operator console" ], "description": "Self-observability, not a privileged mutation: any authenticated role may report its OWN activity. The identity comes from the session, never the body.", "x-orbis-undocumented": "Console live-feed surface, consumed only by the ORBIS console SPA. Not published as a partner contract.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-internal": true, "x-orbis-roles": [ "owner", "issuer", "verifier", "auditor", "ops", "tenant-admin", "support", "analyst" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "unpromised" } }, "/v1/tenants": { "post": { "summary": "Provision a tenant issuer", "operationId": "post_v1_tenants", "tags": [ "Tenants" ], "description": "Owner only. Mints the organization’s `did:web` identity and vault-held signing key, applies branding, and publishes its OID4VCI metadata. The slug is derived from the name. DEMO-TENANT LAW: a demonstration organization must carry a `demo-` slug prefix and a “ (Demo)” display-name suffix; the off-boarding and hygiene surfaces treat that namespace as sacred.\n\nPROMISED (/v1). Identical to `POST /api/tenants` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "description": "The slug is `name` lowercased with non-alphanumerics collapsed to `-`." }, "profile": { "type": "object", "description": "Optional organization profile: legal name, address, contacts, logo, wallet branding." } }, "required": [ "name" ] } } } }, "responses": { "200": { "description": "Provisioned.", "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string" }, "name": { "type": "string" }, "did": { "type": "string" } }, "required": [ "slug", "name", "did" ] } } } }, "400": { "description": "`invalid_tenant` — a name is required and must yield a slug of at least 2 characters.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "409": { "description": "`tenant_exists` (the reserved slug `orbis` also 409s).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/tenants" } }, "/v1/types": { "post": { "summary": "Register a credential type", "operationId": "post_v1_types", "tags": [ "Credential types" ], "description": "Claim specs are strings: `key`, or `key:` where kind is `date`, `number`, `money`, `bool`, `array(text)`, `array(object)` or `enum(a|b|c)`. An unrecognised spec is a hard 400 — registering a SUBSET of the claims you asked for is never what a caller wanted. Claim keys preserve case and may not collide with the reserved SD-JWT members (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`, `cnf`, `vct`, `status`, `_sd`, `_sd_alg`).\n\nPROMISED (/v1). Identical to `POST /api/types` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "claims": { "type": "array", "items": { "type": "string", "description": "Claim spec." } }, "tenant": { "type": "string", "description": "Empty or absent for the root platform." } }, "required": [ "name", "claims" ] } } } }, "x-orbis-undocumented": "The 200 body is consumed by the operator console. It is not published as a partner contract; read the registered type back from `GET /.well-known/openid-credential-issuer` instead, which IS a standard.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "Unparseable or reserved claim specs, named in `error_description`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/types" } }, "/v1/offers": { "post": { "summary": "Create a credential offer", "operationId": "post_v1_offers", "tags": [ "Issuance — OID4VCI" ], "description": "Returns the `openid4vc://` offer URI to render as a QR. Claim VALUES are strictly typed against the registered type: `number`/`money` must be JSON numbers (a numeric STRING is refused, never coerced), `money` must be a whole number of minor units (never a float — sign is unconstrained, a refund is legitimately negative), `bool` must be a JSON boolean, `array(text)` an array of strings, `array(object)` an array of objects, and `enum` must be one of the registered options.\n\nPROMISED (/v1). Identical to `POST /api/offers` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string", "description": "Empty or absent for the root platform." }, "typeId": { "type": "string", "description": "Defaults to `verified-business-member`." }, "subject": { "type": "object", "description": "Claim key → value. May also be supplied as top-level members of the body." } }, "required": [] } } } }, "responses": { "200": { "description": "The offer.", "content": { "application/json": { "schema": { "type": "object", "properties": { "offerUri": { "type": "string", "description": "Render as a QR for the wallet to scan." } }, "required": [ "offerUri" ] } } } }, "400": { "description": "`invalid_subject` — `error_description` names the claim and why.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "Not authenticated for this plane." }, "404": { "description": "`unknown_tenant` or `unknown_type`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-roles": [ "owner", "issuer" ], "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/offers" } }, "/v1/tenants/{tenant}/bills": { "post": { "summary": "Deposit a business event as a wallet item (contracts 0.3.0)", "operationId": "post_v1_tenants_tenant_bills", "tags": [ "Deposit rail" ], "description": "The production deposit rail. ORBIS mints a tenant-signed attestation (`typ orbis-item+jwt`, bound to `externalRef` + `typeId`), then genuinely VERIFIES it and stores the check’s real outcome — a deposit whose attestation does not verify is kept as unverified, never silently upgraded and never dropped. `idempotencyKey` makes a replay a no-op. The tenant in the path is authoritative over the body; a tenant-scoped operator token may only deposit for its own organization.\n\nPROMISED (/v1). Identical to `POST /api/tenants/{tenant}/bills` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document.", "parameters": [ { "name": "tenant", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string", "description": "Must equal the path segment." }, "accountId": { "type": "string", "description": "BARE RFC 7638 thumbprint of the holder’s device key." }, "typeId": { "type": "string", "description": "A credential type registered for this tenant." }, "externalRef": { "type": "string", "description": "The depositor’s own business-fact id." }, "claims": { "type": "object", "description": "The typed claim payload." }, "idempotencyKey": { "type": "string", "description": "e.g. `bill:`. A replay of the same key is a no-op." } }, "required": [ "tenant", "accountId", "typeId", "externalRef", "claims", "idempotencyKey" ] } } } }, "responses": { "200": { "description": "Deposited (or the idempotent replay of an earlier deposit).", "content": { "application/json": { "schema": { "type": "object", "properties": { "itemId": { "type": "string" }, "status": { "enum": [ "offered", "accepted" ] }, "statusIndex": { "type": [ "integer", "null" ] } }, "required": [ "itemId", "status", "statusIndex" ] } } } }, "400": { "description": "`invalid_request`, `invalid_account`, or `root_tenant_forbidden`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "No operator bearer.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "The bearer is scoped to a different organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "404": { "description": "`unknown_tenant`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "409": { "description": "`external_ref_conflict` — the deposit could not be stored and NO existing bill of yours matches it, so nothing was created. Retry with a fresh `externalRef`. This answer deliberately discloses nothing about any other organization’s items for the same holder.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "operatorBearer": [] } ], "x-orbis-auth": "operator", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/tenants/{tenant}/bills" } }, "/v1/member/me": { "get": { "summary": "The holder’s own memberships and open proposals", "operationId": "get_v1_member_me", "tags": [ "Membership & governance" ], "responses": { "200": { "description": "Memberships across tenants, plus the proposals those tenants have open.", "content": { "application/json": { "schema": { "type": "object", "properties": { "memberDid": { "type": "string" }, "memberships": { "type": "array", "items": { "type": "object", "properties": { "tenant": { "type": "string" }, "tier": { "type": "string" }, "orbisCoin": { "type": "integer" }, "joinedAt": { "type": "string" } } } }, "proposals": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "tenant": { "type": "string" }, "kind": { "type": "string" }, "title": { "type": "string" }, "body": { "type": "string" }, "closesAt": { "type": "string" }, "open": { "type": "boolean" }, "tally": { "type": "object" }, "myVote": { "type": [ "string", "null" ] } } } } } } } } }, "401": { "description": "`holder_auth_`: missing, malformed, bad_signature, stale, replayed or bad_audience.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/admin-server.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/member/me", "description": "PROMISED (/v1). Identical to `GET /member/me` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document." } }, "/v1/wallet/{accountId}/items/{itemId}/accept": { "post": { "summary": "Accept an offered item", "operationId": "post_v1_wallet_accountId_items_itemId_accept", "tags": [ "Wallet bridge (holder)" ], "description": "The path account must equal the thumbprint of the signing device key, or the request is refused.\n\nPROMISED (/v1). Identical to `POST /api/wallet/{accountId}/items/{itemId}/accept` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document.", "parameters": [ { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "`account_mismatch` — the signature does not belong to the account in the path.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "429": { "description": "`rate_limited`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/wallet/{accountId}/items/{itemId}/accept" } }, "/v1/wallet/{accountId}/items/{itemId}/sharing": { "post": { "summary": "Set per-element sharing on a held item", "operationId": "post_v1_wallet_accountId_items_itemId_sharing", "tags": [ "Wallet bridge (holder)" ], "parameters": [ { "name": "accountId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "itemId", "in": "path", "required": true, "schema": { "type": "string" } } ], "x-orbis-undocumented": "See `GET /api/wallet/{accountId}/items`.", "responses": { "200": { "description": "Success. Response shape deliberately not published — see `x-orbis-undocumented`." }, "400": { "description": "`invalid_account`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "401": { "description": "`holder_auth_`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } }, "403": { "description": "`account_mismatch`.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } }, "required": [ "error" ] } } } } }, "security": [ { "holderJws": [] } ], "x-orbis-auth": "holder", "x-orbis-source": "src/admin/demo-bridge.ts", "x-orbis-stability": "promised", "x-orbis-v1-alias-of": "/api/wallet/{accountId}/items/{itemId}/sharing", "description": "PROMISED (/v1). Identical to `POST /api/wallet/{accountId}/items/{itemId}/sharing` — the same handler, the same auth, the same body, the same response; the front router rewrites the path and changes nothing else. The unversioned path keeps working; this alias is additive. Compatibility and deprecation terms: see `x-orbis-versioning.policy` at the root of this document." } } }, "x-orbis-generated-from": [ "src/admin/admin-server.ts", "src/admin/backoffice-api.ts", "src/admin/demo-bridge.ts", "src/admin/directory.ts", "src/admin/partner-keys-routes.ts", "src/admin/portal-routes.ts", "src/oid4vci/issuer-server.ts", "src/oid4vp/verifier-server.ts" ], "x-orbis-route-count": 261, "x-orbis-undocumented-count": 190, "x-orbis-versioning": { "prefix": "/v1", "promised": [ { "method": "POST", "path": "/v1/tenants", "aliasOf": "/api/tenants", "auth": "operator" }, { "method": "POST", "path": "/v1/types", "aliasOf": "/api/types", "auth": "operator" }, { "method": "POST", "path": "/v1/offers", "aliasOf": "/api/offers", "auth": "operator" }, { "method": "POST", "path": "/v1/tenants/{tenant}/bills", "aliasOf": "/api/tenants/{tenant}/bills", "auth": "operator" }, { "method": "GET", "path": "/v1/member/me", "aliasOf": "/member/me", "auth": "holder" }, { "method": "POST", "path": "/v1/wallet/{accountId}/items/{itemId}/accept", "aliasOf": "/api/wallet/{accountId}/items/{itemId}/accept", "auth": "holder" }, { "method": "POST", "path": "/v1/wallet/{accountId}/items/{itemId}/sharing", "aliasOf": "/api/wallet/{accountId}/items/{itemId}/sharing", "auth": "holder" } ], "promisedCount": 7, "policy": { "additive": "A promised operation may gain OPTIONAL request fields and NEW response fields. It may never remove a field, repurpose one, change a field's type, tighten validation on an existing input, or change the status code an existing outcome returns.", "breaking": "A breaking change gets a NEW prefix (/v2). /v1 is never changed in place. Two versions may be served side by side for as long as callers need both.", "deprecation": "A promised operation is retired only after it is marked `deprecated: true` in /openapi.json with an `x-orbis-sunset` date, announced on /developers, and left answering for at least 180 days after that announcement. ORBIS does not shorten that window for its own convenience.", "unversionedPathsKeepWorking": "Every existing unversioned path keeps answering exactly as it does today. /v1 is an ADDITIVE alias — the same handler, the same auth, the same body, the same response. There is no cutover and no date on which the current paths stop working.", "adminPlaneExcluded": "The Back Office data plane (/api/admin/*) and every ORBIS product UI are DELIBERATELY EXCLUDED from /v1 and may change at any time without notice. They are the operator SPA's own view models; their shape follows the interface. Do not build on them — they are marked x-orbis-undocumented and x-orbis-internal for exactly this reason.", "verificationPlaneIsNotVersionedByOrbis": "Verification is NEVER versioned by ORBIS. did:web documents, OID4VCI issuer metadata, OAuth authorization-server metadata, Token Status Lists, the OID4VP request/response exchange and the published conformance vectors are versioned by the STANDARDS that define them — OID4VCI, OID4VP, SD-JWT VC, Token Status List — and stay at their standard, unversioned addresses forever. A /v1 segment on any of them fails the ORBIS build (open-rail-invariant-2)." }, "note": "Each promised operation is an additive alias of an existing unversioned path. The unversioned paths keep working; nothing is being cut over." } }