openapi: 3.0.3
info:
  title: Runta Public REST API
  description: Public REST API for external developers and the runta CLI.
  version: 0.1.0
servers:
  - url: https://api.runta.com
    description: Hosted public API
paths:
  /healthz:
    get:
      tags:
        - Health
      summary: Liveness check
      operationId: healthz
      responses:
        '200':
          description: no content
    head:
      tags:
        - Health
      summary: Liveness check
      operationId: headHealthz
      responses:
        '200':
          description: no content
  /v2/ssh-host-key:
    get:
      tags:
        - SSH Keys
      summary: Get the stable SSH gateway host key
      operationId: getSshHostKey
      security:
        - BearerAuth: []
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshHostKeyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
  /v2/auth/token:
    delete:
      tags:
        - Auth
      summary: Revoke the current bearer credential
      operationId: revokeCurrentToken
      responses:
        '204':
          description: Token revoked.
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/auth/device/authorization:
    post:
      tags:
        - Auth
      summary: Start a device authorization
      operationId: beginDeviceAuthorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BeginDeviceAuthorizationRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceAuthorizationStartResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security: []
  /v2/auth/device/token:
    post:
      tags:
        - Auth
      summary: Exchange a device code for an access token
      operationId: exchangeDeviceToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExchangeDeviceTokenRequest'
      responses:
        '200':
          description: Device access token issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceTokenResponse'
        '400':
          description: OAuth device authorization is pending or unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceTokenError'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security: []
  /v2/me:
    get:
      tags: [Identity]
      summary: Get the current user profile
      operationId: getMe
      responses:
        '200':
          description: Current user profile.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserProfileResponse'
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security:
        - BearerAuth: []
  /v2/images:
    get:
      tags:
        - Runtimes
      summary: List available Runtime Image variants
      operationId: listRuntimeImages
      responses:
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRuntimeImagesResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/images/{image_id}:
    delete:
      tags:
        - Runtimes
      summary: Delete an unused custom Runtime Image
      operationId: deleteRuntimeImage
      parameters:
        - in: path
          name: image_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/images/builds:
    get:
      tags:
        - Runtimes
      summary: List Dockerfile Runtime Image builds
      operationId: listRuntimeImageBuilds
      parameters:
        - in: query
          name: limit
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
            default: 50
      responses:
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRuntimeImageBuildsResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - Runtimes
      summary: Build a private Runtime Image from a Dockerfile
      operationId: createRuntimeImageBuild
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRuntimeImageBuildRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeImageBuildResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/images/builds/{build_id}:
    get:
      tags:
        - Runtimes
      summary: Get a Dockerfile Runtime Image build
      operationId: getRuntimeImageBuild
      parameters:
        - in: path
          name: build_id
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeImageBuildResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Runtimes
      summary: Cancel a queued Dockerfile Runtime Image build
      operationId: cancelRuntimeImageBuild
      parameters:
        - in: path
          name: build_id
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeImageBuildResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/images/builds/{build_id}/history:
    delete:
      tags:
        - Runtimes
      summary: Dismiss a terminal Runtime Image build from recent history
      operationId: dismissRuntimeImageBuild
      parameters:
        - in: path
          name: build_id
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/runtimes:
    get:
      tags:
        - Runtimes
      summary: List runtimes
      operationId: listRuntimes
      parameters:
        - in: query
          name: status
          description: Comma-separated public status aliases.
          schema:
            description: Comma-separated public status aliases.
            type: string
          style: form
        - in: query
          name: limit
          description: Maximum number of runtimes to return.
          schema:
            description: Maximum number of runtimes to return.
            type: integer
            format: int64
            minimum: 1
            maximum: 100
            default: 50
          style: form
        - in: query
          name: after
          description: Opaque cursor returned by the previous page.
          schema:
            description: Opaque cursor returned by the previous page.
            type: string
          style: form
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRuntimesResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    post:
      tags:
        - Runtimes
      summary: Create a runtime
      operationId: createRuntime
      parameters:
        - $ref: '#/components/parameters/RuntimeCreateIdempotencyKey'
      requestBody:
        description: Runtime creation request.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRuntimeRequest'
        required: true
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '201':
          description: Runtime resource created.
          headers:
            Location:
              description: Canonical Runtime resource URI.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}:
    get:
      tags:
        - Runtimes
      summary: Get a runtime by UUID
      operationId: getRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Runtimes
      summary: Delete a runtime by UUID
      operationId: deleteRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '202':
          description: Runtime deletion accepted.
          headers:
            Location:
              description: Canonical Runtime resource URI.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '204':
          description: Runtime deletion was already completed.
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    patch:
      tags:
        - Runtimes
      summary: Patch runtime resources or policy
      operationId: patchRuntime
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchRuntimeRequest'
        required: true
  /v2/runtimes/{runtime_id}/start:
    post:
      tags:
        - Runtimes
      summary: Boot a shut-down runtime
      operationId: startRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/vnc/enable:
    post:
      tags: [Runtimes]
      summary: Enable the runtime VNC desktop
      operationId: enableRuntimeVnc
      parameters:
        - {in: path, name: runtime_id, required: true, schema: {type: string}}
        - {$ref: '#/components/parameters/RuntimeExpectedRevision'}
      responses:
        '200': {description: Response envelope., content: {application/json: {schema: {$ref: '#/components/schemas/RuntimeResponse'}}}}
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security: [{BearerAuth: []}]
  /v2/runtimes/{runtime_id}/vnc/disable:
    post:
      tags: [Runtimes]
      summary: Disable the runtime VNC desktop
      operationId: disableRuntimeVnc
      parameters:
        - {in: path, name: runtime_id, required: true, schema: {type: string}}
        - {$ref: '#/components/parameters/RuntimeExpectedRevision'}
      responses:
        '200': {description: Response envelope., content: {application/json: {schema: {$ref: '#/components/schemas/RuntimeResponse'}}}}
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security: [{BearerAuth: []}]
  /v2/runtimes/{runtime_id}/vnc-credentials:
    get:
      tags: [Runtimes]
      summary: List runtime VNC credentials
      operationId: listRuntimeVncCredentials
      parameters:
        - {in: path, name: runtime_id, required: true, schema: {type: string}}
      responses:
        '200': {description: List response envelope., content: {application/json: {schema: {$ref: '#/components/schemas/ListVncCredentialsResponse'}}}}
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security: [{BearerAuth: []}]
    post:
      tags: [Runtimes]
      summary: Create a runtime VNC credential
      operationId: createRuntimeVncCredential
      parameters:
        - {in: path, name: runtime_id, required: true, schema: {type: string}}
      requestBody: {required: true, content: {application/json: {schema: {$ref: '#/components/schemas/CreateVncCredentialRequest'}}}}
      responses:
        '201': {description: Response envelope., content: {application/json: {schema: {$ref: '#/components/schemas/CreateVncCredentialResponse'}}}}
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security: [{BearerAuth: []}]
  /v2/runtimes/{runtime_id}/vnc-credentials/{credential_id}:
    delete:
      tags: [Runtimes]
      summary: Revoke a runtime VNC credential
      operationId: revokeRuntimeVncCredential
      parameters:
        - {in: path, name: runtime_id, required: true, schema: {type: string}}
        - {in: path, name: credential_id, required: true, schema: {type: string}}
      responses:
        '200': {description: Response envelope., content: {application/json: {schema: {$ref: '#/components/schemas/VncCredentialResponse'}}}}
        default: {$ref: '#/components/responses/Error'}
        '401': {$ref: '#/components/responses/Unauthorized'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '404': {$ref: '#/components/responses/NotFound'}
        '409': {$ref: '#/components/responses/Conflict'}
        '422': {$ref: '#/components/responses/Validation'}
        '429': {$ref: '#/components/responses/RateLimited'}
        '501': {$ref: '#/components/responses/NotImplemented'}
        '503': {$ref: '#/components/responses/Unavailable'}
        '504': {$ref: '#/components/responses/Timeout'}
      security: [{BearerAuth: []}]
  /v2/runtimes/{runtime_id}/pause:
    post:
      tags:
        - Runtimes
      summary: Pause a running runtime
      operationId: pauseRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/resume:
    post:
      tags:
        - Runtimes
      summary: Resume a paused runtime
      operationId: resumeRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/stop:
    post:
      tags:
        - Runtimes
      summary: Gracefully shut down a runtime
      operationId: stopRuntime
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - $ref: '#/components/parameters/RuntimeExpectedRevision'
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/files:
    get:
      tags:
        - Files
      summary: Read a single file from a runtime
      operationId: readRuntimeFile
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - in: query
          name: path
          description: Absolute path to a regular file inside the runtime.
          required: true
          schema:
            description: Absolute path to a regular file inside the runtime.
            type: string
          style: form
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: byte stream
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    put:
      tags:
        - Files
      summary: Write a single file into a runtime
      operationId: writeRuntimeFile
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
        - in: query
          name: path
          description: Absolute path to a regular file inside the runtime.
          required: true
          schema:
            description: Absolute path to a regular file inside the runtime.
            type: string
          style: form
      requestBody:
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
        required: true
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '204':
          description: no content
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/checkpoints:
    post:
      tags:
        - Checkpoints
      summary: Create a checkpoint from a runtime
      operationId: createCheckpoint
      parameters:
        - in: path
          name: runtime_id
          description: Runtime UUID or display name.
          required: true
          schema:
            description: Runtime UUID or display name.
            type: string
          style: simple
      requestBody:
        description: Checkpoint creation request.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCheckpointRequest'
        required: true
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckpointResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/secrets:
    get:
      tags:
        - Secrets
      summary: List egress secret metadata
      operationId: listSecrets
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSecretsResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    post:
      tags:
        - Secrets
      summary: Create an egress secret
      operationId: createSecret
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecretRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/secrets/{secret_id}:
    get:
      tags:
        - Secrets
      summary: Get egress secret metadata
      operationId: getSecret
      parameters:
        - in: path
          name: secret_id
          description: Secret UUID or display name.
          required: true
          schema:
            description: Secret UUID or display name.
            type: string
          style: simple
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    put:
      tags:
        - Secrets
      summary: Store or replace an egress secret
      operationId: setSecret
      parameters:
        - in: path
          name: secret_id
          description: Secret UUID or display name.
          required: true
          schema:
            description: Secret UUID or display name.
            type: string
          style: simple
      requestBody:
        description: Secret set request.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetSecretRequest'
        required: true
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Secrets
      summary: Delete an egress secret
      operationId: deleteSecret
      parameters:
        - in: path
          name: secret_id
          description: Secret UUID or display name.
          required: true
          schema:
            description: Secret UUID or display name.
            type: string
          style: simple
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/checkpoints:
    get:
      tags:
        - Checkpoints
      summary: List user checkpoints
      description: Returns only user-created checkpoints.
      operationId: listCheckpoints
      parameters:
        - in: query
          name: limit
          description: Maximum number of checkpoints to return.
          schema:
            description: Maximum number of checkpoints to return.
            type: integer
            format: int64
            minimum: 1
            maximum: 100
            default: 50
          style: form
        - in: query
          name: after
          description: Opaque cursor returned by the previous page.
          schema:
            description: Opaque cursor returned by the previous page.
            type: string
          style: form
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCheckpointsResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/checkpoints/{checkpoint_id}:
    get:
      tags:
        - Checkpoints
      summary: Get checkpoint metadata
      operationId: getCheckpoint
      parameters:
        - in: path
          name: checkpoint_id
          description: Checkpoint UUID or display name.
          required: true
          schema:
            description: Checkpoint UUID or display name.
            type: string
          style: simple
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckpointResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Checkpoints
      summary: Delete a checkpoint
      operationId: deleteCheckpoint
      parameters:
        - in: path
          name: checkpoint_id
          description: Checkpoint UUID or display name.
          required: true
          schema:
            description: Checkpoint UUID or display name.
            type: string
          style: simple
      responses:
        default:
          description: Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
        '401':
          description: Missing, malformed, or rejected bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '403':
          description: The bearer token is not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '404':
          description: The requested resource was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '409':
          description: The request conflicts with current resource state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '422':
          description: Validation or application error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '501':
          description: Operation is not implemented
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '503':
          description: Upstream service is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
        '504':
          description: Upstream request timed out
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      security:
        - BearerAuth: []
  /v2/ssh-keys:
    get:
      tags:
        - SSH Keys
      summary: List the current user's SSH keys in an organization
      operationId: listSshKeys
      responses:
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSshKeysResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - SSH Keys
      summary: Register an Ed25519 SSH public key
      operationId: createSshKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSshKeyRequest'
      responses:
        '201':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshKeyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/ssh-keys/{ssh_key_id}:
    delete:
      tags:
        - SSH Keys
      summary: Delete one of the current user's SSH keys
      operationId: deleteSshKey
      parameters:
        - in: path
          name: ssh_key_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshKeyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/events:
    get:
      tags:
        - Events
      summary: List organization runtime events
      operationId: listOrganizationEvents
      parameters:
        - in: query
          name: runtime_id
          schema:
            type: string
        - in: query
          name: kind
          schema:
            type: string
            minLength: 1
            maxLength: 120
        - in: query
          name: harness
          description: Exact normalized harness identifier, such as claude or codex.
          schema:
            type: string
            minLength: 1
            maxLength: 256
        - in: query
          name: session_id
          description: Exact opaque agent session identifier. For Claude, combine with agent_id to select one subagent; for Codex this is the thread identifier.
          schema:
            type: string
            minLength: 1
            maxLength: 256
        - in: query
          name: session_group_id
          description: Exact native session family identifier shared across related agent sessions, where exposed by the harness.
          schema:
            type: string
            minLength: 1
            maxLength: 256
        - in: query
          name: agent_id
          description: Exact native agent identifier within a session. Combine with session_id to distinguish a child agent without crossing root sessions.
          schema:
            type: string
            minLength: 1
            maxLength: 256
        - in: query
          name: page_token
          schema:
            type: string
        - in: query
          name: page_size
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
            default: 50
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/events/{event_id}:
    get:
      tags:
        - Events
      summary: Get an organization runtime event
      operationId: getOrganizationEvent
      parameters:
        - in: path
          name: event_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/token-analysis:
    get:
      tags:
        - Events
      summary: List analyzed tool calls
      description: Findings are computed once, when the event is ingested, and never recomputed. The summary covers everything the filter selects rather than the page returned.
      operationId: listOrganizationTokenAnalysis
      parameters:
        - in: query
          name: runtime_id
          schema:
            type: string
        - in: query
          name: page_token
          schema:
            type: string
        - in: query
          name: page_size
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
            default: 50
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenAnalysisListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/token-analysis/{event_id}:
    get:
      tags:
        - Events
      summary: Get one analyzed tool call with its capture
      description: The captured input and output are read back from the event, since the analysis stores only previews of them.
      operationId: getOrganizationTokenAnalysis
      parameters:
        - in: path
          name: event_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenAnalysisDetailResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/token-savings:
    get:
      tags:
        - Events
      summary: List token savings the egress proxy already applied
      operationId: listOrganizationTokenSavings
      parameters:
        - in: query
          name: runtime_id
          schema:
            type: string
        - in: query
          name: page_token
          schema:
            type: string
        - in: query
          name: page_size
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
            default: 50
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenSavingsListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/authorization-requests:
    get:
      tags:
        - GitHub
      summary: List GitHub authorization requests awaiting a decision
      operationId: listGitHubAuthorizationRequests
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubAuthorizationRequestListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - GitHub
      summary: Ask a person to connect GitHub for this organization
      operationId: createGitHubAuthorizationRequest
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGitHubAuthorizationRequestRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubAuthorizationRequestResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/authorization-requests/{request_id}:
    get:
      tags:
        - GitHub
      summary: Read a GitHub authorization request
      operationId: getGitHubAuthorizationRequest
      parameters:
        - in: path
          name: request_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubAuthorizationRequestResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/repositories:
    get:
      tags:
        - GitHub
      summary: List cached GitHub repositories
      operationId: listGitHubRepositories
      parameters:
        - in: query
          name: page_token
          schema:
            type: string
        - in: query
          name: page_size
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
            default: 50
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubRepositoryListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/repositories/{repository_id}/branches:
    get:
      tags:
        - GitHub
      summary: List cached repository branches
      operationId: listGitHubBranches
      parameters:
        - in: path
          name: repository_id
          required: true
          schema:
            type: integer
            format: int64
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubBranchListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/runtime-bindings:
    post:
      tags:
        - GitHub
      summary: Bind a runtime to a GitHub repository branch
      operationId: createGitHubRuntimeBinding
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGitHubRuntimeBindingRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubRuntimeBindingResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/github/runtime-bindings/{runtime_id}:
    get:
      tags:
        - GitHub
      summary: Get a runtime GitHub binding
      operationId: getGitHubRuntimeBinding
      parameters:
        - in: path
          name: runtime_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubRuntimeBindingListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    put:
      tags:
        - GitHub
      summary: Atomically replace a runtime's GitHub repository bindings
      operationId: replaceGitHubRuntimeBindings
      parameters:
        - in: path
          name: runtime_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReplaceGitHubRuntimeBindingsRequest'
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GitHubRuntimeBindingListResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - GitHub
      summary: Delete a runtime GitHub binding
      operationId: deleteGitHubRuntimeBinding
      parameters:
        - in: path
          name: runtime_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/ssh-keys:
    get:
      tags:
        - SSH Keys
      summary: List SSH keys attached to a Runtime
      operationId: listRuntimeSshKeys
      parameters:
        - in: path
          name: runtime_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: List response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSshKeysResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/runtimes/{runtime_id}/ssh-keys/{ssh_key_id}:
    parameters:
      - in: path
        name: runtime_id
        required: true
        schema:
          type: string
      - in: path
        name: ssh_key_id
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/RuntimeExpectedRevision'
    put:
      tags:
        - SSH Keys
      summary: Attach one of the current user's SSH keys to a Runtime
      operationId: attachRuntimeSshKey
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshKeyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - SSH Keys
      summary: Detach an SSH key from a Runtime
      operationId: detachRuntimeSshKey
      responses:
        '200':
          description: Response envelope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SshKeyResponse'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents:
    get:
      tags:
        - Cloud Agents
      summary: List Cloud Agents
      operationId: listCloudAgents
      parameters:
        - in: query
          name: after
          schema:
            type: string
        - in: query
          name: limit
          schema:
            type: integer
            format: uint32
            minimum: 1
            maximum: 100
        - in: query
          name: include_latest_reply
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Cloud Agent list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentList'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - Cloud Agents
      summary: Create a Cloud Agent
      operationId: createCloudAgent
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCloudAgentRequest'
      responses:
        '201':
          description: Cloud Agent created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgent'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}:
    get:
      tags:
        - Cloud Agents
      summary: Get a Cloud Agent
      operationId: getCloudAgent
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Cloud Agent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgent'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    patch:
      tags:
        - Cloud Agents
      summary: Update a Cloud Agent
      operationId: updateCloudAgent
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCloudAgentRequest'
      responses:
        '200':
          description: Cloud Agent updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgent'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Cloud Agents
      summary: Delete a Cloud Agent
      operationId: deleteCloudAgent
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: query
          name: delete_runtime
          schema:
            type: boolean
            default: false
      responses:
        '202':
          description: Runtime deletion accepted.
        '204':
          description: Cloud Agent deleted.
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/computer-sessions:
    post:
      tags:
        - Cloud Agents
      summary: Open a short-lived Cloud Agent computer session
      description: Enables the Agent runtime's VNC desktop if needed, waits for it to become ready, and returns a short-lived Runta browser session. Long-lived API credentials remain outside the renderer; clients pass the returned protocols only to the VNC WebSocket handshake.
      operationId: createCloudAgentComputerSession
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Ready computer session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentComputerSession'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/runs:
    get:
      tags:
        - Cloud Agents
      summary: List Cloud Agent runs
      operationId: listCloudAgentRuns
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: query
          name: limit
          schema:
            type: integer
            minimum: 1
            maximum: 500
      responses:
        '200':
          description: Cloud Agent runs.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - Cloud Agents
      summary: Create a Cloud Agent run
      operationId: createCloudAgentRun
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCloudAgentRunRequest'
      responses:
        '202':
          description: Cloud Agent run accepted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/runs/{run_id}:
    get:
      tags:
        - Cloud Agents
      summary: Get a Cloud Agent run
      operationId: getCloudAgentRun
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: run_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Cloud Agent run.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Cloud Agents
      summary: Cancel a Cloud Agent run
      operationId: cancelCloudAgentRun
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: run_id
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Cloud Agent run cancellation result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/runs/{run_id}/resume:
    post:
      tags:
        - Cloud Agents
      summary: Resume a Cloud Agent run
      operationId: resumeCloudAgentRun
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: run_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCloudAgentRunRequest'
      responses:
        '202':
          description: Cloud Agent run accepted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/runs/{run_id}/follow-ups:
    post:
      tags:
        - Cloud Agents
      summary: Follow up a Cloud Agent run
      operationId: followUpCloudAgentRun
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: run_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCloudAgentRunRequest'
      responses:
        '202':
          description: Cloud Agent run accepted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentRun'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/events:
    get:
      tags:
        - Cloud Agents
      summary: List Cloud Agent session events
      operationId: listCloudAgentSessionEvents
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: query
          name: session_id
          required: true
          schema:
            type: string
        - in: query
          name: after
          schema:
            type: integer
            format: int64
      responses:
        '200':
          description: Cloud Agent session events.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentSessionEvents'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/runs/{run_id}/events:
    get:
      tags:
        - Cloud Agents
      summary: Stream Cloud Agent run events
      operationId: streamCloudAgentRunEvents
      x-runta-manual-transport: sse
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: run_id
          required: true
          schema:
            type: string
        - in: query
          name: after
          schema:
            type: integer
            format: int64
      responses:
        '200':
          description: Server-sent Cloud Agent run events.
          content:
            text/event-stream:
              schema:
                type: string
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/artifacts:
    get:
      tags:
        - Cloud Agents
      summary: List Cloud Agent artifacts
      operationId: listCloudAgentArtifacts
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: query
          name: run_id
          schema:
            type: string
      responses:
        '200':
          description: Cloud Agent artifacts.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAgentArtifact'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    post:
      tags:
        - Cloud Agents
      summary: Create a Cloud Agent artifact
      operationId: createCloudAgentArtifact
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCloudAgentArtifactRequest'
      responses:
        '201':
          description: Cloud Agent artifact created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentArtifact'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/artifacts/{artifact_id}:
    get:
      tags:
        - Cloud Agents
      summary: Get a Cloud Agent artifact
      operationId: getCloudAgentArtifact
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: artifact_id
          required: true
          schema:
            type: string
        - in: query
          name: include_content
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Cloud Agent artifact.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentArtifact'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Cloud Agents
      summary: Delete a Cloud Agent artifact
      operationId: deleteCloudAgentArtifact
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
        - in: path
          name: artifact_id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Cloud Agent artifact deleted.
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/workspace:
    post:
      tags:
        - Cloud Agents
      summary: Execute a Cloud Agent workspace operation
      operationId: executeCloudAgentWorkspaceOperation
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuntimeWorkspaceOperationRequest'
      responses:
        '200':
          description: Workspace operation result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeWorkspaceOperationResult'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/agents/{agent_id}/workspace/files:
    put:
      tags:
        - Cloud Agents
      summary: Write a Cloud Agent workspace file
      operationId: writeCloudAgentWorkspaceFile
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudAgentWorkspaceWriteRequest'
      responses:
        '200':
          description: Workspace file written.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudAgentWorkspaceWriteResult'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
    delete:
      tags:
        - Cloud Agents
      summary: Delete a Cloud Agent workspace file
      operationId: deleteCloudAgentWorkspaceFile
      parameters:
        - in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudAgentWorkspaceDeleteRequest'
      responses:
        '204':
          description: Workspace file deleted.
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/model-providers:
    get:
      tags:
        - Managed Model Providers
      summary: List managed model providers
      operationId: listManagedModelProviders
      responses:
        '200':
          description: Managed model providers.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedModelProviderList'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
  /v2/model-providers/{provider_id}:
    patch:
      tags:
        - Managed Model Providers
      summary: Update a managed model provider
      operationId: updateManagedModelProvider
      parameters:
        - in: path
          name: provider_id
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateManagedModelProviderRequest'
      responses:
        '200':
          description: Managed model provider updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedModelProvider'
        default:
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Validation'
        '429':
          $ref: '#/components/responses/RateLimited'
        '501':
          $ref: '#/components/responses/NotImplemented'
        '503':
          $ref: '#/components/responses/Unavailable'
        '504':
          $ref: '#/components/responses/Timeout'
      security:
        - BearerAuth: []
components:
  parameters:
    RuntimeExpectedRevision:
      in: query
      name: expected_revision
      description: Runtime aggregate revision required for optimistic concurrency.
      required: true
      schema:
        type: integer
        format: uint64
        minimum: 1
    IdempotencyKey:
      in: header
      name: Idempotency-Key
      description: Caller-generated key for retry-safe financial mutations.
      required: true
      schema:
        type: string
        minLength: 1
        maxLength: 255
    RuntimeCreateIdempotencyKey:
      in: header
      name: Idempotency-Key
      description: Optional caller-generated key reused across retries of one logical runtime creation.
      required: false
      schema:
        type: string
        minLength: 1
        maxLength: 255
  responses:
    Error:
      description: Error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Unauthorized:
      description: Missing, malformed, or rejected bearer token
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Forbidden:
      description: The bearer token is not allowed to perform this action
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    NotFound:
      description: The requested resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Conflict:
      description: The request conflicts with current resource state
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Validation:
      description: Validation or application error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    RateLimited:
      description: Rate limit exceeded
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    NotImplemented:
      description: Operation is not implemented
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Unavailable:
      description: Upstream service is unavailable
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Timeout:
      description: Upstream request timed out
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Runta API Key
      description: A Runta API Key bound to exactly one organization.
  schemas:
    CreateCloudAgentRequest:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
        system_prompt:
          type: string
          maxLength: 65536
        initial_message:
          type: string
          maxLength: 65536
        repositories:
          description: Ordered GitHub repositories to initialize for fresh or checkpoint runtimes. The first is the default workspace. Nonempty selections are not allowed for existing runtimes.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeRepositorySelection'
        model_provider:
          $ref: '#/components/schemas/ManagedModelProviderReference'
        runtime:
          $ref: '#/components/schemas/CloudAgentRuntimeReference'
        harness:
          $ref: '#/components/schemas/CloudAgentHarnessRequest'
      required:
        - model_provider
      additionalProperties: false
    ManagedModelProviderReference:
      type: object
      properties:
        type:
          type: string
          enum:
            - managed
        id:
          type: string
          minLength: 1
      required:
        - type
        - id
      additionalProperties: false
    CloudAgentRuntimeReference:
      type: object
      properties:
        type:
          type: string
          enum:
            - fresh
            - checkpoint
            - existing
        image_id:
          type: string
        checkpoint_id:
          type: string
        id:
          type: string
      required:
        - type
      additionalProperties: false
    CloudAgentHarnessRequest:
      type: object
      properties:
        id:
          type: string
        kind:
          type: string
      additionalProperties: false
    CloudAgent:
      type: object
      properties:
        id:
          type: string
        runtime_id:
          type: string
        harness_id:
          type: string
        name:
          type: string
        status:
          type: string
        created_at_unix_seconds:
          type: integer
          format: int64
        updated_at_unix_seconds:
          type: integer
          format: int64
        latest_reply:
          $ref: '#/components/schemas/CloudAgentLatestReply'
      required:
        - id
        - runtime_id
        - harness_id
        - name
        - status
        - created_at_unix_seconds
        - updated_at_unix_seconds
      additionalProperties: false
    CloudAgentLatestReply:
      type: object
      properties:
        run_id:
          type: string
        text:
          type: string
        created_at:
          type: string
          nullable: true
        updated_at:
          type: string
          nullable: true
      required:
        - run_id
        - text
        - created_at
        - updated_at
      additionalProperties: false
    CloudAgentComputerSession:
      type: object
      properties:
        agent_id:
          type: string
        runtime_id:
          type: string
        expires_at:
          type: string
          format: date-time
        channels:
          $ref: '#/components/schemas/CloudAgentComputerSessionChannels'
      required: [agent_id, runtime_id, expires_at, channels]
      additionalProperties: false
    CloudAgentComputerSessionChannels:
      type: object
      description: Extensible set of transports authorized by this Runta session. VNC is available now; computer-use transports can be added without changing the session envelope.
      properties:
        vnc:
          $ref: '#/components/schemas/CloudAgentVncSessionChannel'
      required: [vnc]
      additionalProperties: false
    CloudAgentVncSessionChannel:
      type: object
      properties:
        websocket_url:
          type: string
          format: uri
        protocols:
          type: array
          items:
            type: string
      required: [websocket_url, protocols]
      additionalProperties: false
    CloudAgentList:
      type: object
      properties:
        agents:
          type: array
          items:
            $ref: '#/components/schemas/CloudAgent'
        next_cursor:
          type: string
          nullable: true
      required:
        - agents
        - next_cursor
      additionalProperties: false
    UpdateCloudAgentRequest:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
      required:
        - name
      additionalProperties: false
    CreateCloudAgentRunRequest:
      type: object
      properties:
        prompt:
          type: string
          maxLength: 65536
        images:
          type: array
          maxItems: 8
          items:
            $ref: '#/components/schemas/CloudAgentPromptImage'
        resume_session_id:
          type: string
        parent_run_id:
          type: string
      required:
        - prompt
      additionalProperties: false
    CloudAgentPromptImage:
      type: object
      properties:
        type:
          type: string
          enum: [image]
        data:
          type: string
        mime_type:
          type: string
          enum: [image/png, image/jpeg, image/gif, image/webp]
      required: [type, data, mime_type]
      additionalProperties: false
    CloudAgentRun:
      type: object
      properties:
        id:
          type: string
        agent_id:
          type: string
        status:
          type: string
        prompt:
          type: string
          nullable: true
        result:
          type: string
          nullable: true
        error:
          type: string
          nullable: true
        parent_run_id:
          type: string
          nullable: true
        dsh_session_id:
          type: string
          nullable: true
        created_at:
          type: string
          nullable: true
        updated_at:
          type: string
          nullable: true
      required:
        - id
        - agent_id
        - status
        - prompt
        - result
        - error
        - parent_run_id
        - dsh_session_id
        - created_at
        - updated_at
      additionalProperties: false
    CloudAgentSessionEvents:
      type: object
      properties:
        agent_id:
          type: string
        session_id:
          type: string
        events:
          type: array
          items:
            $ref: '#/components/schemas/CloudAgentEvent'
      required:
        - agent_id
        - session_id
        - events
      additionalProperties: false
    CloudAgentEvent:
      description: Dynamic ACP event payload.
      type: object
      additionalProperties: true
    CreateCloudAgentArtifactRequest:
      type: object
      properties:
        run_id:
          type: string
        name:
          type: string
        media_type:
          type: string
        content_base64:
          type: string
      required:
        - run_id
        - name
        - content_base64
      additionalProperties: false
    CloudAgentArtifact:
      type: object
      properties:
        id:
          type: string
        run_id:
          type: string
        harness_id:
          type: string
        name:
          type: string
        media_type:
          type: string
        size:
          type: integer
          format: uint64
        created_at:
          type: string
        content_base64:
          type: string
      required:
        - id
        - run_id
        - harness_id
        - name
        - media_type
        - size
        - created_at
      additionalProperties: false
    RuntimeWorkspaceOperationKind:
      type: string
      enum:
        - list_directory
        - read_text
        - search_files
        - read_media
        - list_ports
    RuntimeWorkspaceOperationRequest:
      type: object
      properties:
        kind:
          $ref: '#/components/schemas/RuntimeWorkspaceOperationKind'
        path:
          type: string
        query:
          type: string
        offset:
          type: integer
          format: uint64
          minimum: 0
      required:
        - kind
      additionalProperties: false
    RuntimeWorkspaceFileKind:
      type: string
      enum:
        - directory
        - text
        - image
        - video
        - file
    RuntimeWorkspaceFileEntry:
      type: object
      properties:
        name:
          type: string
        path:
          type: string
        kind:
          $ref: '#/components/schemas/RuntimeWorkspaceFileKind'
        size:
          type: integer
          format: uint64
          minimum: 0
      required:
        - name
        - path
        - kind
        - size
      additionalProperties: false
    RuntimeWorkspaceSearchMatch:
      type: object
      properties:
        path:
          type: string
        line:
          type: integer
          format: uint32
          minimum: 1
        preview:
          type: string
      required:
        - path
        - line
        - preview
      additionalProperties: false
    RuntimeWorkspacePort:
      type: object
      properties:
        port:
          type: integer
          format: uint16
          minimum: 1
          maximum: 65535
        forwardable:
          type: boolean
          description: Whether the listener accepts traffic addressed to the Runtime rather than loopback only. Omitted by older Runtime agents.
      required:
        - port
      additionalProperties: false
    RuntimeWorkspaceOperationResult:
      type: object
      properties:
        kind:
          $ref: '#/components/schemas/RuntimeWorkspaceOperationKind'
        entries:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeWorkspaceFileEntry'
        text:
          type: string
        matches:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeWorkspaceSearchMatch'
        media_base64:
          type: string
        media_type:
          type: string
        next_offset:
          type: integer
          format: uint64
          minimum: 0
        ports:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeWorkspacePort'
        truncated:
          type: boolean
      required:
        - kind
        - entries
        - matches
        - ports
        - truncated
      additionalProperties: false
    CloudAgentWorkspaceWriteRequest:
      type: object
      properties:
        path:
          type: string
        content_base64:
          type: string
      required:
        - path
        - content_base64
      additionalProperties: false
    CloudAgentWorkspaceWriteResult:
      type: object
      properties:
        path:
          type: string
        size:
          type: integer
          format: uint64
          minimum: 0
      required:
        - path
        - size
      additionalProperties: false
    CloudAgentWorkspaceDeleteRequest:
      type: object
      properties:
        path:
          type: string
        recursive:
          type: boolean
          default: false
      required:
        - path
      additionalProperties: false
    ManagedModelProviderList:
      type: object
      properties:
        organization_id:
          type: string
        model_providers:
          type: array
          items:
            $ref: '#/components/schemas/ManagedModelProvider'
      required:
        - organization_id
        - model_providers
      additionalProperties: false
    ManagedModelProvider:
      type: object
      properties:
        id:
          type: string
        secret_id:
          type: string
        display_name:
          type: string
        protocol:
          type: string
        base_url:
          type: string
        default_model:
          type: string
          nullable: true
        header_name:
          type: string
        value_template:
          type: string
      required:
        - id
        - secret_id
        - display_name
        - protocol
        - base_url
        - default_model
        - header_name
        - value_template
      additionalProperties: false
    UpdateManagedModelProviderRequest:
      type: object
      properties:
        display_name:
          type: string
        protocol:
          type: string
        base_url:
          type: string
        default_model:
          type: string
          nullable: true
        header_name:
          type: string
        value_template:
          type: string
      required:
        - display_name
        - protocol
        - base_url
        - default_model
        - header_name
        - value_template
      additionalProperties: false
    BeginDeviceAuthorizationRequest:
      type: object
      properties:
        client_id:
          type: string
          enum:
            - runta_cli
            - runta_agent
            - runta_crew
        device_name:
          type: string
        app_url:
          type: string
      required:
        - client_id
    DeviceAuthorizationStart:
      type: object
      properties:
        device_code:
          type: string
        user_code:
          type: string
        verification_uri:
          type: string
        verification_uri_complete:
          type: string
        expires_at:
          type: string
          format: date-time
        interval:
          type: integer
      required:
        - device_code
        - user_code
        - verification_uri
        - verification_uri_complete
        - expires_at
        - interval
    DeviceAuthorizationStartResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/DeviceAuthorizationStart'
      required:
        - data
    ExchangeDeviceTokenRequest:
      type: object
      properties:
        device_code:
          type: string
      required:
        - device_code
    DeviceTokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
      required:
        - access_token
        - token_type
        - expires_in
    DeviceTokenError:
      type: object
      properties:
        error:
          type: string
        interval:
          type: integer
      required:
        - error
    UserProfile:
      description: Minimal current-user identity available to user-authorized device clients.
      type: object
      properties:
        user_id: {type: string}
        email: {type: string}
        display_name: {type: string, nullable: true}
      required: [user_id, email, display_name]
      additionalProperties: false
    UserProfileResponse:
      description: Response envelope.
      type: object
      properties:
        data: {$ref: '#/components/schemas/UserProfile'}
      required: [data]
      additionalProperties: false
    SshKey:
      description: Organization-scoped personal SSH public key metadata.
      type: object
      properties:
        id:
          type: string
        organization_id:
          type: string
        user_id:
          type: string
        display_name:
          type: string
        public_key:
          type: string
        fingerprint:
          type: string
        created_at:
          type: string
          format: date-time
      required:
        - id
        - organization_id
        - user_id
        - display_name
        - public_key
        - fingerprint
        - created_at
    CreateSshKeyRequest:
      type: object
      properties:
        display_name:
          type: string
          minLength: 1
          maxLength: 100
        public_key:
          type: string
          minLength: 1
          maxLength: 1024
      required:
        - display_name
        - public_key
      additionalProperties: false
    SshHostKey:
      type: object
      required:
        - public_key
        - fingerprint
        - known_hosts
      properties:
        public_key:
          type: string
        fingerprint:
          type: string
        known_hosts:
          type: string
      additionalProperties: false
    SshHostKeyResponse:
      type: object
      required:
        - data
      properties:
        data:
          $ref: '#/components/schemas/SshHostKey'
      additionalProperties: false
    ListSshKeysResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/SshKey'
      required:
        - data
    SshKeyResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/SshKey'
      required:
        - data
    RuntimeImageDiskCapability:
      type: object
      properties:
        minimum_gib:
          type: integer
          format: uint32
          minimum: 1
        maximum_gib:
          type: integer
          format: uint32
          maximum: 256
        default_gib:
          type: integer
          format: uint32
          minimum: 1
        step_gib:
          type: integer
          format: uint32
          minimum: 1
      required:
        - minimum_gib
        - maximum_gib
        - default_gib
        - step_gib
      additionalProperties: false
    RuntimeImageRecommendedResources:
      type: object
      properties:
        vcpus:
          type: integer
          format: uint32
          minimum: 1
        memory_mib:
          type: integer
          format: uint64
          minimum: 1
      required:
        - vcpus
        - memory_mib
      additionalProperties: false
    RuntimeImageModelProvider:
      type: object
      properties:
        protocol_bindings:
          description: How each protocol this image speaks reaches a provider.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeImageProtocolBinding'
        subscription_options:
          description: Subscription credentials Runta signs in to on the tenant's behalf. Empty when this image only accepts a credential the tenant supplies.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeImageSubscriptionOption'
        allow_custom_base_url:
          description: Whether this image's agent can be pointed at another endpoint.
          type: boolean
        allow_runtime_sign_in:
          type: boolean
      required:
        - protocol_bindings
        - subscription_options
        - allow_custom_base_url
        - allow_runtime_sign_in
      additionalProperties: false
    RuntimeImageProtocolBinding:
      type: object
      properties:
        protocol:
          type: string
        environment_variable:
          description: Guest variable this image's onboarding writes the credential to.
          type: string
        base_url:
          description: Endpoint the onboarding configures when the caller names none.
          type: string
      required:
        - protocol
        - environment_variable
        - base_url
      additionalProperties: false
    RuntimeImageSubscriptionOption:
      type: object
      properties:
        protocols:
          type: array
          items:
            type: string
        secret_preset_ids:
          type: array
          items:
            type: string
      required:
        - protocols
        - secret_preset_ids
      additionalProperties: false
    RuntimeImage:
      description: A selectable Runtime Image product variant.
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
        icon_key:
          type: string
        architectures:
          type: array
          items:
            type: string
            enum:
              - x86_64
              - aarch64
        disk:
          $ref: '#/components/schemas/RuntimeImageDiskCapability'
        recommended_resources:
          $ref: '#/components/schemas/RuntimeImageRecommendedResources'
        is_default:
          type: boolean
        is_custom:
          type: boolean
        created_at:
          type: string
          format: date-time
        model_provider:
          $ref: '#/components/schemas/RuntimeImageModelProvider'
        web_ui:
          $ref: '#/components/schemas/RuntimeImageWebUi'
        exposed_ports:
          description: TCP ports declared by the image. They are discovery hints and are not published automatically.
          type: array
          maxItems: 128
          uniqueItems: true
          items:
            type: integer
            format: uint16
            minimum: 1
            maximum: 65535
      required:
        - id
        - name
        - description
        - icon_key
        - architectures
        - disk
        - recommended_resources
        - is_default
        - is_custom
        - exposed_ports
      additionalProperties: false
    RuntimeImageWebUi:
      description: A browser surface the image serves. It is published through the runtime's ingress on demand, behind a session gateway, rather than being exposed for the lifetime of the runtime.
      type: object
      properties:
        port:
          description: Guest-local port the gateway listens on.
          type: integer
          format: uint32
          minimum: 1
          maximum: 65535
      required:
        - port
      additionalProperties: false
    ListRuntimeImagesResponse:
      description: List response envelope.
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeImage'
      required:
        - data
    RuntimeImageBuildStatus:
      type: string
      enum:
        - pending
        - retrying
        - building
        - succeeded
        - failed
        - cancelled
    RuntimeImageBuild:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        architecture:
          type: string
          enum:
            - x86_64
        status:
          $ref: '#/components/schemas/RuntimeImageBuildStatus'
        attempt:
          type: integer
          format: uint32
        runtime_image_id:
          type: string
        runtime_bundle_index_digest:
          type: string
        runtime_bundle_manifest_digest:
          type: string
        safe_error_code:
          type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        completed_at:
          type: string
          format: date-time
        dockerfile:
          type: string
        attempts:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeImageBuildAttempt'
      required:
        - id
        - name
        - architecture
        - status
        - attempt
        - runtime_image_id
        - created_at
        - updated_at
    RuntimeImageBuildAttempt:
      type: object
      additionalProperties: false
      properties:
        attempt:
          type: integer
          format: uint32
        started_at:
          type: string
          format: date-time
        completed_at:
          type: string
          format: date-time
        outcome:
          type: string
          enum:
            - succeeded
            - failed
            - retry_wait
            - lease_expired
      required:
        - attempt
        - started_at
    CreateRuntimeImageBuildRequest:
      type: object
      additionalProperties: false
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 120
        dockerfile:
          type: string
          minLength: 1
          maxLength: 1048576
        architecture:
          type: string
          enum:
            - x86_64
          default: x86_64
      required:
        - name
        - dockerfile
        - architecture
    RuntimeImageBuildResponse:
      description: Response envelope.
      type: object
      properties:
        data:
          $ref: '#/components/schemas/RuntimeImageBuild'
      required:
        - data
    ListRuntimeImageBuildsResponse:
      description: List response envelope.
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/RuntimeImageBuild'
      required:
        - data
    Event:
      type: object
      properties:
        id:
          type: string
        runtime_id:
          type: string
        kind:
          type: string
        payload: {}
        occurred_at_unix_millis:
          type: integer
          format: int64
      required:
        - id
        - runtime_id
        - kind
        - payload
        - occurred_at_unix_millis
    EventList:
      type: object
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/Event'
        next_page_token:
          type: string
          nullable: true
      required:
        - events
        - next_page_token
    TokenAnalysisFinding:
      type: object
      properties:
        kind:
          type: string
          enum:
            - large_output
            - repeated_lines
            - repeated_keys
            - repeated_paths
            - repeated_call
        severity:
          type: string
          enum:
            - info
            - warning
            - danger
        confidence:
          type: string
          enum:
            - low
            - medium
            - high
        title:
          type: string
        detail:
          type: string
        estimated_savings_tokens:
          type: integer
          format: int64
      required:
        - kind
        - severity
        - confidence
        - title
        - detail
        - estimated_savings_tokens
    TokenAnalysisIssue:
      type: object
      properties:
        kind:
          type: string
          enum:
            - truncated_capture
            - parse_error
        severity:
          type: string
          enum:
            - info
            - warning
            - danger
        confidence:
          type: string
          enum:
            - low
            - medium
            - high
        title:
          type: string
        detail:
          type: string
      required:
        - kind
        - severity
        - confidence
        - title
        - detail
    TokenAnalysisToolCall:
      type: object
      properties:
        id:
          type: string
        event_id:
          type: string
        runtime_id:
          type: string
        provider:
          type: string
          nullable: true
        tool_name:
          type: string
          nullable: true
        tool_call_id:
          type: string
          nullable: true
        observed_at_unix_millis:
          type: integer
          format: int64
        input_chars:
          type: integer
          format: int64
        output_chars:
          type: integer
          format: int64
        total_chars:
          type: integer
          format: int64
        estimated_input_tokens:
          type: integer
          format: int64
        estimated_output_tokens:
          type: integer
          format: int64
        estimated_total_tokens:
          type: integer
          format: int64
        estimated_savings_tokens:
          type: integer
          format: int64
        truncated:
          type: boolean
        parse_error:
          type: string
          nullable: true
        analysis_issues:
          type: array
          items:
            $ref: '#/components/schemas/TokenAnalysisIssue'
        findings:
          type: array
          items:
            $ref: '#/components/schemas/TokenAnalysisFinding'
        input_preview:
          type: string
        output_preview:
          type: string
        analyzer_version:
          type: integer
          format: int32
          description: Which rule set produced this row. Findings are never recomputed.
      required:
        - id
        - event_id
        - runtime_id
        - provider
        - tool_name
        - tool_call_id
        - observed_at_unix_millis
        - input_chars
        - output_chars
        - total_chars
        - estimated_input_tokens
        - estimated_output_tokens
        - estimated_total_tokens
        - estimated_savings_tokens
        - truncated
        - parse_error
        - analysis_issues
        - findings
        - input_preview
        - output_preview
        - analyzer_version
    TokenAnalysisSummary:
      type: object
      description: Totals over everything the filter selects, not merely the page returned.
      properties:
        total_calls:
          type: integer
          format: int64
        calls_with_findings:
          type: integer
          format: int64
        calls_with_analysis_issues:
          type: integer
          format: int64
        estimated_tokens:
          type: integer
          format: int64
        estimated_savings_tokens:
          type: integer
          format: int64
        truncated_calls:
          type: integer
          format: int64
      required:
        - total_calls
        - calls_with_findings
        - calls_with_analysis_issues
        - estimated_tokens
        - estimated_savings_tokens
        - truncated_calls
    TokenAnalysisList:
      type: object
      properties:
        calls:
          type: array
          items:
            $ref: '#/components/schemas/TokenAnalysisToolCall'
        summary:
          $ref: '#/components/schemas/TokenAnalysisSummary'
        next_page_token:
          type: string
          nullable: true
      required:
        - calls
        - summary
        - next_page_token
    TokenAnalysisDetail:
      type: object
      properties:
        call:
          $ref: '#/components/schemas/TokenAnalysisToolCall'
        input_text:
          type: string
        output_text:
          type: string
      required:
        - call
        - input_text
        - output_text
    TokenSavingMethod:
      type: object
      properties:
        method:
          type: string
          enum:
            - json_array
            - git_diff
            - search_results
            - log
        blocks:
          type: integer
          format: int64
        input_units:
          type: integer
          format: int64
        output_units:
          type: integer
          format: int64
      required:
        - method
        - blocks
        - input_units
        - output_units
    TokenSavingEvent:
      type: object
      properties:
        id:
          type: string
        event_id:
          type: string
        runtime_id:
          type: string
        observed_at_unix_millis:
          type: integer
          format: int64
        provider:
          type: string
          nullable: true
        transport:
          type: string
          nullable: true
        endpoint:
          type: string
          nullable: true
        model:
          type: string
          nullable: true
        wire_bytes_before:
          type: integer
          format: int64
        wire_bytes_after:
          type: integer
          format: int64
        saved_wire_bytes:
          type: integer
          format: int64
        estimated_tokens_before:
          type: integer
          format: int64
        estimated_tokens_after:
          type: integer
          format: int64
        saved_estimated_tokens:
          type: integer
          format: int64
        elapsed_micros:
          type: integer
          format: int64
        methods:
          type: array
          items:
            $ref: '#/components/schemas/TokenSavingMethod'
        parse_error:
          type: string
          nullable: true
        analyzer_version:
          type: integer
          format: int32
      required:
        - id
        - event_id
        - runtime_id
        - observed_at_unix_millis
        - provider
        - transport
        - endpoint
        - model
        - wire_bytes_before
        - wire_bytes_after
        - saved_wire_bytes
        - estimated_tokens_before
        - estimated_tokens_after
        - saved_estimated_tokens
        - elapsed_micros
        - methods
        - parse_error
        - analyzer_version
    TokenSavingsSummary:
      type: object
      description: Totals over everything the filter selects, not merely the page returned.
      properties:
        applied_events:
          type: integer
          format: int64
        saved_wire_bytes:
          type: integer
          format: int64
        saved_estimated_tokens:
          type: integer
          format: int64
        malformed_events:
          type: integer
          format: int64
      required:
        - applied_events
        - saved_wire_bytes
        - saved_estimated_tokens
        - malformed_events
    TokenSavingsList:
      type: object
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/TokenSavingEvent'
        summary:
          $ref: '#/components/schemas/TokenSavingsSummary'
        next_page_token:
          type: string
          nullable: true
      required:
        - events
        - summary
        - next_page_token
    GitHubAuthorizationRequest:
      type: object
      properties:
        request_id:
          type: string
        requested_by:
          type: string
        reason:
          type: string
          description: What the agent said it needed access for.
        created_at_unix_seconds:
          type: integer
          format: int64
        lifecycle:
          $ref: '#/components/schemas/GitHubAuthorizationLifecycle'
      required:
        - request_id
        - requested_by
        - created_at_unix_seconds
        - lifecycle
    GitHubAuthorizationDecisionMetadata:
      type: object
      additionalProperties: false
      properties:
        decided_by:
          type: string
        decided_at_unix_seconds:
          type: integer
          format: int64
      required:
        - decided_by
        - decided_at_unix_seconds
    GitHubAuthorizationLifecycle:
      oneOf:
        - $ref: '#/components/schemas/PendingGitHubAuthorization'
        - $ref: '#/components/schemas/ApprovedGitHubAuthorization'
        - $ref: '#/components/schemas/InstalledGitHubAuthorization'
        - $ref: '#/components/schemas/DeniedGitHubAuthorization'
        - $ref: '#/components/schemas/ExpiredGitHubAuthorization'
      discriminator:
        propertyName: status
        mapping:
          pending: '#/components/schemas/PendingGitHubAuthorization'
          approved: '#/components/schemas/ApprovedGitHubAuthorization'
          installed: '#/components/schemas/InstalledGitHubAuthorization'
          denied: '#/components/schemas/DeniedGitHubAuthorization'
          expired: '#/components/schemas/ExpiredGitHubAuthorization'
    PendingGitHubAuthorization:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/PendingGitHubAuthorizationStatus'
        authorization_url:
          type: string
          format: uri
        expires_at_unix_seconds:
          type: integer
          format: int64
      required:
        - status
        - authorization_url
        - expires_at_unix_seconds
    PendingGitHubAuthorizationStatus:
      type: string
      enum:
        - pending
    ApprovedGitHubAuthorization:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/ApprovedGitHubAuthorizationStatus'
        decision:
          $ref: '#/components/schemas/GitHubAuthorizationDecisionMetadata'
        expires_at_unix_seconds:
          type: integer
          format: int64
      required:
        - status
        - decision
        - expires_at_unix_seconds
    ApprovedGitHubAuthorizationStatus:
      type: string
      enum:
        - approved
    InstalledGitHubAuthorization:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/InstalledGitHubAuthorizationStatus'
        decision:
          $ref: '#/components/schemas/GitHubAuthorizationDecisionMetadata'
        installation_id:
          type: integer
          format: int64
      required:
        - status
        - decision
        - installation_id
    InstalledGitHubAuthorizationStatus:
      type: string
      enum:
        - installed
    DeniedGitHubAuthorization:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/DeniedGitHubAuthorizationStatus'
        decision:
          $ref: '#/components/schemas/GitHubAuthorizationDecisionMetadata'
      required:
        - status
        - decision
    DeniedGitHubAuthorizationStatus:
      type: string
      enum:
        - denied
    ExpiredGitHubAuthorization:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/ExpiredGitHubAuthorizationStatus'
        expires_at_unix_seconds:
          type: integer
          format: int64
        decision:
          $ref: '#/components/schemas/GitHubAuthorizationDecisionMetadata'
      required:
        - status
        - expires_at_unix_seconds
    ExpiredGitHubAuthorizationStatus:
      type: string
      enum:
        - expired
    GitHubAuthorizationRequestList:
      type: object
      properties:
        requests:
          type: array
          items:
            $ref: '#/components/schemas/GitHubAuthorizationRequest'
      required:
        - requests
    GitHubRepository:
      type: object
      properties:
        id:
          type: integer
          format: int64
        installation_id:
          type: integer
          format: int64
        owner:
          type: string
        name:
          type: string
        default_branch:
          type: string
        private:
          type: boolean
      required:
        - id
        - installation_id
        - owner
        - name
        - default_branch
        - private
    GitHubInstallation:
      type: object
      properties:
        installation_id:
          type: integer
          format: int64
        account_login:
          type: string
        account_type:
          type: string
        account_avatar_url:
          type: string
        repository_selection:
          type: string
      required:
        - installation_id
        - account_login
        - account_type
        - account_avatar_url
        - repository_selection
    GitHubRepositoryList:
      type: object
      properties:
        repositories:
          type: array
          items:
            $ref: '#/components/schemas/GitHubRepository'
        next_page_token:
          type: string
          nullable: true
        installations:
          type: array
          items:
            $ref: '#/components/schemas/GitHubInstallation'
      required:
        - repositories
        - next_page_token
        - installations
    RuntimeRepositorySelection:
      type: object
      properties:
        repository_id:
          type: integer
          format: int64
        branch:
          type: string
          nullable: true
      required:
        - repository_id
      additionalProperties: false
    ReplaceGitHubRuntimeBindingsRequest:
      type: object
      properties:
        repositories:
          type: array
          items:
            type: object
            properties:
              repository_id:
                type: integer
                format: int64
                minimum: 1
              branch:
                type: string
                minLength: 1
            required:
              - repository_id
              - branch
            additionalProperties: false
      required:
        - repositories
      additionalProperties: false
    GitHubBranch:
      type: object
      properties:
        name:
          type: string
        commit_sha:
          type: string
      required:
        - name
        - commit_sha
    GitHubBranchList:
      type: object
      properties:
        branches:
          type: array
          items:
            $ref: '#/components/schemas/GitHubBranch'
      required:
        - branches
    GitHubRuntimeBinding:
      type: object
      properties:
        id:
          type: string
        tenant_id:
          type: string
        runtime_id:
          type: string
        repository_id:
          type: integer
          format: int64
        branch:
          type: string
        sort_order:
          type: integer
          format: int32
      required:
        - id
        - tenant_id
        - runtime_id
        - repository_id
        - branch
        - sort_order
    GitHubRuntimeBindingList:
      type: object
      properties:
        bindings:
          type: array
          items:
            $ref: '#/components/schemas/GitHubRuntimeBinding'
      required:
        - bindings
    EventResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Event'
      required:
        - data
    EventListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/EventList'
      required:
        - data
    TokenAnalysisListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/TokenAnalysisList'
      required:
        - data
    TokenAnalysisDetailResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/TokenAnalysisDetail'
      required:
        - data
    TokenSavingsListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/TokenSavingsList'
      required:
        - data
    GitHubAuthorizationRequestResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubAuthorizationRequest'
      required:
        - data
    GitHubAuthorizationRequestListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubAuthorizationRequestList'
      required:
        - data
    GitHubRepositoryListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubRepositoryList'
      required:
        - data
    GitHubBranchListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubBranchList'
      required:
        - data
    GitHubRuntimeBindingResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubRuntimeBinding'
      required:
        - data
    GitHubRuntimeBindingListResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GitHubRuntimeBindingList'
      required:
        - data
    CreateGitHubAuthorizationRequestRequest:
      type: object
      properties:
        reason:
          type: string
          maxLength: 512
          description: What access is needed for, shown to the approver verbatim.
      additionalProperties: false
    CreateGitHubRuntimeBindingRequest:
      type: object
      properties:
        runtime_id:
          type: string
        repository_id:
          type: integer
          format: int64
        branch:
          type: string
      required:
        - runtime_id
        - repository_id
        - branch
      additionalProperties: false
    Checkpoint:
      description: Checkpoint response object.
      type: object
      properties:
        kind:
          description: Canonical checkpoint kind, full or cold. Absent on older servers.
          type: string
        display_name:
          description: User-chosen display name.
          type: string
        id:
          description: Stable checkpoint UUID.
          type: string
        created_at:
          description: RFC3339 timestamp when the control-plane checkpoint row was created.
          type: string
        resources:
          description: Checkpoint resource state.
          allOf:
            - $ref: '#/components/schemas/RuntimeResources'
        state:
          description: Checkpoint lifecycle state.
          allOf:
            - $ref: '#/components/schemas/PublicCheckpointState'
        safe_error_code:
          description: Bounded non-sensitive reason when checkpoint creation failed.
          type: string
          nullable: true
        source_runtime:
          description: Runtime that produced this checkpoint, or its retained name after deletion.
          allOf:
            - $ref: '#/components/schemas/CheckpointSourceRuntime'
      required:
        - id
        - created_at
        - display_name
        - state
        - resources
    CheckpointSourceRuntime:
      description: Source runtime lineage for a checkpoint.
      type: object
      properties:
        id:
          description: Stable runtime UUID. Null after the source runtime is deleted.
          type: string
          nullable: true
        name:
          description: Runtime name captured when the checkpoint was created.
          type: string
      required:
        - id
        - name
    CreateCheckpointRequest:
      description: Checkpoint creation request.
      type: object
      properties:
        kind:
          description: Full VM snapshot (`full` or equivalent `live`), or disk-only snapshot (`cold`) of a fully shutdown runtime.
          type: string
          default: full
          enum:
            - full
            - live
            - cold
        name:
          description: Human-readable checkpoint name.
          type: string
          nullable: true
    DisabledIdlePolicy:
      description: Disable automatic idle suspension and wakeup.
      type: object
      properties:
        mode:
          type: string
          enum:
            - disabled
      required:
        - mode
      additionalProperties: false
    SuspendOnlyIdlePolicy:
      description: Automatically suspend an idle runtime, but require an explicit Start to wake it.
      type: object
      properties:
        mode:
          type: string
          enum:
            - suspend_only
        suspend_after_secs:
          description: Idle duration before automatic suspension.
          type: integer
          format: uint32
          maximum: 2147483647
          minimum: 1
      required:
        - mode
        - suspend_after_secs
      additionalProperties: false
    SuspendAndWakeupIdlePolicy:
      description: Automatically suspend an idle runtime and wake it on supported activity.
      type: object
      properties:
        mode:
          type: string
          enum:
            - suspend_and_wakeup
        suspend_after_secs:
          description: Idle duration before automatic suspension.
          type: integer
          format: uint32
          maximum: 2147483647
          minimum: 1
      required:
        - mode
        - suspend_after_secs
      additionalProperties: false
    IdlePolicy:
      description: Runtime idle suspension and automatic wakeup policy.
      oneOf:
        - $ref: '#/components/schemas/DisabledIdlePolicy'
        - $ref: '#/components/schemas/SuspendOnlyIdlePolicy'
        - $ref: '#/components/schemas/SuspendAndWakeupIdlePolicy'
    CreateLlmTokenSavingPolicy:
      description: Initial per-runtime LLM tool-output compression settings. Omitted fields default to false.
      type: object
      properties:
        json_array_enabled:
          type: boolean
          default: false
        log_enabled:
          type: boolean
          default: false
        search_results_enabled:
          type: boolean
          default: false
        git_diff_enabled:
          type: boolean
          default: false
      additionalProperties: false
    PatchLlmTokenSavingPolicy:
      description: Per-method LLM tool-output compression patch. Omitted fields remain unchanged.
      type: object
      minProperties: 1
      properties:
        json_array_enabled:
          type: boolean
        log_enabled:
          type: boolean
        search_results_enabled:
          type: boolean
        git_diff_enabled:
          type: boolean
      additionalProperties: false
    LlmTokenSavingPolicy:
      description: Canonical per-runtime LLM tool-output compression settings.
      type: object
      properties:
        json_array_enabled:
          type: boolean
        log_enabled:
          type: boolean
        search_results_enabled:
          type: boolean
        git_diff_enabled:
          type: boolean
      required:
        - json_array_enabled
        - log_enabled
        - search_results_enabled
        - git_diff_enabled
      additionalProperties: false
    VncCredential:
      type: object
      additionalProperties: false
      properties:
        id: {type: string}
        display_name: {type: string}
        locator: {type: string}
        created_by_user_id: {type: string}
        created_at: {type: string, format: date-time}
        last_used_at: {type: string, format: date-time, nullable: true}
        revoked_at: {type: string, format: date-time, nullable: true}
      required: [id, display_name, locator, created_by_user_id, created_at]
    CreateVncCredentialRequest:
      type: object
      additionalProperties: false
      properties:
        display_name: {type: string, minLength: 1, maxLength: 100}
      required: [display_name]
    VncCredentialConnection:
      type: object
      additionalProperties: false
      properties:
        credential: {$ref: '#/components/schemas/VncCredential'}
        username: {type: string}
        password: {type: string}
        hostname: {type: string}
        port: {type: integer, format: uint16, minimum: 1, maximum: 65535}
        security_type: {type: string, enum: [X509Plain]}
      required: [credential, username, password, hostname, port, security_type]
    CreateVncCredentialResponse:
      type: object
      properties:
        data: {$ref: '#/components/schemas/VncCredentialConnection'}
      required: [data]
    VncCredentialResponse:
      type: object
      properties:
        data: {$ref: '#/components/schemas/VncCredential'}
      required: [data]
    ListVncCredentialsResponse:
      type: object
      properties:
        data:
          type: array
          items: {$ref: '#/components/schemas/VncCredential'}
      required: [data]
    CreateRuntimeRequest:
      description: Fresh runtime creation or checkpoint restoration request.
      oneOf:
        - $ref: '#/components/schemas/FreshRuntimeCreateRequest'
        - $ref: '#/components/schemas/CheckpointRuntimeRestoreRequest'
    FreshRuntimeCreateRequest:
      description: Create a fresh runtime from a Runtime Image.
      type: object
      properties:
        environment_variables:
          description: 'Non-secret environment variables the runtime carries. Names must match [A-Za-z_][A-Za-z0-9_]* and be at most 128 UTF-8 bytes. Names Runta sets itself are reserved: the RUNTA_ prefix, the runtime CA variables, the managed repository credentials, and the canonical names of the provider secret presets. Values must be at most 8192 UTF-8 bytes each and 65536 in total, and must not contain NUL, CR, or LF.'
          type: object
          default: {}
          maxProperties: 64
          additionalProperties:
            type: string
        egress_policy:
          description: Initial egress policy.
          allOf:
            - $ref: '#/components/schemas/PublicEgressPolicy'
          default:
            mode: denylist
            denied_hosts: []
        idle_policy:
          description: Initial idle policy. Omit to use disabled.
          allOf:
            - $ref: '#/components/schemas/IdlePolicy'
          default:
            mode: disabled
        ingress_specs:
          description: Optional ingress specs.
          type: array
          default: []
          maxItems: 16
          items:
            $ref: '#/components/schemas/PublicIngressSpec'
        name:
          description: Human-readable runtime name.
          type: string
          nullable: true
        resources:
          description: Runtime resource requests and limits.
          allOf:
            - $ref: '#/components/schemas/CreateRuntimeResources'
          default:
            requests:
              vcpus: 1
              memory_mib: 1024
            limits:
              memory_mib: 1024
        image:
          description: Runtime Image selection. Omit on a fresh create to use the default variant.
          allOf:
            - $ref: '#/components/schemas/CreateRuntimeImageSelection'
        secret_configuration:
          description: Complete inline secret injection configuration.
          type: array
          default: []
          items:
            $ref: '#/components/schemas/RuntimeSecretConfiguration'
        ssh_key_ids:
          description: Personal SSH key UUIDs to attach atomically.
          type: array
          default: []
          items:
            type: string
        vnc_enabled:
          description: Start the shared VNC desktop whenever the runtime is running.
          type: boolean
          default: false
        repositories:
          description: GitHub repositories to check out during runtime setup, in checkout order. The first repository becomes the default workspace. Repositories may span GitHub App installations.
          type: array
          default: []
          maxItems: 20
          items:
            $ref: '#/components/schemas/RuntimeRepositorySelection'
        llm_tool_io_capture_enabled:
          description: Opt in to official LLM HTTP API tool input/output capture.
          type: boolean
          default: false
        llm_session_content_capture_enabled:
          description: Explicitly opt in to user, assistant, and tool conversation content capture. Disabled by default; independent from tool-only capture.
          type: boolean
          default: false
        llm_token_saving_policy:
          description: Initial LLM tool-output compression policy. Omit to disable every method.
          allOf:
            - $ref: '#/components/schemas/CreateLlmTokenSavingPolicy'
          default:
            json_array_enabled: false
            log_enabled: false
            search_results_enabled: false
            git_diff_enabled: false
      additionalProperties: false
    CheckpointRuntimeRestoreRequest:
      description: Restore a runtime from a checkpoint. Hardware resources and Runtime Image identity are fixed by the checkpoint.
      type: object
      properties:
        checkpoint_id:
          description: Checkpoint UUID to restore from.
          type: string
          minLength: 1
        egress_policy:
          description: Initial egress policy.
          allOf:
            - $ref: '#/components/schemas/PublicEgressPolicy'
          default:
            mode: denylist
            denied_hosts: []
        idle_policy:
          description: Initial idle policy. Omit to use disabled.
          allOf:
            - $ref: '#/components/schemas/IdlePolicy'
          default:
            mode: disabled
        ingress_specs:
          description: Optional ingress specs.
          type: array
          default: []
          maxItems: 16
          items:
            $ref: '#/components/schemas/PublicIngressSpec'
        name:
          description: Human-readable runtime name.
          type: string
          nullable: true
        secret_configuration:
          description: Complete inline secret injection configuration override. Omit or pass an empty array to inherit the checkpoint snapshot.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeSecretConfiguration'
        ssh_key_ids:
          description: Personal SSH key UUIDs to attach atomically.
          type: array
          default: []
          items:
            type: string
        vnc_enabled:
          description: Start the shared VNC desktop whenever the runtime is running.
          type: boolean
          default: false
        repositories:
          description: GitHub repository override in checkout order. Omit or pass an empty array to inherit the checkpoint snapshot. The first repository becomes the default workspace.
          type: array
          maxItems: 20
          items:
            $ref: '#/components/schemas/RuntimeRepositorySelection'
        llm_tool_io_capture_enabled:
          description: Opt in to official LLM HTTP API tool input/output capture.
          type: boolean
          default: false
        llm_session_content_capture_enabled:
          description: Explicitly opt in to user, assistant, and tool conversation content capture. Disabled by default; independent from tool-only capture.
          type: boolean
          default: false
        llm_token_saving_policy:
          description: Initial LLM tool-output compression policy. Omit to disable every method.
          allOf:
            - $ref: '#/components/schemas/CreateLlmTokenSavingPolicy'
          default:
            json_array_enabled: false
            log_enabled: false
            search_results_enabled: false
            git_diff_enabled: false
      required:
        - checkpoint_id
      additionalProperties: false
    CreateRuntimeImageSelection:
      type: object
      properties:
        id:
          type: string
          minLength: 1
        model_provider_protocol:
          type: string
          nullable: true
        runtime_sign_in:
          type: boolean
          default: false
        model_provider_base_url:
          description: HTTPS endpoint the agent is configured against. Omit to use the image's default. Only images advertising allow_custom_base_url accept another endpoint.
          type: string
          nullable: true
        model_provider_model:
          description: Model the agent is configured to use. Omit to use the image's default.
          type: string
          nullable: true
      required:
        - id
      additionalProperties: false
    CreateRuntimeResourceRequests:
      description: Resource requests for runtime creation.
      type: object
      properties:
        memory_mib:
          description: Requested baseline memory in MiB.
          type: integer
          format: uint64
          default: 1024
          minimum: 1
        vcpus:
          description: Requested virtual CPUs.
          type: integer
          format: uint32
          default: 1
          maximum: 2147483647
          minimum: 1
        disk_gib:
          description: Requested overlay virtual capacity in GiB.
          type: integer
          format: uint32
          minimum: 32
          maximum: 256
      additionalProperties: false
    CreateRuntimeResources:
      description: Resource requests and limits for runtime creation.
      type: object
      properties:
        limits:
          description: Resource limits.
          allOf:
            - $ref: '#/components/schemas/RuntimeResourceLimits'
        requests:
          description: Resource requests.
          allOf:
            - $ref: '#/components/schemas/CreateRuntimeResourceRequests'
          default:
            vcpus: 1
            memory_mib: 1024
      additionalProperties: false
    CreateSecretRequest:
      description: Secret creation request.
      type: object
      properties:
        name:
          description: Secret display name.
          type: string
          minLength: 1
        value:
          description: Secret value.
          type: string
        cache_ttl_secs:
          description: Worker-side cache TTL in seconds.
          type: integer
          format: uint32
          default: 0
          minimum: 0
          maximum: 3600
      required:
        - name
        - value
      additionalProperties: false
    SetSecretRequest:
      description: Secret set request.
      type: object
      properties:
        cache_ttl_secs:
          description: Worker-side cache TTL in seconds.
          type: integer
          format: uint32
          default: 0
          minimum: 0
        value:
          description: Secret value.
          type: string
      required:
        - value
    EmptyObject:
      description: Empty object.
      type: object
      additionalProperties: false
    ErrorBody:
      type: object
      properties:
        code:
          $ref: '#/components/schemas/PublicErrorCode'
        message:
          type: string
      required:
        - code
        - message
    ErrorEnvelope:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
        request_id:
          description: UUID v7 correlation ID shared with the `X-Request-Id` response header.
          type: string
      required:
        - error
        - request_id
    PublicCheckpointState:
      description: Checkpoint lifecycle state.
      type: string
      enum:
        - creating
        - ready
        - failed
    PublicEgressPolicy:
      description: Per-runtime egress gateway policy.
      oneOf:
        - $ref: '#/components/schemas/DenylistEgressPolicy'
        - $ref: '#/components/schemas/AllowlistEgressPolicy'
      discriminator:
        propertyName: mode
        mapping:
          denylist: '#/components/schemas/DenylistEgressPolicy'
          allowlist: '#/components/schemas/AllowlistEgressPolicy'
    DenylistEgressPolicy:
      description: Deny matching hosts and allow all other egress destinations.
      type: object
      additionalProperties: false
      properties:
        mode:
          type: string
          enum:
            - denylist
        denied_hosts:
          description: Host names, wildcard patterns, IP addresses, or CIDR ranges to deny.
          type: array
          maxItems: 128
          items:
            type: string
      required:
        - mode
        - denied_hosts
    AllowlistEgressPolicy:
      description: Allow only matching egress destinations.
      type: object
      additionalProperties: false
      properties:
        mode:
          type: string
          enum:
            - allowlist
        allowed_hosts:
          description: Host names, wildcard patterns, IP addresses, or CIDR ranges to allow.
          type: array
          maxItems: 128
          items:
            type: string
      required:
        - mode
        - allowed_hosts
    PublicErrorCode:
      type: string
      enum:
        - already_exists
        - command_failed
        - deadline_exceeded
        - failed_precondition
        - internal
        - invalid_argument
        - not_found
        - permission_denied
        - rate_limited
        - unauthenticated
        - unavailable
        - unimplemented
    PublicIngressProtocol:
      description: HTTP/HTTPS application-layer ingress protocol.
      type: string
      enum:
        - http
        - https
    PublicIngressSpec:
      description: Public ingress forwarding rule.
      type: object
      properties:
        protocol:
          description: Application-layer protocol.
          allOf:
            - $ref: '#/components/schemas/PublicIngressProtocol'
        runtime_port:
          description: Port inside the runtime VM.
          type: integer
          format: uint16
          maximum: 65535
          minimum: 0
      required:
        - protocol
        - runtime_port
    PublicRuntimeStatus:
      description: Runtime state of a runtime.
      type: string
      enum:
        - running
        - paused
        - shutdown
        - creating
        - deleting
        - error
        - crashed
        - suspended
        - unavailable
    CheckpointResponse:
      description: Response envelope.
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Checkpoint'
      required:
        - data
    EmptyResponse:
      description: Response envelope.
      type: object
      properties:
        data:
          $ref: '#/components/schemas/EmptyObject'
      required:
        - data
    ListCheckpointsResponse:
      description: List response envelope.
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Checkpoint'
        pagination:
          $ref: '#/components/schemas/CheckpointPagination'
      required:
        - data
        - pagination
    CheckpointPagination:
      description: Cursor pagination metadata.
      type: object
      properties:
        next_cursor:
          description: Opaque cursor for the next page, or null when this page is complete.
          type: string
          nullable: true
        has_more:
          description: Whether another page is available.
          type: boolean
      required:
        - next_cursor
        - has_more
    ListRuntimesResponse:
      description: List response envelope.
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Runtime'
        pagination:
          $ref: '#/components/schemas/RuntimePagination'
      required:
        - data
        - pagination
    RuntimePagination:
      description: Cursor pagination metadata.
      type: object
      properties:
        next_cursor:
          description: Opaque cursor for the next page, or null when this page is complete.
          type: string
          nullable: true
        has_more:
          description: Whether another page is available.
          type: boolean
      required:
        - next_cursor
        - has_more
    ListSecretsResponse:
      description: List response envelope.
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Secret'
      required:
        - data
    RuntimeResponse:
      description: Response envelope.
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Runtime'
      required:
        - data
    SecretResponse:
      description: Response envelope.
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Secret'
      required:
        - data
    VncGatewayConnection:
      description: Fixed native VNC gateway connection parameters for runtimes in this zone.
      type: object
      properties:
        hostname:
          description: Public VNC gateway DNS hostname.
          type: string
          minLength: 1
        port:
          description: Public native VNC TCP port.
          type: integer
          format: uint16
          minimum: 1
          maximum: 65535
        username:
          description: Username required by the X509Plain handshake.
          type: string
          enum: [runta]
        security_type:
          description: VeNCrypt authentication subtype required by the gateway.
          type: string
          enum: [X509Plain]
      required:
        - hostname
        - port
        - username
        - security_type
      additionalProperties: false
    Runtime:
      description: Runtime response object.
      type: object
      properties:
        environment_variables:
          description: Non-secret environment variables the runtime carries.
          type: object
          maxProperties: 64
          additionalProperties:
            type: string
        display_name:
          description: User-chosen display name.
          type: string
        egress_policy:
          description: Egress policy.
          allOf:
            - $ref: '#/components/schemas/PublicEgressPolicy'
        llm_tool_io_capture_enabled:
          description: Whether official LLM HTTP API tool input/output capture is enabled.
          type: boolean
        llm_session_content_capture_enabled:
          description: Explicitly opt in to user, assistant, and tool conversation content capture. Disabled by default; independent from tool-only capture.
          type: boolean
        llm_token_saving_policy:
          description: Canonical LLM tool-output compression policy.
          allOf:
            - $ref: '#/components/schemas/LlmTokenSavingPolicy'
        idle_policy:
          description: Runtime idle suspension and automatic wakeup policy.
          allOf:
            - $ref: '#/components/schemas/IdlePolicy'
        id:
          description: Stable runtime UUID.
          type: string
        created_at:
          description: RFC3339 timestamp when the control-plane runtime row was created.
          type: string
        updated_at:
          description: RFC3339 timestamp of the last control-plane runtime row mutation.
          type: string
        ingress_specs:
          description: Active ingress specs.
          type: array
          items:
            $ref: '#/components/schemas/PublicIngressSpec'
        resources:
          description: Runtime resource state.
          allOf:
            - $ref: '#/components/schemas/RuntimeResources'
        image_id:
          description: Stable Runtime Image variant identifier.
          type: string
        status:
          description: Runtime status.
          allOf:
            - $ref: '#/components/schemas/PublicRuntimeStatus'
        degraded:
          description: Whether a running runtime has lacked a new successful heartbeat for at least 60 seconds.
          type: boolean
        desired_status:
          description: Control-plane target lifecycle state.
          type: string
          enum:
            - running
            - paused
            - suspended
            - shutdown
            - deleting
        ssh_enabled:
          description: Whether this runtime supports SSH access.
          type: boolean
        vnc_enabled:
          description: Whether the shared VNC desktop is configured to run with this runtime.
          type: boolean
        vnc_ready:
          description: Whether the current Worker assignment has published a ready VNC mapping.
          type: boolean
        vnc_error_code:
          description: Bounded machine-readable VNC startup failure code.
          type: string
          nullable: true
        vnc_connection:
          description: Fixed native VNC gateway connection parameters for this runtime's zone.
          allOf:
            - $ref: '#/components/schemas/VncGatewayConnection'
        error_code:
          description: Bounded machine-readable provisioning failure code.
          type: string
          nullable: true
        owner_user_id:
          description: Organization member who owns the runtime.
          type: string
        can_manage:
          description: Whether the current caller may perform control operations on this runtime.
          type: boolean
        revision:
          description: Monotonic runtime aggregate revision.
          type: integer
          format: uint64
          minimum: 1
        secret_configuration:
          description: Canonical inline secret injection configuration.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeSecretConfiguration'
      required:
        - id
        - created_at
        - updated_at
        - degraded
        - display_name
        - resources
        - image_id
        - ingress_specs
        - egress_policy
        - idle_policy
        - llm_tool_io_capture_enabled
        - llm_session_content_capture_enabled
        - llm_token_saving_policy
        - status
        - desired_status
        - ssh_enabled
        - vnc_enabled
        - vnc_ready
        - vnc_connection
        - owner_user_id
        - can_manage
        - revision
        - secret_configuration
    SecretInjectionAction:
      description: Where an egress secret is injected.
      type: string
      enum:
        - header
        - query
    SecretEnvironmentInjection:
      description: Environment variable populated from a secret.
      type: object
      properties:
        name:
          type: string
        value_template:
          type: string
      required:
        - name
        - value_template
      additionalProperties: false
    SecretEgressInjection:
      description: HTTP egress credential populated from a secret.
      type: object
      properties:
        host_pattern:
          type: string
        path_pattern:
          type: string
          nullable: true
        action:
          $ref: '#/components/schemas/SecretInjectionAction'
        name:
          type: string
        value_template:
          type: string
      required:
        - host_pattern
        - action
        - name
        - value_template
      additionalProperties: false
    SecretFileInjection:
      description: Managed credential file populated from a secret.
      type: object
      properties:
        path:
          description: Delivery path, relative to the guest home directory.
          type: string
        value_template:
          type: string
      required:
        - path
        - value_template
      additionalProperties: false
    RuntimeSecretConfiguration:
      description: Inline injection configuration for one tenant secret.
      type: object
      properties:
        secret_id:
          type: string
        environment:
          type: array
          default: []
          items:
            $ref: '#/components/schemas/SecretEnvironmentInjection'
        egress_rules:
          type: array
          default: []
          items:
            $ref: '#/components/schemas/SecretEgressInjection'
        files:
          type: array
          default: []
          items:
            $ref: '#/components/schemas/SecretFileInjection'
      required:
        - secret_id
      additionalProperties: false
    Secret:
      description: Secret response object.
      type: object
      properties:
        cache_ttl_secs:
          description: Worker-side cache TTL in seconds.
          type: integer
          format: uint32
          minimum: 0
        display_name:
          description: User-chosen display name.
          type: string
        id:
          description: Stable secret UUID.
          type: string
        value_preview:
          description: Server-masked preview (first and last chars) of the value, for display only. Never the full value.
          type: string
      required:
        - id
        - display_name
        - cache_ttl_secs
    PatchRuntimeRequest:
      description: Runtime patch request.
      type: object
      properties:
        environment_variables:
          description: Complete replacement of the runtime's non-secret environment variables. An empty object removes every variable; omit to leave unchanged. The same name, value, and reservation rules as creation apply.
          type: object
          maxProperties: 64
          additionalProperties:
            type: string
        display_name:
          description: New user-facing runtime name. The runtime UUID and data-plane identity remain unchanged.
          type: string
          minLength: 1
          maxLength: 63
        egress_policy:
          allOf:
            - $ref: '#/components/schemas/PublicEgressPolicy'
        ingress_specs:
          description: Complete replacement ingress configuration. Omit to leave unchanged.
          type: array
          items:
            $ref: '#/components/schemas/PublicIngressSpec'
        idle_policy:
          description: Idle policy. Omit to leave unchanged.
          allOf:
            - $ref: '#/components/schemas/IdlePolicy'
        llm_tool_io_capture_enabled:
          description: Whether official LLM HTTP API tool input/output capture is enabled. Omit to leave unchanged.
          type: boolean
        llm_session_content_capture_enabled:
          description: Explicitly opt in to user, assistant, and tool conversation content capture. Disabled by default; independent from tool-only capture. Omit to leave unchanged.
          type: boolean
        vnc_enabled:
          description: Enable or disable the on-demand shared VNC desktop. Omit to leave unchanged.
          type: boolean
        llm_token_saving_policy:
          description: Per-method LLM tool-output compression patch. Omit to leave unchanged.
          allOf:
            - $ref: '#/components/schemas/PatchLlmTokenSavingPolicy'
        resources:
          allOf:
            - $ref: '#/components/schemas/PatchRuntimeResources'
        secret_configuration:
          description: Complete replacement inline secret configuration. Omit to leave unchanged.
          type: array
          items:
            $ref: '#/components/schemas/RuntimeSecretConfiguration'
      additionalProperties: false
    PatchRuntimeResourceRequests:
      description: Resource requests for runtime patching.
      type: object
      properties:
        memory_mib:
          description: Requested baseline memory in MiB.
          type: integer
          format: uint64
          minimum: 1
        disk_gib:
          description: New overlay capacity in GiB. Only growth while fully shutdown is supported.
          type: integer
          format: uint32
          minimum: 32
          maximum: 256
      additionalProperties: false
    PatchRuntimeResources:
      description: Resource requests and limits for runtime patching.
      type: object
      properties:
        limits:
          description: Resource limits.
          allOf:
            - $ref: '#/components/schemas/RuntimeResourceLimits'
        requests:
          description: Resource requests.
          allOf:
            - $ref: '#/components/schemas/PatchRuntimeResourceRequests'
      additionalProperties: false
    RuntimeResourceLimits:
      description: Runtime resource limits.
      type: object
      properties:
        memory_mib:
          description: Maximum memory in MiB.
          type: integer
          format: uint64
          minimum: 1
      required:
        - memory_mib
      additionalProperties: false
    RuntimeResourceCurrent:
      description: Current runtime resource allocation.
      type: object
      properties:
        memory_mib:
          description: Current memory allocation in MiB.
          type: integer
          format: uint64
          minimum: 1
        observed_disk_gib:
          description: Worker-observed overlay virtual capacity in GiB.
          type: integer
          format: uint32
          minimum: 0
      required:
        - memory_mib
        - observed_disk_gib
      additionalProperties: false
    RuntimeResourceRequests:
      description: Runtime resource requests.
      type: object
      properties:
        memory_mib:
          description: Requested baseline memory in MiB.
          type: integer
          format: uint64
          minimum: 1
        vcpus:
          description: Requested virtual CPUs.
          type: integer
          format: uint32
          maximum: 2147483647
          minimum: 1
        disk_gib:
          description: Target overlay virtual capacity in GiB.
          type: integer
          format: uint32
          minimum: 16
          maximum: 256
      required:
        - vcpus
        - memory_mib
        - disk_gib
      additionalProperties: false
    RuntimeResources:
      description: Runtime resource requests and limits.
      type: object
      properties:
        current:
          description: Current resource allocation.
          allOf:
            - $ref: '#/components/schemas/RuntimeResourceCurrent'
        limits:
          description: Resource limits.
          allOf:
            - $ref: '#/components/schemas/RuntimeResourceLimits'
        requests:
          description: Resource requests.
          allOf:
            - $ref: '#/components/schemas/RuntimeResourceRequests'
      required:
        - current
        - requests
        - limits
      additionalProperties: false
tags:
  - name: Health
  - name: Auth
  - name: Events
  - name: GitHub
  - name: Runtimes
  - name: Files
  - name: SSH Keys
  - name: Secrets
  - name: Checkpoints
  - name: Cloud Agents
  - name: Managed Model Providers