components:
  schemas:
    agentrouter.admin.v1.AIModel:
      additionalProperties: false
      properties:
        capabilities:
          description: Supported capability tags (e.g. "vision", "tools").
          items:
            type: string
          title: capabilities
          type: array
        contextWindow:
          description: Maximum context window in tokens.
          format: int32
          title: context_window
          type: integer
        id:
          description: Catalog entry UUID.
          title: id
          type: string
        inputPricePerMillion:
          description: Input token price per million tokens.
          format: double
          title: input_price_per_million
          type: number
        isEnabled:
          description: Whether the model is currently enabled in the catalog.
          title: is_enabled
          type: boolean
        mode:
          description: Optional mode/modality (e.g. "chat", "embedding").
          nullable: true
          title: mode
          type: string
        model:
          description: Provider-facing model identifier (e.g. "gpt-4o").
          title: model
          type: string
        outputPricePerMillion:
          description: Output token price per million tokens.
          format: double
          title: output_price_per_million
          type: number
        provider:
          description: Provider that serves this model (e.g. "openai", "anthropic").
          title: provider
          type: string
      title: AIModel
      type: object
    agentrouter.admin.v1.AddProjectMcpServerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to assign the MCP server to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        serverId:
          description: Catalog server ID to assign (e.g. "github").
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$
          title: server_id
          type: string
      title: AddProjectMcpServerRequest
      type: object
    agentrouter.admin.v1.AddProjectMcpServerResponse:
      additionalProperties: false
      properties:
        entry:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectMcpServerEntry'
          description: The created MCP server assignment.
          title: entry
      title: AddProjectMcpServerResponse
      type: object
    agentrouter.admin.v1.AddProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to add the member to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        role:
          description: 'Role to grant: "admin" or "member".'
          enum:
          - admin
          - member
          title: role
          type: string
        userId:
          description: User ID to add as a member.
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
      title: AddProjectMemberRequest
      type: object
    agentrouter.admin.v1.AddProjectMemberResponse:
      additionalProperties: false
      properties:
        member:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectMember'
          description: The created membership.
          title: member
      title: AddProjectMemberResponse
      type: object
    agentrouter.admin.v1.AddProjectModelRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        modelId:
          description: Catalog model UUID to assign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: model_id
          type: string
        projectId:
          description: Project to assign the model to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: AddProjectModelRequest
      type: object
    agentrouter.admin.v1.AddProjectModelResponse:
      additionalProperties: false
      properties:
        entry:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectModelEntry'
          description: The created model assignment.
          title: entry
      title: AddProjectModelResponse
      type: object
    agentrouter.admin.v1.AddProjectProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to enable the provider for.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        providerName:
          description: Provider name to enable (e.g. "openai").
          maxLength: 63
          minLength: 1
          title: provider_name
          type: string
      title: AddProjectProviderRequest
      type: object
    agentrouter.admin.v1.AddProjectProviderResponse:
      additionalProperties: false
      properties:
        entry:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectProviderEntry'
          description: The created provider assignment.
          title: entry
      title: AddProjectProviderResponse
      type: object
    agentrouter.admin.v1.AttachProjectGatewayProjectRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID to attach the project to.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: Project slug to bind to the project gateway.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      title: AttachProjectGatewayProjectRequest
      type: object
    agentrouter.admin.v1.AttachProjectGatewayProjectResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The project gateway the project was attached to.
          title: project_gateway
        warnings:
          description: "Non-fatal advisories about the attachment. Populated, for\
            \ example, when the\n attached project has no assigned models -- the gateway\
            \ will serve an empty\n route map (404s) until models are assigned. Empty\
            \ when the attachment is\n fully functional."
          items:
            type: string
          title: warnings
          type: array
      title: AttachProjectGatewayProjectResponse
      type: object
    agentrouter.admin.v1.AuditCheckpoint:
      additionalProperties: false
      description: "AuditCheckpoint mirrors an audit_log_checkpoints row (fraser#4599):\
        \ a signed,\n chained Merkle root sealing a closed window of audit_logs."
      properties:
        algo:
          title: algo
          type: string
        contentLeafCount:
          format: int64
          title: content_leaf_count
          type:
          - integer
          - string
        contentRootHash:
          description: "Set only when the request asks for a deep rebuild: the Merkle\
            \ root and leaf\n count recomputed from the window's CURRENT content.\
            \ A mismatch with\n root_hash/leaf_count means a row in the window was\
            \ edited, deleted, or\n inserted after sealing."
          format: byte
          title: content_root_hash
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: created_at
        kekVersion:
          format: int32
          title: kek_version
          type: integer
        leafCount:
          format: int64
          title: leaf_count
          type:
          - integer
          - string
        prevRootHash:
          description: empty for the first checkpoint
          format: byte
          title: prev_root_hash
          type: string
        rangeEndId:
          title: range_end_id
          type: string
        rangeEndTs:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: range_end_ts
        rangeStartId:
          title: range_start_id
          type: string
        rangeStartTs:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: range_start_ts
        rootHash:
          format: byte
          title: root_hash
          type: string
        seq:
          format: int64
          title: seq
          type:
          - integer
          - string
        signature:
          description: empty when sealed unsigned (no MP-wide signing key)
          format: byte
          title: signature
          type: string
        signedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: signed_at
        signingKid:
          title: signing_kid
          type: string
      title: AuditCheckpoint
      type: object
    agentrouter.admin.v1.AuditLogEntry:
      additionalProperties: false
      description: AuditLogEntry mirrors a row of the audit_logs table.
      properties:
        actionType:
          title: action_type
          type: string
        actorType:
          title: actor_type
          type: string
        correlationId:
          title: correlation_id
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: created_at
        endpoint:
          title: endpoint
          type: string
        errorMessage:
          title: error_message
          type: string
        httpMethod:
          title: http_method
          type: string
        id:
          title: id
          type: string
        metadata:
          $ref: '#/components/schemas/google.protobuf.Struct'
          title: metadata
        requestBody:
          $ref: '#/components/schemas/google.protobuf.Struct'
          title: request_body
        requestParams:
          $ref: '#/components/schemas/google.protobuf.Struct'
          title: request_params
        resourceId:
          title: resource_id
          type: string
        resourceType:
          title: resource_type
          type: string
        responseData:
          $ref: '#/components/schemas/google.protobuf.Struct'
          title: response_data
        sourceIp:
          title: source_ip
          type: string
        statusCode:
          format: int32
          title: status_code
          type: integer
        success:
          title: success
          type: boolean
        timestamp:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: timestamp
        userAgent:
          title: user_agent
          type: string
        userEmail:
          title: user_email
          type: string
        userId:
          title: user_id
          type: string
      title: AuditLogEntry
      type: object
    agentrouter.admin.v1.AuthServerConfig:
      additionalProperties: false
      properties:
        audience:
          description: Expected JWT audience (aud).
          title: audience
          type: string
        issuer:
          description: Expected JWT issuer (iss).
          title: issuer
          type: string
        jwksUri:
          description: JWKS endpoint for key discovery.
          title: jwks_uri
          type: string
        publicKeys:
          description: Public keys for offline token verification.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.PublicKey'
          title: public_keys
          type: array
      title: AuthServerConfig
      type: object
    agentrouter.admin.v1.CreateCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Caller-chosen customer slug, unique across the deployment.
          maxLength: 63
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        description:
          description: Optional description.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Optional user-defined labels.
          title: labels
          type: object
        name:
          description: Optional display name.
          maxLength: 255
          nullable: true
          title: name
          type: string
      title: CreateCustomerRequest
      type: object
    agentrouter.admin.v1.CreateCustomerRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.CreateCustomerResponse:
      additionalProperties: false
      properties:
        customer:
          $ref: '#/components/schemas/agentrouter.admin.v1.Customer'
          description: The newly created customer.
          title: customer
      title: CreateCustomerResponse
      type: object
    agentrouter.admin.v1.CreateDataplaneRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer (tenant) slug that will own the data plane.
          maxLength: 63
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        dataplaneId:
          description: Caller-chosen data plane slug, unique within the customer.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: dataplane_id
          type: string
        description:
          description: Optional free-text description.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          description: Optional user-defined key/value labels.
          maxProperties: 50
          title: labels
          type: object
        name:
          description: Optional human-readable display name.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectId:
          description: Optional project this data plane belongs to. Empty = default
            project.
          maxLength: 253
          nullable: true
          title: project_id
          type: string
      title: CreateDataplaneRequest
      type: object
    agentrouter.admin.v1.CreateDataplaneRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.CreateDataplaneResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplane
      title: CreateDataplaneResponse
      type: object
    agentrouter.admin.v1.CreateProjectGatewayRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer (tenant) slug that will own the project gateway.
          maxLength: 63
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        description:
          description: Optional free-text description.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          description: Optional user-defined key/value labels for organization/filtering.
          maxProperties: 50
          title: labels
          type: object
        name:
          description: Optional human-readable display name.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectGatewayId:
          description: Caller-chosen project gateway slug, unique within the workspace.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_gateway_id
          type: string
        url:
          description: Optional customer-facing URL/hostname of this project gateway's
            ingress endpoint.
          maxLength: 2048
          nullable: true
          title: url
          type: string
        workspaceId:
          description: Owning dataplane (workspace) slug that hosts this project gateway.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: CreateProjectGatewayRequest
      type: object
    agentrouter.admin.v1.CreateProjectGatewayRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.CreateProjectGatewayResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The newly created project gateway.
          title: project_gateway
      title: CreateProjectGatewayResponse
      type: object
    agentrouter.admin.v1.CreateProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer slug that will own the project.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        description:
          description: Optional description.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Optional user-defined labels.
          title: labels
          type: object
        name:
          description: Optional display name.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectId:
          description: Caller-chosen project slug, unique within the customer.
          maxLength: 253
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-_.]*[a-z0-9])?$
          title: project_id
          type: string
      title: CreateProjectRequest
      type: object
    agentrouter.admin.v1.CreateProjectRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.CreateProjectResponse:
      additionalProperties: false
      properties:
        project:
          $ref: '#/components/schemas/agentrouter.admin.v1.Project'
          description: The newly created project.
          title: project
      title: CreateProjectResponse
      type: object
    agentrouter.admin.v1.CreateServiceAccountRequest:
      additionalProperties: false
      properties:
        apiUri:
          description: Management-plane API base URI embedded in the service account.
          format: uri
          nullable: true
          title: api_uri
          type: string
        audience:
          description: JWT audience (aud) to embed in the auth-server config.
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9._-]+$
          title: audience
          type: string
        customerId:
          description: Customer slug the service account belongs to.
          maxLength: 63
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        internalApiKey:
          description: "Optional: Internal API key for dataplane → management plane\
            \ authentication.\n In production (DB mode): Must be a secret reference\
            \ (e.g., projects/.../secrets/internal-api-key-...).\n Generated offline\
            \ via admin CLI and stored in remote Secret Manager (GCP/AWS).\n In file\
            \ mode: Can be plaintext for local development.\n Typically per-customer\
            \ (one key shared by all service accounts for the customer)."
          nullable: true
          title: internal_api_key
          type: string
        issuer:
          description: JWT issuer (iss) to embed in the auth-server config.
          format: uri
          nullable: true
          title: issuer
          type: string
        jwksUri:
          description: JWKS endpoint URI for verifying tokens issued to this account.
          format: uri
          nullable: true
          title: jwks_uri
          type: string
        routerKey:
          nullable: true
          title: router_key
          type: string
        routerUrl:
          description: "Optional: Router configuration to include in generated service\
            \ account.\n When providing router_key this may be either a plaintext\
            \ key (the server will\n store it in the configured secret manager and\
            \ replace with a secret ref) or\n a secret reference (e.g. noop://...,\
            \ sm://..., arn:aws:...)."
          format: uri
          nullable: true
          title: router_url
          type: string
        scopes:
          description: OAuth-style scopes granted to the service account.
          items:
            maxItems: 10
            maxLength: 50
            pattern: ^[a-z_]+$
            type: string
          maxItems: 10
          title: scopes
          type: array
        serveUrl:
          description: Customer-facing data-plane serve URL embedded in the service
            account.
          format: uri
          nullable: true
          title: serve_url
          type: string
        telemetryEndpoint:
          description: OTLP exporter endpoint for telemetry export.
          nullable: true
          title: telemetry_endpoint
          type: string
        telemetryHeaders:
          additionalProperties:
            title: value
            type: string
          description: Extra headers attached to telemetry exports (e.g. auth tokens).
          title: telemetry_headers
          type: object
        telemetryInsecure:
          description: If true, skip TLS verification for the telemetry endpoint.
          nullable: true
          title: telemetry_insecure
          type: boolean
        telemetryLocalVars:
          additionalProperties:
            title: value
            type: string
          description: "Optional: Local OTEL environment variable overrides to embed\
            \ in the service account.\n Values may be plaintext or secret references\
            \ (e.g., sm://project/secret, noop://name).\n The server resolves any\
            \ secret references via the configured secret manager and\n re-stores\
            \ them as valet:// references before embedding in the generated service\
            \ account.\n The dataplane resolves valet:// references at load time so\
            \ initLocalDestination sees\n plaintext values when constructing the OTEL\
            \ exporter.\n Example: {\"OTEL_EXPORTER_OTLP_HEADERS\": \"Authorization=Bearer\
            \ sm://myproject/otlp-token\"}"
          title: telemetry_local_vars
          type: object
        telemetryProtocol:
          description: 'OTLP wire protocol: grpc, http/protobuf, or http/json.'
          enum:
          - ''
          - grpc
          - http/protobuf
          - http/json
          nullable: true
          title: telemetry_protocol
          type: string
        telemetryTimeout:
          description: OTLP export timeout as a Go duration (e.g. "10s").
          nullable: true
          pattern: ^[0-9]+(ns|us|ms|s|m|h)$
          title: telemetry_timeout
          type: string
        validityDays:
          description: How many days the generated credential stays valid (default
            applied if unset).
          format: int64
          maximum: 3650
          minimum: 1
          nullable: true
          title: validity_days
          type:
          - integer
          - string
        workspaceId:
          description: Workspace slug the service account is scoped to.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: CreateServiceAccountRequest
      type: object
    agentrouter.admin.v1.CreateServiceAccountRequest.TelemetryHeadersEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: TelemetryHeadersEntry
      type: object
    agentrouter.admin.v1.CreateServiceAccountRequest.TelemetryLocalVarsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: TelemetryLocalVarsEntry
      type: object
    agentrouter.admin.v1.CreateServiceAccountResponse:
      additionalProperties: false
      properties:
        checksum:
          description: Integrity checksum over the canonical service-account JSON.
          title: checksum
          type: string
        checksumAlgorithm:
          description: Hash algorithm used for `checksum` (e.g. "sha256").
          title: checksum_algorithm
          type: string
        serviceAccount:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccount'
          description: The generated service account, including the private key (returned
            only here).
          title: service_account
      title: CreateServiceAccountResponse
      type: object
    agentrouter.admin.v1.CreateTelemetryConfigRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: Header name to carry the key when auth_type is api_key.
          maxLength: 256
          nullable: true
          title: api_key_header
          type: string
        authType:
          description: Authentication scheme for the sink.
          enum:
          - none
          - bearer
          - basic
          - api_key
          title: auth_type
          type: string
        authValue:
          description: Plain text auth value to be encrypted
          nullable: true
          title: auth_value
          type: string
        enabled:
          description: Whether forwarding starts enabled (default enabled if unset).
          nullable: true
          title: enabled
          type: boolean
        forwardIntervalSeconds:
          description: Audit-log forward interval in seconds (default 300 if unset).
          format: int32
          maximum: 86400
          minimum: 0
          nullable: true
          title: forward_interval_seconds
          type: integer
        protocol:
          description: OTLP wire protocol for the sink.
          enum:
          - grpc
          - http/json
          - http/protobuf
          title: protocol
          type: string
        sinkUrl:
          description: Destination OTLP sink URL.
          format: uri
          minLength: 1
          title: sink_url
          type: string
        telemetryType:
          description: 'Signal type to forward: traces, metrics, logs, or audit_logs.'
          enum:
          - traces
          - metrics
          - logs
          - audit_logs
          title: telemetry_type
          type: string
        userId:
          description: Owner of the forwarding config.
          minLength: 1
          title: user_id
          type: string
      title: CreateTelemetryConfigRequest
      type: object
    agentrouter.admin.v1.CreateTelemetryConfigResponse:
      additionalProperties: false
      properties:
        config:
          $ref: '#/components/schemas/agentrouter.admin.v1.TelemetryForwardingConfig'
          description: The created forwarding config (auth_value decrypted).
          title: config
      title: CreateTelemetryConfigResponse
      type: object
    agentrouter.admin.v1.CreateUserTokenRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer ID (e.g., "acme", "default")
          maxLength: 100
          minLength: 1
          pattern: ^[a-z0-9_-]+$
          title: customer_id
          type: string
        expiresInDays:
          description: Token lifetime in days (default applied if unset).
          format: int64
          maximum: 365
          minimum: 1
          nullable: true
          title: expires_in_days
          type:
          - integer
          - string
        impersonate:
          description: "If true, the token will not be persisted to the database.\n\
            \ This is used for impersonation scenarios where the token is temporary."
          nullable: true
          title: impersonate
          type: boolean
        impersonationMetadata:
          $ref: '#/components/schemas/agentrouter.admin.v1.ImpersonationMetadata'
          description: "Optional metadata for impersonation tracking.\n When impersonate=true,\
            \ this should contain the original user/admin who is impersonating."
          nullable: true
          title: impersonation_metadata
        name:
          description: Optional human-readable name for the token
          maxLength: 255
          nullable: true
          title: name
          type: string
        organizationUnit:
          description: Organization unit from authentication (e.g., "engineering",
            "sales")
          maxLength: 255
          minLength: 1
          title: organization_unit
          type: string
        projectId:
          description: "Project the key is scoped to within customer_id. Unset means\
            \ the \"default\"\n project; for a non-default project the subject user\
            \ must be a member\n (#4479). When set it is also embedded as the inference\
            \ token's \"project\"\n claim so the dataplane stamps the internal x-project-id\
            \ egress header\n without a key->project lookup (#4637)."
          maxLength: 253
          nullable: true
          pattern: ^[a-z0-9]([a-z0-9-_.]*[a-z0-9])?$
          title: project_id
          type: string
        role:
          description: User role from authentication (e.g., "developer", "admin")
          maxLength: 100
          minLength: 1
          title: role
          type: string
        scopes:
          description: OAuth-style scopes embedded in the issued token.
          items:
            maxItems: 10
            maxLength: 50
            pattern: ^[a-z_]+$
            type: string
          maxItems: 10
          title: scopes
          type: array
        userId:
          description: User ID from authentication provider (opaque identifier)
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
        workspaceId:
          description: Workspace ID (e.g., "production", "staging", "internal")
          maxLength: 100
          minLength: 1
          pattern: ^[a-z0-9_-]+$
          title: workspace_id
          type: string
      title: CreateUserTokenRequest
      type: object
    agentrouter.admin.v1.CreateUserTokenResponse:
      additionalProperties: false
      properties:
        accessToken:
          description: The signed JWT to use as a bearer credential.
          title: access_token
          type: string
        expiresAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Absolute expiry timestamp.
          title: expires_at
        expiresIn:
          description: Seconds until the token expires.
          format: int64
          title: expires_in
          type:
          - integer
          - string
        jti:
          description: JWT ID (jti); used to look up and revoke the token.
          title: jti
          type: string
        keyAddress:
          description: xxhash64(userId) as hex string
          title: key_address
          type: string
        keyHash:
          description: JTI (used for revocation lookups)
          title: key_hash
          type: string
        keyPrefix:
          description: Database storage identifiers (for internal use) First 12 chars
            of xxhash64(jti)
          title: key_prefix
          type: string
        tokenType:
          description: Token type, typically "Bearer".
          title: token_type
          type: string
      title: CreateUserTokenResponse
      type: object
    agentrouter.admin.v1.CreateWorkspaceRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer (tenant) slug that will own the workspace.
          maxLength: 63
          minLength: 1
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        description:
          description: Optional free-text description.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          description: Optional user-defined key/value labels for organization/filtering.
          maxProperties: 50
          title: labels
          type: object
        name:
          description: Optional human-readable display name.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectId:
          description: Optional project this workspace belongs to. Empty = default
            project.
          maxLength: 253
          nullable: true
          title: project_id
          type: string
        workspaceId:
          description: Caller-chosen workspace slug, unique within the customer.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: CreateWorkspaceRequest
      type: object
    agentrouter.admin.v1.CreateWorkspaceRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.CreateWorkspaceResponse:
      additionalProperties: false
      properties:
        workspace:
          $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          description: The newly created workspace.
          title: workspace
      title: CreateWorkspaceResponse
      type: object
    agentrouter.admin.v1.Customer:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Customer slug, unique across the deployment.
          title: customer_id
          type: string
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Soft-delete timestamp; unset while active.
          nullable: true
          title: deleted_at
        description:
          description: Free-text description.
          nullable: true
          title: description
          type: string
        id:
          description: Server-generated customer UUID (primary key).
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: User-defined key/value labels.
          title: labels
          type: object
        name:
          description: Human-readable display name.
          nullable: true
          title: name
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last-modification timestamp.
          title: updated_at
      title: Customer
      type: object
    agentrouter.admin.v1.Customer.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.DataExportsConfig:
      additionalProperties: false
      properties:
        telemetry:
          $ref: '#/components/schemas/agentrouter.admin.v1.TelemetryConfig'
          description: Telemetry/OTLP export settings.
          title: telemetry
      title: DataExportsConfig
      type: object
    agentrouter.admin.v1.Dataplane:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        dataplaneId:
          description: Customer-chosen data plane slug (the workspaces.workspace_id
            column).
          title: dataplane_id
          type: string
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          nullable: true
          title: deleted_at
        description:
          nullable: true
          title: description
          type: string
        id:
          description: Server-generated data plane UUID (primary key; the workspaces.id
            column).
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          title: labels
          type: object
        name:
          nullable: true
          title: name
          type: string
        projectId:
          description: Project this data plane belongs to; empty means the default
            project.
          title: project_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: updated_at
      title: Dataplane
      type: object
    agentrouter.admin.v1.Dataplane.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.DeleteCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer slug to soft-delete.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      title: DeleteCustomerRequest
      type: object
    agentrouter.admin.v1.DeleteCustomerResponse:
      additionalProperties: false
      properties:
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the soft delete took effect.
          title: deleted_at
        success:
          description: True if the customer was deleted.
          title: success
          type: boolean
      title: DeleteCustomerResponse
      type: object
    agentrouter.admin.v1.DeleteDataplaneRequest:
      additionalProperties: false
      properties:
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: DeleteDataplaneRequest
      type: object
    agentrouter.admin.v1.DeleteDataplaneResponse:
      additionalProperties: false
      properties:
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: deleted_at
        success:
          title: success
          type: boolean
      title: DeleteDataplaneResponse
      type: object
    agentrouter.admin.v1.DeleteProjectGatewayRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID to soft-delete.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      title: DeleteProjectGatewayRequest
      type: object
    agentrouter.admin.v1.DeleteProjectGatewayResponse:
      additionalProperties: false
      properties:
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the soft delete took effect.
          title: deleted_at
        success:
          description: True if the project gateway was deleted.
          title: success
          type: boolean
      title: DeleteProjectGatewayResponse
      type: object
    agentrouter.admin.v1.DeleteProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project slug to soft-delete.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: DeleteProjectRequest
      type: object
    agentrouter.admin.v1.DeleteProjectResponse:
      additionalProperties: false
      properties:
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the soft delete took effect.
          title: deleted_at
        success:
          description: True if the project was deleted.
          title: success
          type: boolean
      title: DeleteProjectResponse
      type: object
    agentrouter.admin.v1.DeleteProjectSettingRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to delete the setting from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        settingName:
          description: Setting key to delete ("global-fallback" or "rate-limit").
          enum:
          - global-fallback
          - rate-limit
          title: setting_name
          type: string
      title: DeleteProjectSettingRequest
      type: object
    agentrouter.admin.v1.DeleteProjectSettingResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the setting was deleted.
          title: success
          type: boolean
      title: DeleteProjectSettingResponse
      type: object
    agentrouter.admin.v1.DeleteTelemetryConfigRequest:
      additionalProperties: false
      properties:
        id:
          description: Forwarding config ID to delete.
          maxLength: 64
          minLength: 1
          title: id
          type: string
      title: DeleteTelemetryConfigRequest
      type: object
    agentrouter.admin.v1.DeleteTelemetryConfigResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the config was deleted.
          title: success
          type: boolean
      title: DeleteTelemetryConfigResponse
      type: object
    agentrouter.admin.v1.DeleteWorkspaceRequest:
      additionalProperties: false
      properties:
        id:
          description: Workspace UUID to soft-delete.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: DeleteWorkspaceRequest
      type: object
    agentrouter.admin.v1.DeleteWorkspaceResponse:
      additionalProperties: false
      properties:
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the soft delete took effect.
          title: deleted_at
        success:
          description: True if the workspace was deleted.
          title: success
          type: boolean
      title: DeleteWorkspaceResponse
      type: object
    agentrouter.admin.v1.DetachProjectGatewayProjectRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID to detach the project from.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: Project slug to unbind from the project gateway.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      title: DetachProjectGatewayProjectRequest
      type: object
    agentrouter.admin.v1.DetachProjectGatewayProjectResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the binding was removed.
          title: success
          type: boolean
      title: DetachProjectGatewayProjectResponse
      type: object
    agentrouter.admin.v1.GatekeeperConfig:
      additionalProperties: false
      properties:
        audience:
          description: Expected JWT audience (aud).
          title: audience
          type: string
        issuer:
          description: Expected JWT issuer (iss) for gatekeeper-issued tokens.
          title: issuer
          type: string
        publicKeys:
          description: Public keys for verifying gatekeeper tokens.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.PublicKey'
          title: public_keys
          type: array
        router:
          $ref: '#/components/schemas/agentrouter.admin.v1.RouterConfig'
          description: Optional router configuration for Agent Router routing
          title: router
      title: GatekeeperConfig
      type: object
    agentrouter.admin.v1.GetAuditInclusionProofRequest:
      additionalProperties: false
      properties:
        auditLogId:
          minLength: 1
          title: audit_log_id
          type: string
      title: GetAuditInclusionProofRequest
      type: object
    agentrouter.admin.v1.GetAuditInclusionProofResponse:
      additionalProperties: false
      properties:
        checkpoint:
          $ref: '#/components/schemas/agentrouter.admin.v1.AuditCheckpoint'
          title: checkpoint
        found:
          description: found is false when the row is not committed to any checkpoint.
          title: found
          type: boolean
        leafHash:
          description: leaf_hash is the row's RFC 6962 leaf hash, recomputed from
            current content.
          format: byte
          title: leaf_hash
          type: string
        leafIndex:
          format: int64
          title: leaf_index
          type:
          - integer
          - string
        proof:
          description: proof is the Merkle audit path, in leaf-to-root order.
          items:
            format: byte
            type: string
          title: proof
          type: array
        reason:
          description: "reason explains a false found: \"unsealed\" (written after\
            \ the last checkpoint\n or before the first) or \"row_missing\" (no such\
            \ row — a possible deletion)."
          title: reason
          type: string
        treeSize:
          description: "tree_size is the number of rows currently in the sealed window;\
            \ a mismatch\n with checkpoint.leaf_count means rows were inserted or\
            \ deleted after sealing."
          format: int64
          title: tree_size
          type:
          - integer
          - string
      title: GetAuditInclusionProofResponse
      type: object
    agentrouter.admin.v1.GetAuditLogRequest:
      additionalProperties: false
      properties:
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: GetAuditLogRequest
      type: object
    agentrouter.admin.v1.GetCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer slug to fetch.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      title: GetCustomerRequest
      type: object
    agentrouter.admin.v1.GetCustomerResponse:
      additionalProperties: false
      properties:
        customer:
          $ref: '#/components/schemas/agentrouter.admin.v1.Customer'
          description: The requested customer.
          title: customer
      title: GetCustomerResponse
      type: object
    agentrouter.admin.v1.GetDataplaneRequest:
      additionalProperties: false
      properties:
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: GetDataplaneRequest
      type: object
    agentrouter.admin.v1.GetDataplaneResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplane
      title: GetDataplaneResponse
      type: object
    agentrouter.admin.v1.GetModelRequest:
      additionalProperties: false
      properties:
        modelId:
          description: Catalog entry UUID to fetch.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: model_id
          type: string
      title: GetModelRequest
      type: object
    agentrouter.admin.v1.GetModelResponse:
      additionalProperties: false
      properties:
        model:
          $ref: '#/components/schemas/agentrouter.admin.v1.AIModel'
          description: The requested model.
          title: model
      title: GetModelResponse
      type: object
    agentrouter.admin.v1.GetProjectGatewayRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID (the internal `id`, not the customer-chosen
            project_gateway_id).
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      title: GetProjectGatewayRequest
      type: object
    agentrouter.admin.v1.GetProjectGatewayResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The requested project gateway.
          title: project_gateway
      title: GetProjectGatewayResponse
      type: object
    agentrouter.admin.v1.GetProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project slug to fetch.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: GetProjectRequest
      type: object
    agentrouter.admin.v1.GetProjectResponse:
      additionalProperties: false
      properties:
        project:
          $ref: '#/components/schemas/agentrouter.admin.v1.Project'
          description: The requested project.
          title: project
      title: GetProjectResponse
      type: object
    agentrouter.admin.v1.GetProjectSettingsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project whose settings to fetch.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: GetProjectSettingsRequest
      type: object
    agentrouter.admin.v1.GetProjectSettingsResponse:
      additionalProperties: false
      properties:
        settings:
          description: All settings for the project.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectSetting'
          title: settings
          type: array
      title: GetProjectSettingsResponse
      type: object
    agentrouter.admin.v1.GetServiceAccountRequest:
      additionalProperties: false
      properties:
        id:
          description: Service account UUID to fetch.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: GetServiceAccountRequest
      type: object
    agentrouter.admin.v1.GetServiceAccountResponse:
      additionalProperties: false
      properties:
        serviceAccount:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountInfo'
          description: The requested service account summary.
          title: service_account
      title: GetServiceAccountResponse
      type: object
    agentrouter.admin.v1.GetTelemetryConfigRequest:
      additionalProperties: false
      properties:
        id:
          description: Forwarding config ID to fetch.
          maxLength: 64
          minLength: 1
          title: id
          type: string
      title: GetTelemetryConfigRequest
      type: object
    agentrouter.admin.v1.GetTelemetryConfigResponse:
      additionalProperties: false
      properties:
        config:
          $ref: '#/components/schemas/agentrouter.admin.v1.TelemetryForwardingConfig'
          description: The requested forwarding config.
          title: config
      title: GetTelemetryConfigResponse
      type: object
    agentrouter.admin.v1.GetUserTokenRequest:
      additionalProperties: false
      properties:
        jti:
          description: JWT ID (jti) of the token to fetch.
          maxLength: 64
          minLength: 1
          title: jti
          type: string
      title: GetUserTokenRequest
      type: object
    agentrouter.admin.v1.GetUserTokenResponse:
      additionalProperties: false
      properties:
        token:
          $ref: '#/components/schemas/agentrouter.admin.v1.UserTokenInfo'
          description: The requested token summary.
          title: token
      title: GetUserTokenResponse
      type: object
    agentrouter.admin.v1.GetWorkspaceRequest:
      additionalProperties: false
      properties:
        id:
          description: Workspace UUID (the internal `id`, not the customer-chosen
            workspace_id).
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: GetWorkspaceRequest
      type: object
    agentrouter.admin.v1.GetWorkspaceResponse:
      additionalProperties: false
      properties:
        workspace:
          $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          description: The requested workspace.
          title: workspace
      title: GetWorkspaceResponse
      type: object
    agentrouter.admin.v1.ImpersonationMetadata:
      additionalProperties: false
      properties:
        context:
          additionalProperties:
            title: value
            type: string
          description: Optional additional context.
          title: context
          type: object
        impersonatorKey:
          description: The key identifier (ID or key hash) of the user/admin performing
            the impersonation.
          maxLength: 255
          minLength: 1
          title: impersonator_key
          type: string
        reason:
          description: Optional reason for impersonation.
          maxLength: 500
          nullable: true
          title: reason
          type: string
      title: ImpersonationMetadata
      type: object
    agentrouter.admin.v1.ImpersonationMetadata.ContextEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: ContextEntry
      type: object
    agentrouter.admin.v1.ListAuditCheckpointsRequest:
      additionalProperties: false
      properties:
        afterSeq:
          description: Return checkpoints with seq strictly greater than this (0 =
            from the start).
          format: int64
          title: after_seq
          type:
          - integer
          - string
        limit:
          description: Max checkpoints to return; the server applies a default and
            a hard cap.
          format: int32
          title: limit
          type: integer
        rebuild:
          description: "When true, the server rebuilds each window from current content\
            \ and fills\n content_root_hash/content_leaf_count, so the caller can\
            \ detect content\n tampering (edits/deletes/back-dated inserts), not just\
            \ header/signature\n tampering. More expensive — it reads every sealed\
            \ row."
          title: rebuild
          type: boolean
      title: ListAuditCheckpointsRequest
      type: object
    agentrouter.admin.v1.ListAuditCheckpointsResponse:
      additionalProperties: false
      properties:
        checkpoints:
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.AuditCheckpoint'
          title: checkpoints
          type: array
      title: ListAuditCheckpointsResponse
      type: object
    agentrouter.admin.v1.ListCustomersRequest:
      additionalProperties: false
      properties:
        pageSize:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque pagination cursor from a prior response.
          nullable: true
          title: page_token
          type: string
      title: ListCustomersRequest
      type: object
    agentrouter.admin.v1.ListCustomersResponse:
      additionalProperties: false
      properties:
        customers:
          description: Page of customers.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.Customer'
          title: customers
          type: array
        nextPageToken:
          description: Cursor for the next page; empty when exhausted.
          title: next_page_token
          type: string
      title: ListCustomersResponse
      type: object
    agentrouter.admin.v1.ListDataplanesRequest:
      additionalProperties: false
      properties:
        customerId:
          maxLength: 63
          nullable: true
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        pageSize:
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          nullable: true
          title: page_token
          type: string
      title: ListDataplanesRequest
      type: object
    agentrouter.admin.v1.ListDataplanesResponse:
      additionalProperties: false
      properties:
        dataplanes:
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplanes
          type: array
        nextPageToken:
          title: next_page_token
          type: string
      title: ListDataplanesResponse
      type: object
    agentrouter.admin.v1.ListModelsRequest:
      additionalProperties: false
      properties:
        onlyEnabled:
          description: If true, return only enabled models.
          title: only_enabled
          type: boolean
      title: ListModelsRequest
      type: object
    agentrouter.admin.v1.ListModelsResponse:
      additionalProperties: false
      properties:
        models:
          description: Catalog models matching the request.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.AIModel'
          title: models
          type: array
      title: ListModelsResponse
      type: object
    agentrouter.admin.v1.ListProjectGatewayProjectsRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID whose attached projects are listed.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      title: ListProjectGatewayProjectsRequest
      type: object
    agentrouter.admin.v1.ListProjectGatewayProjectsResponse:
      additionalProperties: false
      properties:
        projectIds:
          description: Project slugs currently attached to the project gateway.
          items:
            type: string
          title: project_ids
          type: array
      title: ListProjectGatewayProjectsResponse
      type: object
    agentrouter.admin.v1.ListProjectGatewaysRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Optional filter: only return project gateways owned by this
            customer slug.'
          maxLength: 63
          nullable: true
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        pageSize:
          description: Max project gateways to return per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque cursor from a previous response's next_page_token.
          nullable: true
          title: page_token
          type: string
        workspaceId:
          description: 'Optional filter: only return project gateways hosted by this
            workspace (dataplane).'
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: ListProjectGatewaysRequest
      type: object
    agentrouter.admin.v1.ListProjectGatewaysResponse:
      additionalProperties: false
      properties:
        nextPageToken:
          description: Cursor for the next page; empty when there are no more results.
          title: next_page_token
          type: string
        projectGateways:
          description: Page of matching project gateways.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          title: project_gateways
          type: array
      title: ListProjectGatewaysResponse
      type: object
    agentrouter.admin.v1.ListProjectMcpServersRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project whose assigned MCP servers to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: ListProjectMcpServersRequest
      type: object
    agentrouter.admin.v1.ListProjectMcpServersResponse:
      additionalProperties: false
      properties:
        entries:
          description: MCP servers assigned to the project.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectMcpServerEntry'
          title: entries
          type: array
      title: ListProjectMcpServersResponse
      type: object
    agentrouter.admin.v1.ListProjectMembersRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project whose members to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: ListProjectMembersRequest
      type: object
    agentrouter.admin.v1.ListProjectMembersResponse:
      additionalProperties: false
      properties:
        members:
          description: All members of the project.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectMember'
          title: members
          type: array
      title: ListProjectMembersResponse
      type: object
    agentrouter.admin.v1.ListProjectModelsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project whose assigned models to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: ListProjectModelsRequest
      type: object
    agentrouter.admin.v1.ListProjectModelsResponse:
      additionalProperties: false
      properties:
        entries:
          description: Models assigned to the project.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectModelEntry'
          title: entries
          type: array
      title: ListProjectModelsResponse
      type: object
    agentrouter.admin.v1.ListProjectProvidersRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project whose enabled providers to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: ListProjectProvidersRequest
      type: object
    agentrouter.admin.v1.ListProjectProvidersResponse:
      additionalProperties: false
      properties:
        entries:
          description: Providers enabled for the project.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ProjectProviderEntry'
          title: entries
          type: array
      title: ListProjectProvidersResponse
      type: object
    agentrouter.admin.v1.ListProjectsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer slug whose projects to list.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        pageSize:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque pagination cursor from a prior response.
          nullable: true
          title: page_token
          type: string
      title: ListProjectsRequest
      type: object
    agentrouter.admin.v1.ListProjectsResponse:
      additionalProperties: false
      properties:
        nextPageToken:
          description: Cursor for the next page; empty when exhausted.
          title: next_page_token
          type: string
        projects:
          description: Page of projects.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.Project'
          title: projects
          type: array
      title: ListProjectsResponse
      type: object
    agentrouter.admin.v1.ListServiceAccountsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Optional filter by owning customer slug.
          maxLength: 63
          nullable: true
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        pageSize:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque pagination cursor from a prior response.
          nullable: true
          title: page_token
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountStatus'
          description: Optional filter by account status.
          nullable: true
          title: status
        workspaceId:
          description: Optional filter by workspace slug.
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: ListServiceAccountsRequest
      type: object
    agentrouter.admin.v1.ListServiceAccountsResponse:
      additionalProperties: false
      properties:
        nextPageToken:
          description: Cursor for the next page; empty when exhausted.
          title: next_page_token
          type: string
        serviceAccounts:
          description: Page of service account summaries (no private keys).
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountInfo'
          title: service_accounts
          type: array
      title: ListServiceAccountsResponse
      type: object
    agentrouter.admin.v1.ListTelemetryConfigsRequest:
      additionalProperties: false
      properties:
        enabled:
          description: Filter by enabled status
          nullable: true
          title: enabled
          type: boolean
        telemetryType:
          description: Optional filter by signal type.
          enum:
          - traces
          - metrics
          - logs
          - audit_logs
          nullable: true
          title: telemetry_type
          type: string
        userId:
          description: Filter by user_id
          nullable: true
          title: user_id
          type: string
      title: ListTelemetryConfigsRequest
      type: object
    agentrouter.admin.v1.ListTelemetryConfigsResponse:
      additionalProperties: false
      properties:
        configs:
          description: Matching forwarding configs.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.TelemetryForwardingConfig'
          title: configs
          type: array
        total:
          description: Total number of matching configs.
          format: int32
          title: total
          type: integer
      title: ListTelemetryConfigsResponse
      type: object
    agentrouter.admin.v1.ListUserTokensRequest:
      additionalProperties: false
      properties:
        pageSize:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque pagination cursor from a prior response.
          nullable: true
          title: page_token
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.admin.v1.UserTokenStatus'
          description: Optional filter by token status.
          nullable: true
          title: status
        userId:
          description: Optional filter by issuing user ID.
          maxLength: 255
          nullable: true
          title: user_id
          type: string
      title: ListUserTokensRequest
      type: object
    agentrouter.admin.v1.ListUserTokensResponse:
      additionalProperties: false
      properties:
        nextPageToken:
          description: Cursor for the next page; empty when exhausted.
          title: next_page_token
          type: string
        tokens:
          description: Page of user token summaries.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.UserTokenInfo'
          title: tokens
          type: array
      title: ListUserTokensResponse
      type: object
    agentrouter.admin.v1.ListWorkspacesRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Optional filter: only return workspaces owned by this customer
            slug.'
          maxLength: 63
          nullable: true
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
        pageSize:
          description: Max workspaces to return per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          nullable: true
          title: page_size
          type: integer
        pageToken:
          description: Opaque cursor from a previous response's next_page_token.
          nullable: true
          title: page_token
          type: string
      title: ListWorkspacesRequest
      type: object
    agentrouter.admin.v1.ListWorkspacesResponse:
      additionalProperties: false
      properties:
        nextPageToken:
          description: Cursor for the next page; empty when there are no more results.
          title: next_page_token
          type: string
        workspaces:
          description: Page of matching workspaces.
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          title: workspaces
          type: array
      title: ListWorkspacesResponse
      type: object
    agentrouter.admin.v1.PingRequest:
      additionalProperties: false
      title: PingRequest
      type: object
    agentrouter.admin.v1.PingResponse:
      additionalProperties: false
      properties:
        message:
          description: Human-readable status message (e.g. "pong").
          title: message
          type: string
        timestamp:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Server time when the ping was handled.
          title: timestamp
      title: PingResponse
      type: object
    agentrouter.admin.v1.Project:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Soft-delete timestamp; unset while active.
          nullable: true
          title: deleted_at
        description:
          description: Free-text description.
          nullable: true
          title: description
          type: string
        id:
          description: Server-generated project UUID (primary key).
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: User-defined key/value labels.
          title: labels
          type: object
        name:
          description: Human-readable display name.
          nullable: true
          title: name
          type: string
        projectId:
          description: Project slug, unique within the customer.
          title: project_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last-modification timestamp.
          title: updated_at
      title: Project
      type: object
    agentrouter.admin.v1.Project.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.ProjectGateway:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Soft-delete timestamp; unset while the project gateway is active.
          nullable: true
          title: deleted_at
        description:
          description: Free-text description.
          nullable: true
          title: description
          type: string
        id:
          description: Server-generated project gateway UUID (primary key).
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: User-defined key/value labels.
          title: labels
          type: object
        name:
          description: Human-readable display name.
          nullable: true
          title: name
          type: string
        projectGatewayId:
          description: Customer-chosen project gateway slug, unique within the workspace.
          title: project_gateway_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last-modification timestamp.
          title: updated_at
        url:
          description: Customer-facing URL/hostname of this project gateway's ingress
            endpoint.
          nullable: true
          title: url
          type: string
        workspaceId:
          description: Owning dataplane (workspace) slug that hosts this project gateway.
          title: workspace_id
          type: string
      title: ProjectGateway
      type: object
    agentrouter.admin.v1.ProjectGateway.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.ProjectMcpServerEntry:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the server was assigned.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        id:
          description: Assignment row UUID.
          title: id
          type: string
        projectId:
          description: Project the MCP server is assigned to.
          title: project_id
          type: string
        serverId:
          description: Catalog server ID assigned to the project (e.g. "github").
          title: server_id
          type: string
      title: ProjectMcpServerEntry
      type: object
    agentrouter.admin.v1.ProjectMember:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the member was added.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        id:
          description: Membership row UUID.
          title: id
          type: string
        projectId:
          description: Project the membership belongs to.
          title: project_id
          type: string
        role:
          description: The member's role in the project ("admin" or "member").
          title: role
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the membership was last modified.
          title: updated_at
        userId:
          description: The member's user ID.
          title: user_id
          type: string
      title: ProjectMember
      type: object
    agentrouter.admin.v1.ProjectModelEntry:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the model was assigned.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        id:
          description: Assignment row UUID.
          title: id
          type: string
        model:
          $ref: '#/components/schemas/agentrouter.admin.v1.AIModel'
          description: Full catalog details of the assigned model.
          title: model
        modelId:
          description: Catalog model UUID assigned to the project.
          title: model_id
          type: string
        projectId:
          description: Project the model is assigned to.
          title: project_id
          type: string
      title: ProjectModelEntry
      type: object
    agentrouter.admin.v1.ProjectProviderEntry:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the provider was assigned.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        id:
          description: Assignment row UUID.
          title: id
          type: string
        projectId:
          description: Project the provider is enabled for.
          title: project_id
          type: string
        providerName:
          description: Provider name enabled for the project (e.g. "openai").
          title: provider_name
          type: string
      title: ProjectProviderEntry
      type: object
    agentrouter.admin.v1.ProjectSetting:
      additionalProperties: false
      properties:
        settingName:
          description: Setting key (e.g. "global-fallback", "rate-limit").
          title: setting_name
          type: string
        settingValue:
          description: Setting value (string-encoded).
          title: setting_value
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the setting was last updated.
          title: updated_at
      title: ProjectSetting
      type: object
    agentrouter.admin.v1.PublicKey:
      additionalProperties: false
      properties:
        alg:
          description: Signing algorithm (e.g. "RS256").
          title: alg
          type: string
        key:
          description: PEM-encoded public key material.
          title: key
          type: string
        kid:
          description: Key ID (kid) matching the JWT header.
          title: kid
          type: string
        use:
          description: Intended key use (e.g. "sig").
          title: use
          type: string
      title: PublicKey
      type: object
    agentrouter.admin.v1.QueryAuditLogsRequest:
      additionalProperties: false
      properties:
        actionType:
          description: Filter by action type (e.g. "CREATE", "UPDATE", "DELETE", "UPGRADE").
          title: action_type
          type: string
        actorType:
          description: Filter by actor type (e.g. "user", "system", "service_account").
          title: actor_type
          type: string
        correlationId:
          description: Filter by correlation id (groups related entries from one operation).
          title: correlation_id
          type: string
        endTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: End of the time range, exclusive.
          title: end_time
        orderDirection:
          description: 'Sort by timestamp: "asc" or "desc" (default "desc", newest
            first).'
          title: order_direction
          type: string
        pageSize:
          description: Max entries per page; the server applies a default (50) and
            a hard cap (1000).
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: Opaque token from a prior response's next_page_token.
          title: page_token
          type: string
        resourceId:
          description: Filter by the affected resource id.
          title: resource_id
          type: string
        resourceType:
          description: Filter by resource type (e.g. "provider", "api_key", "dataplane").
          title: resource_type
          type: string
        startTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of the time range, inclusive.
          title: start_time
        success:
          description: Filter by outcome; unset matches both successes and failures.
          nullable: true
          title: success
          type: boolean
        userId:
          description: Filter by the user id that performed the action.
          title: user_id
          type: string
      title: QueryAuditLogsRequest
      type: object
    agentrouter.admin.v1.QueryAuditLogsResponse:
      additionalProperties: false
      properties:
        logs:
          items:
            $ref: '#/components/schemas/agentrouter.admin.v1.AuditLogEntry'
          title: logs
          type: array
        nextPageToken:
          description: Token to pass back as page_token for the next page; empty when
            exhausted.
          title: next_page_token
          type: string
        totalCount:
          description: Total number of matching entries across all pages.
          format: int64
          title: total_count
          type:
          - integer
          - string
      title: QueryAuditLogsResponse
      type: object
    agentrouter.admin.v1.RemoveProjectMcpServerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to remove the MCP server from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        serverId:
          description: Catalog server ID to remove.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$
          title: server_id
          type: string
      title: RemoveProjectMcpServerRequest
      type: object
    agentrouter.admin.v1.RemoveProjectMcpServerResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the MCP server assignment was removed.
          title: success
          type: boolean
      title: RemoveProjectMcpServerResponse
      type: object
    agentrouter.admin.v1.RemoveProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to remove the member from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        userId:
          description: User ID of the member to remove.
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
      title: RemoveProjectMemberRequest
      type: object
    agentrouter.admin.v1.RemoveProjectMemberResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the member was removed.
          title: success
          type: boolean
      title: RemoveProjectMemberResponse
      type: object
    agentrouter.admin.v1.RemoveProjectModelRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        modelId:
          description: Catalog model UUID to unassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: model_id
          type: string
        projectId:
          description: Project to remove the model from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: RemoveProjectModelRequest
      type: object
    agentrouter.admin.v1.RemoveProjectModelResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the assignment was removed.
          title: success
          type: boolean
      title: RemoveProjectModelResponse
      type: object
    agentrouter.admin.v1.RemoveProjectProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to disable the provider for.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        providerName:
          description: Provider name to disable.
          maxLength: 63
          minLength: 1
          title: provider_name
          type: string
      title: RemoveProjectProviderRequest
      type: object
    agentrouter.admin.v1.RemoveProjectProviderResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the provider was removed.
          title: success
          type: boolean
      title: RemoveProjectProviderResponse
      type: object
    agentrouter.admin.v1.RestoreServiceAccountRequest:
      additionalProperties: false
      properties:
        id:
          description: Service account UUID to restore to active.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        reason:
          description: Optional human-readable restore reason (audit trail).
          maxLength: 500
          nullable: true
          title: reason
          type: string
      title: RestoreServiceAccountRequest
      type: object
    agentrouter.admin.v1.RestoreServiceAccountResponse:
      additionalProperties: false
      properties:
        serviceAccount:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountInfo'
          description: The restored account summary.
          title: service_account
        success:
          description: True if the account was restored.
          title: success
          type: boolean
      title: RestoreServiceAccountResponse
      type: object
    agentrouter.admin.v1.RevokeServiceAccountRequest:
      additionalProperties: false
      properties:
        id:
          description: Service account UUID to revoke.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        reason:
          description: Optional human-readable revocation reason (audit trail).
          maxLength: 500
          nullable: true
          title: reason
          type: string
      title: RevokeServiceAccountRequest
      type: object
    agentrouter.admin.v1.RevokeServiceAccountResponse:
      additionalProperties: false
      properties:
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the revocation took effect.
          title: revoked_at
        success:
          description: True if the account was revoked.
          title: success
          type: boolean
      title: RevokeServiceAccountResponse
      type: object
    agentrouter.admin.v1.RevokeUserTokenRequest:
      additionalProperties: false
      properties:
        jti:
          description: JWT ID (jti) of the token to revoke.
          maxLength: 64
          minLength: 1
          title: jti
          type: string
        reason:
          description: Optional human-readable revocation reason (audit trail).
          maxLength: 500
          nullable: true
          title: reason
          type: string
      title: RevokeUserTokenRequest
      type: object
    agentrouter.admin.v1.RevokeUserTokenResponse:
      additionalProperties: false
      properties:
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the revocation took effect.
          title: revoked_at
        success:
          description: True if the token was revoked.
          title: success
          type: boolean
      title: RevokeUserTokenResponse
      type: object
    agentrouter.admin.v1.RouterConfig:
      additionalProperties: false
      properties:
        key:
          description: Secret reference (or the raw value in server responses) for router key.
          title: key
          type: string
        url:
          description: Agent Router base URL.
          format: uri
          title: url
          type: string
      title: RouterConfig
      type: object
    agentrouter.admin.v1.ServiceAccount:
      additionalProperties: false
      properties:
        apiUri:
          description: Management-plane API base URI.
          title: api_uri
          type: string
        authServer:
          $ref: '#/components/schemas/agentrouter.admin.v1.AuthServerConfig'
          description: Issuer/audience/JWKS settings for the auth server.
          title: auth_server
        clientEmail:
          description: Email-style subject identifier used as the JWT `sub`.
          title: client_email
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        dataExports:
          $ref: '#/components/schemas/agentrouter.admin.v1.DataExportsConfig'
          description: Telemetry export configuration.
          title: data_exports
        expiresAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Expiry timestamp derived from validity_days.
          title: expires_at
        gatekeeper:
          $ref: '#/components/schemas/agentrouter.admin.v1.GatekeeperConfig'
          description: Issuer/audience/keys plus optional router config for gatekeeper.
          title: gatekeeper
        id:
          description: Service account UUID.
          title: id
          type: string
        privateKey:
          description: PEM-encoded RSA private key (returned only at creation time).
          title: private_key
          type: string
        privateKeyId:
          description: Key ID (kid) of the signing key pair.
          title: private_key_id
          type: string
        scopes:
          description: Scopes granted to the account.
          items:
            type: string
          title: scopes
          type: array
        serveUrl:
          description: Customer-facing data-plane serve URL.
          title: serve_url
          type: string
        type:
          description: Credential type discriminator; always "service_account".
          title: type
          type: string
        workspaceId:
          description: Workspace slug the account is scoped to.
          title: workspace_id
          type: string
      title: ServiceAccount
      type: object
    agentrouter.admin.v1.ServiceAccountInfo:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        email:
          description: Email-style subject identifier (client_email).
          title: email
          type: string
        expiresAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Expiry timestamp.
          title: expires_at
        id:
          description: Service account UUID.
          title: id
          type: string
        lastUsedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last time the account authenticated; unset if never used.
          nullable: true
          title: last_used_at
        metadata:
          additionalProperties:
            title: value
            type: string
          description: Arbitrary stored metadata for the account.
          title: metadata
          type: object
        publicKeyFingerprint:
          description: Fingerprint of the account's public key.
          title: public_key_fingerprint
          type: string
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Revocation timestamp; unset unless revoked.
          nullable: true
          title: revoked_at
        status:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountStatus'
          description: Current lifecycle status.
          title: status
        workspaceId:
          description: Workspace slug the account is scoped to.
          title: workspace_id
          type: string
      title: ServiceAccountInfo
      type: object
    agentrouter.admin.v1.ServiceAccountInfo.MetadataEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: MetadataEntry
      type: object
    agentrouter.admin.v1.ServiceAccountStatus:
      enum:
      - SERVICE_ACCOUNT_STATUS_UNSPECIFIED
      - SERVICE_ACCOUNT_STATUS_ACTIVE
      - SERVICE_ACCOUNT_STATUS_REVOKED
      - SERVICE_ACCOUNT_STATUS_EXPIRED
      title: ServiceAccountStatus
      type: string
    agentrouter.admin.v1.SetDataplaneProjectRequest:
      additionalProperties: false
      properties:
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          maxLength: 255
          nullable: true
          title: project_id
          type: string
      title: SetDataplaneProjectRequest
      type: object
    agentrouter.admin.v1.SetDataplaneProjectResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplane
      title: SetDataplaneProjectResponse
      type: object
    agentrouter.admin.v1.SetDataplaneURLRequest:
      additionalProperties: false
      properties:
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        triggerUpdate:
          title: trigger_update
          type: boolean
        url:
          maxLength: 2048
          minLength: 1
          title: url
          type: string
      title: SetDataplaneURLRequest
      type: object
    agentrouter.admin.v1.SetDataplaneURLResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplane
      title: SetDataplaneURLResponse
      type: object
    agentrouter.admin.v1.SetProjectGatewayURLRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID whose URL is being set.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
        url:
          description: "url is the customer-facing URL/hostname of the project gateway's\
            \ ingress\n endpoint. Its host part must be globally unique across all\
            \ project gateways\n (a hostname bound to another gateway is rejected\
            \ with ALREADY_EXISTS)."
          maxLength: 2048
          minLength: 1
          title: url
          type: string
      title: SetProjectGatewayURLRequest
      type: object
    agentrouter.admin.v1.SetProjectGatewayURLResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The project gateway reflecting the new URL.
          title: project_gateway
        warnings:
          description: "Non-fatal advisories about the URL change. Populated, for\
            \ example, when the\n gateway has no attached project (or its project\
            \ has no assigned models) --\n the gateway is now reachable but will return\
            \ 404 for every request until a\n project with assigned models is attached.\
            \ Empty when the gateway is fully\n functional."
          items:
            type: string
          title: warnings
          type: array
      title: SetProjectGatewayURLResponse
      type: object
    agentrouter.admin.v1.SetProjectGatewayWorkspaceRequest:
      additionalProperties: false
      properties:
        id:
          description: Project gateway UUID to reassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        workspaceId:
          description: "Target dataplane (workspace) slug to move the project gateway\
            \ to. Must\n exist for the gateway's customer, and the gateway's slug\
            \ must be free in\n it."
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      title: SetProjectGatewayWorkspaceRequest
      type: object
    agentrouter.admin.v1.SetProjectGatewayWorkspaceResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The project gateway reflecting the new workspace.
          title: project_gateway
        warnings:
          description: "Non-fatal advisories about the move. ALWAYS includes a reminder\
            \ that the\n gateway's hostname is unchanged and must be repointed (DNS\
            \ + TLS cert) to\n the new dataplane's ingress, or traffic will 404 on\
            \ the old dataplane until\n cutover. May also carry the same no-project\
            \ / no-models / no-URL advisories\n as SetProjectGatewayURL when the gateway\
            \ is not yet fully functional."
          items:
            type: string
          title: warnings
          type: array
      title: SetProjectGatewayWorkspaceResponse
      type: object
    agentrouter.admin.v1.SetWorkspaceProjectRequest:
      additionalProperties: false
      properties:
        id:
          description: Workspace UUID to reassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        projectId:
          description: project_id to assign. Omit or set to empty string to clear
            back to the default project (NULL).
          maxLength: 255
          nullable: true
          title: project_id
          type: string
      title: SetWorkspaceProjectRequest
      type: object
    agentrouter.admin.v1.SetWorkspaceProjectResponse:
      additionalProperties: false
      properties:
        workspace:
          $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          description: The workspace with its updated project assignment.
          title: workspace
      title: SetWorkspaceProjectResponse
      type: object
    agentrouter.admin.v1.SetWorkspaceURLRequest:
      additionalProperties: false
      properties:
        id:
          description: Workspace UUID whose data-plane URL is being set.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        triggerUpdate:
          description: trigger_update fires a PROXY_URL config event to the data plane
            after persisting the URL.
          title: trigger_update
          type: boolean
        url:
          description: url is the full https:// URL of the data plane's customer-facing
            gateway endpoint.
          maxLength: 2048
          minLength: 1
          title: url
          type: string
      title: SetWorkspaceURLRequest
      type: object
    agentrouter.admin.v1.SetWorkspaceURLResponse:
      additionalProperties: false
      properties:
        workspace:
          $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          description: The workspace reflecting the new data-plane URL.
          title: workspace
      title: SetWorkspaceURLResponse
      type: object
    agentrouter.admin.v1.TelemetryConfig:
      additionalProperties: false
      properties:
        endpoint:
          description: OTLP exporter endpoint.
          title: endpoint
          type: string
        headers:
          additionalProperties:
            title: value
            type: string
          description: Extra headers attached to exports.
          title: headers
          type: object
        insecure:
          description: If true, TLS verification is skipped.
          title: insecure
          type: boolean
        protocol:
          description: OTLP wire protocol (grpc, http/protobuf, http/json).
          title: protocol
          type: string
        timeout:
          description: Export timeout as a Go duration string.
          title: timeout
          type: string
      title: TelemetryConfig
      type: object
    agentrouter.admin.v1.TelemetryConfig.HeadersEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: HeadersEntry
      type: object
    agentrouter.admin.v1.TelemetryForwardingConfig:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: Header name for API key auth
          nullable: true
          title: api_key_header
          type: string
        authType:
          description: '''none'', ''bearer'', ''basic'', ''api_key'''
          title: auth_type
          type: string
        authValue:
          description: Decrypted auth value (only returned in Get/Create responses)
          nullable: true
          title: auth_value
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: created_at
        enabled:
          title: enabled
          type: boolean
        forwardIntervalSeconds:
          description: "How often (seconds) the audit-log forwarder ships for this\
            \ config.\n Only meaningful for telemetry_type='audit_logs'."
          format: int32
          title: forward_interval_seconds
          type: integer
        id:
          description: UUID
          title: id
          type: string
        lastCheckedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: last_checked_at
        protocol:
          description: '''grpc'', ''http/json'', ''http/protobuf'''
          title: protocol
          type: string
        sinkUrl:
          description: Destination URL
          title: sink_url
          type: string
        status:
          description: '''connected'', ''disconnected'', ''error'', ''testing'''
          title: status
          type: string
        telemetryType:
          description: '''traces'', ''metrics'', ''logs'', ''audit_logs'''
          title: telemetry_type
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: updated_at
        userId:
          title: user_id
          type: string
      title: TelemetryForwardingConfig
      type: object
    agentrouter.admin.v1.TestAuditForwardRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          title: api_key_header
          type: string
        authType:
          description: "Auth triple. auth_value may be a plaintext credential or a\
            \ valet://sm://\n reference (resolved server-side), mirroring the forwarder."
          title: auth_type
          type: string
        authValue:
          title: auth_value
          type: string
        owner:
          description: Optional owner hint for logging.
          title: owner
          type: string
        protocol:
          description: Wire protocol; only "http/json" is supported for audit-log
            forwarding.
          title: protocol
          type: string
        sinkUrl:
          description: Sink to test (OTLP/HTTP-JSON; the /v1/logs path is appended
            if absent).
          minLength: 1
          title: sink_url
          type: string
      title: TestAuditForwardRequest
      type: object
    agentrouter.admin.v1.TestAuditForwardResponse:
      additionalProperties: false
      properties:
        message:
          description: Error/diagnostic detail when ok is false.
          title: message
          type: string
        ok:
          description: True if the synthetic record was accepted (2xx) by the sink.
          title: ok
          type: boolean
      title: TestAuditForwardResponse
      type: object
    agentrouter.admin.v1.TriggerAuditForwardRequest:
      additionalProperties: false
      properties:
        owner:
          description: Optional owner hint for logging; the forwarder drains all due
            configs.
          title: owner
          type: string
      title: TriggerAuditForwardRequest
      type: object
    agentrouter.admin.v1.TriggerAuditForwardResponse:
      additionalProperties: false
      title: TriggerAuditForwardResponse
      type: object
    agentrouter.admin.v1.UpdateCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Customer slug to update.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        description:
          description: New description; unset leaves it unchanged.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Replacement set of labels.
          title: labels
          type: object
        name:
          description: New display name; unset leaves it unchanged.
          maxLength: 255
          nullable: true
          title: name
          type: string
      title: UpdateCustomerRequest
      type: object
    agentrouter.admin.v1.UpdateCustomerRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.UpdateCustomerResponse:
      additionalProperties: false
      properties:
        customer:
          $ref: '#/components/schemas/agentrouter.admin.v1.Customer'
          description: The updated customer.
          title: customer
      title: UpdateCustomerResponse
      type: object
    agentrouter.admin.v1.UpdateDataplaneRequest:
      additionalProperties: false
      properties:
        description:
          maxLength: 1000
          nullable: true
          title: description
          type: string
        id:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          maxProperties: 50
          title: labels
          type: object
        name:
          maxLength: 255
          nullable: true
          title: name
          type: string
      title: UpdateDataplaneRequest
      type: object
    agentrouter.admin.v1.UpdateDataplaneRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.UpdateDataplaneResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.admin.v1.Dataplane'
          title: dataplane
      title: UpdateDataplaneResponse
      type: object
    agentrouter.admin.v1.UpdateProjectGatewayRequest:
      additionalProperties: false
      properties:
        description:
          description: New description; unset leaves the existing value.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        id:
          description: Project gateway UUID to update.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          description: Replacement set of labels.
          maxProperties: 50
          title: labels
          type: object
        name:
          description: New display name; unset leaves the existing value.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectId:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          nullable: true
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
        url:
          description: New customer-facing URL/hostname; unset leaves the existing
            value.
          maxLength: 2048
          nullable: true
          title: url
          type: string
      title: UpdateProjectGatewayRequest
      type: object
    agentrouter.admin.v1.UpdateProjectGatewayRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.UpdateProjectGatewayResponse:
      additionalProperties: false
      properties:
        projectGateway:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectGateway'
          description: The updated project gateway.
          title: project_gateway
      title: UpdateProjectGatewayResponse
      type: object
    agentrouter.admin.v1.UpdateProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project the member belongs to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        role:
          description: 'New role: "admin" or "member".'
          enum:
          - admin
          - member
          title: role
          type: string
        userId:
          description: User ID of the member to update.
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
      title: UpdateProjectMemberRequest
      type: object
    agentrouter.admin.v1.UpdateProjectMemberResponse:
      additionalProperties: false
      properties:
        member:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectMember'
          description: The updated membership.
          title: member
      title: UpdateProjectMemberResponse
      type: object
    agentrouter.admin.v1.UpdateProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        description:
          description: New description; unset leaves it unchanged.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Replacement set of labels.
          title: labels
          type: object
        name:
          description: New display name; unset leaves it unchanged.
          maxLength: 255
          nullable: true
          title: name
          type: string
        projectId:
          description: Project slug to update.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      title: UpdateProjectRequest
      type: object
    agentrouter.admin.v1.UpdateProjectRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.UpdateProjectResponse:
      additionalProperties: false
      properties:
        project:
          $ref: '#/components/schemas/agentrouter.admin.v1.Project'
          description: The updated project.
          title: project
      title: UpdateProjectResponse
      type: object
    agentrouter.admin.v1.UpdateTelemetryConfigRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: New API key header name; unset leaves it unchanged.
          maxLength: 256
          nullable: true
          title: api_key_header
          type: string
        authType:
          description: New auth scheme; unset leaves it unchanged.
          enum:
          - none
          - bearer
          - basic
          - api_key
          nullable: true
          title: auth_type
          type: string
        authValue:
          description: Plain text auth value to be encrypted
          nullable: true
          title: auth_value
          type: string
        enabled:
          description: New enabled flag; unset leaves it unchanged.
          nullable: true
          title: enabled
          type: boolean
        forwardIntervalSeconds:
          description: New audit-log forward interval in seconds; unset leaves it
            unchanged.
          format: int32
          maximum: 86400
          minimum: 0
          nullable: true
          title: forward_interval_seconds
          type: integer
        id:
          description: Forwarding config ID to update.
          maxLength: 64
          minLength: 1
          title: id
          type: string
        protocol:
          description: New OTLP protocol; unset leaves it unchanged.
          enum:
          - grpc
          - http/json
          - http/protobuf
          nullable: true
          title: protocol
          type: string
        sinkUrl:
          description: New sink URL; unset leaves it unchanged.
          format: uri
          nullable: true
          title: sink_url
          type: string
        status:
          description: Override the connection status (connected/disconnected/error/testing).
          enum:
          - connected
          - disconnected
          - error
          - testing
          nullable: true
          title: status
          type: string
      title: UpdateTelemetryConfigRequest
      type: object
    agentrouter.admin.v1.UpdateTelemetryConfigResponse:
      additionalProperties: false
      properties:
        config:
          $ref: '#/components/schemas/agentrouter.admin.v1.TelemetryForwardingConfig'
          description: The updated forwarding config.
          title: config
      title: UpdateTelemetryConfigResponse
      type: object
    agentrouter.admin.v1.UpdateWorkspaceRequest:
      additionalProperties: false
      properties:
        description:
          description: New description; unset leaves the existing value.
          maxLength: 1000
          nullable: true
          title: description
          type: string
        id:
          description: Workspace UUID to update.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
        labels:
          additionalProperties:
            maxLength: 255
            title: value
            type: string
          description: Replacement set of labels.
          maxProperties: 50
          title: labels
          type: object
        name:
          description: New display name; unset leaves the existing value.
          maxLength: 255
          nullable: true
          title: name
          type: string
      title: UpdateWorkspaceRequest
      type: object
    agentrouter.admin.v1.UpdateWorkspaceRequest.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.admin.v1.UpdateWorkspaceResponse:
      additionalProperties: false
      properties:
        workspace:
          $ref: '#/components/schemas/agentrouter.admin.v1.Workspace'
          description: The updated workspace.
          title: workspace
      title: UpdateWorkspaceResponse
      type: object
    agentrouter.admin.v1.UpsertProjectSettingRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
        projectId:
          description: Project to set the value on.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
        settingName:
          description: Setting key to create or update ("global-fallback" or "rate-limit").
          enum:
          - global-fallback
          - rate-limit
          title: setting_name
          type: string
        settingValue:
          description: New string-encoded value for the setting.
          maxLength: 1024
          minLength: 1
          title: setting_value
          type: string
      title: UpsertProjectSettingRequest
      type: object
    agentrouter.admin.v1.UpsertProjectSettingResponse:
      additionalProperties: false
      properties:
        setting:
          $ref: '#/components/schemas/agentrouter.admin.v1.ProjectSetting'
          description: The created or updated setting.
          title: setting
      title: UpsertProjectSettingResponse
      type: object
    agentrouter.admin.v1.UserTokenInfo:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Issuance timestamp.
          title: created_at
        expiresAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Expiry timestamp.
          title: expires_at
        jti:
          description: JWT ID (jti), unique per token.
          title: jti
          type: string
        lastUsedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last time the token was used; unset if never used.
          nullable: true
          title: last_used_at
        organizationUnit:
          description: Organization unit embedded in the token.
          title: organization_unit
          type: string
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Revocation timestamp; unset unless revoked.
          nullable: true
          title: revoked_at
        revokedReason:
          description: Reason recorded at revocation, if any.
          nullable: true
          title: revoked_reason
          type: string
        role:
          description: Role embedded in the token.
          title: role
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.admin.v1.UserTokenStatus'
          description: Current lifecycle status.
          title: status
        userId:
          description: User the token was issued for.
          title: user_id
          type: string
      title: UserTokenInfo
      type: object
    agentrouter.admin.v1.UserTokenStatus:
      enum:
      - USER_TOKEN_STATUS_UNSPECIFIED
      - USER_TOKEN_STATUS_ACTIVE
      - USER_TOKEN_STATUS_REVOKED
      - USER_TOKEN_STATUS_EXPIRED
      title: UserTokenStatus
      type: string
    agentrouter.admin.v1.Workspace:
      additionalProperties: false
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Creation timestamp.
          title: created_at
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        deletedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Soft-delete timestamp; unset while the workspace is active.
          nullable: true
          title: deleted_at
        description:
          description: Free-text description.
          nullable: true
          title: description
          type: string
        id:
          description: Server-generated workspace UUID (primary key).
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: User-defined key/value labels.
          title: labels
          type: object
        name:
          description: Human-readable display name.
          nullable: true
          title: name
          type: string
        projectId:
          description: Project this workspace belongs to; empty means the default
            project.
          title: project_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last-modification timestamp.
          title: updated_at
        workspaceId:
          description: Customer-chosen workspace slug, unique within the customer.
          title: workspace_id
          type: string
      title: Workspace
      type: object
    agentrouter.admin.v1.Workspace.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.aikeys.v1.AiKey:
      additionalProperties: false
      description: "AiKey is the BYOK record. The plaintext is never returned after\n\
        \ registration; the inference handler fetches the secret-svc handle\n and\
        \ decrypts on demand.\n\n Storage / ownership model (table: ai_keys): user_id\
        \ holds the user who\n created the key; key_address holds the \"customer::project\"\
        \ scope.\n\n Two scopes share the same (customer, project) address:\n   -\
        \ PROJECT-level keys have scope_user_id = NULL. Every project member\n   \
        \  sees them and the project owner manages them. These are the\n     project's\
        \ shared BYOK keys.\n   - USER-level keys have scope_user_id = <caller>. A\
        \ member sets their\n     OWN key; it is private to that user and OVERRIDES\
        \ the project key\n     for that user's inference traffic for the same provider.\n\
        \n At inference time the resolver prefers the caller's user-scoped key for\n\
        \ the provider and falls back to the project-level key. The legacy\n per-user\
        \ \"/byok\" dashboard view instead filters on user_id."
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the key was registered.
          readOnly: true
          title: created_at
        customerId:
          description: Customer that owns the project this key is scoped to.
          readOnly: true
          title: customer_id
          type: string
        displaySuffix:
          description: "Last 4 chars of the registered plaintext, for human-friendly\n\
            \ display."
          readOnly: true
          title: display_suffix
          type: string
        id:
          description: byok_<ulid>. Server-assigned.
          readOnly: true
          title: id
          type: string
        name:
          description: Operator-supplied label, e.g. "openai-prod".
          title: name
          type: string
        projectId:
          description: Project this key is registered under; List/Get/Revoke filter
            on it.
          readOnly: true
          title: project_id
          type: string
        provider:
          $ref: '#/components/schemas/agentrouter.aikeys.v1.Provider'
          description: Upstream LLM provider this key authenticates against.
          title: provider
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the key was revoked; unset while the key is active.
          readOnly: true
          title: revoked_at
        scopeUserId:
          description: "scope_user_id is the owning user for a user-scoped key; empty\
            \ for a\n project-level key."
          readOnly: true
          title: scope_user_id
          type: string
        secretRef:
          description: Reference to the secrets-svc record holding the wrapped plaintext.
          readOnly: true
          title: secret_ref
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the key's metadata was last modified.
          readOnly: true
          title: updated_at
        userScope:
          description: "user_scope is true when this is a per-user key (private to,\
            \ and\n managed by, scope_user_id) that overrides the project key for\
            \ that\n user. False for shared project-level keys."
          readOnly: true
          title: user_scope
          type: boolean
      required:
      - provider
      - name
      title: AiKey
      type: object
    agentrouter.aikeys.v1.FetchRequest:
      additionalProperties: false
      properties:
        id:
          description: byok_<ulid> of the active key to decrypt and return.
          title: id
          type: string
      required:
      - id
      title: FetchRequest
      type: object
    agentrouter.aikeys.v1.FetchResponse:
      additionalProperties: false
      properties:
        displaySuffix:
          description: Last 4 chars of the plaintext, for human-friendly display.
          readOnly: true
          title: display_suffix
          type: string
        provider:
          $ref: '#/components/schemas/agentrouter.aikeys.v1.Provider'
          description: Provider the returned key authenticates against.
          readOnly: true
          title: provider
        secret:
          description: Decrypted plaintext provider key for the inference hot path.
          readOnly: true
          title: secret
          type: string
      title: FetchResponse
      type: object
    agentrouter.aikeys.v1.GetRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        id:
          description: byok_<ulid> identifying the key to fetch.
          title: id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetRequest
      type: object
    agentrouter.aikeys.v1.GetResponse:
      additionalProperties: false
      properties:
        key:
          $ref: '#/components/schemas/agentrouter.aikeys.v1.AiKey'
          description: The requested key's metadata record (no plaintext).
          title: key
      title: GetResponse
      type: object
    agentrouter.aikeys.v1.ListRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      title: ListRequest
      type: object
    agentrouter.aikeys.v1.ListResponse:
      additionalProperties: false
      properties:
        keys:
          description: All keys registered under the project (metadata only, no plaintext).
          items:
            $ref: '#/components/schemas/agentrouter.aikeys.v1.AiKey'
          title: keys
          type: array
      title: ListResponse
      type: object
    agentrouter.aikeys.v1.Provider:
      description: "Provider enumerates the upstream LLM providers Agent Router proxies. Adding\
        \ a\n provider is a versioned change."
      enum:
      - PROVIDER_UNSPECIFIED
      - PROVIDER_OPENAI
      - PROVIDER_ANTHROPIC
      - PROVIDER_AZURE_OPENAI
      - PROVIDER_GOOGLE_VERTEX
      - PROVIDER_AWS_BEDROCK
      title: Provider
      type: string
    agentrouter.aikeys.v1.RegisterRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        name:
          description: Operator-supplied label for the key, e.g. "openai-prod".
          title: name
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        provider:
          $ref: '#/components/schemas/agentrouter.aikeys.v1.Provider'
          description: Provider this key authenticates against.
          title: provider
        secret:
          description: "Plaintext provider key, e.g. sk-.... Sent over TLS only; the\
            \ server\n immediately wraps with secrets-svc and discards the plaintext."
          title: secret
          type: string
        userScope:
          description: "user_scope registers a per-user key private to the caller\
            \ that\n overrides the project key for the caller's inference traffic.\
            \ When\n false (default) the key is project-level (shared) and requires\
            \ the\n caller to be the project owner."
          title: user_scope
          type: boolean
      required:
      - provider
      - name
      - secret
      title: RegisterRequest
      type: object
    agentrouter.aikeys.v1.RegisterResponse:
      additionalProperties: false
      properties:
        key:
          $ref: '#/components/schemas/agentrouter.aikeys.v1.AiKey'
          description: The newly registered key's metadata record (no plaintext).
          title: key
      title: RegisterResponse
      type: object
    agentrouter.aikeys.v1.RevokeRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        id:
          description: byok_<ulid> identifying the key to revoke.
          title: id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - id
      title: RevokeRequest
      type: object
    agentrouter.aikeys.v1.RevokeResponse:
      additionalProperties: false
      title: RevokeResponse
      type: object
    agentrouter.api_keys.v1.CreateApiKeyRequest:
      additionalProperties: false
      properties:
        enterpriseContext:
          $ref: '#/components/schemas/agentrouter.api_keys.v1.EnterpriseContext'
          description: "Optional enterprise context overrides for JWT user-token issuance.\n\
            \ When omitted, service defaults are used."
          nullable: true
          title: enterprise_context
        name:
          description: Human-readable key name.
          title: name
          type: string
        userId:
          description: User ID that will own the API key.
          title: user_id
          type: string
        userKeyAddress:
          description: "User key address input (typically email or user id).\n Required\
            \ for API parity with client flows and request provenance checks.\n In\
            \ JWT-based issuance, returned key_address is derived from user_id by\
            \ the token service."
          title: user_key_address
          type: string
      title: CreateApiKeyRequest
      type: object
    agentrouter.api_keys.v1.CreateApiKeyResponse:
      additionalProperties: false
      properties:
        apiKey:
          description: Plaintext key (returned once).
          title: api_key
          type: string
        id:
          description: Key ID (UUID).
          title: id
          type: string
        keyAddress:
          description: 16-char hex key address from the token service (currently xxhash64(user_id)
            for JWT issuance).
          title: key_address
          type: string
        keyHash:
          description: 64-char hex HMAC hash of the full key.
          title: key_hash
          type: string
        keySuffix:
          description: Last 4 chars of the plaintext key (for display).
          title: key_suffix
          type: string
        prefix:
          description: 12-char key prefix.
          title: prefix
          type: string
        userId:
          description: User ID that owns the key.
          title: user_id
          type: string
      title: CreateApiKeyResponse
      type: object
    agentrouter.api_keys.v1.DeleteApiKeyRequest:
      additionalProperties: false
      properties:
        keyId:
          description: Key ID (UUID).
          title: key_id
          type: string
        userId:
          description: User ID that owns the API key.
          title: user_id
          type: string
      title: DeleteApiKeyRequest
      type: object
    agentrouter.api_keys.v1.DeleteApiKeyResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the key was soft-deleted; failures surface as RPC
            errors instead.
          title: success
          type: boolean
      title: DeleteApiKeyResponse
      type: object
    agentrouter.api_keys.v1.EnterpriseContext:
      additionalProperties: false
      properties:
        customerId:
          description: Customer identifier (e.g. "default", "acme").
          title: customer_id
          type: string
        organizationUnit:
          description: Organization unit for the user (e.g. "engineering").
          title: organization_unit
          type: string
        workspaceId:
          description: Workspace identifier (defaults to "default" when empty).
          title: workspace_id
          type: string
      title: EnterpriseContext
      type: object
    agentrouter.api_keys.v1.UpdateApiKeyRequest:
      additionalProperties: false
      properties:
        isActive:
          description: Optional active state.
          nullable: true
          title: is_active
          type: boolean
        keyId:
          description: Key ID (UUID).
          title: key_id
          type: string
        name:
          description: Optional new name.
          nullable: true
          title: name
          type: string
        userId:
          description: User ID that owns the API key.
          title: user_id
          type: string
      title: UpdateApiKeyRequest
      type: object
    agentrouter.api_keys.v1.UpdateApiKeyResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the update was applied; failures surface as RPC errors
            instead.
          title: success
          type: boolean
      title: UpdateApiKeyResponse
      type: object
    agentrouter.auth.v1.GetJWKSRequest:
      additionalProperties: false
      title: GetJWKSRequest
      type: object
    agentrouter.auth.v1.GetJWKSResponse:
      additionalProperties: false
      description: JWKS response containing public keys for JWT verification.
      properties:
        keys:
          description: Set of public JWKs available for verifying JWT signatures.
          items:
            $ref: '#/components/schemas/agentrouter.auth.v1.JWK'
          title: keys
          type: array
      title: GetJWKSResponse
      type: object
    agentrouter.auth.v1.JWK:
      additionalProperties: false
      description: JSON Web Key (JWK) representation for ECDSA keys.
      properties:
        alg:
          description: 'Algorithm: "ES256", "ES384", or "ES512".'
          title: alg
          type: string
        crv:
          description: 'EC curve name: "P-256", "P-384", or "P-521".'
          title: crv
          type: string
        kid:
          description: 'Key ID: fingerprint of the public key.'
          title: kid
          type: string
        kty:
          description: 'Key type: always "EC" (Elliptic Curve).'
          title: kty
          type: string
        use:
          description: 'Public key use: "sig" (signature).'
          title: use
          type: string
        x:
          description: EC public key x coordinate (base64url-encoded).
          title: x
          type: string
        y:
          description: EC public key y coordinate (base64url-encoded).
          title: y
          type: string
      title: JWK
      type: object
    agentrouter.catalog.v1.AssignModelToProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        modelId:
          description: Catalog model id (uuid).
          title: model_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - modelId
      title: AssignModelToProjectRequest
      type: object
    agentrouter.catalog.v1.AssignModelToProjectResponse:
      additionalProperties: false
      properties:
        entry:
          $ref: '#/components/schemas/agentrouter.catalog.v1.ProjectModelEntry'
          description: The created (or already-existing) project-to-model assignment.
          title: entry
      title: AssignModelToProjectResponse
      type: object
    agentrouter.catalog.v1.DeleteModelRequest:
      additionalProperties: false
      properties:
        id:
          description: Id of the model to delete. mdl_<ulid>.
          title: id
          type: string
      required:
      - id
      title: DeleteModelRequest
      type: object
    agentrouter.catalog.v1.DeleteProviderRequest:
      additionalProperties: false
      properties:
        id:
          description: Id of the provider to delete. prov_<ulid>.
          title: id
          type: string
      required:
      - id
      title: DeleteProviderRequest
      type: object
    agentrouter.catalog.v1.GetModelRequest:
      additionalProperties: false
      properties:
        id:
          description: "Model id (UUID) or unique model name. A UUID is looked up\
            \ by id; any\n other value is resolved by model name across the visible\
            \ catalog. A\n name that matches models from multiple providers is rejected\
            \ with\n InvalidArgument naming the candidates."
          title: id
          type: string
      required:
      - id
      title: GetModelRequest
      type: object
    agentrouter.catalog.v1.GetModelResponse:
      additionalProperties: false
      properties:
        model:
          $ref: '#/components/schemas/agentrouter.catalog.v1.Model'
          description: The requested model.
          title: model
      title: GetModelResponse
      type: object
    agentrouter.catalog.v1.GetProviderRequest:
      additionalProperties: false
      properties:
        id:
          description: Provider id to fetch. prov_<ulid>.
          title: id
          type: string
      required:
      - id
      title: GetProviderRequest
      type: object
    agentrouter.catalog.v1.GetProviderResponse:
      additionalProperties: false
      properties:
        provider:
          $ref: '#/components/schemas/agentrouter.catalog.v1.Provider'
          description: The requested provider.
          title: provider
      title: GetProviderResponse
      type: object
    agentrouter.catalog.v1.ListModelsRequest:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Page size and continuation token for cursor-based pagination.
          title: page
        providerId:
          description: "Filter to models belonging to this provider. Empty returns\
            \ all\n models."
          title: provider_id
          type: string
      title: ListModelsRequest
      type: object
    agentrouter.catalog.v1.ListModelsResponse:
      additionalProperties: false
      properties:
        models:
          description: Models on this page, in catalog order.
          items:
            $ref: '#/components/schemas/agentrouter.catalog.v1.Model'
          title: models
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination cursor; carries next_page_token for the following
            call.
          title: page
      title: ListModelsResponse
      type: object
    agentrouter.catalog.v1.ListProjectModelsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      title: ListProjectModelsRequest
      type: object
    agentrouter.catalog.v1.ListProjectModelsResponse:
      additionalProperties: false
      properties:
        entries:
          description: Every model assigned to the project, each joined with its catalog
            Model.
          items:
            $ref: '#/components/schemas/agentrouter.catalog.v1.ProjectModelEntry'
          title: entries
          type: array
      title: ListProjectModelsResponse
      type: object
    agentrouter.catalog.v1.ListProvidersRequest:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Page size and continuation token for cursor-based pagination.
          title: page
      title: ListProvidersRequest
      type: object
    agentrouter.catalog.v1.ListProvidersResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination cursor; carries next_page_token for the following
            call.
          title: page
        providers:
          description: Providers on this page, in catalog order.
          items:
            $ref: '#/components/schemas/agentrouter.catalog.v1.Provider'
          title: providers
          type: array
      title: ListProvidersResponse
      type: object
    agentrouter.catalog.v1.Model:
      additionalProperties: false
      description: "Model is a platform-curated entry that ties a logical name to\
        \ a\n provider and a provider-side model identifier."
      properties:
        capabilities:
          description: "Capabilities this model supports, e.g. \"chat\", \"embeddings\"\
            ,\n \"images\"."
          items:
            type: string
          title: capabilities
          type: array
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this model record was created.
          readOnly: true
          title: created_at
        id:
          description: Resource name mdl_<ulid>. Server-assigned; immutable.
          readOnly: true
          title: id
          type: string
        maxContextTokens:
          description: Maximum context window in tokens.
          title: max_context_tokens
          type: integer
        name:
          description: "Logical name used in routing and billing, e.g. \"gpt-4o\"\
            . Unique\n within a provider."
          title: name
          type: string
        pricing:
          $ref: '#/components/schemas/agentrouter.catalog.v1.Pricing'
          description: Per-token pricing rates.
          title: pricing
        providerId:
          description: Provider this model belongs to. prov_<ulid>.
          title: provider_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this model record was last modified.
          readOnly: true
          title: updated_at
        upstreamModel:
          description: "Provider-side model id sent as body.model to upstream,\n e.g.\
            \ \"gpt-4o-2024-11-20\"."
          title: upstream_model
          type: string
      required:
      - providerId
      - name
      - upstreamModel
      title: Model
      type: object
    agentrouter.catalog.v1.Pricing:
      additionalProperties: false
      description: "Pricing holds per-million-token rates for a model. All values\
        \ are\n decimal strings to avoid float drift (e.g. \"2.50\")."
      properties:
        cacheReadPerMillion:
          description: "Cost in USD per million cache-read tokens. Empty means not\n\
            \ applicable."
          title: cache_read_per_million
          type: string
        inputPerMillion:
          description: Cost in USD per million input tokens.
          title: input_per_million
          type: string
        maxCostPerRequest:
          description: Hard cap in USD per single request. Empty means no cap.
          title: max_cost_per_request
          type: string
        outputPerMillion:
          description: Cost in USD per million output tokens.
          title: output_per_million
          type: string
      title: Pricing
      type: object
    agentrouter.catalog.v1.ProjectModelEntry:
      additionalProperties: false
      description: "ProjectModelEntry pairs a project assignment row with the catalog\n\
        \ Model it points at. The Model field is populated on List responses\n via\
        \ a JOIN against ai_models."
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          readOnly: true
          title: created_at
        customerId:
          description: Customer that owns this assignment.
          title: customer_id
          type: string
        id:
          description: Resource name of the project_models row (uuid).
          readOnly: true
          title: id
          type: string
        model:
          $ref: '#/components/schemas/agentrouter.catalog.v1.Model'
          description: "Full catalog Model resource. Populated on List responses;\
            \ may be\n empty on Add responses if the join was skipped."
          title: model
        modelId:
          description: Catalog model id (uuid). Same value as model.id when model
            is set.
          title: model_id
          type: string
        projectId:
          description: Project the model is assigned to.
          title: project_id
          type: string
      title: ProjectModelEntry
      type: object
    agentrouter.catalog.v1.Provider:
      additionalProperties: false
      description: Provider is an AI inference backend.
      properties:
        baseUrl:
          description: "Base URL for all models served by this provider,\n e.g. \"\
            https://api.openai.com\"."
          title: base_url
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this provider record was created.
          readOnly: true
          title: created_at
        credentialSuffix:
          description: "Last 4 chars of the stored platform credential (e.g. \"sk-..**4a2f\"\
            ).\n Empty if no platform credential has been set. BYOK keys are tracked\n\
            \ separately via aikeys.v1."
          readOnly: true
          title: credential_suffix
          type: string
        displayName:
          description: Human-readable display name, e.g. "OpenAI".
          title: display_name
          type: string
        id:
          description: Resource name prov_<ulid>. Server-assigned; immutable.
          readOnly: true
          title: id
          type: string
        name:
          description: "Machine-readable slug, e.g. \"openai\", \"anthropic\", \"\
            awsbedrock\".\n Unique. Canonical form is lowercase alphanumeric [a-z0-9]+\
            \ (no hyphens,\n spaces, or uppercase) -- it is matched hyphen-insensitively\
            \ at inference\n time, so UpsertProvider requires this canonical form\
            \ on write."
          title: name
          type: string
        supportedAuthSchemes:
          description: "Auth schemes this provider supports, e.g. \"bearer\",\n \"\
            aws-sigv4-static\"."
          items:
            type: string
          title: supported_auth_schemes
          type: array
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this provider record was last modified.
          readOnly: true
          title: updated_at
      required:
      - name
      - displayName
      - baseUrl
      title: Provider
      type: object
    agentrouter.catalog.v1.SetProviderCredentialRequest:
      additionalProperties: false
      properties:
        credential:
          description: "Plaintext credential (API key, bearer token, etc.). Stored\n\
            \ server-side under envelope encryption and never returned.\n Provider.credential_suffix\
            \ reflects the last 4 chars."
          title: credential
          type: string
        id:
          description: Provider id / slug.
          title: id
          type: string
      required:
      - id
      - credential
      title: SetProviderCredentialRequest
      type: object
    agentrouter.catalog.v1.UnassignModelFromProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        modelId:
          description: Catalog model id (uuid) to unassign from the project.
          title: model_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - modelId
      title: UnassignModelFromProjectRequest
      type: object
    agentrouter.catalog.v1.UnassignModelFromProjectResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the assignment was removed.
          title: success
          type: boolean
      title: UnassignModelFromProjectResponse
      type: object
    agentrouter.catalog.v1.UpsertModelRequest:
      additionalProperties: false
      description: "UpsertModelRequest carries the fields of a Model as scalar top-level\n\
        \ fields for the same CLI-flag reason as UpsertProviderRequest."
      properties:
        cacheReadPerMillion:
          description: Cost in USD per million cache-read tokens. Empty if not applicable.
          title: cache_read_per_million
          type: string
        capabilities:
          description: Capabilities this model supports, e.g. ["chat", "embeddings"].
          items:
            type: string
          title: capabilities
          type: array
        inputPerMillion:
          description: Cost in USD per million input tokens (decimal string).
          title: input_per_million
          type: string
        maxContextTokens:
          description: Maximum context window in tokens.
          title: max_context_tokens
          type: integer
        maxCostPerRequest:
          description: Hard cap in USD per single request. Empty means no cap.
          title: max_cost_per_request
          type: string
        name:
          description: Logical model name, e.g. "gpt-4o". Unique within provider.
          title: name
          type: string
        outputPerMillion:
          description: Cost in USD per million output tokens (decimal string).
          title: output_per_million
          type: string
        providerId:
          description: Provider slug this model belongs to.
          title: provider_id
          type: string
        upstreamModel:
          description: Provider-side model id (defaults to name when empty).
          title: upstream_model
          type: string
      required:
      - providerId
      - name
      title: UpsertModelRequest
      type: object
    agentrouter.catalog.v1.UpsertProviderRequest:
      additionalProperties: false
      description: "UpsertProviderRequest carries the fields of a Provider as scalar\n\
        \ top-level fields so the generated CLI can surface each one as a\n flag (`protoc-gen-ia-cli`\
        \ skips message-typed fields). This is the\n one unavoidable divergence from\
        \ IA's nested-`provider` shape; the\n HTTP body shape on the wire stays semantically\
        \ equivalent."
      properties:
        baseUrl:
          description: "Provider API base URL. The CLI flag is renamed to\n --provider-base-url\
            \ to avoid colliding with the root command's\n persistent --base-url (which\
            \ overrides the active profile's API\n URL for one invocation)."
          title: base_url
          type: string
        displayName:
          description: Human-readable display name, e.g. "OpenAI".
          title: display_name
          type: string
        id:
          description: "Provider slug, e.g. \"openai\". Natural key; required. Must\
            \ be canonical\n lowercase alphanumeric [a-z0-9]+ (no hyphens, spaces,\
            \ or uppercase)."
          title: id
          type: string
        supportedAuthSchemes:
          description: Auth schemes this provider supports, e.g. ["bearer"].
          items:
            type: string
          title: supported_auth_schemes
          type: array
      required:
      - id
      - displayName
      - baseUrl
      title: UpsertProviderRequest
      type: object
    agentrouter.clients.v1.AddKeyToClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) to attach the key to.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        keyId:
          description: Id (UUID) of the existing key to attach.
          title: key_id
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - clientId
      - keyId
      title: AddKeyToClientRequest
      type: object
    agentrouter.clients.v1.AddKeyToClientResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the key was attached successfully.
          title: success
          type: boolean
      title: AddKeyToClientResponse
      type: object
    agentrouter.clients.v1.Client:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug the client is scoped to.
          title: customer_id
          type: string
        id:
          description: Client id (UUID); equals the bootstrap key's id at creation
            time.
          title: id
          type: string
        keys:
          description: API key versions attached to this client.
          items:
            $ref: '#/components/schemas/agentrouter.clients.v1.ClientKey'
          title: keys
          type: array
        projectId:
          description: Owning project slug the client is scoped to.
          title: project_id
          type: string
        title:
          description: Human-friendly client title; lazily derived from a key name
            when unset.
          title: title
          type: string
        userId:
          description: Owning user id (authn user PK) the client is scoped to.
          title: user_id
          type: string
      title: Client
      type: object
    agentrouter.clients.v1.ClientKey:
      additionalProperties: false
      properties:
        destroyedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Time the key was permanently destroyed; unset while still alive.
          nullable: true
          title: destroyed_at
        id:
          description: Key version id (UUID), the api_keys row primary key.
          title: id
          type: string
        isActive:
          description: Whether the key is currently enabled (not disabled/destroyed).
          title: is_active
          type: boolean
        isDeleted:
          description: Whether the key has been soft-deleted.
          title: is_deleted
          type: boolean
        keyAddress:
          description: System-generated lookup handle used to locate the key at auth
            time.
          title: key_address
          type: string
        keyHash:
          description: Hash of the secret key material; the raw key is never stored.
          title: key_hash
          type: string
        keySuffix:
          description: Last 4 characters of the issued key, for display/disambiguation.
          title: key_suffix
          type: string
        name:
          description: Human-friendly key name.
          title: name
          type: string
        prefix:
          description: Public, non-secret key prefix shown in listings.
          title: prefix
          type: string
        rotationDestroyAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Scheduled time at which a rotated key will be auto-destroyed;
            unset if none.
          nullable: true
          title: rotation_destroy_at
        rotationDisableAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Scheduled time at which a rotated key will be auto-disabled;
            unset if none.
          nullable: true
          title: rotation_disable_at
        state:
          $ref: '#/components/schemas/agentrouter.clients.v1.KeyVersionState'
          description: 'Lifecycle state: enabled, disabled, or destroyed.'
          title: state
      title: ClientKey
      type: object
    agentrouter.clients.v1.CreateClientWithKeyRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        enterpriseContext:
          $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
          description: Optional enterprise tenancy context (legacy AdminServer path).
          title: enterprise_context
        keyName:
          description: Backing key name; defaults to title when empty.
          title: key_name
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
        title:
          description: Human-friendly title for the client.
          title: title
          type: string
      title: CreateClientWithKeyRequest
      type: object
    agentrouter.clients.v1.CreateClientWithKeyResponse:
      additionalProperties: false
      properties:
        apiKeyOnce:
          description: The raw secret key, returned exactly once at creation; never
            stored.
          title: api_key_once
          type: string
        clientId:
          description: "Bootstrap behavior: the first key establishes the client identity,\n\
            \ so initially client_id == key_id."
          title: client_id
          type: string
        keyAddress:
          description: System-generated lookup handle used to locate the key at auth
            time.
          title: key_address
          type: string
        keyHash:
          description: Hash of the secret key material.
          title: key_hash
          type: string
        keyId:
          description: Id (UUID) of the newly minted key version.
          title: key_id
          type: string
        keySuffix:
          description: Last 4 characters of the issued key, for display.
          title: key_suffix
          type: string
        prefix:
          description: Public, non-secret key prefix.
          title: prefix
          type: string
      title: CreateClientWithKeyResponse
      type: object
    agentrouter.clients.v1.DestroyKeyVersionInClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        keyVersion:
          description: Key version id (UUID) to permanently destroy.
          title: key_version
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - clientId
      - keyVersion
      title: DestroyKeyVersionInClientRequest
      type: object
    agentrouter.clients.v1.DestroyKeyVersionInClientResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the key version was destroyed.
          title: success
          type: boolean
      title: DestroyKeyVersionInClientResponse
      type: object
    agentrouter.clients.v1.DisableKeyVersionInClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        keyVersion:
          description: "Key version id (UUID). Named key_version to match IA's vocabulary;\n\
            \ fraser stores one row per version in api_keys."
          title: key_version
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - clientId
      - keyVersion
      title: DisableKeyVersionInClientRequest
      type: object
    agentrouter.clients.v1.DisableKeyVersionInClientResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the key version was disabled.
          title: success
          type: boolean
      title: DisableKeyVersionInClientResponse
      type: object
    agentrouter.clients.v1.EmergencyRevokeKeyVersionRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) that owns the key version being revoked.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        generateReplacement:
          description: When true, also rotate in a replacement key after revoking.
          title: generate_replacement
          type: boolean
        keyVersion:
          description: Key version id (UUID) to revoke (disable immediately).
          title: key_version
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
        replacementEnterpriseContext:
          $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
          description: Optional enterprise tenancy context for the replacement key.
          title: replacement_enterprise_context
        replacementKeyName:
          description: Name for the replacement key; required when generate_replacement
            is true.
          title: replacement_key_name
          type: string
        replacementUserKeyAddress:
          description: 'Deprecated/ignored: replacement key address is system-generated.'
          title: replacement_user_key_address
          type: string
      required:
      - clientId
      - keyVersion
      title: EmergencyRevokeKeyVersionRequest
      type: object
    agentrouter.clients.v1.EmergencyRevokeKeyVersionResponse:
      additionalProperties: false
      properties:
        replacement:
          $ref: '#/components/schemas/agentrouter.clients.v1.RotateKeyInClientResponse'
          description: The freshly rotated replacement key; set only when one was
            requested.
          nullable: true
          title: replacement
        success:
          description: True when the key version was revoked.
          title: success
          type: boolean
      title: EmergencyRevokeKeyVersionResponse
      type: object
    agentrouter.clients.v1.EnableKeyVersionInClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        keyVersion:
          description: Key version id (UUID) to re-enable.
          title: key_version
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - clientId
      - keyVersion
      title: EnableKeyVersionInClientRequest
      type: object
    agentrouter.clients.v1.EnableKeyVersionInClientResponse:
      additionalProperties: false
      properties:
        success:
          description: True when the key version was re-enabled.
          title: success
          type: boolean
      title: EnableKeyVersionInClientResponse
      type: object
    agentrouter.clients.v1.EnterpriseContext:
      additionalProperties: false
      description: "EnterpriseContext is preserved as an optional, OPAQUE substructure\
        \ on\n the create / rotate / revoke paths because the existing AdminServer\n\
        \ path requires it. The project-scoping authoritatively lives in the\n top-level\
        \ customer_id / project_id fields on every request."
      properties:
        customerId:
          description: Customer/tenant slug; seeds the admin user-token request when
            set.
          title: customer_id
          type: string
        organizationUnit:
          description: Organization unit the key belongs to; defaults to "default"
            when empty.
          title: organization_unit
          type: string
        workspaceId:
          description: Workspace slug within the customer; defaults to "default" when
            empty.
          title: workspace_id
          type: string
      title: EnterpriseContext
      type: object
    agentrouter.clients.v1.GetClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) to fetch.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - clientId
      title: GetClientRequest
      type: object
    agentrouter.clients.v1.GetClientResponse:
      additionalProperties: false
      properties:
        client:
          $ref: '#/components/schemas/agentrouter.clients.v1.Client'
          description: The requested client with its attached keys.
          title: client
      title: GetClientResponse
      type: object
    agentrouter.clients.v1.KeyVersionState:
      enum:
      - KEY_VERSION_STATE_UNSPECIFIED
      - KEY_VERSION_STATE_ENABLED
      - KEY_VERSION_STATE_DISABLED
      - KEY_VERSION_STATE_DESTROYED
      title: KeyVersionState
      type: string
    agentrouter.clients.v1.ListClientsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      title: ListClientsRequest
      type: object
    agentrouter.clients.v1.ListClientsResponse:
      additionalProperties: false
      properties:
        clients:
          description: All clients owned by the caller within the (customer, project)
            scope.
          items:
            $ref: '#/components/schemas/agentrouter.clients.v1.Client'
          title: clients
          type: array
      title: ListClientsResponse
      type: object
    agentrouter.clients.v1.RotateKeyInClientRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) whose key is being rotated.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        destroyAfter:
          title: destroy_after
          type: string
        disableAfter:
          description: "Convenience flags for the CLI: durations relative to now.\
            \ When set\n they override old_key_disable_at / old_key_destroy_at."
          title: disable_after
          type: string
        enterpriseContext:
          $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
          description: Optional enterprise tenancy context (legacy AdminServer path).
          title: enterprise_context
        keyName:
          description: Name for the new key version. Required.
          title: key_name
          type: string
        oldKeyDestroyAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Absolute time to auto-destroy the old key; overridden by destroy_after
            when set.
          title: old_key_destroy_at
        oldKeyDisableAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Absolute time to auto-disable the old key; overridden by disable_after
            when set.
          title: old_key_disable_at
        oldKeyId:
          description: Id (UUID) of the prior key to schedule disable/destroy for;
            empty skips scheduling.
          title: old_key_id
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
        userKeyAddress:
          description: 'Deprecated/ignored: key address is system-generated, not user-chosen.'
          title: user_key_address
          type: string
      required:
      - clientId
      title: RotateKeyInClientRequest
      type: object
    agentrouter.clients.v1.RotateKeyInClientResponse:
      additionalProperties: false
      properties:
        apiKeyOnce:
          description: The raw secret key, returned exactly once; never stored.
          title: api_key_once
          type: string
        clientId:
          description: Client id (UUID) the new key is attached to (unchanged by rotation).
          title: client_id
          type: string
        keyAddress:
          description: System-generated lookup handle used to locate the key at auth
            time.
          title: key_address
          type: string
        keyHash:
          description: Hash of the secret key material.
          title: key_hash
          type: string
        keyId:
          description: Id (UUID) of the newly minted key version.
          title: key_id
          type: string
        keySuffix:
          description: Last 4 characters of the issued key, for display.
          title: key_suffix
          type: string
        oldKeyLifecycleScheduled:
          description: True when a disable/destroy schedule was applied to the prior
            key.
          title: old_key_lifecycle_scheduled
          type: boolean
        prefix:
          description: Public, non-secret key prefix.
          title: prefix
          type: string
      title: RotateKeyInClientResponse
      type: object
    agentrouter.clients.v1.UpdateClientTitleRequest:
      additionalProperties: false
      properties:
        clientId:
          description: Client id (UUID) whose title is being updated.
          title: client_id
          type: string
        customerId:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
        title:
          description: New human-friendly title for the client.
          title: title
          type: string
      required:
      - clientId
      - title
      title: UpdateClientTitleRequest
      type: object
    agentrouter.clients.v1.UpdateClientTitleResponse:
      additionalProperties: false
      properties:
        client:
          $ref: '#/components/schemas/agentrouter.clients.v1.Client'
          description: The client after the title update.
          title: client
      title: UpdateClientTitleResponse
      type: object
    agentrouter.common.v1.PageRequest:
      additionalProperties: false
      description: "PageRequest carries the standard cursor-pagination inputs.\n\n\
        \ List RPCs may either embed this message directly or inline the equivalent\n\
        \ fields with the same field numbers. Pagination is opaque-cursor only;\n\
        \ offset-based paging is not supported."
      properties:
        filter:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
        orderBy:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
        pageSize:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      title: PageRequest
      type: object
    agentrouter.common.v1.PageResponse:
      additionalProperties: false
      description: "PageResponse carries the standard cursor-pagination outputs.\n\
        \n List RPCs may embed this message or inline the equivalent field. Empty\n\
        \ next_page_token means there are no further pages."
      properties:
        nextPageToken:
          description: "Continuation token to pass as PageRequest.page_token on the\
            \ next call.\n Empty when the listing is exhausted."
          readOnly: true
          title: next_page_token
          type: string
      title: PageResponse
      type: object
    agentrouter.configurator.v1.AckDataplaneUpgradeCredentialsRequest:
      additionalProperties: false
      properties:
        delivered:
          description: "True when the worker successfully created the in-cluster Secret;\n\
            \ MP DELETEs the ciphertext row. False when materialisation failed\n (e.g.\
            \ RBAC) — MP keeps the row so the operator's submission\n isn't lost;\
            \ worker will retry on its next poll."
          title: delivered
          type: boolean
        upgradeEventId:
          description: Upgrade event id whose credentials were materialised. Workspace
            claim must match.
          title: upgrade_event_id
          type: string
      title: AckDataplaneUpgradeCredentialsRequest
      type: object
    agentrouter.configurator.v1.AckDataplaneUpgradeCredentialsResponse:
      additionalProperties: false
      properties:
        success:
          description: True if the ciphertext row was deleted (or already gone — idempotent).
          title: success
          type: boolean
      title: AckDataplaneUpgradeCredentialsResponse
      type: object
    agentrouter.configurator.v1.AcknowledgeEventRequest:
      additionalProperties: false
      description: AcknowledgeEventRequest acknowledges an event.
      properties:
        eventId:
          description: Event ID to acknowledge.
          title: event_id
          type: string
        workerId:
          description: Worker ID that is acknowledging the event.
          title: worker_id
          type: string
      title: AcknowledgeEventRequest
      type: object
    agentrouter.configurator.v1.AcknowledgeEventResponse:
      additionalProperties: false
      description: AcknowledgeEventResponse confirms acknowledgment.
      properties:
        success:
          description: True if the event was acknowledged (claimed) by this worker.
          title: success
          type: boolean
      title: AcknowledgeEventResponse
      type: object
    agentrouter.configurator.v1.CancelDataplaneUpgradeRequest:
      additionalProperties: false
      properties:
        upgradeEventId:
          description: Upgrade event id whose in-flight CR should be cancelled.
          title: upgrade_event_id
          type: string
      title: CancelDataplaneUpgradeRequest
      type: object
    agentrouter.configurator.v1.CancelDataplaneUpgradeResponse:
      additionalProperties: false
      properties:
        success:
          title: success
          type: boolean
      title: CancelDataplaneUpgradeResponse
      type: object
    agentrouter.configurator.v1.CompleteEventRequest:
      additionalProperties: false
      description: CompleteEventRequest marks an event as complete (applied or failed).
      properties:
        errorMessage:
          description: Error message if failed.
          title: error_message
          type: string
        eventId:
          description: Event ID to complete.
          title: event_id
          type: string
        success:
          description: Whether the event was successfully applied.
          title: success
          type: boolean
      title: CompleteEventRequest
      type: object
    agentrouter.configurator.v1.CompleteEventResponse:
      additionalProperties: false
      description: CompleteEventResponse confirms completion.
      properties:
        success:
          description: True if the event status was updated to applied or failed.
          title: success
          type: boolean
      title: CompleteEventResponse
      type: object
    agentrouter.configurator.v1.ConfigType:
      description: ConfigType defines the type of configuration being managed.
      enum:
      - CONFIG_TYPE_UNSPECIFIED
      - CONFIG_TYPE_GLOBAL_ROUTES
      - CONFIG_TYPE_USER_ROUTES
      - CONFIG_TYPE_BYOK
      - CONFIG_TYPE_MCP_PROFILE
      - CONFIG_TYPE_MCP_BACKENDS
      - CONFIG_TYPE_OAUTH_TOKEN
      - CONFIG_TYPE_BYOK_BACKENDS
      - CONFIG_TYPE_GUARDRAILS
      - CONFIG_TYPE_PROXY_URL
      - CONFIG_TYPE_PROXY
      - CONFIG_TYPE_PROVIDER_SECRETS
      - CONFIG_TYPE_DATAPLANE_UPGRADE
      - CONFIG_TYPE_BYOK_SCOPED
      title: ConfigType
      type: string
    agentrouter.configurator.v1.Configuration:
      additionalProperties: false
      description: Configuration represents a liaison configuration entry.
      properties:
        configData:
          description: "Configuration data as JSON.\n The structure depends on config_type:\n\
            \ - BYOK: AIProvidersList with BYOK keys\n - MCP_PROFILE: MCPProfile list\n\
            \ - OAUTH_TOKEN: OAuth token metadata\n - GLOBAL_ROUTES: Global route\
            \ map\n - FALLBACK: FallbackSettings\n - TRAFFIC_SPLIT: TrafficSplitSettings"
          title: config_data
          type: string
        configType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Configuration type.
          title: config_type
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Timestamps.
          title: created_at
        id:
          description: Unique identifier.
          title: id
          type: string
        keyId:
          description: Optional key ID for user-specific configurations.
          title: key_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this configuration was last modified.
          title: updated_at
        userId:
          description: "User ID who owns this configuration.\n \"system\" for global\
            \ configuration."
          title: user_id
          type: string
        version:
          description: "Version number (monotonically increasing).\n Used by workers\
            \ to detect changes."
          format: int64
          title: version
          type:
          - integer
          - string
      title: Configuration
      type: object
    agentrouter.configurator.v1.ConfigurationEvent:
      additionalProperties: false
      description: ConfigurationEvent represents a configuration change event.
      properties:
        configId:
          description: Reference to the configuration in liaison_configurations table.
          title: config_id
          type: string
        configType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Configuration type.
          title: config_type
        configVersion:
          description: Configuration version number.
          format: int64
          title: config_version
          type:
          - integer
          - string
        eventType:
          description: Event type (new/update/delete).
          title: event_type
          type: string
        id:
          description: Unique event identifier.
          title: id
          type: string
        keyId:
          description: Optional key ID for user-specific configurations.
          title: key_id
          type: string
        metadata:
          description: "Raw event metadata JSON from liaison_configuration_events.metadata.\n\
            \ Most config types leave this empty (the worker reads config_data via\n\
            \ GetConfiguration instead). DATAPLANE_UPGRADE events carry their\n trigger\
            \ payload here so the worker can dispatch off the event directly."
          title: metadata
          type: string
        retryCount:
          description: Retry count for failed events.
          format: int32
          title: retry_count
          type: integer
        status:
          description: Event status (pending/acknowledged/applied/failed).
          title: status
          type: string
        triggeredAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the event was triggered.
          title: triggered_at
        userId:
          description: User ID who owns this configuration.
          title: user_id
          type: string
        workspaceId:
          description: "Workspace (data plane) this event is scoped to. Empty for\
            \ legacy\n unscoped events written before multi-data-plane support."
          title: workspace_id
          type: string
      title: ConfigurationEvent
      type: object
    agentrouter.configurator.v1.DataplaneUpgradeCredential:
      additionalProperties: false
      description: "DataplaneUpgradeCredential is one slot of operator-supplied registry\n\
        \ credentials. Username + password are passed as cleartext to MP over\n TLS,\
        \ encrypted at rest, and only ever returned to the cluster's\n service-account-authenticated\
        \ worker."
      properties:
        password:
          description: Registry password/token for this slot (cleartext over TLS,
            encrypted at rest).
          title: password
          type: string
        registry:
          description: "Registry host override. Empty means use the slot's implicit\n\
            \ registry — source uses tare.tetrate.ai, destination is resolved\n from\
            \ the customer's image_registry value."
          title: registry
          type: string
        slot:
          description: "Slot names the registry side these credentials authenticate\
            \ against.\n Matches the missingCredentials enum surfaced in TarsUpgrade.status\n\
            \ (SourceRegistry / DestRegistryPush)."
          title: slot
          type: string
        username:
          description: Registry username for this slot (cleartext over TLS, encrypted
            at rest).
          title: username
          type: string
      title: DataplaneUpgradeCredential
      type: object
    agentrouter.configurator.v1.DataplaneUpgradeTrigger:
      additionalProperties: false
      description: "DataplaneUpgradeTrigger is the operator-provided payload for one\n\
        \ MP-initiated remote DP upgrade attempt. Mirrors the fields persisted\n into\
        \ liaison_configuration_events.metadata when the event is written."
      properties:
        acknowledgedPreflightChecks:
          description: "Check names the operator has accepted via the dashboard \"\
            proceed\n anyway\" flow. Matching Preflight error rows are downgraded\
            \ to\n warnings on the next attempt so the upgrade proceeds; the row stays\n\
            \ in status.preflightChecks for audit.\n\n Persistence is implicit: the\
            \ dashboard reads the previous event's\n metadata to pre-check the blocker\
            \ modal on retry, so \"remember this\"\n is the same code path as \"include\
            \ in this trigger\". No parallel\n storage."
          items:
            type: string
          title: acknowledged_preflight_checks
          type: array
        allowDowntime:
          description: Bypass the data-plane HA preflight. UI gates this to Super
            Admin.
          title: allow_downtime
          type: boolean
        credentialsRef:
          description: "Optional reference to a stored credential bundle (v1.x retry-with-creds\n\
            \ flow). Empty for the initial trigger; populated when the operator\n\
            \ resubmits after a NeedsCredentials reject."
          title: credentials_ref
          type: string
        persistInCluster:
          description: "When true on a retry-with-creds trigger, the worker preserves\
            \ the\n referenced service-secret row after delivery so subsequent upgrades\n\
            \ in this workspace can reuse it without re-prompting."
          title: persist_in_cluster
          type: boolean
        targetVersion:
          description: "tare release tag to upgrade to (e.g. \"v0.4.1\"). Shared across\
            \ Liaison,\n EG, AIGW, data-plane Envoy, and ExtProc."
          title: target_version
          type: string
      title: DataplaneUpgradeTrigger
      type: object
    agentrouter.configurator.v1.DeleteBYOKBackendsRequest:
      additionalProperties: false
      description: DeleteBYOKBackendsRequest deletes BYOK backends configuration.
      properties:
        userId:
          description: User ID who owns these backends.
          title: user_id
          type: string
      title: DeleteBYOKBackendsRequest
      type: object
    agentrouter.configurator.v1.DeleteBYOKBackendsResponse:
      additionalProperties: false
      description: DeleteBYOKBackendsResponse confirms the delete operation.
      properties:
        deleted:
          description: Whether the configuration was deleted.
          title: deleted
          type: boolean
      title: DeleteBYOKBackendsResponse
      type: object
    agentrouter.configurator.v1.DoctorRuntimeStatus:
      additionalProperties: false
      description: "DoctorRuntimeStatus is the liaison worker's backup view of the\
        \ tare-doctor\n CronJob's runtime health, derived from in-cluster Job/pod\
        \ state. Used to\n explain a stale doctor report rather than to gate anything."
      properties:
        instanceId:
          description: Worker pod identity (hostname / pod name) of the reporting
            instance.
          title: instance_id
          type: string
        lastSuccessfulRun:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: CronJob's last successful completion; unset if never / unknown.
          title: last_successful_run
        observedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the worker computed this verdict (worker clock).
          title: observed_at
        reason:
          description: "Human-readable failure reason when state=\"failing\" (e.g.\n\
            \ \"ImagePullBackOff\", \"CrashLoopBackOff\", \"exit code 1\")."
          title: reason
          type: string
        state:
          description: "Verdict for the doctor CronJob: \"ok\" (recent success / currently\
            \ running),\n \"failing\" (last Job failed), or \"suspended\"."
          title: state
          type: string
        tareVersion:
          description: Running liaison build version, from the worker binary's embedded
            version.
          title: tare_version
          type: string
      title: DoctorRuntimeStatus
      type: object
    agentrouter.configurator.v1.EventType:
      description: EventType defines the type of event that triggered the update.
      enum:
      - EVENT_TYPE_UNSPECIFIED
      - EVENT_TYPE_NEW
      - EVENT_TYPE_UPDATE
      - EVENT_TYPE_UPGRADE
      - EVENT_TYPE_UPGRADE_CANCEL
      - EVENT_TYPE_UPGRADE_ROLLBACK
      - EVENT_TYPE_DELETE
      - EVENT_TYPE_UPDATE_BYOK
      - EVENT_TYPE_UPDATE_MCP
      - EVENT_TYPE_UPDATE_OAUTH
      title: EventType
      type: string
    agentrouter.configurator.v1.FullSyncWorkspaceRequest:
      additionalProperties: false
      description: "FullSyncWorkspaceRequest is the (empty) request for FullSyncWorkspace.\n\
        \ Target workspace and customer are resolved from the caller's auth claims."
      title: FullSyncWorkspaceRequest
      type: object
    agentrouter.configurator.v1.FullSyncWorkspaceResponse:
      additionalProperties: false
      description: "FullSyncWorkspaceResponse reports how many slot events the full\
        \ sync\n enqueued, scoped to per-user buckets (global is handled by drift\
        \ sweep)."
      properties:
        replayedPerUser:
          description: Events enqueued for per-user config slots.
          format: int32
          title: replayed_per_user
          type: integer
        replayedPerUserPerKey:
          description: Events enqueued for per-user, per-key config slots.
          format: int32
          title: replayed_per_user_per_key
          type: integer
        replayedTotal:
          description: Total per-user slot events enqueued (sum of the fields below).
          format: int32
          title: replayed_total
          type: integer
      title: FullSyncWorkspaceResponse
      type: object
    agentrouter.configurator.v1.GatekeeperPublicKey:
      additionalProperties: false
      description: "GatekeeperPublicKey is a single customer-shared keypair entry\
        \ the\n filter uses to verify API-key JWTs."
      properties:
        alg:
          description: JWS algorithm (e.g., "ES256").
          title: alg
          type: string
        kid:
          description: Key ID, matches the `kid` header on API-key JWTs.
          title: kid
          type: string
        publicKeyPem:
          description: PEM-encoded public key.
          title: public_key_pem
          type: string
        use:
          description: JWK `use` value (e.g., "sig").
          title: use
          type: string
      title: GatekeeperPublicKey
      type: object
    agentrouter.configurator.v1.GetConfigurationRequest:
      additionalProperties: false
      description: GetConfigurationRequest requests configuration for users.
      properties:
        queries:
          description: "List of user queries to check for updates.\n Supports batch\
            \ queries for efficiency."
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.UserConfigQuery'
          title: queries
          type: array
      title: GetConfigurationRequest
      type: object
    agentrouter.configurator.v1.GetConfigurationResponse:
      additionalProperties: false
      description: GetConfigurationResponse returns configurations that have updates.
      properties:
        configurations:
          description: "List of configurations with updates.\n Only includes configs\
            \ where version > current_version in request."
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.Configuration'
          title: configurations
          type: array
      title: GetConfigurationResponse
      type: object
    agentrouter.configurator.v1.GetDataplaneUpgradeCredentialsRequest:
      additionalProperties: false
      properties:
        upgradeEventId:
          description: Upgrade event id whose stored credentials to fetch. Workspace
            claim must match.
          title: upgrade_event_id
          type: string
      title: GetDataplaneUpgradeCredentialsRequest
      type: object
    agentrouter.configurator.v1.GetDataplaneUpgradeCredentialsResponse:
      additionalProperties: false
      properties:
        credentials:
          description: "Plaintext credentials, decrypted at MP. Caller (worker) is\n\
            \ expected to materialise them as a dockerconfigjson Secret in\n the cluster\
            \ and call Ack to confirm successful delivery."
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.DataplaneUpgradeCredential'
          title: credentials
          type: array
        persistInCluster:
          description: "Mirrors SubmitDataplaneUpgradeCredentialsRequest.persist_in_cluster.\n\
            \ Worker uses this to decide whether to set ownerReferences on the\n generated\
            \ Secret."
          title: persist_in_cluster
          type: boolean
        present:
          description: "Empty when no operator submission has happened yet. Worker\n\
            \ treats this as \"keep polling\" and re-tries on its next tick."
          title: present
          type: boolean
      title: GetDataplaneUpgradeCredentialsResponse
      type: object
    agentrouter.configurator.v1.ListActiveProvidersRequest:
      additionalProperties: false
      description: ListActiveProvidersRequest requests list of active AI providers.
      title: ListActiveProvidersRequest
      type: object
    agentrouter.configurator.v1.ListActiveProvidersResponse:
      additionalProperties: false
      description: ListActiveProvidersResponse returns list of active AI providers.
      properties:
        providers:
          description: Active (enabled) AI providers from the database.
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.Provider'
          title: providers
          type: array
      title: ListActiveProvidersResponse
      type: object
    agentrouter.configurator.v1.ListActiveUsersRequest:
      additionalProperties: false
      description: ListActiveUsersRequest requests list of active users.
      properties:
        limit:
          description: "Maximum number of users to return.\n If not specified, defaults\
            \ to 100."
          format: int32
          title: limit
          type: integer
      title: ListActiveUsersRequest
      type: object
    agentrouter.configurator.v1.ListActiveUsersResponse:
      additionalProperties: false
      description: ListActiveUsersResponse returns list of active user IDs.
      properties:
        userIds:
          description: User IDs that currently have active configurations.
          items:
            type: string
          title: user_ids
          type: array
      title: ListActiveUsersResponse
      type: object
    agentrouter.configurator.v1.ListConfigurationsRequest:
      additionalProperties: false
      description: ListConfigurationsRequest lists configurations with filtering.
      properties:
        configType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Filter by config type (optional).
          title: config_type
        pageSize:
          description: Pagination.
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: Page token returned by a prior call's next_page_token.
          title: page_token
          type: string
        userId:
          description: Filter by user ID (optional).
          title: user_id
          type: string
      title: ListConfigurationsRequest
      type: object
    agentrouter.configurator.v1.ListConfigurationsResponse:
      additionalProperties: false
      description: ListConfigurationsResponse returns list of configurations.
      properties:
        configurations:
          description: Configurations matching the request filters for this page.
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.Configuration'
          title: configurations
          type: array
        nextPageToken:
          description: Token to pass as page_token to fetch the next page; empty when
            no more.
          title: next_page_token
          type: string
      title: ListConfigurationsResponse
      type: object
    agentrouter.configurator.v1.ListPendingEventsRequest:
      additionalProperties: false
      description: ListPendingEventsRequest requests list of pending configuration
        events.
      properties:
        doctorRuntime:
          $ref: '#/components/schemas/agentrouter.configurator.v1.DoctorRuntimeStatus'
          description: "The liaison's out-of-band observation of the tare-doctor CronJob,\n\
            \ piggybacked on the poll. Lets MP surface *why* the doctor stopped\n\
            \ reporting — the doctor can't report when it is itself the broken\n component,\
            \ so the (live) worker reports on its behalf. Empty on legacy\n workers\
            \ and until the worker's first doctor sweep."
          title: doctor_runtime
        limit:
          description: "Maximum number of events to return.\n If not specified, defaults\
            \ to 100."
          format: int32
          title: limit
          type: integer
      title: ListPendingEventsRequest
      type: object
    agentrouter.configurator.v1.ListPendingEventsResponse:
      additionalProperties: false
      description: ListPendingEventsResponse returns list of pending events.
      properties:
        events:
          description: Pending configuration events awaiting worker processing.
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigurationEvent'
          title: events
          type: array
      title: ListPendingEventsResponse
      type: object
    agentrouter.configurator.v1.Provider:
      additionalProperties: false
      description: Provider represents an AI provider from the database.
      properties:
        apiBaseUrl:
          description: API base URL for the provider endpoint.
          title: api_base_url
          type: string
        authType:
          description: Authentication type (e.g., "api_key", "aws", "vertex").
          title: auth_type
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Timestamps.
          title: created_at
        displayName:
          description: Display name for the provider.
          title: display_name
          type: string
        isEnabled:
          description: Whether the provider is enabled.
          title: is_enabled
          type: boolean
        metadata:
          description: Additional metadata as JSON string.
          title: metadata
          type: string
        slug:
          description: Provider slug/name (e.g., "openai", "anthropic").
          title: slug
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When this provider record was last modified.
          title: updated_at
      title: Provider
      type: object
    agentrouter.configurator.v1.ProviderBackend:
      additionalProperties: false
      description: ProviderBackend represents a single BYOK provider backend.
      properties:
        byokPolicy:
          description: BYOK policy ("none", "always", "primary", "fallback").
          title: byok_policy
          type: string
        isExternal:
          description: Whether provider is external (not managed by Agent Router).
          title: is_external
          type: boolean
        modelName:
          description: Model name in this provider.
          title: model_name
          type: string
        name:
          description: Backend name (e.g., "fsbb-anthropic-owner-keyid").
          title: name
          type: string
        owner:
          description: Owner/user ID.
          title: owner
          type: string
        priority:
          description: Fallback priority (lower is higher priority).
          format: int32
          title: priority
          type: integer
        provider:
          description: Provider name (e.g., "anthropic").
          title: provider
          type: string
        weight:
          description: Traffic weight for load balancing.
          format: int32
          title: weight
          type: integer
      title: ProviderBackend
      type: object
    agentrouter.configurator.v1.ReconcileWorkspaceRequest:
      additionalProperties: false
      description: "ReconcileWorkspaceRequest is the (empty) request for ReconcileWorkspace.\n\
        \ Target workspace is resolved from the caller's auth claims."
      title: ReconcileWorkspaceRequest
      type: object
    agentrouter.configurator.v1.ReconcileWorkspaceResponse:
      additionalProperties: false
      description: "ReconcileWorkspaceResponse reports how many slot events the sweep\n\
        \ enqueued. replayed_total is the sum of the per-bucket counts."
      properties:
        replayedGlobal:
          description: Events enqueued for the global (system-wide) config slot.
          format: int32
          title: replayed_global
          type: integer
        replayedPerUser:
          description: Events enqueued for per-user config slots.
          format: int32
          title: replayed_per_user
          type: integer
        replayedPerUserPerKey:
          description: Events enqueued for per-user, per-key config slots.
          format: int32
          title: replayed_per_user_per_key
          type: integer
        replayedTotal:
          description: Total slot events enqueued across all buckets (sum of the fields
            below).
          format: int32
          title: replayed_total
          type: integer
      title: ReconcileWorkspaceResponse
      type: object
    agentrouter.configurator.v1.ReportMCPRouteStatusRequest:
      additionalProperties: false
      description: "ReportMCPRouteStatusRequest reports an MCP route's in-cluster\
        \ readiness.\n Exactly one scope is set: (customer_id + project_id) for a\
        \ per-Project-Gateway\n MCP route, or user_id for the per-user route. The\
        \ worker reads these off the\n MCP RouteDeployment's labels (stamped at apply\
        \ from the profile data)."
      properties:
        customerId:
          description: 'Per-gateway scope: the project whose MCP route this is.'
          title: customer_id
          type: string
        message:
          description: Human-readable reason when not ready (surfaced as the profile
            error_message).
          title: message
          type: string
        projectId:
          title: project_id
          type: string
        ready:
          description: True when the RouteDeployment's child MCPRoute(s) are Accepted/programmed.
          title: ready
          type: boolean
        userId:
          description: "Per-user scope (the legacy non-gateway MCP route owner). Mutually\
            \ exclusive\n with customer_id/project_id."
          title: user_id
          type: string
      title: ReportMCPRouteStatusRequest
      type: object
    agentrouter.configurator.v1.ReportMCPRouteStatusResponse:
      additionalProperties: false
      description: ReportMCPRouteStatusResponse confirms how many profiles were updated.
      properties:
        updated:
          description: Number of mcp_profiles rows whose status changed.
          format: int32
          title: updated
          type: integer
      title: ReportMCPRouteStatusResponse
      type: object
    agentrouter.configurator.v1.RevokeUserTokenRequest:
      additionalProperties: false
      description: RevokeUserTokenRequest revokes a user token by JTI.
      properties:
        jti:
          description: JWT ID (JTI) of the token to revoke.
          title: jti
          type: string
        reason:
          description: Optional reason for revocation.
          nullable: true
          title: reason
          type: string
        userId:
          description: "User ID who owns the token being revoked.\n Used to populate\
            \ revoked_by field."
          title: user_id
          type: string
      title: RevokeUserTokenRequest
      type: object
    agentrouter.configurator.v1.RevokeUserTokenResponse:
      additionalProperties: false
      description: RevokeUserTokenResponse confirms the revocation.
      properties:
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the token was revoked.
          title: revoked_at
        success:
          description: Whether the token was successfully revoked.
          title: success
          type: boolean
      title: RevokeUserTokenResponse
      type: object
    agentrouter.configurator.v1.RollbackDataplaneUpgradeRequest:
      additionalProperties: false
      properties:
        upgradeEventId:
          description: "Upgrade event id of the completed upgrade being rolled back.\
            \ Used\n for audit + display (\"rollback of upgrade <id>\") and so the\
            \ worker\n can resolve the workspace + target revision from the original\
            \ event\n metadata."
          title: upgrade_event_id
          type: string
      title: RollbackDataplaneUpgradeRequest
      type: object
    agentrouter.configurator.v1.RollbackDataplaneUpgradeResponse:
      additionalProperties: false
      properties:
        rollbackEventId:
          description: "Event id of the new rollback event. The dashboard polls this\
            \ id to\n watch the rollback Job progress."
          title: rollback_event_id
          type: string
        success:
          title: success
          type: boolean
      title: RollbackDataplaneUpgradeResponse
      type: object
    agentrouter.configurator.v1.SaveBYOKBackendsRequest:
      additionalProperties: false
      description: SaveBYOKBackendsRequest saves BYOK backends configuration.
      properties:
        backends:
          description: List of provider backends to save.
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.ProviderBackend'
          title: backends
          type: array
        keyAddress:
          description: Key address (owner identifier) for these backends.
          title: key_address
          type: string
        userId:
          description: User ID who owns these backends.
          title: user_id
          type: string
      title: SaveBYOKBackendsRequest
      type: object
    agentrouter.configurator.v1.SaveBYOKBackendsResponse:
      additionalProperties: false
      description: SaveBYOKBackendsResponse confirms the save operation.
      properties:
        configuration:
          $ref: '#/components/schemas/agentrouter.configurator.v1.Configuration'
          description: Configuration that was saved.
          title: configuration
        updated:
          description: Whether the configuration was created or updated.
          title: updated
          type: boolean
      title: SaveBYOKBackendsResponse
      type: object
    agentrouter.configurator.v1.SetDataplaneURLRequest:
      additionalProperties: false
      description: "SetDataplaneURLRequest registers (or updates) the customer-facing\
        \ gateway\n URL for a data plane."
      properties:
        triggerUpdate:
          description: "When true, fire a PROXY_URL configuration event after persisting\
            \ the\n URL so the running data plane converges on the new value via the\n\
            \ worker's event loop. Dashboard admin edits set this; `tare install`\n\
            \ leaves it false because the data plane is being created and the chart\n\
            \ populates tars-config[proxy-url] directly at install time."
          title: trigger_update
          type: boolean
        url:
          description: "Full gateway URL (scheme + host + optional port), e.g.\n \"\
            https://router.acmecorp.tetrate.ai\"."
          title: url
          type: string
        workspaceId:
          description: "Workspace ID of the data plane whose URL is being set. Must\
            \ match the\n workspace claim on the caller's service-account token."
          title: workspace_id
          type: string
      title: SetDataplaneURLRequest
      type: object
    agentrouter.configurator.v1.SetDataplaneURLResponse:
      additionalProperties: false
      description: SetDataplaneURLResponse confirms the URL was persisted.
      title: SetDataplaneURLResponse
      type: object
    agentrouter.configurator.v1.SubmitDataplaneUpgradeCredentialsRequest:
      additionalProperties: false
      properties:
        credentials:
          description: Operator-supplied registry credentials, one entry per required
            slot.
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.DataplaneUpgradeCredential'
          title: credentials
          type: array
        persistInCluster:
          description: "When true, the worker creates the in-cluster Secret WITHOUT\
            \ an\n ownerReference back to the TarsUpgrade CR, and labels it\n `agentrouter.tetrate.ai/persistent=true`.\
            \ The Secret survives the\n upgrade so future upgrades and image pulls\
            \ can reuse it.\n\n When false (the default), the Secret is short-lived:\
            \ ownerRef\n cascade-deletes it when the CR is removed, and the orphan\n\
            \ janitor sweeps after terminal phases. Operators who don't tick\n the\
            \ form's \"save for future upgrades\" box get this.\n\n Either way, MP\
            \ DELETEs the ciphertext row from\n dataplane_upgrade_credentials as soon\
            \ as AckDataplaneUpgradeCredentials\n arrives — the secret material never\
            \ sits in the MP DB after sync\n completes."
          title: persist_in_cluster
          type: boolean
        upgradeEventId:
          description: "Upgrade event id (the liaison_configuration_events.id whose\n\
            \ metadata carries the trigger). Workspace claim must match."
          title: upgrade_event_id
          type: string
      title: SubmitDataplaneUpgradeCredentialsRequest
      type: object
    agentrouter.configurator.v1.SubmitDataplaneUpgradeCredentialsResponse:
      additionalProperties: false
      properties:
        credentialsId:
          description: "Echoes back the row id of the stored ciphertext for audit\
            \ log\n correlation."
          title: credentials_id
          type: string
        success:
          description: True if the ciphertext row was stored successfully.
          title: success
          type: boolean
      title: SubmitDataplaneUpgradeCredentialsResponse
      type: object
    agentrouter.configurator.v1.TriggerMetadata:
      additionalProperties: false
      description: "TriggerMetadata is the open extension point on TriggerUpdate for\
        \ config\n types whose payload is operator-supplied rather than DB-derived.\
        \ Add\n per-config-type sub-messages here as new types appear."
      properties:
        dataplaneUpgrade:
          $ref: '#/components/schemas/agentrouter.configurator.v1.DataplaneUpgradeTrigger'
          description: Set when config_type=CONFIG_TYPE_DATAPLANE_UPGRADE.
          title: dataplane_upgrade
      title: TriggerMetadata
      type: object
    agentrouter.configurator.v1.TriggerUpdateRequest:
      additionalProperties: false
      description: TriggerUpdateRequest triggers a configuration update.
      properties:
        configType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Configuration type to update.
          title: config_type
        eventType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.EventType'
          description: Event type that triggered this update.
          title: event_type
        keyId:
          description: "Optional key ID for user-specific configurations.\n Used for\
            \ BYOK, MCP profiles, etc."
          title: key_id
          type: string
        metadata:
          $ref: '#/components/schemas/agentrouter.configurator.v1.TriggerMetadata'
          description: "Optional inline payload for config types that take operator-provided\n\
            \ params. Ignored by config types that read their state from DB. Today\n\
            \ only CONFIG_TYPE_DATAPLANE_UPGRADE consumes this. The fields end up\n\
            \ merged into the persisted event.metadata JSON so the worker can read\n\
            \ them at dispatch time."
          title: metadata
        projectGatewayHostname:
          title: project_gateway_hostname
          type: string
        projectGatewayId:
          description: "Optional Project Gateway scope (Phase 2). When set, the emitted\
            \ event is\n additionally scoped to a single Project Gateway hosted by\
            \ the resolved\n workspace, and the gateway slug + hostname ride along\
            \ in the persisted\n event.metadata JSON. Empty for the common case (no\
            \ Project Gateways\n attached), in which case behavior is identical to\
            \ the pre-Project-Gateway\n path. These are additive: the configurator\
            \ derives them automatically by\n fanning out over a project's attached\
            \ Project Gateways; callers normally\n leave them unset."
          title: project_gateway_id
          type: string
        userId:
          description: "User ID for the configuration.\n If not provided, uses authenticated\
            \ user ID.\n Use \"system\" for global configuration."
          title: user_id
          type: string
        workspaceId:
          description: "Optional workspace (data plane) scope for the event.\n When\
            \ set, the configurator emits a single event scoped to this\n workspace\
            \ only. When unset, the configurator fans the event out\n to every workspace\
            \ belonging to the caller's customer, so every\n data plane in that customer\
            \ converges on the new configuration."
          title: workspace_id
          type: string
      title: TriggerUpdateRequest
      type: object
    agentrouter.configurator.v1.TriggerUpdateResponse:
      additionalProperties: false
      description: TriggerUpdateResponse confirms the update trigger.
      properties:
        configuration:
          $ref: '#/components/schemas/agentrouter.configurator.v1.Configuration'
          description: Configuration that was generated/updated.
          title: configuration
        configurationUpdated:
          description: Whether a new configuration was generated.
          title: configuration_updated
          type: boolean
      title: TriggerUpdateResponse
      type: object
    agentrouter.configurator.v1.UpdateEventMetadataRequest:
      additionalProperties: false
      description: "Full replacement of the metadata JSON on an existing event row.\
        \ The\n handler does NOT merge keys — callers send the complete intended state.\n\
        \ Workspace ownership is enforced server-side against the caller's claims.\n\
        \ Upgrade workers use this to push TarsUpgrade.status changes back to MP."
      properties:
        eventId:
          description: "Event ID (UUID, matches ConfigurationEvent.id) whose metadata\
            \ is\n being replaced."
          title: event_id
          type: string
        metadata:
          description: Full intended metadata JSON. Empty string clears the column.
          title: metadata
          type: string
      title: UpdateEventMetadataRequest
      type: object
    agentrouter.configurator.v1.UpdateEventMetadataResponse:
      additionalProperties: false
      properties:
        success:
          description: "Server returns success=false when the event doesn't exist\
            \ or when the\n caller's workspace doesn't own it. No error code path;\
            \ callers should\n log and continue (a stale event id can race with operator-initiated\n\
            \ cancellation, which is benign)."
          title: success
          type: boolean
      title: UpdateEventMetadataResponse
      type: object
    agentrouter.configurator.v1.UpsertMCPCatalogServerRequest:
      additionalProperties: false
      description: "UpsertMCPCatalogServerRequest carries the operator-provided URL\
        \ plus\n the catalog-seed fields needed to populate a new row in\n mcp_catalog_servers.\
        \ See the RPC comment above for semantics."
      properties:
        authentication:
          description: "Auth metadata, also seed-derived. Same write semantics as\
            \ the\n display fields."
          title: authentication
          type: string
        categories:
          description: Catalog category tags the server is grouped under.
          items:
            type: string
          title: categories
          type: array
        description:
          description: Human-readable description of the MCP server.
          title: description
          type: string
        forceOverwrite:
          description: "When true, every field above (including url) replaces the\
            \ existing\n row, clobbering dashboard edits. Default false: sparse update\
            \ —\n only url + is_enabled (+ updated_at) move on an existing row."
          title: force_overwrite
          type: boolean
        iconUrl:
          description: URL of the server's display icon.
          title: icon_url
          type: string
        id:
          description: "Stable identifier — matches mcp_catalog_servers.id. Comes\
            \ from the\n catalog seed JSON; the operator picks the server name on\
            \ the\n command line (`tare mcp enable jira`)."
          title: id
          type: string
        name:
          description: "Seed-derived display fields. Used only when the row is being\n\
            \ INSERTed (or when force_overwrite=true); ignored on sparse updates\n\
            \ of an existing row."
          title: name
          type: string
        requiresAuth:
          description: Whether clients must authenticate to use this server.
          title: requires_auth
          type: boolean
        url:
          description: "In-cluster (or public) URL the operator wants the dashboard\
            \ to use\n as this server's backend endpoint. The only field the operator\n\
            \ explicitly enters — everything else flows from the seed JSON."
          title: url
          type: string
        workspaceId:
          description: "Workspace ID — must match the workspace claim on the caller's\
            \ SA\n token. API-key callers (admin scope) are trusted across workspaces."
          title: workspace_id
          type: string
      title: UpsertMCPCatalogServerRequest
      type: object
    agentrouter.configurator.v1.UpsertMCPCatalogServerResponse:
      additionalProperties: false
      description: UpsertMCPCatalogServerResponse describes the outcome.
      properties:
        created:
          description: True if a new row was inserted; false if an existing row was
            updated.
          title: created
          type: boolean
      title: UpsertMCPCatalogServerResponse
      type: object
    agentrouter.configurator.v1.UserConfigQuery:
      additionalProperties: false
      description: UserConfigQuery queries configuration for a specific user and config
        type.
      properties:
        configType:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Configuration type to query.
          title: config_type
        currentVersion:
          description: "Current version the client has.\n Server returns configuration\
            \ only if version is newer."
          format: int64
          title: current_version
          type:
          - integer
          - string
        keyId:
          description: "Key ID for user-specific configurations.\n Used for BYOK,\
            \ User routes, MCP profiles, etc."
          title: key_id
          type: string
        userId:
          description: "User ID to query configuration for.\n Use \"system\" for global/system-level\
            \ configuration."
          title: user_id
          type: string
      title: UserConfigQuery
      type: object
    agentrouter.configurator.v1.ValidateDataplaneRequest:
      additionalProperties: false
      description: "ValidateDataplaneRequest is sent by a data plane's filter (via\
        \ the\n worker's authenticated channel) to confirm this DP is still active\
        \ and\n fetch the customer's gatekeeper public keys.\n\n The caller is identified\
        \ by the SA JWT it signs with its DP keypair\n (kid=`instance-<...>`); MP's\
        \ auth layer looks the kid up in the\n `keypairs` table and rejects the call\
        \ with Unauthenticated when the row\n is soft-deleted. No fields are required\
        \ — everything MP needs is in the\n authenticated claims."
      title: ValidateDataplaneRequest
      type: object
    agentrouter.configurator.v1.ValidateDataplaneResponse:
      additionalProperties: false
      description: "ValidateDataplaneResponse returns the customer's current gatekeeper\n\
        \ public keys. The filter uses these to verify user-token (API key) JWTs\n\
        \ when its in-process key cache is cold."
      properties:
        gatekeeperPublicKeys:
          description: "Gatekeeper public keys for the customer this DP belongs to.\
            \ Contains\n the customer-shared keypair rows (kid has no `instance-`\
            \ prefix);\n the DP's own identity key is not included."
          items:
            $ref: '#/components/schemas/agentrouter.configurator.v1.GatekeeperPublicKey'
          title: gatekeeper_public_keys
          type: array
      title: ValidateDataplaneResponse
      type: object
    agentrouter.guardrails.v1.AIDiscoveryConfiguration:
      additionalProperties: false
      description: "AIDiscoveryConfiguration is the complete guardrails configuration\
        \ the\n management plane assembles for one project and the data-plane aidiscovery\n\
        \ filter consumes. It is serialized with protojson; this JSON is the wire\n\
        \ contract between the control plane and the gateway.\n\n The runtime guardrail/rule/provider\
        \ messages below are a distinct,\n flattened projection of the CRUD entities\
        \ (Guardrail, GuardrailRule,\n GuardrailProvider): rules are embedded under\
        \ their guardrail, identity and\n audit columns are dropped, and enums travel\
        \ as their canonical names."
      properties:
        aiProcessor:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.AIProcessorConfiguration'
          title: ai_processor
        guardrailConfig:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRuntimeConfig'
          title: guardrail_config
      title: AIDiscoveryConfiguration
      type: object
    agentrouter.guardrails.v1.AIProcessorConfiguration:
      additionalProperties: false
      description: "AIProcessorConfiguration carries the request/response processing\
        \ settings for\n the aidiscovery filter."
      properties:
        aodManagementPlanes:
          description: Management plane endpoints the data plane reports discovery
            results to.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.ManagementPlane'
          title: aod_management_planes
          type: array
        headersToIdentifyConsumers:
          description: Request header names used to identify the calling consumer.
          items:
            type: string
          title: headers_to_identify_consumers
          type: array
        parsers:
          description: Parsers enabled for request/response bodies (e.g., "openai",
            "bedrock").
          items:
            type: string
          title: parsers
          type: array
        roundTripValidationEnabled:
          description: "When true, parse, re-serialize, and compare request/response\
            \ bodies to\n detect missing or inconsistent parsed properties."
          title: round_trip_validation_enabled
          type: boolean
      title: AIProcessorConfiguration
      type: object
    agentrouter.guardrails.v1.BanCompetitorsConfiguration:
      additionalProperties: false
      description: "BanCompetitorsConfiguration for CHECK_TYPE_BAN_COMPETITORS\n with\
        \ provider=\"builtin\".\n\n Configures brand protection with signal-counting\
        \ disambiguation.\n Detection action is controlled by the rule-level RuleAction\
        \ field."
      properties:
        brandSelf:
          description: The brand name to protect.
          title: brand_self
          type: string
        competitors:
          description: List of competitor names to detect.
          items:
            type: string
          title: competitors
          type: array
      title: BanCompetitorsConfiguration
      type: object
    agentrouter.guardrails.v1.BanSubstringsConfiguration:
      additionalProperties: false
      description: BanSubstringsConfiguration for CHECK_TYPE_BANNED_SUBSTRINGS.
      properties:
        caseSensitive:
          description: Whether matching is case-sensitive.
          title: case_sensitive
          type: boolean
        substrings:
          description: List of substrings to ban.
          items:
            type: string
          title: substrings
          type: array
      title: BanSubstringsConfiguration
      type: object
    agentrouter.guardrails.v1.BanTopicsConfiguration:
      additionalProperties: false
      description: BanTopicsConfiguration for CHECK_TYPE_BANNED_TOPICS.
      properties:
        bannedTopics:
          description: List of topics to ban.
          items:
            type: string
          title: banned_topics
          type: array
        similarityThreshold:
          description: Similarity threshold for topic matching (0.0 to 1.0).
          format: float
          title: similarity_threshold
          type: number
      title: BanTopicsConfiguration
      type: object
    agentrouter.guardrails.v1.BiasConfiguration:
      additionalProperties: false
      description: BiasConfiguration for CHECK_TYPE_BIAS.
      properties:
        biasCategories:
          description: Categories of bias to detect.
          items:
            type: string
          title: bias_categories
          type: array
        threshold:
          description: Bias detection threshold (0.0 to 1.0).
          format: float
          title: threshold
          type: number
      title: BiasConfiguration
      type: object
    agentrouter.guardrails.v1.BuiltinDetectionConfiguration:
      additionalProperties: false
      description: "BuiltinDetectionConfiguration for rules with provider=\"builtin\"\
        .\n\n Configures the 5-layer detection pipeline, evaluated in order:\n blocked\
        \ keywords (layer 1), allowlist phrases (layer 2),\n conditional matching\
        \ (layer 3), detection patterns (layer 4),\n and general keyword detection\
        \ (layer 5).\n\n Blocked keywords run first and are zero-tolerance: they always\
        \ trigger\n regardless of any allowlist match. Allowlist phrases only suppress\n\
        \ detections from layers 3-5, not from layer 1."
      properties:
        allowlistPhrases:
          description: "Layer 2: Phrases that suppress detections from layers 3-5\
            \ (false-positive\n prevention). Do NOT override layer 1 blocked_keywords\
            \ -- if any blocked\n keyword matches, allowlist_phrases are not consulted."
          items:
            type: string
          title: allowlist_phrases
          type: array
        blockedKeywords:
          description: "Layer 1: Zero-tolerance keywords that always trigger. Not\
            \ bypassed by\n allowlist_phrases."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.DetectionKeyword'
          title: blocked_keywords
          type: array
        categoryName:
          description: Category identifier, e.g., "denied_insults".
          title: category_name
          type: string
        description:
          description: Description of what this category detects.
          title: description
          type: string
        detectionPatterns:
          description: "Layer 4: Regex phrase detection patterns with per-pattern\
            \ exceptions\n and severity bands. Suppressed by allowlist_phrases."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.DetectionPattern'
          title: detection_patterns
          type: array
        displayName:
          description: Human-readable name, e.g., "Insults & Personal Attacks".
          title: display_name
          type: string
        flaggedTerms:
          description: "Layer 3: Conditional matching -- offensive terms (e.g., \"\
            stupid\", \"dumb\").\n Suppressed by allowlist_phrases."
          items:
            type: string
          title: flagged_terms
          type: array
        keywords:
          description: "Layer 5: General keyword detection with severity levels. Filtered\
            \ by\n min_severity and suppressed by allowlist_phrases."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.DetectionKeyword'
          title: keywords
          type: array
        minSeverity:
          description: "Minimum severity to trigger: \"high\", \"medium\", \"low\"\
            . Applies to\n layers 4 and 5."
          title: min_severity
          type: string
        patternNames:
          description: Names of Pattern entities from the patterns catalog.
          items:
            type: string
          title: pattern_names
          type: array
        targetSubjects:
          description: "Layer 3: Conditional matching -- target subjects (e.g., \"\
            you\", \"they\").\n Suppressed by allowlist_phrases."
          items:
            type: string
          title: target_subjects
          type: array
      title: BuiltinDetectionConfiguration
      type: object
    agentrouter.guardrails.v1.CheckType:
      description: "CheckType defines the specific type of detection or validation\
        \ logic.\n\n Each check type implements a different kind of guardrail logic,\
        \ from\n simple pattern matching to sophisticated ML-based detection. Values\
        \ are\n aligned with discovery-gateway's canonical Check vocabulary."
      enum:
      - CHECK_TYPE_UNSPECIFIED
      - CHECK_TYPE_PII
      - CHECK_TYPE_BANNED_TOPICS
      - CHECK_TYPE_BAN_COMPETITORS
      - CHECK_TYPE_BANNED_SUBSTRINGS
      - CHECK_TYPE_BAN_CODE
      - CHECK_TYPE_BIAS
      - CHECK_TYPE_CODE
      - CHECK_TYPE_FACTUAL_CONSISTENCY
      - CHECK_TYPE_GIBBERISH
      - CHECK_TYPE_LANGUAGE
      - CHECK_TYPE_PROMPT_INJECTION
      - CHECK_TYPE_REGEXP
      - CHECK_TYPE_RELEVANCE
      - CHECK_TYPE_SECRETS
      - CHECK_TYPE_SENTIMENT
      - CHECK_TYPE_TOXICITY
      - CHECK_TYPE_COMPLIANCE
      - CHECK_TYPE_JAILBREAK
      - CHECK_TYPE_HATE_SPEECH
      - CHECK_TYPE_SEXUAL_CONTENT
      - CHECK_TYPE_VIOLENCE
      - CHECK_TYPE_SELF_HARM
      - CHECK_TYPE_PROTECTED_MATERIAL
      title: CheckType
      type: string
    agentrouter.guardrails.v1.CreateGuardrailFromTemplateRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        description:
          description: Optional description for the new guardrail.
          title: description
          type: string
        name:
          description: 'Required: display name for the new guardrail.'
          title: name
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        templateId:
          description: 'Required: id of the template guardrail (is_template=true)
            to clone.'
          title: template_id
          type: string
      required:
      - templateId
      - name
      title: CreateGuardrailFromTemplateRequest
      type: object
    agentrouter.guardrails.v1.CreateGuardrailFromTemplateResponse:
      additionalProperties: false
      properties:
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: The newly created guardrail instantiated from the template.
          title: guardrail
      title: CreateGuardrailFromTemplateResponse
      type: object
    agentrouter.guardrails.v1.CreateGuardrailProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        provider:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          description: 'Required: provider to create. id must be absent or empty (server-assigned).'
          title: provider
      required:
      - provider
      title: CreateGuardrailProviderRequest
      type: object
    agentrouter.guardrails.v1.CreateGuardrailProviderResponse:
      additionalProperties: false
      properties:
        provider:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          description: The created provider with server-assigned fields populated.
          title: provider
      title: CreateGuardrailProviderResponse
      type: object
    agentrouter.guardrails.v1.CreateGuardrailRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: 'Required: guardrail to create. id must be absent or empty
            (server-assigned).'
          title: guardrail
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - guardrail
      title: CreateGuardrailRequest
      type: object
    agentrouter.guardrails.v1.CreateGuardrailResponse:
      additionalProperties: false
      properties:
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: The created guardrail with server-assigned fields populated.
          title: guardrail
      title: CreateGuardrailResponse
      type: object
    agentrouter.guardrails.v1.CreateGuardrailRuleRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrailId:
          description: 'Required: parent guardrail id (must match rule.guardrail_id
            when both are set).'
          title: guardrail_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        rule:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          description: 'Required: rule to create. id must be absent or empty (server-assigned).'
          title: rule
      required:
      - guardrailId
      - rule
      title: CreateGuardrailRuleRequest
      type: object
    agentrouter.guardrails.v1.CreateGuardrailRuleResponse:
      additionalProperties: false
      properties:
        rule:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          description: The created rule with server-assigned fields populated.
          title: rule
      title: CreateGuardrailRuleResponse
      type: object
    agentrouter.guardrails.v1.CreatePatternRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        pattern:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          description: 'Required: pattern to create. id must be absent or empty (server-assigned).'
          title: pattern
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - pattern
      title: CreatePatternRequest
      type: object
    agentrouter.guardrails.v1.CreatePatternResponse:
      additionalProperties: false
      properties:
        pattern:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          description: The created pattern with server-assigned fields populated.
          title: pattern
      title: CreatePatternResponse
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the provider to delete.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: DeleteGuardrailProviderRequest
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailProviderResponse:
      additionalProperties: false
      description: DeleteGuardrailProviderResponse is intentionally empty.
      title: DeleteGuardrailProviderResponse
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the guardrail to delete.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: DeleteGuardrailRequest
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailResponse:
      additionalProperties: false
      description: DeleteGuardrailResponse is intentionally empty.
      title: DeleteGuardrailResponse
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailRuleRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrailId:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
        id:
          description: 'Required: uuid of the rule to delete.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - guardrailId
      - id
      title: DeleteGuardrailRuleRequest
      type: object
    agentrouter.guardrails.v1.DeleteGuardrailRuleResponse:
      additionalProperties: false
      description: DeleteGuardrailRuleResponse is intentionally empty.
      title: DeleteGuardrailRuleResponse
      type: object
    agentrouter.guardrails.v1.DeletePatternRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the pattern to delete.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: DeletePatternRequest
      type: object
    agentrouter.guardrails.v1.DeletePatternResponse:
      additionalProperties: false
      description: DeletePatternResponse is intentionally empty.
      title: DeletePatternResponse
      type: object
    agentrouter.guardrails.v1.DetectionKeyword:
      additionalProperties: false
      description: DetectionKeyword represents a keyword with its severity level.
      properties:
        keyword:
          description: The keyword or phrase to detect.
          title: keyword
          type: string
        severity:
          description: 'Severity level: "high", "medium", "low".'
          title: severity
          type: string
      title: DetectionKeyword
      type: object
    agentrouter.guardrails.v1.DetectionPattern:
      additionalProperties: false
      description: "DetectionPattern is a regex pattern with per-pattern exception\
        \ regexes and\n a severity band.\n\n At runtime the consumer evaluates `pattern`\
        \ against input; if any regex in\n `exceptions` matches the same input window\
        \ the detection is suppressed.\n `severity` is compared against BuiltinDetectionConfiguration.min_severity\
        \ to decide\n whether the pattern is active for the rule's threshold."
      properties:
        exceptions:
          description: "Regex exceptions. If any matches the input window where `pattern`\
            \ matched,\n the detection is suppressed."
          items:
            type: string
          title: exceptions
          type: array
        pattern:
          description: "Regex pattern (Go RE2 syntax). Case-insensitivity / multiline\
            \ must be\n expressed in the pattern body (e.g. \"(?i)\"), matching how\
            \ DB-authored\n patterns are stored."
          title: pattern
          type: string
        severity:
          description: "Severity band: \"high\", \"medium\", or \"low\". Compared\
            \ against\n BuiltinDetectionConfiguration.min_severity to filter low-priority\
            \ patterns."
          title: severity
          type: string
      title: DetectionPattern
      type: object
    agentrouter.guardrails.v1.EventsSummary:
      additionalProperties: false
      description: EventsSummary is a high-level count of trigger events for the dashboard.
      properties:
        recent30d:
          description: Trigger events recorded in the past 30 days.
          format: int64
          title: recent_30d
          type:
          - integer
          - string
        total:
          description: Total trigger events recorded in scope.
          format: int64
          title: total
          type:
          - integer
          - string
      title: EventsSummary
      type: object
    agentrouter.guardrails.v1.ExecuteOn:
      description: ExecuteOn specifies when a rule should be executed in the request
        lifecycle.
      enum:
      - EXECUTE_ON_UNSPECIFIED
      - EXECUTE_ON_INPUT
      - EXECUTE_ON_OUTPUT
      - EXECUTE_ON_INPUT_OUTPUT
      title: ExecuteOn
      type: string
    agentrouter.guardrails.v1.ExecuteOnContentType:
      description: ExecuteOnContentType specifies the content types a rule applies
        to.
      enum:
      - EXECUTE_ON_CONTENT_TYPE_UNSPECIFIED
      - EXECUTE_ON_CONTENT_TYPE_ALL
      - EXECUTE_ON_CONTENT_TYPE_TEXT
      - EXECUTE_ON_CONTENT_TYPE_IMAGE
      - EXECUTE_ON_CONTENT_TYPE_DOCUMENT
      - EXECUTE_ON_CONTENT_TYPE_TOOL
      - EXECUTE_ON_CONTENT_TYPE_THINKING
      - EXECUTE_ON_CONTENT_TYPE_CONTEXT
      title: ExecuteOnContentType
      type: string
    agentrouter.guardrails.v1.ExternalServiceConfiguration:
      additionalProperties: false
      description: "ExternalServiceConfiguration for rules whose provider is a named\
        \ row in\n guardrail_providers (i.e., not a built-in kind).\n\n Configures\
        \ integration with external HTTP guardrail APIs."
      properties:
        endpoint:
          description: HTTP endpoint URL for the external service.
          title: endpoint
          type: string
        headers:
          additionalProperties:
            title: value
            type: string
          description: HTTP headers to include in requests (e.g., Authorization).
          title: headers
          type: object
        requestFormat:
          description: Request format identifier (e.g., "openai_moderation").
          title: request_format
          type: string
        responseFormat:
          description: Response format identifier (e.g., "openai_moderation").
          title: response_format
          type: string
        timeoutMs:
          description: Request timeout in milliseconds.
          format: int32
          title: timeout_ms
          type: integer
      title: ExternalServiceConfiguration
      type: object
    agentrouter.guardrails.v1.ExternalServiceConfiguration.HeadersEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: HeadersEntry
      type: object
    agentrouter.guardrails.v1.FailureMode:
      description: "FailureMode determines the behavior when guardrail evaluation\
        \ fails or\n times out.\n\n This is a critical security vs. availability trade-off\
        \ that organisations\n must carefully consider based on their risk tolerance\
        \ and requirements."
      enum:
      - FAILURE_MODE_UNSPECIFIED
      - FAILURE_MODE_FAIL_CLOSE
      - FAILURE_MODE_FAIL_OPEN
      title: FailureMode
      type: string
    agentrouter.guardrails.v1.GetDashboardRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      title: GetDashboardRequest
      type: object
    agentrouter.guardrails.v1.GetDashboardResponse:
      additionalProperties: false
      properties:
        events:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.EventsSummary'
          description: Summary of trigger events recorded in scope.
          title: events
        guardrails:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailsSummary'
          description: Summary of guardrails configured in scope.
          title: guardrails
      title: GetDashboardResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the provider to fetch.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetGuardrailProviderRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailProviderResponse:
      additionalProperties: false
      properties:
        provider:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          description: The requested guardrail provider.
          title: provider
      title: GetGuardrailProviderResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the guardrail to fetch.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetGuardrailRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailResponse:
      additionalProperties: false
      properties:
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: The requested guardrail.
          title: guardrail
      title: GetGuardrailResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailRuleRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrailId:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
        id:
          description: 'Required: uuid of the rule to fetch.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - guardrailId
      - id
      title: GetGuardrailRuleRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailRuleResponse:
      additionalProperties: false
      properties:
        rule:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          description: The requested guardrail rule.
          title: rule
      title: GetGuardrailRuleResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailStatsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      title: GetGuardrailStatsRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailStatsResponse:
      additionalProperties: false
      properties:
        active:
          description: Number of guardrails with status ACTIVE.
          format: int64
          title: active
          type:
          - integer
          - string
        byCategory:
          additionalProperties:
            format: int64
            title: value
            type:
            - integer
            - string
          description: "Count of guardrails per GuardrailCategory. Keys are the stored\
            \ lowercase\n domain values (e.g. `data-privacy`, `financial`), not enum\
            \ value names."
          title: by_category
          type: object
        bySeverity:
          additionalProperties:
            format: int64
            title: value
            type:
            - integer
            - string
          description: "Count of guardrails per GuardrailSeverity. Keys are the stored\
            \ lowercase\n domain values (e.g. `critical`, `high`), not enum value\
            \ names."
          title: by_severity
          type: object
        byType:
          additionalProperties:
            format: int64
            title: value
            type:
            - integer
            - string
          description: "Count of guardrails per GuardrailType. Keys are the stored\
            \ lowercase domain\n values (e.g. `security`, `compliance`), not enum\
            \ value names."
          title: by_type
          type: object
        total:
          description: Total number of guardrails in scope.
          format: int64
          title: total
          type:
          - integer
          - string
      title: GetGuardrailStatsResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailStatsResponse.ByCategoryEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          format: int64
          title: value
          type:
          - integer
          - string
      title: ByCategoryEntry
      type: object
    agentrouter.guardrails.v1.GetGuardrailStatsResponse.BySeverityEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          format: int64
          title: value
          type:
          - integer
          - string
      title: BySeverityEntry
      type: object
    agentrouter.guardrails.v1.GetGuardrailStatsResponse.ByTypeEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          format: int64
          title: value
          type:
          - integer
          - string
      title: ByTypeEntry
      type: object
    agentrouter.guardrails.v1.GetGuardrailTriggerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: id of the trigger event to fetch.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetGuardrailTriggerRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailTriggerResponse:
      additionalProperties: false
      properties:
        trigger:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailTrigger'
          description: The requested guardrail trigger event.
          title: trigger
      title: GetGuardrailTriggerResponse
      type: object
    agentrouter.guardrails.v1.GetGuardrailTriggerStatsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      title: GetGuardrailTriggerStatsRequest
      type: object
    agentrouter.guardrails.v1.GetGuardrailTriggerStatsResponse:
      additionalProperties: false
      properties:
        avgExecutionTimeMs:
          description: Average execution time across all triggers, in milliseconds.
          format: double
          title: avg_execution_time_ms
          type: number
        timeDistribution:
          description: Time-series distribution of trigger counts.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TimeBucket'
          title: time_distribution
          type: array
        topConsumers:
          description: Ranked list of consumers by trigger count.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TopEntry'
          title: top_consumers
          type: array
        topGuardrails:
          description: Ranked list of guardrails by trigger count.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TopEntry'
          title: top_guardrails
          type: array
        topResources:
          description: Ranked list of resources by trigger count.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TopEntry'
          title: top_resources
          type: array
        totalTriggers:
          description: Total number of trigger events in scope.
          format: int64
          title: total_triggers
          type:
          - integer
          - string
      title: GetGuardrailTriggerStatsResponse
      type: object
    agentrouter.guardrails.v1.GetPatternRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the pattern to fetch.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetPatternRequest
      type: object
    agentrouter.guardrails.v1.GetPatternResponse:
      additionalProperties: false
      properties:
        pattern:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          description: The requested pattern.
          title: pattern
      title: GetPatternResponse
      type: object
    agentrouter.guardrails.v1.Guardrail:
      additionalProperties: false
      description: "Guardrail is the top-level policy resource.\n\n A guardrail bundles\
        \ GuardrailRules that are evaluated in the request\n pipeline. It is scoped\
        \ to (customer_id, project_id); the server fills\n those from the caller's\
        \ session claims when they are empty on write."
      properties:
        category:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailCategory'
          description: Industry or domain category for this guardrail. Required.
          title: category
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Owning customer scope. Defaults to the caller's session customer\
            \ when\n empty; immutable once set."
          title: customer_id
          type: string
        description:
          description: Optional freeform description.
          title: description
          type: string
        enabled:
          description: "Whether this guardrail is enabled for evaluation.\n Presence-tracked\
            \ so partial updates can distinguish \"unset = leave\n unchanged\" from\
            \ an explicit false. On create, absent means the server\n default (enabled=false)."
          nullable: true
          title: enabled
          type: boolean
        evaluationTimeoutMs:
          description: Maximum evaluation time in milliseconds. Zero means no explicit
            timeout.
          format: int32
          title: evaluation_timeout_ms
          type: integer
        failureMode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.FailureMode'
          description: Behaviour when evaluation fails or times out.
          title: failure_mode
        id:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
        isTemplate:
          description: "True when this row is a platform template (not directly used;\
            \ customers\n clone it via CreateGuardrailFromTemplate). Output-only."
          readOnly: true
          title: is_template
          type: boolean
        name:
          description: Human-readable display name. Required.
          title: name
          type: string
        projectId:
          description: "Owning project scope. Defaults to the caller's session project\
            \ when\n empty; immutable once set."
          title: project_id
          type: string
        severity:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailSeverity'
          description: Risk level of violations caught by this guardrail. Required.
          title: severity
        status:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailStatus'
          description: Operational state of the guardrail.
          title: status
        triggeredResponse:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredResponse'
          description: Optional response template emitted when this guardrail is triggered.
          title: triggered_response
        type:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          description: Broad classification of the guardrail's purpose. Required.
          title: type
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - name
      - type
      - severity
      - category
      title: Guardrail
      type: object
    agentrouter.guardrails.v1.GuardrailCategory:
      description: GuardrailCategory organises guardrails by industry or domain context.
      enum:
      - GUARDRAIL_CATEGORY_UNSPECIFIED
      - GUARDRAIL_CATEGORY_DATA_PRIVACY
      - GUARDRAIL_CATEGORY_FINANCIAL
      - GUARDRAIL_CATEGORY_HEALTHCARE
      - GUARDRAIL_CATEGORY_GOVERNMENT
      - GUARDRAIL_CATEGORY_CUSTOM
      title: GuardrailCategory
      type: string
    agentrouter.guardrails.v1.GuardrailProvider:
      additionalProperties: false
      description: "GuardrailProvider is a registered guardrail service provider.\n\
        \n Rules reference a provider by id (GuardrailRule.provider_id). The\n provider's\
        \ `kind` string tells the data-plane resolver which factory to\n use (e.g.,\
        \ \"regexp\", \"builtin\", \"tetrate\", or an external provider kind).\n\n\
        \ Global seeded rows (regexp / builtin / tetrate) are immutable via this API;\n\
        \ mutations return PERMISSION_DENIED. Operators can create additional provider\n\
        \ instances for external guardrail APIs."
      properties:
        config:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: "Provider-specific configuration as flexible JSON (e.g., endpoint,\n\
            \ credentials, headers, timeouts). Structure depends on the provider kind\n\
            \ and is validated at the application layer."
          title: config
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Owning customer scope. Defaults to the caller's session customer\
            \ when\n empty. Global seeded providers have this field empty (visible\
            \ everywhere)."
          title: customer_id
          type: string
        enabled:
          description: "Whether this provider is active and should be used for guardrail\n\
            \ evaluation. Disabled providers are skipped during rule execution.\n\
            \ Presence-tracked so partial updates can distinguish \"unset = leave\n\
            \ unchanged\" from an explicit false. On create, absent means the server\n\
            \ default (enabled=true)."
          nullable: true
          title: enabled
          type: boolean
        id:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
        isTemplate:
          description: "True when this row is a catalog template (not directly usable).\n\
            \ Operators clone a template to create an instance they can reference\
            \ from\n rules. Output-only."
          readOnly: true
          title: is_template
          type: boolean
        kind:
          description: "Stable implementation key that tells the resolver which data-plane\
            \ factory\n to use. Required. Examples: \"regexp\", \"builtin\", \"tetrate\"\
            ,\n \"azure-content-safety\". Not editable after creation."
          title: kind
          type: string
        name:
          description: "Human-readable display name. Required. Must be unique within\
            \ the\n customer scope."
          title: name
          type: string
        projectId:
          description: "Owning project scope. Defaults to the caller's session project\
            \ when\n empty. Global seeded providers have this field empty (visible\
            \ everywhere)."
          title: project_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - name
      - kind
      title: GuardrailProvider
      type: object
    agentrouter.guardrails.v1.GuardrailRule:
      additionalProperties: false
      description: "GuardrailRule is an atomic detection-and-enforcement unit within\
        \ a\n Guardrail.\n\n Each rule specifies a check type, the provider that performs\
        \ the\n evaluation, and the action to take on a violation. Rules can be scoped\n\
        \ to run on input, output, or both, and can be placed in MONITOR mode to\n\
        \ preview their effect without blocking traffic."
      properties:
        action:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleAction'
          description: Enforcement action when this rule triggers.
          title: action
        active:
          description: "Whether this rule is active. Inactive rules are skipped during\
            \ evaluation.\n Presence-tracked so partial updates can distinguish \"\
            unset = leave\n unchanged\" from an explicit false. On create, absent\
            \ means the server\n default (active=true)."
          nullable: true
          title: active
          type: boolean
        checkType:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.CheckType'
          description: Canonical safety check this rule performs.
          title: check_type
        configuration:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleConfiguration'
          description: "Provider-specific configuration. Exactly one RuleConfiguration\
            \ variant,\n selected to match this rule's provider kind and check_type.\
            \ Absent on\n update leaves the stored value untouched; a present configuration\n\
            \ replaces it wholesale."
          title: configuration
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        description:
          description: Optional freeform description.
          title: description
          type: string
        executeOn:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOn'
          description: When in the request lifecycle this rule executes.
          title: execute_on
        guardrailId:
          description: Parent guardrail id. Required.
          title: guardrail_id
          type: string
        id:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
        isTemplate:
          description: True when this row is a platform template. Output-only.
          readOnly: true
          title: is_template
          type: boolean
        mode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleMode'
          description: 'Enforcement mode: ENFORCE applies the action; MONITOR only
            reports.'
          title: mode
        name:
          description: Human-readable rule name. Required.
          title: name
          type: string
        providerId:
          description: "ID (UUID) of the provider used for execution. References a\
            \ row in\n guardrail_providers (including the built-in 'regexp' and 'builtin'\n\
            \ seeded rows). Required."
          title: provider_id
          type: string
        triggeredResponse:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredResponse'
          description: "Optional response template when this specific rule is triggered.\n\
            \ Can supplement the guardrail-level response."
          title: triggered_response
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - guardrailId
      - name
      - providerId
      title: GuardrailRule
      type: object
    agentrouter.guardrails.v1.GuardrailRuntimeConfig:
      additionalProperties: false
      description: GuardrailRuntimeConfig wraps the guardrail set in a nested `config`
        object.
      properties:
        config:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRuntimeConfigInner'
          title: config
      title: GuardrailRuntimeConfig
      type: object
    agentrouter.guardrails.v1.GuardrailRuntimeConfigInner:
      additionalProperties: false
      description: "GuardrailRuntimeConfigInner holds the project's guardrails and\
        \ the providers\n their rules reference."
      properties:
        guardrails:
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuntimeGuardrail'
          title: guardrails
          type: array
        managementPlane:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ManagementPlane'
          title: management_plane
        providers:
          description: "Provider instances referenced by rules, keyed by id (a UUID).\
            \ The entry's\n kind selects the data-plane factory."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuntimeGuardrailProvider'
          title: providers
          type: array
      title: GuardrailRuntimeConfigInner
      type: object
    agentrouter.guardrails.v1.GuardrailSeverity:
      description: "GuardrailSeverity indicates the risk level of violations caught\
        \ by a\n guardrail."
      enum:
      - GUARDRAIL_SEVERITY_UNSPECIFIED
      - GUARDRAIL_SEVERITY_LOW
      - GUARDRAIL_SEVERITY_MEDIUM
      - GUARDRAIL_SEVERITY_HIGH
      - GUARDRAIL_SEVERITY_CRITICAL
      title: GuardrailSeverity
      type: string
    agentrouter.guardrails.v1.GuardrailStatus:
      description: GuardrailStatus reflects the operational state of a guardrail.
      enum:
      - GUARDRAIL_STATUS_UNSPECIFIED
      - GUARDRAIL_STATUS_ACTIVE
      - GUARDRAIL_STATUS_INACTIVE
      - GUARDRAIL_STATUS_ERROR
      - GUARDRAIL_STATUS_TESTING
      title: GuardrailStatus
      type: string
    agentrouter.guardrails.v1.GuardrailTrigger:
      additionalProperties: false
      description: "GuardrailTrigger represents a single guardrail activation event\
        \ with full\n context.\n\n This captures comprehensive information about when\
        \ and why a guardrail was\n triggered, what evaluations were performed, and\
        \ what actions were taken.\n Essential for security monitoring, compliance\
        \ auditing, and understanding\n guardrail effectiveness."
      properties:
        consumerId:
          description: "Id of the consumer that initiated the request (user id, service\
            \ account,\n application id, etc.). Required."
          title: consumer_id
          type: string
        customerId:
          description: "Owning customer scope.\n\n When the RPC is authenticated as\
            \ a service account the server ALWAYS\n derives the scope from the caller's\
            \ token (customer claim + workspace's\n project). Explicit values supplied\
            \ here MUST match the resolved scope; a\n mismatch returns success=false\
            \ with TRIGGER_ERROR_CODE_VALIDATION_ERROR for\n that item. In test/dev\
            \ contexts without claims the value must be provided\n explicitly; omitting\
            \ it returns TRIGGER_ERROR_CODE_VALIDATION_ERROR."
          title: customer_id
          type: string
        executionDurationMs:
          description: Total time taken to evaluate all rules in this guardrail, in
            milliseconds.
          format: int32
          title: execution_duration_ms
          type: integer
        guardrailId:
          description: Id of the guardrail that was triggered. Required.
          title: guardrail_id
          type: string
        id:
          description: "Client-generated UUID; used as the idempotency key to prevent\
            \ duplicate\n trigger records on retry. Required."
          title: id
          type: string
        metadata:
          additionalProperties:
            title: value
            type: string
          description: "Extensible key-value metadata (trace ids, geographic context,\
            \ feature\n flags, etc.)."
          title: metadata
          type: object
        projectId:
          description: "Owning project scope.\n\n Same derivation rules as customer_id:\
            \ resolved from the authenticated\n service account's workspace in production;\
            \ explicit in test/dev contexts.\n An explicit value that differs from\
            \ the resolved scope returns per-item\n TRIGGER_ERROR_CODE_VALIDATION_ERROR."
          title: project_id
          type: string
        resourceId:
          description: "Id of the AI resource being accessed (model id, endpoint path,\
            \ service\n name, etc.). Required."
          title: resource_id
          type: string
        ruleEvaluations:
          description: Per-rule evaluation results.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleEvaluation'
          title: rule_evaluations
          type: array
        triggeredAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Timestamp when the guardrail was triggered. Required.
          title: triggered_at
      required:
      - id
      - triggeredAt
      - guardrailId
      - consumerId
      - resourceId
      title: GuardrailTrigger
      type: object
    agentrouter.guardrails.v1.GuardrailTrigger.MetadataEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: MetadataEntry
      type: object
    agentrouter.guardrails.v1.GuardrailType:
      description: GuardrailType classifies the broad purpose of a guardrail.
      enum:
      - GUARDRAIL_TYPE_UNSPECIFIED
      - GUARDRAIL_TYPE_COMPLIANCE
      - GUARDRAIL_TYPE_SECURITY
      - GUARDRAIL_TYPE_POLICY
      - GUARDRAIL_TYPE_QUALITY
      - GUARDRAIL_TYPE_CUSTOM
      - GUARDRAIL_TYPE_EVALUATOR
      title: GuardrailType
      type: string
    agentrouter.guardrails.v1.GuardrailsSummary:
      additionalProperties: false
      description: GuardrailsSummary is a high-level count of guardrails for the dashboard.
      properties:
        active:
          description: Guardrails with status ACTIVE.
          format: int64
          title: active
          type:
          - integer
          - string
        bySeverity:
          additionalProperties:
            format: int64
            title: value
            type:
            - integer
            - string
          description: "Count of guardrails per GuardrailSeverity. Keys are the stored\
            \ lowercase\n domain values (e.g. `critical`, `high`), not enum value\
            \ names."
          title: by_severity
          type: object
        byType:
          additionalProperties:
            format: int64
            title: value
            type:
            - integer
            - string
          description: "Count of guardrails per GuardrailType. Keys are the stored\
            \ lowercase domain\n values (e.g. `security`, `compliance`), not enum\
            \ value names."
          title: by_type
          type: object
        total:
          description: Total guardrails in scope.
          format: int64
          title: total
          type:
          - integer
          - string
      title: GuardrailsSummary
      type: object
    agentrouter.guardrails.v1.GuardrailsSummary.BySeverityEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          format: int64
          title: value
          type:
          - integer
          - string
      title: BySeverityEntry
      type: object
    agentrouter.guardrails.v1.GuardrailsSummary.ByTypeEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          format: int64
          title: value
          type:
          - integer
          - string
      title: ByTypeEntry
      type: object
    agentrouter.guardrails.v1.LanguageConfiguration:
      additionalProperties: false
      description: LanguageConfiguration for CHECK_TYPE_LANGUAGE.
      properties:
        allowedLanguages:
          description: Allowed languages (ISO 639-1 codes).
          items:
            type: string
          title: allowed_languages
          type: array
        blockUnknown:
          description: Whether to block content in unrecognised languages.
          title: block_unknown
          type: boolean
      title: LanguageConfiguration
      type: object
    agentrouter.guardrails.v1.ListGuardrailProvidersRequest:
      additionalProperties: false
      properties:
        customerId:
          description: "Owning customer scope; defaults to caller's session customer\
            \ when empty.\n Globally-seeded providers are always included."
          title: customer_id
          type: string
        enabled:
          description: When set, filter to enabled or disabled providers only.
          nullable: true
          title: enabled
          type: boolean
        includeTemplates:
          description: When true, include template rows (is_template=true).
          title: include_templates
          type: boolean
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs.
          title: page
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        search:
          description: Optional substring search on provider name.
          title: search
          type: string
      title: ListGuardrailProvidersRequest
      type: object
    agentrouter.guardrails.v1.ListGuardrailProvidersResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs.
          title: page
        providers:
          description: Providers matching the request filters, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          title: providers
          type: array
        total:
          description: Total count of matching providers across all pages.
          format: int64
          title: total
          type:
          - integer
          - string
      title: ListGuardrailProvidersResponse
      type: object
    agentrouter.guardrails.v1.ListGuardrailRulesRequest:
      additionalProperties: false
      properties:
        actions:
          description: Filter to rules with these action values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleAction'
          title: actions
          type: array
        active:
          description: When set, filter to active or inactive rules only.
          nullable: true
          title: active
          type: boolean
        checkTypes:
          description: Filter to rules with these check_type values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.CheckType'
          title: check_types
          type: array
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        executeOn:
          description: Filter to rules with these execute_on values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOn'
          title: execute_on
          type: array
        guardrailId:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
        modes:
          description: Filter to rules with these mode values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleMode'
          title: modes
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs.
          title: page
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        providerIds:
          description: Filter to rules referencing these provider ids.
          items:
            type: string
          title: provider_ids
          type: array
        search:
          description: Optional substring search on rule name.
          title: search
          type: string
      required:
      - guardrailId
      title: ListGuardrailRulesRequest
      type: object
    agentrouter.guardrails.v1.ListGuardrailRulesResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs.
          title: page
        rules:
          description: Rules matching the request filters, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          title: rules
          type: array
        total:
          description: Total count of matching rules across all pages.
          format: int64
          title: total
          type:
          - integer
          - string
      title: ListGuardrailRulesResponse
      type: object
    agentrouter.guardrails.v1.ListGuardrailTriggersRequest:
      additionalProperties: false
      properties:
        consumerIds:
          description: Filter to events for these consumer ids.
          items:
            type: string
          title: consumer_ids
          type: array
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        dateFrom:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Inclusive start of the time range to query.
          title: date_from
        dateTo:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Inclusive end of the time range to query.
          title: date_to
        excludeGuardrailTypes:
          description: Exclude events for guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: exclude_guardrail_types
          type: array
        guardrailIds:
          description: Filter to events for these guardrail ids.
          items:
            type: string
          title: guardrail_ids
          type: array
        guardrailTypes:
          description: Filter to events for guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: guardrail_types
          type: array
        maxExecutionDurationMs:
          description: Filter to events with execution_duration_ms <= this value.
          format: int32
          nullable: true
          title: max_execution_duration_ms
          type: integer
        minExecutionDurationMs:
          description: Filter to events with execution_duration_ms >= this value.
          format: int32
          nullable: true
          title: min_execution_duration_ms
          type: integer
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs.
          title: page
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        resourceIds:
          description: Filter to events for these resource ids.
          items:
            type: string
          title: resource_ids
          type: array
      title: ListGuardrailTriggersRequest
      type: object
    agentrouter.guardrails.v1.ListGuardrailTriggersResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs.
          title: page
        total:
          description: Total count of matching triggers across all pages.
          format: int64
          title: total
          type:
          - integer
          - string
        triggers:
          description: Trigger events matching the request filters, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailTrigger'
          title: triggers
          type: array
      title: ListGuardrailTriggersResponse
      type: object
    agentrouter.guardrails.v1.ListGuardrailsRequest:
      additionalProperties: false
      properties:
        categories:
          description: Filter to guardrails in these categories.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailCategory'
          title: categories
          type: array
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        excludeTypes:
          description: Exclude guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: exclude_types
          type: array
        includeTemplates:
          description: When true, include platform template rows (is_template=true).
          title: include_templates
          type: boolean
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs.
          title: page
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        search:
          description: Optional substring search on guardrail name.
          title: search
          type: string
        severities:
          description: Filter to guardrails with these severity levels.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailSeverity'
          title: severities
          type: array
        statuses:
          description: Filter to guardrails in these statuses.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailStatus'
          title: statuses
          type: array
        types:
          description: Filter to guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: types
          type: array
      title: ListGuardrailsRequest
      type: object
    agentrouter.guardrails.v1.ListGuardrailsResponse:
      additionalProperties: false
      properties:
        guardrails:
          description: Guardrails matching the request filters, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          title: guardrails
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs.
          title: page
        total:
          description: Total count of matching guardrails across all pages.
          format: int64
          title: total
          type:
          - integer
          - string
      title: ListGuardrailsResponse
      type: object
    agentrouter.guardrails.v1.ListPatternsRequest:
      additionalProperties: false
      properties:
        builtinOnly:
          description: When true, return only built-in patterns (is_builtin=true).
          nullable: true
          title: builtin_only
          type: boolean
        category:
          description: Optional filter by category (e.g., "pii", "credentials").
          title: category
          type: string
        customerId:
          description: "Owning customer scope; defaults to caller's session customer\
            \ when empty.\n Built-in patterns are always included regardless of this\
            \ value."
          title: customer_id
          type: string
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs.
          title: page
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        search:
          description: Optional substring search on pattern name or display_name.
          title: search
          type: string
      title: ListPatternsRequest
      type: object
    agentrouter.guardrails.v1.ListPatternsResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs.
          title: page
        patterns:
          description: Patterns matching the request filters, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          title: patterns
          type: array
        total:
          description: Total count of matching patterns across all pages.
          format: int64
          title: total
          type:
          - integer
          - string
      title: ListPatternsResponse
      type: object
    agentrouter.guardrails.v1.ManagementPlane:
      additionalProperties: false
      description: "ManagementPlane describes a management plane endpoint the data\
        \ plane connects\n to for discovery reporting."
      properties:
        address:
          title: address
          type: string
        maxMessageSize:
          description: Maximum gRPC message size in bytes; 0 leaves the client default.
          format: int32
          title: max_message_size
          type: integer
        tlsConfig:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TLSConfig'
          title: tls_config
      title: ManagementPlane
      type: object
    agentrouter.guardrails.v1.Pattern:
      additionalProperties: false
      description: "Pattern is a reusable regex pattern definition (e.g., \"US SSN\"\
        ,\n \"email_address\") that guardrail rules reference by name via pattern_names\n\
        \ in BuiltinDetectionConfiguration or RegexConfiguration."
      properties:
        category:
          description: "Classification category for organising patterns\n (e.g., \"\
            pii\", \"credentials\", \"payment\", \"regional\").\n Free-text display\
            \ category."
          title: category
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Owning customer scope. Defaults to the caller's session customer\
            \ when\n empty. Built-in patterns have this field empty (globally visible)."
          title: customer_id
          type: string
        description:
          description: Explanation of what the pattern detects and any known limitations.
          title: description
          type: string
        displayName:
          description: Human-readable label shown in the UI (e.g., "US Social Security
            Number").
          title: display_name
          type: string
        id:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
        isBuiltin:
          description: "True when this pattern is from the built-in seed library.\
            \ Output-only.\n Built-in patterns are read-only and cannot be modified\
            \ or deleted via the\n API."
          readOnly: true
          title: is_builtin
          type: boolean
        name:
          description: "Machine-readable name used to reference this pattern in rule\n\
            \ configurations (e.g., \"us_ssn\", \"email_address\"). Required.\n Must\
            \ be unique within the customer scope."
          title: name
          type: string
        pattern:
          description: The RE2-compatible regex string used for content matching.
            Required.
          title: pattern
          type: string
        projectId:
          description: "Owning project scope. Defaults to the caller's session project\
            \ when\n empty. Built-in patterns have this field empty (globally visible)."
          title: project_id
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - name
      - pattern
      title: Pattern
      type: object
    agentrouter.guardrails.v1.PromptInjectionConfiguration:
      additionalProperties: false
      description: PromptInjectionConfiguration for CHECK_TYPE_PROMPT_INJECTION.
      properties:
        knownPatterns:
          description: Known injection patterns to check.
          items:
            type: string
          title: known_patterns
          type: array
        sensitivity:
          description: Detection sensitivity (0.0 to 1.0).
          format: float
          title: sensitivity
          type: number
        useMlDetection:
          description: Whether to use ML-based detection.
          title: use_ml_detection
          type: boolean
      title: PromptInjectionConfiguration
      type: object
    agentrouter.guardrails.v1.RegexConfiguration:
      additionalProperties: false
      description: "RegexConfiguration is shared by every rule whose provider is \"\
        regexp\",\n regardless of check_type. Case-insensitivity and multiline semantics\
        \ must\n be expressed in the pattern body (e.g. \"(?i)\", \"(?m)\"), matching\
        \ how\n DB-authored named patterns are stored."
      properties:
        patternNames:
          description: "Names of Pattern entities from the patterns catalog to include.\n\
            \ Resolved at runtime against the regexp provider's precompiled catalog."
          items:
            type: string
          title: pattern_names
          type: array
        redactionFormat:
          description: "Redaction template applied when a pattern matches. Supports\
            \ substitution\n parameters like \"{pattern_name}\". Example: \"[{pattern_name}_REDACTED]\"\
            \n expands to \"[EMAIL_REDACTED]\" for a pattern named \"EMAIL\". Empty\
            \ defaults\n to \"[REDACTED]\"."
          title: redaction_format
          type: string
      title: RegexConfiguration
      type: object
    agentrouter.guardrails.v1.ReportGuardrailTriggersRequest:
      additionalProperties: false
      description: "ReportGuardrailTriggersRequest carries a batch of trigger events\
        \ from the\n data plane to the management plane.\n\n Per-item failure model:\
        \ a malformed or unknown-reference trigger yields\n success=false for THAT\
        \ item only; the RPC itself fails only for auth errors,\n an empty batch,\
        \ or a batch exceeding 1000 triggers (INVALID_ARGUMENT).\n Duplicate trigger.id\
        \ values are NOT errors: a duplicate returns success=true\n with no error_code."
      properties:
        triggers:
          description: "Batch of trigger events to record. Idempotent on trigger.id.\
            \ Maximum 1000\n triggers per call; an empty batch returns INVALID_ARGUMENT."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailTrigger'
          title: triggers
          type: array
      title: ReportGuardrailTriggersRequest
      type: object
    agentrouter.guardrails.v1.ReportGuardrailTriggersResponse:
      additionalProperties: false
      description: ReportGuardrailTriggersResponse returns per-item results for the
        batch.
      properties:
        results:
          description: Per-trigger outcomes, one entry per input trigger in request
            order.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggerResult'
          title: results
          type: array
      title: ReportGuardrailTriggersResponse
      type: object
    agentrouter.guardrails.v1.RuleAction:
      description: "RuleAction defines the enforcement action when a rule triggers\
        \ and is\n running in ENFORCE mode.\n\n Whether the action is actually applied\
        \ is determined by the rule's\n RuleMode. This enum only describes what enforcement\
        \ would be performed."
      enum:
      - RULE_ACTION_UNSPECIFIED
      - RULE_ACTION_BLOCK
      - RULE_ACTION_REDACT
      title: RuleAction
      type: string
    agentrouter.guardrails.v1.RuleConfiguration:
      additionalProperties: false
      description: "RuleConfiguration is the typed, per-rule configuration carried\
        \ by\n GuardrailRule.configuration.\n\n Exactly one variant is set. The variant\
        \ must agree with the rule's\n provider kind and check_type; that agreement\
        \ is enforced server-side\n (protojson only guarantees that a single variant\
        \ is populated, not that\n it is the correct one for the provider/check_type).\n\
        \n The `raw` variant is the open-world fallback for external or\n customer-registered\
        \ providers whose configuration shape is not enumerated\n here."
      oneOf:
      - properties:
          banCompetitor:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.BanCompetitorsConfiguration'
            description: CHECK_TYPE_BAN_COMPETITORS with provider="builtin".
            title: ban_competitor
        required:
        - banCompetitor
        title: ban_competitor
      - properties:
          banSubstrings:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.BanSubstringsConfiguration'
            description: CHECK_TYPE_BANNED_SUBSTRINGS.
            title: ban_substrings
        required:
        - banSubstrings
        title: ban_substrings
      - properties:
          banTopics:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.BanTopicsConfiguration'
            description: CHECK_TYPE_BANNED_TOPICS.
            title: ban_topics
        required:
        - banTopics
        title: ban_topics
      - properties:
          bias:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.BiasConfiguration'
            description: CHECK_TYPE_BIAS.
            title: bias
        required:
        - bias
        title: bias
      - properties:
          builtinDetection:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.BuiltinDetectionConfiguration'
            description: provider="builtin" (the 5-layer detection pipeline).
            title: builtin_detection
        required:
        - builtinDetection
        title: builtin_detection
      - properties:
          externalService:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.ExternalServiceConfiguration'
            description: Provider is a named row in guardrail_providers (external
              HTTP service).
            title: external_service
        required:
        - externalService
        title: external_service
      - properties:
          language:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.LanguageConfiguration'
            description: CHECK_TYPE_LANGUAGE.
            title: language
        required:
        - language
        title: language
      - properties:
          promptInjection:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.PromptInjectionConfiguration'
            description: CHECK_TYPE_PROMPT_INJECTION.
            title: prompt_injection
        required:
        - promptInjection
        title: prompt_injection
      - properties:
          raw:
            $ref: '#/components/schemas/google.protobuf.Struct'
            description: "Fallback for providers whose configuration shape is not\
              \ enumerated\n above. Free-form JSON object."
            title: raw
        required:
        - raw
        title: raw
      - properties:
          regex:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RegexConfiguration'
            description: provider="regexp" (any check_type).
            title: regex
        required:
        - regex
        title: regex
      - properties:
          secrets:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.SecretsConfiguration'
            description: CHECK_TYPE_SECRETS.
            title: secrets
        required:
        - secrets
        title: secrets
      - properties:
          toxicity:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.ToxicityConfiguration'
            description: CHECK_TYPE_TOXICITY.
            title: toxicity
        required:
        - toxicity
        title: toxicity
      title: RuleConfiguration
      type: object
    agentrouter.guardrails.v1.RuleEvaluation:
      additionalProperties: false
      description: RuleEvaluation captures how a single guardrail rule evaluated the
        content.
      properties:
        action:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleAction'
          description: "Enforcement action declared by the rule at evaluation time\
            \ (BLOCK /\n REDACT). Indicates what would be applied regardless of whether\
            \ mode is\n ENFORCE or MONITOR."
          title: action
        checkType:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.CheckType'
          description: Canonical safety check performed by the rule.
          title: check_type
        executeOnContentType:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOnContentType'
          description: Content types this rule evaluated.
          title: execute_on_content_type
        executedOn:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOn'
          description: When in the request lifecycle this rule was executed.
          title: executed_on
        executionDurationMs:
          description: Time taken to evaluate this rule, in milliseconds.
          format: int32
          title: execution_duration_ms
          type: integer
        guardrailRuleId:
          description: Id of the specific rule that was evaluated. Required.
          title: guardrail_rule_id
          type: string
        inputResults:
          description: "Evaluation results for input messages.\n Empty when executed_on\
            \ is EXECUTE_ON_OUTPUT only."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredInputResult'
          title: input_results
          type: array
        mode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleMode'
          description: "Enforcement mode the rule was running in when this evaluation\
            \ fired.\n When mode == MONITOR the action was NOT applied; consumers\
            \ should render\n this as \"would have <action>\"."
          title: mode
        outputResults:
          description: "Evaluation results for output messages.\n Empty when executed_on\
            \ is EXECUTE_ON_INPUT only."
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredOutputResult'
          title: output_results
          type: array
        providerId:
          description: Id of the provider used for execution.
          title: provider_id
          type: string
        score:
          description: "Normalised score between 0.0 and 1.0 indicating confidence\
            \ or severity.\n Interpretation is rule-type-specific:\n   - toxicity:\
            \ higher score means more toxic\n   - PII detection: higher score means\
            \ higher confidence\n   - prompt injection: higher score means higher\
            \ risk"
          format: float
          title: score
          type: number
      required:
      - guardrailRuleId
      title: RuleEvaluation
      type: object
    agentrouter.guardrails.v1.RuleMode:
      description: "RuleMode determines whether a rule's action is enforced in-flight\
        \ or only\n observed and reported.\n\n MONITOR mode lets operators preview\
        \ a rule's effect (\"would have blocked\",\n \"would have redacted\") without\
        \ breaking the request flow."
      enum:
      - RULE_MODE_UNSPECIFIED
      - RULE_MODE_ENFORCE
      - RULE_MODE_MONITOR
      title: RuleMode
      type: string
    agentrouter.guardrails.v1.RuntimeGuardrail:
      additionalProperties: false
      description: RuntimeGuardrail is one guardrail policy with its rules embedded.
      properties:
        evaluationTimeout:
          $ref: '#/components/schemas/google.protobuf.Duration'
          description: Maximum time allowed to evaluate all rules in this guardrail.
          title: evaluation_timeout
        failureMode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.FailureMode'
          title: failure_mode
        id:
          title: id
          type: string
        policyName:
          title: policy_name
          type: string
        rules:
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuntimeGuardrailRule'
          title: rules
          type: array
        triggeredResponse:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredResponse'
          title: triggered_response
        type:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: type
      title: RuntimeGuardrail
      type: object
    agentrouter.guardrails.v1.RuntimeGuardrailProvider:
      additionalProperties: false
      description: "RuntimeGuardrailProvider is a configured provider instance. Templates\n\
        \ (is_template=true) are catalog entries and are skipped during evaluation."
      properties:
        config:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: "Open-world, kind-specific configuration (e.g., the synthesized\
            \ pattern\n catalog for regexp/builtin providers, or passthrough config\
            \ for external\n services)."
          title: config
        enabled:
          title: enabled
          type: boolean
        id:
          title: id
          type: string
        isTemplate:
          title: is_template
          type: boolean
        kind:
          description: Selects the data-plane factory (e.g., "regexp", "builtin",
            "llmguard").
          title: kind
          type: string
        name:
          title: name
          type: string
      title: RuntimeGuardrailProvider
      type: object
    agentrouter.guardrails.v1.RuntimeGuardrailRule:
      additionalProperties: false
      description: RuntimeGuardrailRule is one detection-and-enforcement rule.
      properties:
        action:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleAction'
          title: action
        active:
          title: active
          type: boolean
        checkType:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.CheckType'
          title: check_type
        configuration:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleConfiguration'
          description: "Provider-specific configuration. Exactly one variant is set,\
            \ matching the\n rule's provider kind and check_type."
          title: configuration
        executeOn:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOn'
          title: execute_on
        executeOnContentType:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOnContentType'
          title: execute_on_content_type
        id:
          title: id
          type: string
        mode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleMode'
          title: mode
        name:
          title: name
          type: string
        providerId:
          description: Provider instance this rule dispatches to, referenced by id.
          title: provider_id
          type: string
        triggeredResponse:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggeredResponse'
          title: triggered_response
      title: RuntimeGuardrailRule
      type: object
    agentrouter.guardrails.v1.SecretsConfiguration:
      additionalProperties: false
      description: SecretsConfiguration for CHECK_TYPE_SECRETS.
      properties:
        customPatterns:
          description: Custom regex patterns for secret detection.
          items:
            type: string
          title: custom_patterns
          type: array
        secretTypes:
          description: Types of secrets to detect (e.g., "aws_key", "github_token").
          items:
            type: string
          title: secret_types
          type: array
        useEntropyAnalysis:
          description: Whether to use entropy analysis for detection.
          title: use_entropy_analysis
          type: boolean
      title: SecretsConfiguration
      type: object
    agentrouter.guardrails.v1.SetGuardrailStatusRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        enabled:
          description: New enabled state. When absent the enabled field is left unchanged.
          nullable: true
          title: enabled
          type: boolean
        id:
          description: 'Required: uuid of the guardrail to update.'
          title: id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailStatus'
          description: "New operational status for the guardrail.\n GUARDRAIL_STATUS_UNSPECIFIED\
            \ leaves the stored status unchanged."
          title: status
      required:
      - id
      title: SetGuardrailStatusRequest
      type: object
    agentrouter.guardrails.v1.SetGuardrailStatusResponse:
      additionalProperties: false
      properties:
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: The guardrail with the updated status.
          title: guardrail
      title: SetGuardrailStatusResponse
      type: object
    agentrouter.guardrails.v1.TLSConfig:
      additionalProperties: false
      description: "TLSConfig is the transport security configuration for a ManagementPlane\n\
        \ connection."
      properties:
        caFile:
          title: ca_file
          type: string
        certFile:
          title: cert_file
          type: string
        enabled:
          title: enabled
          type: boolean
        insecureSkipVerify:
          title: insecure_skip_verify
          type: boolean
        keyFile:
          title: key_file
          type: string
        minVersion:
          description: "Minimum TLS version as a crypto/tls version constant (e.g.,\
            \ 0x0303 for\n TLS 1.2)."
          title: min_version
          type: integer
        serverName:
          title: server_name
          type: string
      title: TLSConfig
      type: object
    agentrouter.guardrails.v1.TimeBucket:
      additionalProperties: false
      description: TimeBucket groups trigger counts by a time window.
      properties:
        bucket:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of the time bucket.
          title: bucket
        count:
          description: Number of triggers that occurred in this bucket.
          format: int64
          title: count
          type:
          - integer
          - string
      title: TimeBucket
      type: object
    agentrouter.guardrails.v1.TopEntry:
      additionalProperties: false
      description: TopEntry is a generic ranked entry used in stats responses.
      properties:
        count:
          description: Number of triggers attributed to this entry.
          format: int64
          title: count
          type:
          - integer
          - string
        id:
          description: Resource id (consumer_id, resource_id, or guardrail_id).
          title: id
          type: string
        name:
          description: Human-readable display name for the resource.
          title: name
          type: string
      title: TopEntry
      type: object
    agentrouter.guardrails.v1.ToxicityConfiguration:
      additionalProperties: false
      description: ToxicityConfiguration for CHECK_TYPE_TOXICITY.
      properties:
        categories:
          description: Categories of toxicity to detect.
          items:
            type: string
          title: categories
          type: array
        threshold:
          description: Toxicity threshold (0.0 to 1.0).
          format: float
          title: threshold
          type: number
      title: ToxicityConfiguration
      type: object
    agentrouter.guardrails.v1.TriggerErrorCode:
      description: Machine-readable failure category for a rejected trigger.
      enum:
      - TRIGGER_ERROR_CODE_UNSPECIFIED
      - TRIGGER_ERROR_CODE_VALIDATION_ERROR
      - TRIGGER_ERROR_CODE_UNKNOWN_GUARDRAIL
      - TRIGGER_ERROR_CODE_INTERNAL_ERROR
      title: TriggerErrorCode
      type: string
    agentrouter.guardrails.v1.TriggerResult:
      additionalProperties: false
      description: TriggerResult captures the outcome of processing a single trigger
        event.
      properties:
        errorCode:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.TriggerErrorCode'
          description: Machine-readable failure category when success is false.
          title: error_code
        errorMessage:
          description: Human-readable error message when success is false.
          title: error_message
          type: string
        success:
          description: Whether this specific trigger was successfully recorded.
          title: success
          type: boolean
        triggerId:
          description: Id of the trigger this result corresponds to.
          title: trigger_id
          type: string
      title: TriggerResult
      type: object
    agentrouter.guardrails.v1.TriggeredInputResult:
      additionalProperties: false
      description: TriggeredInputResult captures an input message and any sanitisation
        applied.
      properties:
        message:
          description: The original input message evaluated by the guardrail.
          title: message
          type: string
        sanitizedMessage:
          description: "The sanitised version after guardrail processing. Empty when\
            \ no\n sanitisation was applied."
          title: sanitized_message
          type: string
      title: TriggeredInputResult
      type: object
    agentrouter.guardrails.v1.TriggeredOutputResult:
      additionalProperties: false
      description: "TriggeredOutputResult captures an output message and any sanitisation\n\
        \ applied, together with the prompt that generated it."
      properties:
        inputMessage:
          description: "The original input prompt that led to the output message.\
            \ Useful for\n understanding the context of the output."
          title: input_message
          type: string
        message:
          description: The original output message evaluated by the guardrail.
          title: message
          type: string
        sanitizedMessage:
          description: "The sanitised version of the output after guardrail processing.\
            \ Empty\n when no sanitisation was applied."
          title: sanitized_message
          type: string
      title: TriggeredOutputResult
      type: object
    agentrouter.guardrails.v1.TriggeredResponse:
      additionalProperties: false
      description: "TriggeredResponse defines the response template emitted when a\
        \ guardrail\n or rule is triggered.\n\n Supports variable substitution:\n\
        \   - {{policy_name}}: name of the guardrail policy\n   - {{rule_name}}: name\
        \ of the specific rule (if applicable)\n   - {{violation_details}}: details\
        \ about what triggered the rule\n\n Example: \"Request blocked by {{policy_name}}:\
        \ {{violation_details}}\""
      properties:
        callerTemplate:
          description: Template for generating user-facing messages when triggered.
          title: caller_template
          type: string
      title: TriggeredResponse
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailProviderRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        provider:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          description: "Required: provider to update. provider.id must be set. Partial\
            \ update\n semantics: omitted/empty scalar string fields leave the existing\
            \ value\n untouched; enum fields set to *_UNSPECIFIED leave the existing\
            \ value\n untouched; absent message fields (config) leave the existing\
            \ value\n untouched; a present config Struct REPLACES the stored configuration\n\
            \ wholesale (no deep merge)."
          title: provider
      required:
      - provider
      title: UpdateGuardrailProviderRequest
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailProviderResponse:
      additionalProperties: false
      properties:
        provider:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
          description: The updated provider with server-assigned fields populated.
          title: provider
      title: UpdateGuardrailProviderResponse
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: "Required: guardrail to update. guardrail.id must be set. Partial\
            \ update\n semantics: omitted/empty scalar string fields leave the existing\
            \ value\n untouched; enum fields set to *_UNSPECIFIED leave the existing\
            \ value\n untouched; absent message fields (triggered_response) leave\
            \ the existing\n value untouched."
          title: guardrail
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - guardrail
      title: UpdateGuardrailRequest
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailResponse:
      additionalProperties: false
      properties:
        guardrail:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
          description: The updated guardrail with server-assigned fields populated.
          title: guardrail
      title: UpdateGuardrailResponse
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailRuleRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        guardrailId:
          description: 'Required: parent guardrail id (must match rule.guardrail_id
            when both are set).'
          title: guardrail_id
          type: string
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
        rule:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          description: "Required: rule to update. rule.id must be set. Partial update\
            \ semantics:\n omitted/empty scalar string fields leave the existing value\
            \ untouched; enum\n fields set to *_UNSPECIFIED leave the existing value\
            \ untouched; absent\n message fields (triggered_response, configuration)\
            \ leave the existing value\n untouched; a present configuration Struct\
            \ REPLACES the stored configuration\n wholesale (no deep merge)."
          title: rule
      required:
      - guardrailId
      - rule
      title: UpdateGuardrailRuleRequest
      type: object
    agentrouter.guardrails.v1.UpdateGuardrailRuleResponse:
      additionalProperties: false
      properties:
        rule:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
          description: The updated rule with server-assigned fields populated.
          title: rule
      title: UpdateGuardrailRuleResponse
      type: object
    agentrouter.guardrails.v1.UpdatePatternRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
        pattern:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          description: "Required: pattern to update. pattern.id must be set. Partial\
            \ update\n semantics: omitted/empty scalar string fields leave the existing\
            \ value\n untouched; enum fields set to *_UNSPECIFIED leave the existing\
            \ value\n untouched."
          title: pattern
        projectId:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      required:
      - pattern
      title: UpdatePatternRequest
      type: object
    agentrouter.guardrails.v1.UpdatePatternResponse:
      additionalProperties: false
      properties:
        pattern:
          $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
          description: The updated pattern with server-assigned fields populated.
          title: pattern
      title: UpdatePatternResponse
      type: object
    agentrouter.identity.v1.ApiKey:
      additionalProperties: false
      description: "ApiKey is metadata about an issued long-lived API key.\n\n The\
        \ plaintext secret is returned exactly once at issue time on the\n IssueMyKeyResponse.\
        \ After that only the typed prefix and metadata\n are visible."
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          readOnly: true
          title: created_at
        customerId:
          description: Customer scope.
          readOnly: true
          title: customer_id
          type: string
        expiresAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Optional explicit expiry; zero means non-expiring.
          title: expires_at
        id:
          description: Resource name key_<ulid>. Server-assigned; immutable.
          readOnly: true
          title: id
          type: string
        identityId:
          description: Identity that owns this key.
          readOnly: true
          title: identity_id
          type: string
        lastUsedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last-used timestamp; updated by the facade on accepted calls.
          readOnly: true
          title: last_used_at
        name:
          description: Human-friendly label set by the issuer.
          title: name
          type: string
        prefix:
          description: Typed prefix portion of the key (e.g. tat_live_a4F...). Safe
            to log.
          readOnly: true
          title: prefix
          type: string
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          readOnly: true
          title: revoked_at
        state:
          $ref: '#/components/schemas/agentrouter.identity.v1.ApiKeyState'
          description: Lifecycle state.
          readOnly: true
          title: state
        type:
          $ref: '#/components/schemas/agentrouter.identity.v1.ApiKeyType'
          description: What the key is authorized to do. Defaults to PROMPT when unspecified.
          readOnly: true
          title: type
      title: ApiKey
      type: object
    agentrouter.identity.v1.ApiKeyState:
      description: ApiKeyState is the lifecycle of a long-lived API key.
      enum:
      - API_KEY_STATE_UNSPECIFIED
      - API_KEY_STATE_ACTIVE
      - API_KEY_STATE_REVOKED
      title: ApiKeyState
      type: string
    agentrouter.identity.v1.ApiKeyType:
      description: "ApiKeyType is what an API key is authorized to do. Servers derive\
        \ it from\n the stored token_type ('api_key' -> MANAGEMENT); it defaults to\
        \ PROMPT when\n unspecified."
      enum:
      - API_KEY_TYPE_UNSPECIFIED
      - API_KEY_TYPE_PROMPT
      - API_KEY_TYPE_MANAGEMENT
      title: ApiKeyType
      type: string
    agentrouter.identity.v1.ClientDetails:
      additionalProperties: false
      description: ClientDetails carries fields specific to machine workloads.
      properties:
        description:
          description: Description of the workload's purpose.
          title: description
          type: string
      title: ClientDetails
      type: object
    agentrouter.identity.v1.CreateUserRequest:
      additionalProperties: false
      properties:
        email:
          description: "Email is the unique identity key (authn.user.email). Required;\
            \ validated by\n the handler."
          title: email
          type: string
        issueSession:
          description: "When true, also create a session and return its token once,\
            \ so the caller\n can immediately act AS the new user (provisioning /\
            \ automated tests)."
          title: issue_session
          type: boolean
        name:
          description: Display name. Defaults to the email local-part when empty.
          title: name
          type: string
      title: CreateUserRequest
      type: object
    agentrouter.identity.v1.CreateUserResponse:
      additionalProperties: false
      properties:
        email:
          title: email
          type: string
        identityId:
          description: The created (or existing, idempotent-by-email) identity id
            (authn.user.id).
          title: identity_id
          type: string
        sessionToken:
          description: Set ONLY when issue_session was true; returned exactly once.
          title: session_token
          type: string
      title: CreateUserResponse
      type: object
    agentrouter.identity.v1.GetMeRequest:
      additionalProperties: false
      title: GetMeRequest
      type: object
    agentrouter.identity.v1.GetMeResponse:
      additionalProperties: false
      properties:
        identity:
          $ref: '#/components/schemas/agentrouter.identity.v1.Identity'
          description: Full identity record for the authenticated caller.
          title: identity
      title: GetMeResponse
      type: object
    agentrouter.identity.v1.Identity:
      additionalProperties: false
      allOf:
      - properties:
          bundles:
            description: "Role bundles assigned to this identity. Expanded into the\
              \ flat\n permission set at JWT-issue time."
            items:
              type: string
            title: bundles
            type: array
          createdAt:
            $ref: '#/components/schemas/google.protobuf.Timestamp'
            description: Timestamps.
            readOnly: true
            title: created_at
          customerId:
            description: "Customer this identity belongs to. Immutable. Empty for\
              \ platform\n identities (cross-customer operators)."
            readOnly: true
            title: customer_id
            type: string
          customerMemberships:
            description: "Customer memberships -- the set of customer ids this identity\
              \ may\n operate against. Populated by the facade from the identity's\
              \ bindings\n at JWT-issue time; surfaced on GetMe for the CLI's whoami\
              \ output."
            items:
              readOnly: true
              type: string
            readOnly: true
            title: customer_memberships
            type: array
          id:
            description: Resource name id_<ulid>. Server-assigned; immutable.
            readOnly: true
            title: id
            type: string
          state:
            $ref: '#/components/schemas/agentrouter.identity.v1.IdentityState'
            description: Lifecycle state.
            readOnly: true
            title: state
          type:
            $ref: '#/components/schemas/agentrouter.identity.v1.IdentityType'
            description: Discriminator selecting the populated details oneof branch.
            title: type
          updatedAt:
            $ref: '#/components/schemas/google.protobuf.Timestamp'
            readOnly: true
            title: updated_at
          version:
            description: "Optimistic concurrency token. Echo the value back on update;\
              \ a stale\n value yields concurrent_update."
            format: int64
            title: version
            type:
            - integer
            - string
      - oneOf:
        - properties:
            client:
              $ref: '#/components/schemas/agentrouter.identity.v1.ClientDetails'
              title: client
          required:
          - client
          title: client
        - properties:
            serviceAccount:
              $ref: '#/components/schemas/agentrouter.identity.v1.ServiceAccountDetails'
              title: service_account
          required:
          - serviceAccount
          title: service_account
        - properties:
            user:
              $ref: '#/components/schemas/agentrouter.identity.v1.UserDetails'
              title: user
          required:
          - user
          title: user
      description: "Identity is the unified principal record.\n\n Every TARS token\
        \ resolves to exactly one Identity. The facade injects\n the id into the X-Tetrate-Identity\
        \ header on backend calls."
      required:
      - type
      title: Identity
      type: object
    agentrouter.identity.v1.IdentityState:
      description: IdentityState is the lifecycle state of an Identity.
      enum:
      - IDENTITY_STATE_UNSPECIFIED
      - IDENTITY_STATE_ACTIVE
      - IDENTITY_STATE_SUSPENDED
      - IDENTITY_STATE_DELETED
      title: IdentityState
      type: string
    agentrouter.identity.v1.IdentityType:
      description: "IdentityType discriminates the principal kind. The value selects\
        \ which\n of user / service_account / client is populated on an Identity."
      enum:
      - IDENTITY_TYPE_UNSPECIFIED
      - IDENTITY_TYPE_USER
      - IDENTITY_TYPE_SERVICE_ACCOUNT
      - IDENTITY_TYPE_CLIENT
      title: IdentityType
      type: string
    agentrouter.identity.v1.IssueMyKeyRequest:
      additionalProperties: false
      properties:
        idempotencyKey:
          description: Optional caller-supplied idempotency key.
          title: idempotency_key
          type: string
        name:
          description: Human-friendly label for the key. Surfaced in `ia keys list`
            output.
          title: name
          type: string
        projectId:
          description: "Optional project the key is scoped to. Empty => \"default\"\
            \ project\n (legacy callers are unaffected). When set to a non-default\
            \ project the\n server verifies the caller is a member of that project\
            \ before issuing."
          title: project_id
          type: string
        type:
          $ref: '#/components/schemas/agentrouter.identity.v1.ApiKeyType'
          description: What the key is authorized to do. Unspecified defaults to PROMPT.
          title: type
      required:
      - name
      title: IssueMyKeyRequest
      type: object
    agentrouter.identity.v1.IssueMyKeyResponse:
      additionalProperties: false
      properties:
        key:
          $ref: '#/components/schemas/agentrouter.identity.v1.ApiKey'
          description: Metadata for the newly issued key (id, name, prefix, type,
            state).
          title: key
        secret:
          description: Plaintext API key value. Returned exactly once at issue time.
          readOnly: true
          title: secret
          type: string
      title: IssueMyKeyResponse
      type: object
    agentrouter.identity.v1.ListMyKeysRequest:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Pagination cursor and page size for the listing.
          title: page
      title: ListMyKeysRequest
      type: object
    agentrouter.identity.v1.ListMyKeysResponse:
      additionalProperties: false
      properties:
        keys:
          description: The caller's API keys (metadata only; never the plaintext secret).
          items:
            $ref: '#/components/schemas/agentrouter.identity.v1.ApiKey'
          title: keys
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination state; carries the next-page cursor when more remain.
          title: page
      title: ListMyKeysResponse
      type: object
    agentrouter.identity.v1.LoginRequest:
      additionalProperties: false
      properties:
        codeChallenge:
          description: PKCE code challenge generated by the client.
          title: code_challenge
          type: string
        codeChallengeMethod:
          description: PKCE code-challenge method. Only S256 is accepted.
          title: code_challenge_method
          type: string
        issuer:
          description: "Operator's OIDC issuer alias (allows multi-IdP operators to\
            \ select).\n Empty selects the default issuer for the operator domain."
          title: issuer
          type: string
        redirectUri:
          description: "Where the IdP should redirect after authentication. For the\
            \ CLI this\n is a localhost loopback URL bound to a free port."
          title: redirect_uri
          type: string
      required:
      - redirectUri
      - codeChallenge
      - codeChallengeMethod
      title: LoginRequest
      type: object
    agentrouter.identity.v1.LoginResponse:
      additionalProperties: false
      properties:
        authorizationUrl:
          description: URL the client follows to the upstream IdP.
          readOnly: true
          title: authorization_url
          type: string
        state:
          description: "Opaque state value bound to the request. Echoed by the IdP\
            \ and\n verified by the /v1/auth/callback handler."
          readOnly: true
          title: state
          type: string
      title: LoginResponse
      type: object
    agentrouter.identity.v1.LogoutRequest:
      additionalProperties: false
      title: LogoutRequest
      type: object
    agentrouter.identity.v1.LogoutResponse:
      additionalProperties: false
      title: LogoutResponse
      type: object
    agentrouter.identity.v1.ResolveApiKeyRequest:
      additionalProperties: false
      properties:
        key:
          description: Plaintext API key value (sent over mTLS only).
          title: key
          type: string
      required:
      - key
      title: ResolveApiKeyRequest
      type: object
    agentrouter.identity.v1.ResolveApiKeyResponse:
      additionalProperties: false
      properties:
        identity:
          $ref: '#/components/schemas/agentrouter.identity.v1.Identity'
          description: Identity that owns the resolved key.
          title: identity
        key:
          $ref: '#/components/schemas/agentrouter.identity.v1.ApiKey'
          description: Metadata for the resolved key (id, type, state, owning identity).
          title: key
      title: ResolveApiKeyResponse
      type: object
    agentrouter.identity.v1.RevokeMyKeyRequest:
      additionalProperties: false
      properties:
        keyId:
          description: Id (key_<ulid>) of the caller-owned key to revoke.
          title: key_id
          type: string
      required:
      - keyId
      title: RevokeMyKeyRequest
      type: object
    agentrouter.identity.v1.RevokeMyKeyResponse:
      additionalProperties: false
      title: RevokeMyKeyResponse
      type: object
    agentrouter.identity.v1.ServiceAccountDetails:
      additionalProperties: false
      description: ServiceAccountDetails carries fields specific to service accounts.
      properties:
        description:
          description: Human-friendly description of the account's purpose.
          title: description
          type: string
      title: ServiceAccountDetails
      type: object
    agentrouter.identity.v1.UserDetails:
      additionalProperties: false
      description: UserDetails carries fields specific to human users.
      properties:
        email:
          description: Email address from the OIDC profile.
          title: email
          type: string
        emailVerified:
          description: True when the IdP asserted email ownership (the email_verified
            claim).
          title: email_verified
          type: boolean
        name:
          description: Display name from the OIDC profile.
          title: name
          type: string
        oidcIssuer:
          description: Issuer URL of the upstream IdP (matches iss on the OIDC token).
          title: oidc_issuer
          type: string
        oidcSubject:
          description: Stable identifier from the upstream IdP (sub claim on the OIDC
            token).
          title: oidc_subject
          type: string
      required:
      - oidcSubject
      - oidcIssuer
      title: UserDetails
      type: object
    agentrouter.inference.v1.DataplaneURL:
      additionalProperties: false
      description: DataplaneURL is a resolved gateway endpoint for one workspace.
      properties:
        customerId:
          description: Customer that owns the workspace.
          readOnly: true
          title: customer_id
          type: string
        name:
          description: Optional display name.
          readOnly: true
          title: name
          type: string
        projectId:
          description: Project the workspace belongs to (empty if the workspace has
            no project).
          readOnly: true
          title: project_id
          type: string
        url:
          description: Resolved gateway URL (scheme + host + port).
          readOnly: true
          title: url
          type: string
        workspaceId:
          description: Workspace the URL routes to.
          readOnly: true
          title: workspace_id
          type: string
      title: DataplaneURL
      type: object
    agentrouter.inference.v1.GetDataplaneURLRequest:
      additionalProperties: false
      properties:
        customerId:
          description: "Optional customer override. Empty resolves to the customer\
            \ deduced from\n the credential. Honored only for principals not already\
            \ bound to a\n customer; a cross-customer value is rejected unless the\
            \ caller is a member."
          title: customer_id
          type: string
        projectId:
          description: "Optional project override. Empty resolves to the workspace\
            \ the credential\n pins (when it carries one) or the caller's default\
            \ project (the oldest\n membership). Supply explicitly to pick a specific\
            \ project when the identity\n spans several; the chosen project is membership-checked."
          title: project_id
          type: string
      title: GetDataplaneURLRequest
      type: object
    agentrouter.inference.v1.GetDataplaneURLResponse:
      additionalProperties: false
      properties:
        dataplane:
          $ref: '#/components/schemas/agentrouter.inference.v1.DataplaneURL'
          readOnly: true
          title: dataplane
      title: GetDataplaneURLResponse
      type: object
    agentrouter.inference.v1.ListDataplaneURLsRequest:
      additionalProperties: false
      description: Customer is deduced from the credential; no fields.
      title: ListDataplaneURLsRequest
      type: object
    agentrouter.inference.v1.ListDataplaneURLsResponse:
      additionalProperties: false
      properties:
        dataplanes:
          items:
            $ref: '#/components/schemas/agentrouter.inference.v1.DataplaneURL'
          readOnly: true
          title: dataplanes
          type: array
      title: ListDataplaneURLsResponse
      type: object
    agentrouter.inference.v1.PromptRequest:
      additionalProperties: false
      properties:
        customerId:
          description: "Customer the prompt is billed/scoped against. When empty the\
            \ server\n resolves the caller's default customer from their session identity\n\
            \ (the first customer the caller is a member of, ordered by oldest\n membership).\
            \ Supply explicitly to override the session default."
          title: customer_id
          type: string
        idempotencyKey:
          description: Idempotency key for safe retry of mutating prompts.
          title: idempotency_key
          type: string
        keyId:
          description: "Optional client_keys / api_keys row id (UUID) to bind this\
            \ request\n to a specific customer-owned key for per-key ratelimit + fallback\n\
            \ accounting on the dataplane. Empty means \"use the latest active\n client\
            \ key for the customer\". The id flows through the minted MP\n JWT's jti\
            \ claim, which the dataplane reads in its ext-authz filter."
          title: key_id
          type: string
        model:
          description: "Model selector. A bare model name (e.g. gpt-4o) is accepted\
            \ when it is\n unique across the catalog; the server resolves its provider.\
            \ Use the\n provider/model form (e.g. openai/gpt-4o) to disambiguate when\
            \ the same\n model name exists under more than one provider. Empty selects\
            \ the\n project's default model."
          title: model
          type: string
        projectId:
          description: "Project the prompt is logged against. When empty the server\
            \ resolves\n the caller's default project from their session identity\
            \ (the first\n project the caller is a member of, ordered by oldest membership).\n\
            \ Supply explicitly to override the session default."
          title: project_id
          type: string
        prompt:
          description: "The user prompt as plain text. Multi-message conversations\
            \ land\n when the proto grows a `messages` repeated field; the skeleton\
            \ path\n is a single user turn."
          title: prompt
          type: string
      required:
      - prompt
      title: PromptRequest
      type: object
    agentrouter.inference.v1.PromptResponse:
      additionalProperties: false
      properties:
        completion:
          description: The model's reply text.
          readOnly: true
          title: completion
          type: string
        completionTokens:
          description: "Tokens generated in the completion (output tokens), as reported\
            \ by the\n provider's usage block."
          format: int32
          readOnly: true
          title: completion_tokens
          type: integer
        dataplaneId:
          description: "The dataplane that served the request, for observability.\
            \ Empty in\n milestone B (no dataplane yet); populated once milestone\
            \ C lands."
          readOnly: true
          title: dataplane_id
          type: string
        model:
          description: The model that produced the reply.
          readOnly: true
          title: model
          type: string
        promptTokens:
          description: Token accounting (best effort; some providers don't report).
          format: int32
          readOnly: true
          title: prompt_tokens
          type: integer
      title: PromptResponse
      type: object
    agentrouter.insights.v1.GetCustomerRequestLogRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer_id / project_id when
            empty.
          title: customer_id
          type: string
        projectId:
          title: project_id
          type: string
        requestId:
          description: Identifier of the request log to fetch; must be owned by the
            caller.
          title: request_id
          type: string
      required:
      - requestId
      title: GetCustomerRequestLogRequest
      type: object
    agentrouter.insights.v1.GetCustomerRequestLogStatsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer_id / project_id when
            empty.
          title: customer_id
          type: string
        endTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: End of the aggregation time range (exclusive).
          title: end_time
        groupBy:
          description: 'Dimension to group by: "model", "user", "api_key", "status",
            "hour", "day".'
          title: group_by
          type: string
        metric:
          description: 'Metric to compute: "count", "tokens", "cost", "latency", "errors".'
          title: metric
          type: string
        modelName:
          description: Optional filter restricting stats to a single model name.
          title: model_name
          type: string
        projectId:
          title: project_id
          type: string
        startTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of the aggregation time range (inclusive).
          title: start_time
      title: GetCustomerRequestLogStatsRequest
      type: object
    agentrouter.insights.v1.GetRequestLogRequest:
      additionalProperties: false
      description: GetRequestLogRequest retrieves a single log by request ID.
      properties:
        requestId:
          description: Request identifier
          title: request_id
          type: string
      title: GetRequestLogRequest
      type: object
    agentrouter.insights.v1.GetRequestLogStatsRequest:
      additionalProperties: false
      description: GetRequestLogStatsRequest defines aggregation parameters for log
        statistics.
      properties:
        endTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: End of time range (exclusive)
          title: end_time
        groupBy:
          description: "Group by dimension\n Valid values: \"model\", \"user\", \"\
            api_key\", \"status\", \"hour\", \"day\""
          title: group_by
          type: string
        metric:
          description: "Metric to calculate\n Valid values: \"count\", \"tokens\"\
            , \"cost\", \"latency\", \"errors\""
          title: metric
          type: string
        modelName:
          description: Filter by model name
          title: model_name
          type: string
        startTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of time range (inclusive)
          title: start_time
        userId:
          description: Filter by user ID
          title: user_id
          type: string
      title: GetRequestLogStatsRequest
      type: object
    agentrouter.insights.v1.ListCustomerRequestLogsRequest:
      additionalProperties: false
      description: "ListCustomerRequestLogsRequest carries the (customer_id, project_id)\n\
        \ tenancy scope the caller is querying against, plus the same filter\n and\
        \ pagination knobs QueryRequestLogsRequest exposes. The user_id\n filter is\
        \ forced to the authenticated caller server-side."
      properties:
        apiKeyId:
          description: "Optional filters. Mirror QueryRequestLogsRequest minus user_id\n\
            \ (forced to caller).\n Restrict to logs produced by this API key (UUID)."
          title: api_key_id
          type: string
        customerId:
          description: "Tenancy scope. Defaults to the caller's session customer_id\
            \ /\n project_id when empty."
          title: customer_id
          type: string
        endTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: End of the time range (exclusive).
          title: end_time
        maxDurationMs:
          description: Only include requests at most this many milliseconds long.
          format: int32
          title: max_duration_ms
          type: integer
        minDurationMs:
          description: Only include requests at least this many milliseconds long.
          format: int32
          title: min_duration_ms
          type: integer
        modelName:
          description: Restrict to a single model name (e.g. "claude-3-opus", "gpt-4").
          title: model_name
          type: string
        orderBy:
          description: "Ordering. Valid order_by: timestamp, duration_ms, input_tokens,\n\
            \ output_tokens. Valid order_direction: asc, desc."
          title: order_by
          type: string
        orderDirection:
          description: 'Sort direction for order_by: "asc" or "desc".'
          title: order_direction
          type: string
        pageSize:
          description: "Pagination.\n Maximum logs per page (server applies a default\
            \ and cap)."
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: Opaque token from a prior response's next_page_token to fetch
            the next page.
          title: page_token
          type: string
        projectId:
          description: Project within the customer to scope the query to.
          title: project_id
          type: string
        startTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of the time range (inclusive).
          title: start_time
        status:
          description: Restrict by logical status (e.g. "success", "error", "timeout").
          title: status
          type: string
        statusCode:
          description: Restrict by HTTP status code returned to the client.
          format: int32
          title: status_code
          type: integer
      title: ListCustomerRequestLogsRequest
      type: object
    agentrouter.insights.v1.ListCustomerRequestLogsResponse:
      additionalProperties: false
      properties:
        logs:
          description: Request logs for the caller on this page, newest first by default.
          items:
            $ref: '#/components/schemas/agentrouter.insights.v1.RequestLog'
          title: logs
          type: array
        nextPageToken:
          description: Token to pass back as page_token for the next page; empty when
            exhausted.
          title: next_page_token
          type: string
        totalCount:
          description: Total number of matching logs across all pages (may be approximate).
          format: int64
          title: total_count
          type:
          - integer
          - string
      title: ListCustomerRequestLogsResponse
      type: object
    agentrouter.insights.v1.QueryRequestLogsRequest:
      additionalProperties: false
      description: QueryRequestLogsRequest defines filters for querying request logs.
      properties:
        apiKeyId:
          description: Filter by API key ID
          title: api_key_id
          type: string
        endTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: End of time range (exclusive)
          title: end_time
        maxDurationMs:
          description: Maximum duration in milliseconds
          format: int32
          title: max_duration_ms
          type: integer
        minDurationMs:
          description: Minimum duration in milliseconds
          format: int32
          title: min_duration_ms
          type: integer
        modelName:
          description: Filter by model name (e.g., "claude-3-opus", "gpt-4")
          title: model_name
          type: string
        orderBy:
          description: "Order by field (default: \"timestamp\")\n Valid values: \"\
            timestamp\", \"duration_ms\", \"input_tokens\", \"output_tokens\""
          title: order_by
          type: string
        orderDirection:
          description: 'Order direction: "asc" or "desc" (default: "desc")'
          title: order_direction
          type: string
        pageSize:
          description: 'Page size (default: 50, max: 1000)'
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: Page token for pagination
          title: page_token
          type: string
        startTime:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Start of time range (inclusive)
          title: start_time
        status:
          description: Filter by status (e.g., "success", "error", "timeout")
          title: status
          type: string
        statusCode:
          description: Filter by HTTP status code
          format: int32
          title: status_code
          type: integer
        userId:
          description: Filter by user ID
          title: user_id
          type: string
      title: QueryRequestLogsRequest
      type: object
    agentrouter.insights.v1.QueryRequestLogsResponse:
      additionalProperties: false
      description: QueryRequestLogsResponse contains the query results and pagination
        info.
      properties:
        logs:
          description: List of request logs matching the query
          items:
            $ref: '#/components/schemas/agentrouter.insights.v1.RequestLog'
          title: logs
          type: array
        nextPageToken:
          description: Token for retrieving the next page (empty if no more pages)
          title: next_page_token
          type: string
        totalCount:
          description: Total count of matching logs (may be approximate for large
            datasets)
          format: int64
          title: total_count
          type:
          - integer
          - string
      title: QueryRequestLogsResponse
      type: object
    agentrouter.insights.v1.RequestLog:
      additionalProperties: false
      description: RequestLog represents a single LLM request/response log entry.
      properties:
        apiKeyAddress:
          description: On-chain/account address the API key is bound to.
          title: api_key_address
          type: string
        apiKeyHash:
          description: Hash of the API key used to look it up without storing the
            secret.
          title: api_key_hash
          type: string
        apiKeyId:
          description: "API key information\n UUID of the API key that authenticated\
            \ the request."
          title: api_key_id
          type: string
        apiKeyName:
          description: Human-readable label assigned to the API key.
          title: api_key_name
          type: string
        apiKeyPrefix:
          description: Leading visible characters of the key (e.g. "sk-..."), for
            display.
          title: api_key_prefix
          type: string
        cacheCreationInputTokens:
          description: Input tokens written to the prompt cache (cache-creation writes).
          format: int32
          title: cache_creation_input_tokens
          type: integer
        cacheCreationInputTokensCost:
          description: 'Decimal string (precision: 18, scale: 10)'
          title: cache_creation_input_tokens_cost
          type: string
        cacheCreationInputTokensCostBeforeFee:
          description: Cache-creation cost before the platform fee/markup is applied.
            Decimal string.
          title: cache_creation_input_tokens_cost_before_fee
          type: string
        cachedInputTokens:
          description: "Cache token breakdown.\n Input tokens served from the prompt\
            \ cache (cache reads), billed at the cached rate."
          format: int32
          title: cached_input_tokens
          type: integer
        cachedInputTokensCost:
          description: 'Decimal string (precision: 18, scale: 10)'
          title: cached_input_tokens_cost
          type: string
        cachedInputTokensCostBeforeFee:
          description: Cached-input cost before the platform fee/markup is applied.
            Decimal string.
          title: cached_input_tokens_cost_before_fee
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Record creation timestamp
          title: created_at
        durationMs:
          description: Total request duration
          format: int32
          title: duration_ms
          type: integer
        id:
          description: Unique log identifier
          title: id
          type: string
        inputTokens:
          description: "Token usage\n Number of prompt/input tokens consumed by the\
            \ request."
          format: int32
          title: input_tokens
          type: integer
        inputTokensCost:
          description: 'Decimal string (precision: 18, scale: 10)'
          title: input_tokens_cost
          type: string
        inputTokensCostBeforeFee:
          description: Input-token cost before the platform fee/markup is applied.
            Decimal string.
          title: input_tokens_cost_before_fee
          type: string
        inputTokensCostMicrodollar:
          description: "Cost information (in microdollars and decimal)\n Input-token\
            \ cost in microdollars (1e-6 USD), after fee."
          format: int64
          title: input_tokens_cost_microdollar
          type:
          - integer
          - string
        llmParameters:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: LLM parameters used
          title: llm_parameters
        modelName:
          description: Model name used for the request
          title: model_name
          type: string
        outputTokens:
          description: Number of completion/output tokens generated in the response.
          format: int32
          title: output_tokens
          type: integer
        outputTokensCost:
          description: 'Decimal string (precision: 18, scale: 10)'
          title: output_tokens_cost
          type: string
        outputTokensCostBeforeFee:
          description: Output-token cost before the platform fee/markup is applied.
            Decimal string.
          title: output_tokens_cost_before_fee
          type: string
        outputTokensCostMicrodollar:
          description: Output-token cost in microdollars (1e-6 USD), after fee.
          format: int64
          title: output_tokens_cost_microdollar
          type:
          - integer
          - string
        requestBody:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: Captured request payload as a JSON object.
          title: request_body
        requestHeaders:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: "Request metadata\n Captured request headers as a JSON object."
          title: request_headers
        requestId:
          description: Request identifier
          title: request_id
          type: string
        responseBody:
          description: Text response body
          title: response_body
          type: string
        responseBodyRaw:
          description: Raw response body (for binary data)
          format: byte
          title: response_body_raw
          type: string
        responseHeaders:
          $ref: '#/components/schemas/google.protobuf.Struct'
          description: "Response metadata\n Captured response headers as a JSON object."
          title: response_headers
        status:
          description: "Request/Response status\n Logical outcome of the request (e.g.\
            \ \"success\", \"error\", \"timeout\")."
          title: status
          type: string
        statusCode:
          description: HTTP status code returned to the client.
          format: int32
          title: status_code
          type: integer
        storageBatchId:
          description: Batch UUID for grouping
          title: storage_batch_id
          type: string
        storageLocation:
          description: Object storage information (for Parquet-based storage) GCS
            path to Parquet file
          title: storage_location
          type: string
        storageRowIndex:
          description: Row index within Parquet file
          format: int32
          title: storage_row_index
          type: integer
        timestamp:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Timestamp when the request was received
          title: timestamp
        upstreamDurationMs:
          description: Timing information Duration of upstream LLM call
          format: int32
          title: upstream_duration_ms
          type: integer
        useObjectStorage:
          description: true = GCS, false = DB
          title: use_object_storage
          type: boolean
        userId:
          description: User ID who made the request
          title: user_id
          type: string
      title: RequestLog
      type: object
    agentrouter.insights.v1.RequestLogStatsResponse:
      additionalProperties: false
      description: RequestLogStatsResponse contains aggregated statistics.
      properties:
        avgDurationMs:
          description: Mean request duration in milliseconds across all groups.
          format: double
          title: avg_duration_ms
          type: number
        errorCount:
          description: Total number of error requests across all groups.
          format: int64
          title: error_count
          type:
          - integer
          - string
        stats:
          description: Statistics grouped by the requested dimension
          items:
            $ref: '#/components/schemas/agentrouter.insights.v1.StatEntry'
          title: stats
          type: array
        totalCost:
          description: Decimal string
          title: total_cost
          type: string
        totalCount:
          description: "Total counts across all groups\n Total number of requests\
            \ across all groups."
          format: int64
          title: total_count
          type:
          - integer
          - string
        totalInputTokens:
          description: Sum of input tokens across all groups.
          format: int64
          title: total_input_tokens
          type:
          - integer
          - string
        totalOutputTokens:
          description: Sum of output tokens across all groups.
          format: int64
          title: total_output_tokens
          type:
          - integer
          - string
      title: RequestLogStatsResponse
      type: object
    agentrouter.insights.v1.StatEntry:
      additionalProperties: false
      description: StatEntry represents statistics for a single group.
      properties:
        avgDurationMs:
          description: "Latency metrics\n Mean request duration in milliseconds for\
            \ this group."
          format: int64
          title: avg_duration_ms
          type:
          - integer
          - string
        cost:
          description: Cost information Decimal string
          title: cost
          type: string
        costMicrodollar:
          description: Group cost in microdollars (1e-6 USD).
          format: int64
          title: cost_microdollar
          type:
          - integer
          - string
        count:
          description: "Request counts\n Number of requests in this group."
          format: int64
          title: count
          type:
          - integer
          - string
        errorCount:
          description: Number of error requests in this group.
          format: int64
          title: error_count
          type:
          - integer
          - string
        inputTokens:
          description: "Token usage\n Input tokens summed over this group."
          format: int64
          title: input_tokens
          type:
          - integer
          - string
        key:
          description: Group key (model name, user id, date, etc.)
          title: key
          type: string
        maxDurationMs:
          description: Maximum request duration in milliseconds for this group.
          format: int64
          title: max_duration_ms
          type:
          - integer
          - string
        minDurationMs:
          description: Minimum request duration in milliseconds for this group.
          format: int64
          title: min_duration_ms
          type:
          - integer
          - string
        outputTokens:
          description: Output tokens summed over this group.
          format: int64
          title: output_tokens
          type:
          - integer
          - string
        p50DurationMs:
          description: Median (p50) request duration in milliseconds for this group.
          format: int64
          title: p50_duration_ms
          type:
          - integer
          - string
        p95DurationMs:
          description: 95th-percentile request duration in milliseconds for this group.
          format: int64
          title: p95_duration_ms
          type:
          - integer
          - string
        p99DurationMs:
          description: 99th-percentile request duration in milliseconds for this group.
          format: int64
          title: p99_duration_ms
          type:
          - integer
          - string
        totalTokens:
          description: Input plus output tokens for this group.
          format: int64
          title: total_tokens
          type:
          - integer
          - string
      title: StatEntry
      type: object
    agentrouter.mcp.v1.CreateMCPProfileRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        description:
          description: Optional description.
          title: description
          type: string
        name:
          description: 'Required: human-friendly profile name.'
          title: name
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        securityPolicyType:
          description: 'Required: security policy type ("oauth" | "api_key" | "none").'
          title: security_policy_type
          type: string
        securityPolicyValue:
          description: 'Optional: JSON-encoded security policy value. Empty for "none".'
          title: security_policy_value
          type: string
        userId:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      required:
      - name
      - securityPolicyType
      title: CreateMCPProfileRequest
      type: object
    agentrouter.mcp.v1.CreateMcpOAuthClientRequest:
      additionalProperties: false
      properties:
        authorizationUrl:
          description: 'Required: OAuth authorization endpoint URL.'
          title: authorization_url
          type: string
        clientId:
          description: 'Required: OAuth client id from the provider.'
          title: client_id
          type: string
        clientSecret:
          description: "Required: OAuth client secret. WRITE-ONLY -- wrapped by the\
            \ secret\n service and never returned on any response."
          title: client_secret
          type: string
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        metadata:
          additionalProperties:
            title: value
            type: string
          description: 'Optional: free-form provider configuration.'
          title: metadata
          type: object
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        provider:
          description: 'Required: stable provider key, e.g. "github".'
          title: provider
          type: string
        providerName:
          description: 'Required: human-friendly provider display name.'
          title: provider_name
          type: string
        redirectUris:
          description: 'Optional: allowed redirect URIs.'
          items:
            type: string
          title: redirect_uris
          type: array
        scopes:
          description: 'Optional: requested OAuth scopes.'
          items:
            type: string
          title: scopes
          type: array
        serverIds:
          description: 'Optional: MCP server ids this client serves.'
          items:
            type: string
          title: server_ids
          type: array
        status:
          description: "Optional: initial status (\"active\" | \"inactive\"). Defaults\
            \ to\n \"active\" when empty."
          title: status
          type: string
        tokenUrl:
          description: 'Required: OAuth token endpoint URL.'
          title: token_url
          type: string
      required:
      - provider
      - providerName
      - clientId
      - clientSecret
      - authorizationUrl
      - tokenUrl
      title: CreateMcpOAuthClientRequest
      type: object
    agentrouter.mcp.v1.CreateMcpOAuthClientRequest.MetadataEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: MetadataEntry
      type: object
    agentrouter.mcp.v1.DeleteCatalogServerRequest:
      additionalProperties: false
      properties:
        id:
          description: 'Required: stable id of the catalog entry to delete (e.g. "github").'
          title: id
          type: string
      required:
      - id
      title: DeleteCatalogServerRequest
      type: object
    agentrouter.mcp.v1.DeleteMCPProfileRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        profileId:
          description: 'Required: uuid of the profile to soft-delete (MCPProfile.id).'
          title: profile_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        userId:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      required:
      - profileId
      title: DeleteMCPProfileRequest
      type: object
    agentrouter.mcp.v1.DeleteMcpOAuthClientRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the client to soft-delete (McpOAuthClient.id).'
          title: id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - id
      title: DeleteMcpOAuthClientRequest
      type: object
    agentrouter.mcp.v1.GetCatalogServerRequest:
      additionalProperties: false
      properties:
        id:
          description: 'Required: stable catalog entry id (e.g. "github").'
          title: id
          type: string
      required:
      - id
      title: GetCatalogServerRequest
      type: object
    agentrouter.mcp.v1.GetMCPProfileRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        profileId:
          description: 'Required: uuid of the profile to fetch (MCPProfile.id).'
          title: profile_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        userId:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      required:
      - profileId
      title: GetMCPProfileRequest
      type: object
    agentrouter.mcp.v1.GetMcpOAuthClientRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the client to fetch (McpOAuthClient.id).'
          title: id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      required:
      - id
      title: GetMcpOAuthClientRequest
      type: object
    agentrouter.mcp.v1.ListCatalogServersRequest:
      additionalProperties: false
      properties:
        includeDisabled:
          description: "When true, include is_enabled=false entries. The dashboard\
            \ sets\n this false; the operator CLI defaults to true so disabled servers\n\
            \ are visible."
          title: include_disabled
          type: boolean
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size + continuation token).
          title: page
      title: ListCatalogServersRequest
      type: object
    agentrouter.mcp.v1.ListCatalogServersResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs (next-page token).
          title: page
        servers:
          description: Catalog entries for this page (disabled rows included per request).
          items:
            $ref: '#/components/schemas/agentrouter.mcp.v1.MCPCatalogServer'
          title: servers
          type: array
      title: ListCatalogServersResponse
      type: object
    agentrouter.mcp.v1.ListMCPProfilesRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size + continuation token).
          title: page
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        userId:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      title: ListMCPProfilesRequest
      type: object
    agentrouter.mcp.v1.ListMCPProfilesResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs (next-page token).
          title: page
        profiles:
          description: Profiles owned by the requested scope, one page's worth.
          items:
            $ref: '#/components/schemas/agentrouter.mcp.v1.MCPProfile'
          title: profiles
          type: array
      title: ListMCPProfilesResponse
      type: object
    agentrouter.mcp.v1.ListMcpOAuthClientsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size + continuation token).
          title: page
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      title: ListMcpOAuthClientsRequest
      type: object
    agentrouter.mcp.v1.ListMcpOAuthClientsResponse:
      additionalProperties: false
      properties:
        clients:
          description: OAuth clients in the requested scope (metadata only, no secrets).
          items:
            $ref: '#/components/schemas/agentrouter.mcp.v1.McpOAuthClient'
          title: clients
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Cursor-pagination outputs (next-page token).
          title: page
      title: ListMcpOAuthClientsResponse
      type: object
    agentrouter.mcp.v1.MCPCatalogServer:
      additionalProperties: false
      description: "MCPCatalogServer is a platform-curated MCP server registration.\n\
        \ Mirrors the mcp_catalog_servers row 1:1."
      properties:
        authentication:
          description: "Authentication kind label (\"oauth\", \"api_key\", \"none\"\
            ). Free-form\n string -- the catalog renderer interprets it."
          title: authentication
          type: string
        categories:
          description: Category tags ("git", "issue-tracker", ...). Empty list permitted.
          items:
            type: string
          title: categories
          type: array
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        description:
          description: Description text shown in the dashboard catalog.
          title: description
          type: string
        iconUrl:
          description: Optional icon URL displayed in the dashboard catalog.
          title: icon_url
          type: string
        id:
          description: Stable string id (e.g. "github", "jira"). Required on upsert.
          title: id
          type: string
        isEnabled:
          description: "Operator-controlled visibility toggle. Disabled servers stay\
            \ in\n the table but are hidden from the customer-facing list."
          title: is_enabled
          type: boolean
        name:
          description: Display name shown in the dashboard catalog.
          title: name
          type: string
        note:
          description: Optional free-form note shown alongside the catalog entry.
          title: note
          type: string
        requiresAuth:
          description: "True when this catalog entry requires a credential from the\
            \ user\n (used by the dashboard \"Add\" flow to pre-populate credential\
            \ UI)."
          title: requires_auth
          type: boolean
        requiresProfile:
          description: "True when the user must register a profile before using this\n\
            \ catalog entry (rather than just adding a backend selector)."
          title: requires_profile
          type: boolean
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
        url:
          description: Customer-facing MCP server URL.
          title: url
          type: string
      required:
      - id
      - name
      - url
      title: MCPCatalogServer
      type: object
    agentrouter.mcp.v1.MCPProfile:
      additionalProperties: false
      description: "MCPProfile is a user-registered MCP server: a remote URL the data\n\
        \ plane proxies for the owner, optionally guarded by an API key or an\n OAuth\
        \ resource policy."
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Owning customer scope. Defaults to the caller's session customer\n\
            \ when empty; immutable once set. A profile is only visible to\n (user_id,\
            \ customer_id, project_id) tuples that match."
          title: customer_id
          type: string
        description:
          description: Optional freeform description.
          title: description
          type: string
        errorMessage:
          description: Last error from the reconciler when status is "error".
          readOnly: true
          title: error_message
          type: string
        id:
          description: Server-assigned uuid row id. Output-only.
          readOnly: true
          title: id
          type: string
        name:
          description: Human-friendly display name. Unique per user.
          title: name
          type: string
        projectId:
          description: "Owning project scope. Defaults to the caller's session project\
            \ when\n empty; immutable once set."
          title: project_id
          type: string
        securityPolicyType:
          description: 'Security policy type: "oauth" | "api_key" | "none".'
          title: security_policy_type
          type: string
        securityPolicyValue:
          description: "JSON-encoded security policy value. Shape depends on\n security_policy_type\
            \ -- see schema docs on the mcp_profiles table.\n Sensitive material (raw\
            \ api keys, oauth issuer secrets) is stored\n server-side; responses redact\
            \ secret bytes."
          title: security_policy_value
          type: string
        status:
          description: 'Lifecycle status: "active" | "pending" | "error".'
          readOnly: true
          title: status
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
        url:
          description: "URL path the data plane exposes for this profile, e.g.\n \"\
            /mcp/<user-hash>-<profile-hash>\". Server-assigned on create."
          readOnly: true
          title: url
          type: string
        userId:
          description: "Owning user id (authn.user.id). Defaults to the caller's session\n\
            \ user when empty; immutable once set."
          title: user_id
          type: string
      required:
      - name
      - securityPolicyType
      title: MCPProfile
      type: object
    agentrouter.mcp.v1.McpOAuthClient:
      additionalProperties: false
      description: "McpOAuthClient is the metadata projection of an mcp_server_oauth_clients\n\
        \ row. The client_secret is never present on this message -- only the\n write\
        \ requests carry it, and only as input."
      properties:
        authorizationUrl:
          description: OAuth authorization endpoint URL.
          title: authorization_url
          type: string
        clientId:
          description: OAuth client id issued by the upstream provider.
          title: client_id
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Owning customer scope. Defaults to the caller's session customer\
            \ when\n empty on the request; immutable once set."
          readOnly: true
          title: customer_id
          type: string
        id:
          description: Server-assigned uuid row id. Output-only.
          readOnly: true
          title: id
          type: string
        metadata:
          additionalProperties:
            title: value
            type: string
          description: "Free-form provider configuration (discovery_url, token_auth_method,\n\
            \ ...). Mirrors the dashboard's jsonb metadata column."
          title: metadata
          type: object
        projectId:
          description: "Owning project scope. Defaults to the caller's session project\
            \ when\n empty on the request; immutable once set."
          readOnly: true
          title: project_id
          type: string
        provider:
          description: "Stable provider key, e.g. \"github\", \"google\". Unique per\n\
            \ (customer, project). Required on create."
          title: provider
          type: string
        providerName:
          description: Human-friendly display name for the provider, e.g. "GitHub".
          title: provider_name
          type: string
        redirectUris:
          description: Allowed redirect URIs for the authorization-code flow.
          items:
            type: string
          title: redirect_uris
          type: array
        scopes:
          description: OAuth scopes requested during the authorization flow.
          items:
            type: string
          title: scopes
          type: array
        serverIds:
          description: "MCP server ids this client serves. Empty means \"all servers\
            \ in the\n project\"."
          items:
            type: string
          title: server_ids
          type: array
        status:
          description: 'Lifecycle status: "active" | "inactive" | "revoked".'
          title: status
          type: string
        tokenUrl:
          description: OAuth token endpoint URL.
          title: token_url
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - provider
      - providerName
      - clientId
      - authorizationUrl
      - tokenUrl
      title: McpOAuthClient
      type: object
    agentrouter.mcp.v1.McpOAuthClient.MetadataEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: MetadataEntry
      type: object
    agentrouter.mcp.v1.SetCatalogServerEnabledRequest:
      additionalProperties: false
      properties:
        enabled:
          description: "Target visibility. true -> entry is visible to the customer-facing\n\
            \ list; false -> hidden (row kept, is_enabled set to false)."
          title: enabled
          type: boolean
        id:
          description: Stable catalog entry id, e.g. "github".
          title: id
          type: string
      required:
      - id
      - enabled
      title: SetCatalogServerEnabledRequest
      type: object
    agentrouter.mcp.v1.UpdateMCPProfileRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        description:
          title: description
          type: string
        name:
          description: "Mutable scalar fields. Empty string leaves the existing value\n\
            \ untouched -- callers explicitly pass \" \" when they want to clear\n\
            \ a free-form description (the server trims that to \"\")."
          title: name
          type: string
        profileId:
          description: 'Required: uuid of the profile to update (MCPProfile.id).'
          title: profile_id
          type: string
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        securityPolicyType:
          title: security_policy_type
          type: string
        securityPolicyValue:
          title: security_policy_value
          type: string
        userId:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      required:
      - profileId
      title: UpdateMCPProfileRequest
      type: object
    agentrouter.mcp.v1.UpdateMcpOAuthClientRequest:
      additionalProperties: false
      properties:
        authorizationUrl:
          title: authorization_url
          type: string
        clientId:
          title: client_id
          type: string
        clientSecret:
          description: "Optional: a non-empty value rotates the wrapped client secret\
            \ in\n place. Empty leaves the stored secret untouched. WRITE-ONLY."
          title: client_secret
          type: string
        customerId:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
        id:
          description: 'Required: uuid of the client to update (McpOAuthClient.id).'
          title: id
          type: string
        metadata:
          additionalProperties:
            title: value
            type: string
          title: metadata
          type: object
        projectId:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
        providerName:
          description: "Mutable scalar fields. Empty string leaves the existing value\n\
            \ untouched."
          title: provider_name
          type: string
        redirectUris:
          items:
            type: string
          title: redirect_uris
          type: array
        replaceMetadata:
          title: replace_metadata
          type: boolean
        replaceRedirectUris:
          title: replace_redirect_uris
          type: boolean
        replaceScopes:
          description: "Because proto3 cannot distinguish an omitted repeated/map\
            \ field from\n an explicit \"set to empty\", these booleans opt in to\
            \ clearing the\n matching collection. When false, an empty scopes/redirect_uris/\n\
            \ metadata/server_ids is treated as \"leave untouched\"."
          title: replace_scopes
          type: boolean
        replaceServerIds:
          title: replace_server_ids
          type: boolean
        scopes:
          description: "Repeated / map fields: a non-nil value REPLACES the stored\
            \ value;\n a nil/omitted value leaves it untouched (see the replace_*\
            \ flags)."
          items:
            type: string
          title: scopes
          type: array
        serverIds:
          items:
            type: string
          title: server_ids
          type: array
        status:
          title: status
          type: string
        tokenUrl:
          title: token_url
          type: string
      required:
      - id
      title: UpdateMcpOAuthClientRequest
      type: object
    agentrouter.mcp.v1.UpdateMcpOAuthClientRequest.MetadataEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: MetadataEntry
      type: object
    agentrouter.mcp.v1.UpsertCatalogServerRequest:
      additionalProperties: false
      properties:
        authentication:
          description: Optional authentication kind label.
          title: authentication
          type: string
        categories:
          description: Optional category tags.
          items:
            type: string
          title: categories
          type: array
        description:
          description: Optional description.
          title: description
          type: string
        iconUrl:
          description: Optional icon URL.
          title: icon_url
          type: string
        id:
          description: 'Required: stable catalog entry id (e.g. "github").'
          title: id
          type: string
        name:
          description: 'Required: display name.'
          title: name
          type: string
        note:
          description: Optional free-form note.
          title: note
          type: string
        requiresAuth:
          description: Whether this catalog entry requires a credential.
          title: requires_auth
          type: boolean
        requiresProfile:
          description: Whether the user must register a profile before using this
            entry.
          title: requires_profile
          type: boolean
        url:
          description: "Required: customer-facing URL. The flag is renamed to\n --catalog-url\
            \ to avoid colliding with the root command's\n persistent --base-url override."
          title: url
          type: string
      required:
      - id
      - name
      - url
      title: UpsertCatalogServerRequest
      type: object
    agentrouter.secret.v1.CreateSecretRequest:
      additionalProperties: false
      description: CreateSecretRequest creates or updates a secret.
      properties:
        description:
          description: Description of the secret (optional).
          title: description
          type: string
        name:
          description: "Name of the secret (unique per user and realm).\n Examples:\
            \ \"openai-api-key\", \"anthropic-byok-key\", \"mcp-oauth-token\""
          title: name
          type: string
        realm:
          description: "Realm defines the scope/purpose of the secret.\n Examples:\
            \ \"llm-providers\", \"byok\", \"mcp\", \"telemetry\", \"kek\""
          title: realm
          type: string
        tags:
          additionalProperties:
            title: value
            type: string
          description: Tags for categorization and filtering (optional).
          title: tags
          type: object
        userId:
          description: "User ID for the secret owner (optional).\n If not provided,\
            \ uses the authenticated user's ID.\n Only allowed for internal operations\
            \ with secrets/write/internal scope.\n Use \"system\" for service-level\
            \ KEKs.\n Note: For LLM realms (llm-keys, llm, llm-providers, ai-keys,\
            \ byok),\n this field is ignored and \"system\" is always used as the\
            \ user_id."
          title: user_id
          type: string
        value:
          description: "The plaintext secret value to encrypt and store.\n This is\
            \ never stored in plaintext or returned in responses."
          title: value
          type: string
      title: CreateSecretRequest
      type: object
    agentrouter.secret.v1.CreateSecretRequest.TagsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: TagsEntry
      type: object
    agentrouter.secret.v1.CreateSecretResponse:
      additionalProperties: false
      description: CreateSecretResponse returns the created secret metadata.
      properties:
        secret:
          $ref: '#/components/schemas/agentrouter.secret.v1.Secret'
          description: The created or updated secret's metadata (no plaintext value).
          title: secret
      title: CreateSecretResponse
      type: object
    agentrouter.secret.v1.DeleteSecretRequest:
      additionalProperties: false
      description: DeleteSecretRequest deletes a secret.
      properties:
        name:
          description: Name of the secret to delete.
          title: name
          type: string
        realm:
          description: Realm of the secret (optional, defaults to user's current realm).
          title: realm
          type: string
      title: DeleteSecretRequest
      type: object
    agentrouter.secret.v1.DeleteSecretResponse:
      additionalProperties: false
      description: DeleteSecretResponse confirms deletion.
      properties:
        success:
          description: True if the secret was successfully deleted.
          title: success
          type: boolean
      title: DeleteSecretResponse
      type: object
    agentrouter.secret.v1.GetSecretRequest:
      additionalProperties: false
      description: GetSecretRequest retrieves a secret by name.
      properties:
        name:
          description: Name of the secret.
          title: name
          type: string
        realm:
          description: Realm of the secret (optional, defaults to user's current realm).
          title: realm
          type: string
      title: GetSecretRequest
      type: object
    agentrouter.secret.v1.GetSecretResponse:
      additionalProperties: false
      description: GetSecretResponse returns secret metadata.
      properties:
        secret:
          $ref: '#/components/schemas/agentrouter.secret.v1.Secret'
          description: The requested secret's metadata (no plaintext value).
          title: secret
      title: GetSecretResponse
      type: object
    agentrouter.secret.v1.GetSecretValueRequest:
      additionalProperties: false
      description: GetSecretValueRequest requests the plaintext value of a secret.
      properties:
        name:
          description: Name of the secret.
          title: name
          type: string
        realm:
          description: Realm of the secret.
          title: realm
          type: string
        userId:
          description: "User ID who owns the secret.\n For system secrets (KEKs, LLM\
            \ keys), use \"system\"."
          title: user_id
          type: string
      title: GetSecretValueRequest
      type: object
    agentrouter.secret.v1.GetSecretValueResponse:
      additionalProperties: false
      description: GetSecretValueResponse returns the plaintext secret value.
      properties:
        secret:
          $ref: '#/components/schemas/agentrouter.secret.v1.Secret'
          description: Secret metadata.
          title: secret
        value:
          description: Plaintext secret value (decrypted).
          title: value
          type: string
      title: GetSecretValueResponse
      type: object
    agentrouter.secret.v1.ListSecretsRequest:
      additionalProperties: false
      description: ListSecretsRequest lists secrets with optional filtering.
      properties:
        pageSize:
          description: "Pagination.\n Maximum number of secrets to return per page."
          format: int32
          title: page_size
          type: integer
        pageToken:
          description: Opaque token from a previous response's next_page_token to
            fetch the next page.
          title: page_token
          type: string
        realm:
          description: Filter by realm (optional).
          title: realm
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.secret.v1.SecretStatus'
          description: Filter by status (optional).
          title: status
        tags:
          additionalProperties:
            title: value
            type: string
          description: Filter by tags (optional).
          title: tags
          type: object
      title: ListSecretsRequest
      type: object
    agentrouter.secret.v1.ListSecretsRequest.TagsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: TagsEntry
      type: object
    agentrouter.secret.v1.ListSecretsResponse:
      additionalProperties: false
      description: ListSecretsResponse returns a list of secrets.
      properties:
        nextPageToken:
          description: Token to pass as page_token to retrieve the next page; empty
            when no more pages.
          title: next_page_token
          type: string
        secrets:
          description: The page of secret metadata (no plaintext values).
          items:
            $ref: '#/components/schemas/agentrouter.secret.v1.Secret'
          title: secrets
          type: array
      title: ListSecretsResponse
      type: object
    agentrouter.secret.v1.RotateSecretRequest:
      additionalProperties: false
      description: RotateSecretRequest rotates a secret to a new value.
      properties:
        name:
          description: Name of the secret to rotate.
          title: name
          type: string
        newValue:
          description: New secret value.
          title: new_value
          type: string
        realm:
          description: Realm of the secret (optional).
          title: realm
          type: string
      title: RotateSecretRequest
      type: object
    agentrouter.secret.v1.RotateSecretResponse:
      additionalProperties: false
      description: RotateSecretResponse returns the updated secret.
      properties:
        secret:
          $ref: '#/components/schemas/agentrouter.secret.v1.Secret'
          description: The rotated secret's metadata reflecting the new version (no
            plaintext value).
          title: secret
      title: RotateSecretResponse
      type: object
    agentrouter.secret.v1.Secret:
      additionalProperties: false
      description: Secret represents a secret's metadata (never includes plaintext
        value).
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: "Timestamps.\n Time the secret was first created."
          title: created_at
        description:
          description: Description.
          title: description
          type: string
        id:
          description: Unique identifier.
          title: id
          type: string
        kekVersion:
          description: KEK version used to encrypt this secret.
          title: kek_version
          type: string
        name:
          description: Name of the secret.
          title: name
          type: string
        realm:
          description: Realm/scope of the secret.
          title: realm
          type: string
        status:
          $ref: '#/components/schemas/agentrouter.secret.v1.SecretStatus'
          description: Current status.
          title: status
        tags:
          additionalProperties:
            title: value
            type: string
          description: Tags for categorization.
          title: tags
          type: object
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Time the secret was last modified (e.g. updated or rotated).
          title: updated_at
        userId:
          description: User ID who owns this secret.
          title: user_id
          type: string
      title: Secret
      type: object
    agentrouter.secret.v1.Secret.TagsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: TagsEntry
      type: object
    agentrouter.secret.v1.SecretStatus:
      description: SecretStatus defines the lifecycle state of a secret.
      enum:
      - SECRET_STATUS_UNSPECIFIED
      - SECRET_STATUS_ACTIVE
      - SECRET_STATUS_REVOKED
      - SECRET_STATUS_ROTATED_PENDING
      title: SecretStatus
      type: string
    agentrouter.secret.v1.ValidateSecretRequest:
      additionalProperties: false
      description: ValidateSecretRequest validates a secret can be decrypted.
      properties:
        name:
          description: Name of the secret to validate.
          title: name
          type: string
        realm:
          description: Realm of the secret (optional).
          title: realm
          type: string
      title: ValidateSecretRequest
      type: object
    agentrouter.secret.v1.ValidateSecretResponse:
      additionalProperties: false
      description: ValidateSecretResponse returns validation result.
      properties:
        error:
          description: Failure reason when valid is false; empty otherwise.
          title: error
          type: string
        valid:
          description: True if the secret could be decrypted successfully.
          title: valid
          type: boolean
      title: ValidateSecretResponse
      type: object
    agentrouter.telemetry.v1.CreateTelemetryConfigRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: api_key_header is the header name when auth_type is api_key.
          title: api_key_header
          type: string
        authType:
          description: auth_type defaults to "none" when empty.
          title: auth_type
          type: string
        authValue:
          description: auth_value is the plaintext credential to encrypt at rest.
          title: auth_value
          type: string
        customerId:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
        enabled:
          description: "enabled toggles the configuration; defaults to true when unset.\n\
            \ Use the \"yes\"/\"no\"/\"true\"/\"false\" CLI form; absent is treated\
            \ as\n true."
          title: enabled
          type: boolean
        endpoint:
          description: endpoint is the OTLP sink URL.
          title: endpoint
          type: string
        headers:
          additionalProperties:
            title: value
            type: string
          description: "headers is sugar for the CLI: any of these are appended as\
            \ basic\n headers on outbound exports. Currently advisory -- the backing\n\
            \ configuration carries auth_type + auth_value."
          title: headers
          type: object
        projectId:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
        protocol:
          description: protocol defaults to "http/protobuf" when empty.
          title: protocol
          type: string
        telemetryType:
          description: telemetry_type partitions sinks; defaults to "traces" when
            empty.
          title: telemetry_type
          type: string
      required:
      - customerId
      - projectId
      - endpoint
      title: CreateTelemetryConfigRequest
      type: object
    agentrouter.telemetry.v1.CreateTelemetryConfigRequest.HeadersEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: HeadersEntry
      type: object
    agentrouter.telemetry.v1.DeleteTelemetryConfigRequest:
      additionalProperties: false
      properties:
        configId:
          description: config_id is the id of the config to delete.
          title: config_id
          type: string
        customerId:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
        projectId:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      - configId
      title: DeleteTelemetryConfigRequest
      type: object
    agentrouter.telemetry.v1.GetProjectTelemetryConfigRequest:
      additionalProperties: false
      properties:
        customerId:
          description: customer_id identifies the project's customer.
          title: customer_id
          type: string
        projectId:
          description: project_id identifies the project whose shared config is requested.
          title: project_id
          type: string
        telemetryType:
          description: telemetry_type partitions sinks; defaults to "traces" when
            empty.
          title: telemetry_type
          type: string
      required:
      - customerId
      - projectId
      title: GetProjectTelemetryConfigRequest
      type: object
    agentrouter.telemetry.v1.GetTelemetryConfigRequest:
      additionalProperties: false
      properties:
        configId:
          description: config_id is the id of the config to fetch.
          title: config_id
          type: string
        customerId:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
        projectId:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      - configId
      title: GetTelemetryConfigRequest
      type: object
    agentrouter.telemetry.v1.ListTelemetryConfigsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
        enabled:
          description: "enabled is a tri-state encoded as a string: \"\" (no filter),\
            \ \"true\",\n \"false\". Avoids `optional bool` because the CLI generator\
            \ does not\n yet emit pointer assignments."
          title: enabled
          type: string
        projectId:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
        telemetryType:
          description: Optional telemetry_type filter.
          title: telemetry_type
          type: string
      required:
      - customerId
      - projectId
      title: ListTelemetryConfigsRequest
      type: object
    agentrouter.telemetry.v1.ListTelemetryConfigsResponse:
      additionalProperties: false
      properties:
        configs:
          description: configs is the matching set of configs owned by the caller.
          items:
            $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          title: configs
          type: array
        total:
          description: total is the count of returned configs.
          format: int32
          title: total
          type: integer
      title: ListTelemetryConfigsResponse
      type: object
    agentrouter.telemetry.v1.SetProjectTelemetryConfigRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: api_key_header is the header name when auth_type is api_key.
          title: api_key_header
          type: string
        authType:
          description: auth_type defaults to "none" when empty.
          title: auth_type
          type: string
        authValue:
          description: auth_value is the plaintext credential to encrypt at rest.
          title: auth_value
          type: string
        customerId:
          description: customer_id identifies the project's customer.
          title: customer_id
          type: string
        enabled:
          description: enabled toggles the configuration; defaults to true when unset.
          title: enabled
          type: boolean
        endpoint:
          description: endpoint is the OTLP sink URL.
          title: endpoint
          type: string
        projectId:
          description: project_id identifies the project whose shared config is being
            set.
          title: project_id
          type: string
        protocol:
          description: protocol defaults to "http/protobuf" when empty.
          title: protocol
          type: string
        telemetryType:
          description: telemetry_type partitions sinks; defaults to "traces" when
            empty.
          title: telemetry_type
          type: string
      required:
      - customerId
      - projectId
      - endpoint
      title: SetProjectTelemetryConfigRequest
      type: object
    agentrouter.telemetry.v1.TelemetryConfig:
      additionalProperties: false
      description: "TelemetryConfig is one configuration row -- a sink + protocol\
        \ +\n optional auth credentials."
      properties:
        apiKeyHeader:
          description: "api_key_header is the header name for api_key auth (defaults\
            \ to\n X-API-Key)."
          title: api_key_header
          type: string
        authType:
          description: 'auth_type is one of: none, bearer, basic, api_key.'
          title: auth_type
          type: string
        authValue:
          description: "auth_value is a secret reference. Returned on Get / Create.\
            \ Empty\n on List (avoid leakage in bulk reads)."
          title: auth_value
          type: string
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: created_at is when this config was first created.
          title: created_at
        enabled:
          description: enabled indicates whether exports to this sink are active.
          title: enabled
          type: boolean
        id:
          description: id is the server-assigned unique identifier for this config
            row.
          title: id
          type: string
        lastCheckedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: last_checked_at is when the sink's reachability was last probed.
          title: last_checked_at
        protocol:
          description: 'protocol is one of: grpc, http/json, http/protobuf.'
          title: protocol
          type: string
        sinkUrl:
          description: sink_url is the destination OTLP endpoint.
          title: sink_url
          type: string
        status:
          description: 'status is one of: connected, disconnected, error, testing.'
          title: status
          type: string
        telemetryType:
          description: telemetry_type partitions sinks for traces, metrics, logs.
          title: telemetry_type
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: updated_at is when this config was last modified.
          title: updated_at
        userId:
          description: user_id is the owning (authenticated) caller; the row key.
          title: user_id
          type: string
      title: TelemetryConfig
      type: object
    agentrouter.telemetry.v1.UpdateTelemetryConfigRequest:
      additionalProperties: false
      properties:
        apiKeyHeader:
          description: api_key_header -- header name for api_key auth; empty leaves
            unchanged.
          title: api_key_header
          type: string
        authType:
          description: auth_type -- empty leaves unchanged; otherwise none, bearer,
            basic, api_key.
          title: auth_type
          type: string
        authValue:
          description: auth_value -- new plaintext credential to encrypt; empty leaves
            unchanged.
          title: auth_value
          type: string
        configId:
          description: config_id is the id of the config to update.
          title: config_id
          type: string
        customerId:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
        enabled:
          description: enabled tri-state encoded as "" (unchanged), "true", "false".
          title: enabled
          type: string
        endpoint:
          description: Empty string means "leave unchanged".
          title: endpoint
          type: string
        projectId:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
        protocol:
          description: protocol -- empty leaves unchanged; otherwise grpc, http/json,
            http/protobuf.
          title: protocol
          type: string
        status:
          description: status -- reported connection state; empty leaves unchanged.
          title: status
          type: string
      required:
      - customerId
      - projectId
      - configId
      title: UpdateTelemetryConfigRequest
      type: object
    agentrouter.tenancy.v1.AddProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        identityId:
          description: Identity row id (authn.user.id). Required.
          title: identity_id
          type: string
        projectId:
          description: 'Required: project the identity is being granted access to.'
          title: project_id
          type: string
        role:
          description: 'Role bundle: "admin" or "member".'
          title: role
          type: string
      required:
      - customerId
      - projectId
      - identityId
      - role
      title: AddProjectMemberRequest
      type: object
    agentrouter.tenancy.v1.ArchiveCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: slug of the customer to soft-delete.'
          title: customer_id
          type: string
      required:
      - customerId
      title: ArchiveCustomerRequest
      type: object
    agentrouter.tenancy.v1.ArchiveProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        projectId:
          description: 'Required: the project to soft-delete (the default project
            cannot be archived).'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      title: ArchiveProjectRequest
      type: object
    agentrouter.tenancy.v1.CreateCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: operator-scoped slug, e.g. "acme".'
          title: customer_id
          type: string
        description:
          description: 'Optional: freeform description.'
          title: description
          type: string
        displayName:
          description: 'Optional: human-friendly display name.'
          title: display_name
          type: string
      required:
      - customerId
      title: CreateCustomerRequest
      type: object
    agentrouter.tenancy.v1.CreateProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: Owning customer slug.
          title: customer_id
          type: string
        description:
          description: 'Optional: freeform description.'
          title: description
          type: string
        displayName:
          description: 'Optional: human-friendly display name.'
          title: display_name
          type: string
        projectId:
          description: 'Required: customer-scoped project slug.'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      title: CreateProjectRequest
      type: object
    agentrouter.tenancy.v1.Customer:
      additionalProperties: false
      description: "Customer mirrors ia.tenancy.v1.Customer with fraser-shaped fields.\n\
        \ `customer_id` is the operator-scoped slug (e.g. \"acme\") -- the\n natural\
        \ key callers use everywhere. `id` is the server-assigned uuid\n row key."
      properties:
        archivedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: "When the customer was archived (soft-deleted, state ARCHIVED);\
            \ unset\n while active. Maps to the row's deleted_at. Output-only."
          readOnly: true
          title: archived_at
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the customer row was created. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: "Operator-scoped slug used in CLI and URLs (e.g. \"acme\").\
            \ Required\n on create; immutable thereafter."
          title: customer_id
          type: string
        description:
          description: Freeform description.
          title: description
          type: string
        displayName:
          description: Human-friendly display name.
          title: display_name
          type: string
        id:
          description: Server-assigned uuid row id. Output-only.
          readOnly: true
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Freeform labels for filtering / grouping.
          title: labels
          type: object
        state:
          $ref: '#/components/schemas/agentrouter.tenancy.v1.CustomerState'
          description: Lifecycle state.
          readOnly: true
          title: state
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the customer row was last modified. Output-only.
          readOnly: true
          title: updated_at
      required:
      - customerId
      title: Customer
      type: object
    agentrouter.tenancy.v1.Customer.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.tenancy.v1.CustomerState:
      description: "CustomerState is the lifecycle of a customer record. ARCHIVED\
        \ is the\n soft-deleted state -- the row stays in customers with deleted_at\
        \ set."
      enum:
      - CUSTOMER_STATE_UNSPECIFIED
      - CUSTOMER_STATE_ACTIVE
      - CUSTOMER_STATE_ARCHIVED
      title: CustomerState
      type: string
    agentrouter.tenancy.v1.GetCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: slug of the customer to fetch.'
          title: customer_id
          type: string
      required:
      - customerId
      title: GetCustomerRequest
      type: object
    agentrouter.tenancy.v1.GetProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        projectId:
          description: 'Required: customer-scoped slug of the project to fetch.'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      title: GetProjectRequest
      type: object
    agentrouter.tenancy.v1.ListCustomersRequest:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size, page token, filter, order_by).
          title: page
      title: ListCustomersRequest
      type: object
    agentrouter.tenancy.v1.ListCustomersResponse:
      additionalProperties: false
      properties:
        customers:
          description: Page of customers visible to the caller.
          items:
            $ref: '#/components/schemas/agentrouter.tenancy.v1.Customer'
          title: customers
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination outputs; carries next_page_token for the following
            page.
          title: page
      title: ListCustomersResponse
      type: object
    agentrouter.tenancy.v1.ListProjectMembersRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size, page token, filter, order_by).
          title: page
        projectId:
          description: 'Required: project whose members to list.'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      title: ListProjectMembersRequest
      type: object
    agentrouter.tenancy.v1.ListProjectMembersResponse:
      additionalProperties: false
      properties:
        members:
          description: Page of members assigned to the requested project, with their
            roles.
          items:
            $ref: '#/components/schemas/agentrouter.tenancy.v1.ProjectMember'
          title: members
          type: array
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination outputs; carries next_page_token for the following
            page.
          title: page
      title: ListProjectMembersResponse
      type: object
    agentrouter.tenancy.v1.ListProjectsRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: customer scope whose projects to list.'
          title: customer_id
          type: string
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageRequest'
          description: Cursor-pagination inputs (page size, page token, filter, order_by).
          title: page
      required:
      - customerId
      title: ListProjectsRequest
      type: object
    agentrouter.tenancy.v1.ListProjectsResponse:
      additionalProperties: false
      properties:
        page:
          $ref: '#/components/schemas/agentrouter.common.v1.PageResponse'
          description: Pagination outputs; carries next_page_token for the following
            page.
          title: page
        projects:
          description: Page of projects within the requested customer scope.
          items:
            $ref: '#/components/schemas/agentrouter.tenancy.v1.Project'
          title: projects
          type: array
      title: ListProjectsResponse
      type: object
    agentrouter.tenancy.v1.Project:
      additionalProperties: false
      description: "Project carries the per-customer isolation unit. The natural key\
        \ is\n (customer_id, project_id); `id` is the server-assigned uuid row key."
      properties:
        archivedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Time the project was archived; unset while ACTIVE. Output-only.
          readOnly: true
          title: archived_at
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Row creation time. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: Owning customer slug. Immutable on update.
          title: customer_id
          type: string
        description:
          description: Freeform description.
          title: description
          type: string
        displayName:
          description: Human-friendly display name.
          title: display_name
          type: string
        id:
          description: Server-assigned uuid row id. Output-only.
          readOnly: true
          title: id
          type: string
        labels:
          additionalProperties:
            title: value
            type: string
          description: Freeform labels for filtering / grouping.
          title: labels
          type: object
        projectId:
          description: Customer-scoped slug. Required on create; immutable thereafter.
          title: project_id
          type: string
        state:
          $ref: '#/components/schemas/agentrouter.tenancy.v1.ProjectState'
          description: Lifecycle state.
          readOnly: true
          title: state
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last mutation time. Output-only.
          readOnly: true
          title: updated_at
      required:
      - customerId
      - projectId
      title: Project
      type: object
    agentrouter.tenancy.v1.Project.LabelsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          title: value
          type: string
      title: LabelsEntry
      type: object
    agentrouter.tenancy.v1.ProjectMember:
      additionalProperties: false
      description: "ProjectMember binds an Identity to a Project with a role. Fraser's\n\
        \ underlying schema stores the identity as `user_id` (text) and the\n role\
        \ as one of \"admin\" or \"member\"; the proto exposes those values\n as `identity_id`\
        \ and a free-form role string to match IA's wire\n shape while remaining compatible\
        \ with the existing `project_members`\n table."
      properties:
        createdAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Time the identity was added to the project. Output-only.
          readOnly: true
          title: created_at
        customerId:
          description: Owning customer slug.
          readOnly: true
          title: customer_id
          type: string
        id:
          description: Server-assigned uuid row id. Output-only.
          readOnly: true
          title: id
          type: string
        identityId:
          description: Identity row id (authn.user.id). Required on add.
          title: identity_id
          type: string
        projectId:
          description: Owning project slug.
          readOnly: true
          title: project_id
          type: string
        role:
          description: Role bundle. One of "admin", "member". Required on add / update.
          title: role
          type: string
        updatedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: Last time the membership (e.g. role) changed. Output-only.
          readOnly: true
          title: updated_at
      required:
      - identityId
      - role
      title: ProjectMember
      type: object
    agentrouter.tenancy.v1.ProjectState:
      description: ProjectState mirrors CustomerState.
      enum:
      - PROJECT_STATE_UNSPECIFIED
      - PROJECT_STATE_ACTIVE
      - PROJECT_STATE_ARCHIVED
      title: ProjectState
      type: string
    agentrouter.tenancy.v1.RemoveProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        identityId:
          description: 'Required: identity row id (authn.user.id) whose membership
            is revoked.'
          title: identity_id
          type: string
        projectId:
          description: 'Required: project the membership belongs to.'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      - identityId
      title: RemoveProjectMemberRequest
      type: object
    agentrouter.tenancy.v1.UpdateCustomerRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: the customer to update.'
          title: customer_id
          type: string
        description:
          description: 'Optional: new description.'
          title: description
          type: string
        displayName:
          description: 'Optional: new display name.'
          title: display_name
          type: string
      required:
      - customerId
      title: UpdateCustomerRequest
      type: object
    agentrouter.tenancy.v1.UpdateProjectMemberRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
        identityId:
          description: 'Required: identity row id (authn.user.id) whose role is being
            changed.'
          title: identity_id
          type: string
        projectId:
          description: 'Required: project the membership belongs to.'
          title: project_id
          type: string
        role:
          description: 'Required: new role bundle: "admin" or "member".'
          title: role
          type: string
      required:
      - customerId
      - projectId
      - identityId
      - role
      title: UpdateProjectMemberRequest
      type: object
    agentrouter.tenancy.v1.UpdateProjectRequest:
      additionalProperties: false
      properties:
        customerId:
          description: 'Required: owning customer slug. Immutable.'
          title: customer_id
          type: string
        description:
          description: 'Optional: new description.'
          title: description
          type: string
        displayName:
          description: 'Optional: new display name.'
          title: display_name
          type: string
        projectId:
          description: 'Required: the project to update. Immutable.'
          title: project_id
          type: string
      required:
      - customerId
      - projectId
      title: UpdateProjectRequest
      type: object
    agentrouter.tokens.v1.GetRevocationListRequest:
      additionalProperties: false
      description: GetRevocationListRequest requests the revocation list.
      properties:
        limit:
          description: "Optional: Maximum number of entries to return.\n If not specified,\
            \ returns all revoked tokens."
          format: int32
          nullable: true
          title: limit
          type: integer
        since:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: "Optional: Only return revocations updated after this timestamp.\n\
            \ Used for incremental updates."
          nullable: true
          title: since
      title: GetRevocationListRequest
      type: object
    agentrouter.tokens.v1.GetRevocationListResponse:
      additionalProperties: false
      description: GetRevocationListResponse contains the revocation list.
      properties:
        revocations:
          description: List of revoked token information.
          items:
            $ref: '#/components/schemas/agentrouter.tokens.v1.RevokedTokenInfo'
          title: revocations
          type: array
        snapshotAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: "Timestamp of this revocation list snapshot.\n Can be used\
            \ for 'since' in next request for incremental updates."
          title: snapshot_at
        totalCount:
          description: "Total number of revoked tokens (may be more than returned\
            \ if limit was\n set)."
          format: int64
          title: total_count
          type:
          - integer
          - string
      title: GetRevocationListResponse
      type: object
    agentrouter.tokens.v1.RevokedTokenInfo:
      additionalProperties: false
      description: RevokedTokenInfo contains information about a revoked token.
      properties:
        jti:
          description: JWT ID (jti) of the revoked token.
          title: jti
          type: string
        reason:
          description: 'Optional: Reason for revocation.'
          nullable: true
          title: reason
          type: string
        revokedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: When the token was revoked.
          title: revoked_at
      title: RevokedTokenInfo
      type: object
    agentrouter.tokens.v1.UpdateLastUsedRequest:
      additionalProperties: false
      description: UpdateLastUsedRequest updates the last used timestamp for a token.
      properties:
        jti:
          description: JWT ID (jti) of the token.
          title: jti
          type: string
        usedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: "Timestamp when the token was used.\n If not provided, server\
            \ will use current time."
          nullable: true
          title: used_at
      title: UpdateLastUsedRequest
      type: object
    agentrouter.tokens.v1.UpdateLastUsedResponse:
      additionalProperties: false
      description: UpdateLastUsedResponse confirms the update.
      properties:
        recordedAt:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          description: The timestamp that was recorded.
          title: recorded_at
        success:
          description: Whether the update was successful.
          title: success
          type: boolean
      title: UpdateLastUsedResponse
      type: object
    google.protobuf.Duration:
      description: "A Duration represents a signed, fixed-length span of time represented\n\
        \ as a count of seconds and fractions of seconds at nanosecond\n resolution.\
        \ It is independent of any calendar and concepts like \"day\"\n or \"month\"\
        . It is related to Timestamp in that the difference between\n two Timestamp\
        \ values is a Duration and it can be added or subtracted\n from a Timestamp.\
        \ Range is approximately +-10,000 years.\n\n # Examples\n\n Example 1: Compute\
        \ Duration from two Timestamps in pseudo code.\n\n     Timestamp start = ...;\n\
        \     Timestamp end = ...;\n     Duration duration = ...;\n\n     duration.seconds\
        \ = end.seconds - start.seconds;\n     duration.nanos = end.nanos - start.nanos;\n\
        \n     if (duration.seconds < 0 && duration.nanos > 0) {\n       duration.seconds\
        \ += 1;\n       duration.nanos -= 1000000000;\n     } else if (duration.seconds\
        \ > 0 && duration.nanos < 0) {\n       duration.seconds -= 1;\n       duration.nanos\
        \ += 1000000000;\n     }\n\n Example 2: Compute Timestamp from Timestamp +\
        \ Duration in pseudo code.\n\n     Timestamp start = ...;\n     Duration duration\
        \ = ...;\n     Timestamp end = ...;\n\n     end.seconds = start.seconds +\
        \ duration.seconds;\n     end.nanos = start.nanos + duration.nanos;\n\n  \
        \   if (end.nanos < 0) {\n       end.seconds -= 1;\n       end.nanos += 1000000000;\n\
        \     } else if (end.nanos >= 1000000000) {\n       end.seconds += 1;\n  \
        \     end.nanos -= 1000000000;\n     }\n\n Example 3: Compute Duration from\
        \ datetime.timedelta in Python.\n\n     td = datetime.timedelta(days=3, minutes=10)\n\
        \     duration = Duration()\n     duration.FromTimedelta(td)\n\n # JSON Mapping\n\
        \n In JSON format, the Duration type is encoded as a string rather than an\n\
        \ object, where the string ends in the suffix \"s\" (indicating seconds) and\n\
        \ is preceded by the number of seconds, with nanoseconds expressed as\n fractional\
        \ seconds. For example, 3 seconds with 0 nanoseconds should be\n encoded in\
        \ JSON format as \"3s\", while 3 seconds and 1 nanosecond should\n be expressed\
        \ in JSON format as \"3.000000001s\", and 3 seconds and 1\n microsecond should\
        \ be expressed in JSON format as \"3.000001s\"."
      format: duration
      type: string
    google.protobuf.Empty:
      description: "A generic empty message that you can re-use to avoid defining\
        \ duplicated\n empty messages in your APIs. A typical example is to use it\
        \ as the request\n or the response type of an API method. For instance:\n\n\
        \     service Foo {\n       rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);\n\
        \     }"
      type: object
    google.protobuf.ListValue:
      additionalProperties: false
      description: "`ListValue` is a wrapper around a repeated field of values.\n\n\
        \ The JSON representation for `ListValue` is JSON array."
      properties:
        values:
          description: Repeated field of dynamically typed values.
          items:
            $ref: '#/components/schemas/google.protobuf.Value'
          title: values
          type: array
      title: ListValue
      type: object
    google.protobuf.NullValue:
      description: "`NullValue` is a singleton enumeration to represent the null value\
        \ for the\n `Value` type union.\n\n The JSON representation for `NullValue`\
        \ is JSON `null`."
      enum:
      - NULL_VALUE
      title: NullValue
      type: string
    google.protobuf.Struct:
      additionalProperties:
        $ref: '#/components/schemas/google.protobuf.Value'
      description: "`Struct` represents a structured data value, consisting of fields\n\
        \ which map to dynamically typed values. In some languages, `Struct`\n might\
        \ be supported by a native representation. For example, in\n scripting languages\
        \ like JS a struct is represented as an\n object. The details of that representation\
        \ are described together\n with the proto support for the language.\n\n The\
        \ JSON representation for `Struct` is JSON object."
      type: object
    google.protobuf.Struct.FieldsEntry:
      additionalProperties: false
      properties:
        key:
          title: key
          type: string
        value:
          $ref: '#/components/schemas/google.protobuf.Value'
          title: value
      title: FieldsEntry
      type: object
    google.protobuf.Timestamp:
      description: "A Timestamp represents a point in time independent of any time\
        \ zone or local\n calendar, encoded as a count of seconds and fractions of\
        \ seconds at\n nanosecond resolution. The count is relative to an epoch at\
        \ UTC midnight on\n January 1, 1970, in the proleptic Gregorian calendar which\
        \ extends the\n Gregorian calendar backwards to year one.\n\n All minutes\
        \ are 60 seconds long. Leap seconds are \"smeared\" so that no leap\n second\
        \ table is needed for interpretation, using a [24-hour linear\n smear](https://developers.google.com/time/smear).\n\
        \n The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z.\
        \ By\n restricting to that range, we ensure that we can convert to and from\
        \ [RFC\n 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.\n\n # Examples\n\
        \n Example 1: Compute Timestamp from POSIX `time()`.\n\n     Timestamp timestamp;\n\
        \     timestamp.set_seconds(time(NULL));\n     timestamp.set_nanos(0);\n\n\
        \ Example 2: Compute Timestamp from POSIX `gettimeofday()`.\n\n     struct\
        \ timeval tv;\n     gettimeofday(&tv, NULL);\n\n     Timestamp timestamp;\n\
        \     timestamp.set_seconds(tv.tv_sec);\n     timestamp.set_nanos(tv.tv_usec\
        \ * 1000);\n\n Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.\n\
        \n     FILETIME ft;\n     GetSystemTimeAsFileTime(&ft);\n     UINT64 ticks\
        \ = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;\n\n     // A Windows\
        \ tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z\n     // is\
        \ 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.\n     Timestamp\
        \ timestamp;\n     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));\n\
        \     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));\n\n Example\
        \ 4: Compute Timestamp from Java `System.currentTimeMillis()`.\n\n     long\
        \ millis = System.currentTimeMillis();\n\n     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis\
        \ / 1000)\n         .setNanos((int) ((millis % 1000) * 1000000)).build();\n\
        \n Example 5: Compute Timestamp from Java `Instant.now()`.\n\n     Instant\
        \ now = Instant.now();\n\n     Timestamp timestamp =\n         Timestamp.newBuilder().setSeconds(now.getEpochSecond())\n\
        \             .setNanos(now.getNano()).build();\n\n Example 6: Compute Timestamp\
        \ from current time in Python.\n\n     timestamp = Timestamp()\n     timestamp.GetCurrentTime()\n\
        \n # JSON Mapping\n\n In JSON format, the Timestamp type is encoded as a string\
        \ in the\n [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is,\
        \ the\n format is \"{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z\"\
        \n where {year} is always expressed using four digits while {month}, {day},\n\
        \ {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional\n\
        \ seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),\n\
        \ are optional. The \"Z\" suffix indicates the timezone (\"UTC\"); the timezone\n\
        \ is required. A proto3 JSON serializer should always use UTC (as indicated\
        \ by\n \"Z\") when printing the Timestamp type and a proto3 JSON parser should\
        \ be\n able to accept both UTC and other timezones (as indicated by an offset).\n\
        \n For example, \"2017-01-15T01:30:15.01Z\" encodes 15.01 seconds past\n 01:30\
        \ UTC on January 15, 2017.\n\n In JavaScript, one can convert a Date object\
        \ to this format using the\n standard\n [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)\n\
        \ method. In Python, a standard `datetime.datetime` object can be converted\n\
        \ to this format using\n [`strftime`](https://docs.python.org/2/library/time.html#time.strftime)\
        \ with\n the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java,\
        \ one can use\n the Joda Time's [`ISODateTimeFormat.dateTime()`](\n http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()\n\
        \ ) to obtain a formatter capable of generating timestamps in this format."
      examples:
      - '2023-01-15T01:30:15.01Z'
      - '2024-12-25T12:00:00Z'
      format: date-time
      type: string
    google.protobuf.Value:
      description: "`Value` represents a dynamically typed value which can be either\n\
        \ null, a number, a string, a boolean, a recursive struct value, or a\n list\
        \ of values. A producer of value is expected to set one of these\n variants.\
        \ Absence of any variant indicates an error.\n\n The JSON representation for\
        \ `Value` is JSON value."
      oneOf:
      - type: 'null'
      - type: number
      - type: string
      - type: boolean
      - type: array
      - additionalProperties: true
        type: object
  securitySchemes:
    bearerAuth:
      description: 'AgentRouter API key as an HTTP Bearer token: Authorization: Bearer
        <api-key>.'
      scheme: bearer
      type: http
info:
  description: Combined AgentRouter API surface, merged from the per-service OpenAPI
    documents under docs/api-reference/openapi. Generated by scripts/sdk-package.sh;
    do not edit by hand.
  title: AgentRouter API
  version: 0.1.1
openapi: 3.1.0
paths:
  /.well-known/jwks.json:
    get:
      description: "JWKS endpoint.\n Public endpoint - no authentication required.\n\
        \ Returns JSON Web Key Set for verifying JWT tokens."
      operationId: agentrouter.auth.v1.AuthService.GetJWKS
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.auth.v1.GetJWKSResponse'
          description: Success
      summary: GetJWKS
      tags:
      - agentrouter.auth.v1.AuthService
  /admin/v1/audit/checkpoints:list:
    post:
      description: "List signed Merkle checkpoints (fraser#4599) for chain verification:\
        \ each\n checkpoint's prev_root chains to the previous and its signature covers\
        \ the\n root. Ordered by seq ascending, starting strictly after after_seq."
      operationId: agentrouter.admin.v1.AdminService.ListAuditCheckpoints
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.ListAuditCheckpointsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListAuditCheckpointsResponse'
          description: Success
      summary: ListAuditCheckpoints
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/audit/inclusion-proof:
    post:
      description: "Return the Merkle inclusion proof for an audit_logs row: its leaf\
        \ hash and\n audit path recomputed from current content, plus the signed checkpoint\
        \ it\n belongs to, so a verifier can confirm the row is committed to a signed\
        \ root."
      operationId: agentrouter.admin.v1.AdminService.GetAuditInclusionProof
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.GetAuditInclusionProofRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetAuditInclusionProofResponse'
          description: Success
      summary: GetAuditInclusionProof
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/audit/logs/{id}:
    get:
      description: Get a single audit_logs entry by id.
      operationId: agentrouter.admin.v1.AdminService.GetAuditLog
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AuditLogEntry'
          description: Success
      summary: GetAuditLog
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/audit/logs:query:
    post:
      description: "Query stored audit_logs entries with filtering and pagination.\
        \ The read\n complement to the SIEM forwarder (which only exports) and the\
        \ checkpoint\n verification RPCs (which only prove tamper-evidence): list\
        \ and inspect\n entries over the API instead of standing up a SIEM."
      operationId: agentrouter.admin.v1.AdminService.QueryAuditLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.QueryAuditLogsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.QueryAuditLogsResponse'
          description: Success
      summary: QueryAuditLogs
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListCustomers
      parameters:
      - description: Max results per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque pagination cursor from a prior response.
        in: query
        name: pageToken
        schema:
          description: Opaque pagination cursor from a prior response.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListCustomersResponse'
          description: Success
      summary: ListCustomers
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.CreateCustomer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateCustomerRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateCustomerResponse'
          description: Success
      summary: CreateCustomer
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.DeleteCustomer
      parameters:
      - description: Customer slug to soft-delete.
        in: path
        name: customer_id
        required: true
        schema:
          description: Customer slug to soft-delete.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteCustomerResponse'
          description: Success
      summary: DeleteCustomer
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      operationId: agentrouter.admin.v1.AdminService.GetCustomer
      parameters:
      - description: Customer slug to fetch.
        in: path
        name: customer_id
        required: true
        schema:
          description: Customer slug to fetch.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetCustomerResponse'
          description: Success
      summary: GetCustomer
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      operationId: agentrouter.admin.v1.AdminService.UpdateCustomer
      parameters:
      - description: Customer slug to update.
        in: path
        name: customer_id
        required: true
        schema:
          description: Customer slug to update.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: New description; unset leaves it unchanged.
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    title: value
                    type: string
                  description: Replacement set of labels.
                  title: labels
                  type: object
                name:
                  description: New display name; unset leaves it unchanged.
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
              title: UpdateCustomerRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateCustomerResponse'
          description: Success
      summary: UpdateCustomer
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListProjects
      parameters:
      - description: Customer slug whose projects to list.
        in: path
        name: customer_id
        required: true
        schema:
          description: Customer slug whose projects to list.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Max results per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque pagination cursor from a prior response.
        in: query
        name: pageToken
        schema:
          description: Opaque pagination cursor from a prior response.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectsResponse'
          description: Success
      summary: ListProjects
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.CreateProject
      parameters:
      - description: Customer slug that will own the project.
        in: path
        name: customer_id
        required: true
        schema:
          description: Customer slug that will own the project.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: Optional description.
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    title: value
                    type: string
                  description: Optional user-defined labels.
                  title: labels
                  type: object
                name:
                  description: Optional display name.
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
                projectId:
                  description: Caller-chosen project slug, unique within the customer.
                  maxLength: 253
                  minLength: 1
                  pattern: ^[a-z0-9]([a-z0-9-_.]*[a-z0-9])?$
                  title: project_id
                  type: string
              title: CreateProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateProjectResponse'
          description: Success
      summary: CreateProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.DeleteProject
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project slug to soft-delete.
        in: path
        name: project_id
        required: true
        schema:
          description: Project slug to soft-delete.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteProjectResponse'
          description: Success
      summary: DeleteProject
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      operationId: agentrouter.admin.v1.AdminService.GetProject
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project slug to fetch.
        in: path
        name: project_id
        required: true
        schema:
          description: Project slug to fetch.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetProjectResponse'
          description: Success
      summary: GetProject
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      operationId: agentrouter.admin.v1.AdminService.UpdateProject
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project slug to update.
        in: path
        name: project_id
        required: true
        schema:
          description: Project slug to update.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: New description; unset leaves it unchanged.
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    title: value
                    type: string
                  description: Replacement set of labels.
                  title: labels
                  type: object
                name:
                  description: New display name; unset leaves it unchanged.
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
              title: UpdateProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateProjectResponse'
          description: Success
      summary: UpdateProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/mcp-servers:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListProjectMcpServers
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project whose assigned MCP servers to list.
        in: path
        name: project_id
        required: true
        schema:
          description: Project whose assigned MCP servers to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectMcpServersResponse'
          description: Success
      summary: ListProjectMcpServers
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.AddProjectMcpServer
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to assign the MCP server to.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to assign the MCP server to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                serverId:
                  description: Catalog server ID to assign (e.g. "github").
                  maxLength: 253
                  minLength: 1
                  pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$
                  title: server_id
                  type: string
              title: AddProjectMcpServerRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AddProjectMcpServerResponse'
          description: Success
      summary: AddProjectMcpServer
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/mcp-servers/{server_id}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.RemoveProjectMcpServer
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to remove the MCP server from.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to remove the MCP server from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: Catalog server ID to remove.
        in: path
        name: server_id
        required: true
        schema:
          description: Catalog server ID to remove.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$
          title: server_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RemoveProjectMcpServerResponse'
          description: Success
      summary: RemoveProjectMcpServer
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/members:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListProjectMembers
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project whose members to list.
        in: path
        name: project_id
        required: true
        schema:
          description: Project whose members to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectMembersResponse'
          description: Success
      summary: ListProjectMembers
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.AddProjectMember
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to add the member to.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to add the member to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                role:
                  description: 'Role to grant: "admin" or "member".'
                  enum:
                  - admin
                  - member
                  title: role
                  type: string
                userId:
                  description: User ID to add as a member.
                  maxLength: 255
                  minLength: 1
                  title: user_id
                  type: string
              title: AddProjectMemberRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AddProjectMemberResponse'
          description: Success
      summary: AddProjectMember
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/members/{user_id}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.RemoveProjectMember
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to remove the member from.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to remove the member from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: User ID of the member to remove.
        in: path
        name: user_id
        required: true
        schema:
          description: User ID of the member to remove.
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RemoveProjectMemberResponse'
          description: Success
      summary: RemoveProjectMember
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      operationId: agentrouter.admin.v1.AdminService.UpdateProjectMember
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project the member belongs to.
        in: path
        name: project_id
        required: true
        schema:
          description: Project the member belongs to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: User ID of the member to update.
        in: path
        name: user_id
        required: true
        schema:
          description: User ID of the member to update.
          maxLength: 255
          minLength: 1
          title: user_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                role:
                  description: 'New role: "admin" or "member".'
                  enum:
                  - admin
                  - member
                  title: role
                  type: string
              title: UpdateProjectMemberRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateProjectMemberResponse'
          description: Success
      summary: UpdateProjectMember
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/models:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListProjectModels
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project whose assigned models to list.
        in: path
        name: project_id
        required: true
        schema:
          description: Project whose assigned models to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectModelsResponse'
          description: Success
      summary: ListProjectModels
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.AddProjectModel
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to assign the model to.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to assign the model to.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                modelId:
                  description: Catalog model UUID to assign.
                  pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
                  title: model_id
                  type: string
              title: AddProjectModelRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AddProjectModelResponse'
          description: Success
      summary: AddProjectModel
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/models/{model_id}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.RemoveProjectModel
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to remove the model from.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to remove the model from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: Catalog model UUID to unassign.
        in: path
        name: model_id
        required: true
        schema:
          description: Catalog model UUID to unassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: model_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RemoveProjectModelResponse'
          description: Success
      summary: RemoveProjectModel
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/providers:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListProjectProviders
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project whose enabled providers to list.
        in: path
        name: project_id
        required: true
        schema:
          description: Project whose enabled providers to list.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectProvidersResponse'
          description: Success
      summary: ListProjectProviders
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      operationId: agentrouter.admin.v1.AdminService.AddProjectProvider
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to enable the provider for.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to enable the provider for.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                providerName:
                  description: Provider name to enable (e.g. "openai").
                  maxLength: 63
                  minLength: 1
                  title: provider_name
                  type: string
              title: AddProjectProviderRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AddProjectProviderResponse'
          description: Success
      summary: AddProjectProvider
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/providers/{provider_name}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.RemoveProjectProvider
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to disable the provider for.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to disable the provider for.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: Provider name to disable.
        in: path
        name: provider_name
        required: true
        schema:
          description: Provider name to disable.
          maxLength: 63
          minLength: 1
          title: provider_name
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RemoveProjectProviderResponse'
          description: Success
      summary: RemoveProjectProvider
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/settings:
    get:
      operationId: agentrouter.admin.v1.AdminService.GetProjectSettings
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project whose settings to fetch.
        in: path
        name: project_id
        required: true
        schema:
          description: Project whose settings to fetch.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetProjectSettingsResponse'
          description: Success
      summary: GetProjectSettings
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/customers/{customer_id}/projects/{project_id}/settings/{setting_name}:
    delete:
      operationId: agentrouter.admin.v1.AdminService.DeleteProjectSetting
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to delete the setting from.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to delete the setting from.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: Setting key to delete ("global-fallback" or "rate-limit").
        in: path
        name: setting_name
        required: true
        schema:
          description: Setting key to delete ("global-fallback" or "rate-limit").
          enum:
          - global-fallback
          - rate-limit
          title: setting_name
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteProjectSettingResponse'
          description: Success
      summary: DeleteProjectSetting
      tags:
      - agentrouter.admin.v1.AdminService
    put:
      operationId: agentrouter.admin.v1.AdminService.UpsertProjectSetting
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          maxLength: 63
          minLength: 1
          title: customer_id
          type: string
      - description: Project to set the value on.
        in: path
        name: project_id
        required: true
        schema:
          description: Project to set the value on.
          maxLength: 253
          minLength: 1
          title: project_id
          type: string
      - description: Setting key to create or update ("global-fallback" or "rate-limit").
        in: path
        name: setting_name
        required: true
        schema:
          description: Setting key to create or update ("global-fallback" or "rate-limit").
          enum:
          - global-fallback
          - rate-limit
          title: setting_name
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                settingValue:
                  description: New string-encoded value for the setting.
                  maxLength: 1024
                  minLength: 1
                  title: setting_value
                  type: string
              title: UpsertProjectSettingRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpsertProjectSettingResponse'
          description: Success
      summary: UpsertProjectSetting
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/dataplanes:
    get:
      description: List data planes.
      operationId: agentrouter.admin.v1.AdminService.ListDataplanes
      parameters:
      - in: query
        name: customerId
        schema:
          maxLength: 63
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
      - in: query
        name: pageSize
        schema:
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - in: query
        name: pageToken
        schema:
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListDataplanesResponse'
          description: Success
      summary: ListDataplanes
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: "===== Data Plane Management (supersedes Workspace; #4637) =====\n\
        \ Register a data plane."
      operationId: agentrouter.admin.v1.AdminService.CreateDataplane
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateDataplaneRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateDataplaneResponse'
          description: Success
      summary: CreateDataplane
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/dataplanes/{id}:
    delete:
      description: Delete a data plane (soft delete).
      operationId: agentrouter.admin.v1.AdminService.DeleteDataplane
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteDataplaneResponse'
          description: Success
      summary: DeleteDataplane
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      description: Get a data plane.
      operationId: agentrouter.admin.v1.AdminService.GetDataplane
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetDataplaneResponse'
          description: Success
      summary: GetDataplane
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      description: Update a data plane.
      operationId: agentrouter.admin.v1.AdminService.UpdateDataplane
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    maxLength: 255
                    title: value
                    type: string
                  maxProperties: 50
                  title: labels
                  type: object
                name:
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
              title: UpdateDataplaneRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateDataplaneResponse'
          description: Success
      summary: UpdateDataplane
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/dataplanes/{id}/project:
    post:
      description: Assign a data plane to a project (omit project_id to clear to default).
      operationId: agentrouter.admin.v1.AdminService.SetDataplaneProject
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                projectId:
                  maxLength: 255
                  nullable: true
                  title: project_id
                  type: string
              title: SetDataplaneProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetDataplaneProjectResponse'
          description: Success
      summary: SetDataplaneProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/dataplanes/{id}/url:
    post:
      description: Set the customer-facing advertised URL for a data plane.
      operationId: agentrouter.admin.v1.AdminService.SetDataplaneURL
      parameters:
      - in: path
        name: id
        required: true
        schema:
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                triggerUpdate:
                  title: trigger_update
                  type: boolean
                url:
                  maxLength: 2048
                  minLength: 1
                  title: url
                  type: string
              title: SetDataplaneURLRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetDataplaneURLResponse'
          description: Success
      summary: SetDataplaneURL
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/models:
    get:
      operationId: agentrouter.admin.v1.AdminService.ListModels
      parameters:
      - description: If true, return only enabled models.
        in: query
        name: onlyEnabled
        schema:
          description: If true, return only enabled models.
          title: only_enabled
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListModelsResponse'
          description: Success
      summary: ListModels
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/models/{model_id}:
    get:
      operationId: agentrouter.admin.v1.AdminService.GetModel
      parameters:
      - description: Catalog entry UUID to fetch.
        in: path
        name: model_id
        required: true
        schema:
          description: Catalog entry UUID to fetch.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: model_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetModelResponse'
          description: Success
      summary: GetModel
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/ping:
    get:
      description: Ping endpoint for health checks and authentication testing
      operationId: agentrouter.admin.v1.AdminService.Ping
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.PingResponse'
          description: Success
      summary: Ping
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways:
    get:
      description: List project gateways (optionally filtered by customer and/or workspace)
      operationId: agentrouter.admin.v1.AdminService.ListProjectGateways
      parameters:
      - description: 'Optional filter: only return project gateways owned by this
          customer slug.'
        in: query
        name: customerId
        schema:
          description: 'Optional filter: only return project gateways owned by this
            customer slug.'
          maxLength: 63
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
      - description: 'Optional filter: only return project gateways hosted by this
          workspace (dataplane).'
        in: query
        name: workspaceId
        schema:
          description: 'Optional filter: only return project gateways hosted by this
            workspace (dataplane).'
          maxLength: 253
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      - description: Max project gateways to return per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max project gateways to return per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque cursor from a previous response's next_page_token.
        in: query
        name: pageToken
        schema:
          description: Opaque cursor from a previous response's next_page_token.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectGatewaysResponse'
          description: Success
      summary: ListProjectGateways
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: Create project gateway
      operationId: agentrouter.admin.v1.AdminService.CreateProjectGateway
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateProjectGatewayRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateProjectGatewayResponse'
          description: Success
      summary: CreateProjectGateway
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways/{id}:
    delete:
      description: Delete project gateway (soft delete)
      operationId: agentrouter.admin.v1.AdminService.DeleteProjectGateway
      parameters:
      - description: Project gateway UUID to soft-delete.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID to soft-delete.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      - description: "Owner scope (#4637): when the caller is a project owner (not\
          \ a platform admin),\n this is the project they own; the handler verifies\
          \ the gateway serves it. Ignored for admins."
        in: query
        name: projectId
        schema:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteProjectGatewayResponse'
          description: Success
      summary: DeleteProjectGateway
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      description: Get project gateway
      operationId: agentrouter.admin.v1.AdminService.GetProjectGateway
      parameters:
      - description: Project gateway UUID (the internal `id`, not the customer-chosen
          project_gateway_id).
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID (the internal `id`, not the customer-chosen
            project_gateway_id).
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      - description: "Owner scope (#4637): when the caller is a project owner (not\
          \ a platform admin),\n this is the project they own; the handler verifies\
          \ the gateway serves it. Ignored for admins."
        in: query
        name: projectId
        schema:
          description: "Owner scope (#4637): when the caller is a project owner (not\
            \ a platform admin),\n this is the project they own; the handler verifies\
            \ the gateway serves it. Ignored for admins."
          maxLength: 253
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetProjectGatewayResponse'
          description: Success
      summary: GetProjectGateway
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      description: Update project gateway
      operationId: agentrouter.admin.v1.AdminService.UpdateProjectGateway
      parameters:
      - description: Project gateway UUID to update.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID to update.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: New description; unset leaves the existing value.
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    maxLength: 255
                    title: value
                    type: string
                  description: Replacement set of labels.
                  maxProperties: 50
                  title: labels
                  type: object
                name:
                  description: New display name; unset leaves the existing value.
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
                projectId:
                  description: "Owner scope (#4637): when the caller is a project\
                    \ owner (not a platform admin),\n this is the project they own;\
                    \ the handler verifies the gateway serves it. Ignored for admins."
                  maxLength: 253
                  nullable: true
                  pattern: ^[a-zA-Z0-9-_.]+$
                  title: project_id
                  type: string
                url:
                  description: New customer-facing URL/hostname; unset leaves the
                    existing value.
                  maxLength: 2048
                  nullable: true
                  title: url
                  type: string
              title: UpdateProjectGatewayRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateProjectGatewayResponse'
          description: Success
      summary: UpdateProjectGateway
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways/{id}/projects:
    get:
      description: List the project slugs attached to a project gateway.
      operationId: agentrouter.admin.v1.AdminService.ListProjectGatewayProjects
      parameters:
      - description: Project gateway UUID whose attached projects are listed.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID whose attached projects are listed.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListProjectGatewayProjectsResponse'
          description: Success
      summary: ListProjectGatewayProjects
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: "Attach a project to a project gateway (idempotent). Establishes\
        \ a\n gateway<->project binding in the many-to-many project_gateway_projects\n\
        \ relationship.\n\n A project gateway may host only ONE project: attaching\
        \ a second, different\n project is rejected (detach the current project first).\
        \ Re-attaching the\n same project is a no-op.\n\n Ensure the attached project\
        \ has assigned models BEFORE setting the\n gateway's URL: under strict isolation\
        \ a gateway with no assigned models\n serves an EMPTY route map and will return\
        \ 404 for every request. The\n response carries any such warnings in the `warnings`\
        \ field."
      operationId: agentrouter.admin.v1.AdminService.AttachProjectGatewayProject
      parameters:
      - description: Project gateway UUID to attach the project to.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID to attach the project to.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                projectId:
                  description: Project slug to bind to the project gateway.
                  maxLength: 253
                  minLength: 1
                  pattern: ^[a-zA-Z0-9-_.]+$
                  title: project_id
                  type: string
              title: AttachProjectGatewayProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.AttachProjectGatewayProjectResponse'
          description: Success
      summary: AttachProjectGatewayProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways/{id}/projects/{project_id}:
    delete:
      description: Detach a project from a project gateway.
      operationId: agentrouter.admin.v1.AdminService.DetachProjectGatewayProject
      parameters:
      - description: Project gateway UUID to detach the project from.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID to detach the project from.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      - description: Project slug to unbind from the project gateway.
        in: path
        name: project_id
        required: true
        schema:
          description: Project slug to unbind from the project gateway.
          maxLength: 253
          minLength: 1
          pattern: ^[a-zA-Z0-9-_.]+$
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DetachProjectGatewayProjectResponse'
          description: Success
      summary: DetachProjectGatewayProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways/{id}/url:
    post:
      description: "Set the customer-facing URL/hostname for a project gateway.\n\n\
        \ The hostname (host part of the URL) must be globally UNIQUE across all\n\
        \ project gateways in the platform; setting a hostname already bound to a\n\
        \ different gateway is rejected with ALREADY_EXISTS.\n\n Behavior change (strict\
        \ isolation): once any gateway in a data plane's\n workspace has its URL set,\
        \ that data plane serves ONLY per-gateway\n host-scoped routes -- the default\
        \ all-models route is suppressed, so\n clients must call the gateway hostname\
        \ rather than the workspace's shared\n URL.\n\n Best practice: attach a project\
        \ and assign its models BEFORE setting the\n URL. Setting a URL on a gateway\
        \ with no attached project (or whose project\n has no assigned models) makes\
        \ the gateway reachable but it will return 404\n for every request until a\
        \ project with assigned models is attached. The\n response surfaces any such\
        \ condition in the `warnings` field."
      operationId: agentrouter.admin.v1.AdminService.SetProjectGatewayURL
      parameters:
      - description: Project gateway UUID whose URL is being set.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID whose URL is being set.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                projectId:
                  description: "Owner scope (#4637): when the caller is a project\
                    \ owner (not a platform admin),\n this is the project they own;\
                    \ the handler verifies the gateway serves it. Ignored for admins."
                  maxLength: 253
                  nullable: true
                  pattern: ^[a-zA-Z0-9-_.]+$
                  title: project_id
                  type: string
                url:
                  description: "url is the customer-facing URL/hostname of the project\
                    \ gateway's ingress\n endpoint. Its host part must be globally\
                    \ unique across all project gateways\n (a hostname bound to another\
                    \ gateway is rejected with ALREADY_EXISTS)."
                  maxLength: 2048
                  minLength: 1
                  title: url
                  type: string
              title: SetProjectGatewayURLRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetProjectGatewayURLResponse'
          description: Success
      summary: SetProjectGatewayURL
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/project-gateways/{id}/workspace:
    post:
      description: "Reassign a project gateway to a different dataplane (workspace).\n\
        \n A data plane serves ONLY the hostnames of project gateways whose\n workspace_id\
        \ matches its own (via per-gateway host-scoped routes plus the\n P10 authz\
        \ map). Moving a gateway is therefore NOT a bare DB flip: this RPC\n tears\
        \ down the gateway's per-gateway routes + authz binding on the OLD data\n\
        \ plane and materializes them on the NEW one, refreshing both workspaces'\n\
        \ authz maps and default-route suppression.\n\n The gateway's hostname is\
        \ unchanged, so DNS is NOT moved automatically: the\n hostname still resolves\
        \ to the OLD data plane's ingress until an operator\n repoints it. Until that\
        \ cutover, requests to the hostname hit the old data\n plane (now torn down)\
        \ and 404. The response ALWAYS includes a `warnings`\n entry reminding the\
        \ operator to repoint DNS (and provision the new data\n plane's TLS cert).\
        \ Recommended order: provision the new data plane's\n DNS/cert, call this\
        \ RPC, then cut DNS over.\n\n Reassigning to the gateway's current workspace\
        \ is a no-op. The new\n workspace must exist for the gateway's customer, and\
        \ the gateway's slug\n must be free in the new workspace (a collision is rejected\
        \ with\n ALREADY_EXISTS)."
      operationId: agentrouter.admin.v1.AdminService.SetProjectGatewayWorkspace
      parameters:
      - description: Project gateway UUID to reassign.
        in: path
        name: id
        required: true
        schema:
          description: Project gateway UUID to reassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                workspaceId:
                  description: "Target dataplane (workspace) slug to move the project\
                    \ gateway to. Must\n exist for the gateway's customer, and the\
                    \ gateway's slug must be free in\n it."
                  maxLength: 253
                  minLength: 1
                  pattern: ^[a-zA-Z0-9-_.]+$
                  title: workspace_id
                  type: string
              title: SetProjectGatewayWorkspaceRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetProjectGatewayWorkspaceResponse'
          description: Success
      summary: SetProjectGatewayWorkspace
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/service-accounts:
    get:
      description: List service accounts
      operationId: agentrouter.admin.v1.AdminService.ListServiceAccounts
      parameters:
      - description: Optional filter by owning customer slug.
        in: query
        name: customerId
        schema:
          description: Optional filter by owning customer slug.
          maxLength: 63
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
      - description: Optional filter by workspace slug.
        in: query
        name: workspaceId
        schema:
          description: Optional filter by workspace slug.
          maxLength: 253
          pattern: ^[a-zA-Z0-9-_.]+$
          title: workspace_id
          type: string
      - description: Optional filter by account status.
        in: query
        name: status
        schema:
          $ref: '#/components/schemas/agentrouter.admin.v1.ServiceAccountStatus'
          description: Optional filter by account status.
          title: status
      - description: Max results per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque pagination cursor from a prior response.
        in: query
        name: pageToken
        schema:
          description: Opaque pagination cursor from a prior response.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListServiceAccountsResponse'
          description: Success
      summary: ListServiceAccounts
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: Create service account
      operationId: agentrouter.admin.v1.AdminService.CreateServiceAccount
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateServiceAccountRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateServiceAccountResponse'
          description: Success
      summary: CreateServiceAccount
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/service-accounts/{id}:
    get:
      description: Get service account
      operationId: agentrouter.admin.v1.AdminService.GetServiceAccount
      parameters:
      - description: Service account UUID to fetch.
        in: path
        name: id
        required: true
        schema:
          description: Service account UUID to fetch.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetServiceAccountResponse'
          description: Success
      summary: GetServiceAccount
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/service-accounts/{id}:restore:
    post:
      description: "Restore service account\n Restores a revoked service account to\
        \ active status.\n Only one active service account per customer_id + workspace_id\
        \ is allowed."
      operationId: agentrouter.admin.v1.AdminService.RestoreServiceAccount
      parameters:
      - description: Service account UUID to restore to active.
        in: path
        name: id
        required: true
        schema:
          description: Service account UUID to restore to active.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                reason:
                  description: Optional human-readable restore reason (audit trail).
                  maxLength: 500
                  nullable: true
                  title: reason
                  type: string
              title: RestoreServiceAccountRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RestoreServiceAccountResponse'
          description: Success
      summary: RestoreServiceAccount
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/service-accounts/{id}:revoke:
    post:
      description: Revoke service account
      operationId: agentrouter.admin.v1.AdminService.RevokeServiceAccount
      parameters:
      - description: Service account UUID to revoke.
        in: path
        name: id
        required: true
        schema:
          description: Service account UUID to revoke.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                reason:
                  description: Optional human-readable revocation reason (audit trail).
                  maxLength: 500
                  nullable: true
                  title: reason
                  type: string
              title: RevokeServiceAccountRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RevokeServiceAccountResponse'
          description: Success
      summary: RevokeServiceAccount
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/telemetry-configs:
    get:
      description: List telemetry configs
      operationId: agentrouter.admin.v1.AdminService.ListTelemetryConfigs
      parameters:
      - description: Filter by user_id
        in: query
        name: userId
        schema:
          description: Filter by user_id
          title: user_id
          type: string
      - description: Optional filter by signal type.
        in: query
        name: telemetryType
        schema:
          description: Optional filter by signal type.
          enum:
          - traces
          - metrics
          - logs
          - audit_logs
          title: telemetry_type
          type: string
      - description: Filter by enabled status
        in: query
        name: enabled
        schema:
          description: Filter by enabled status
          title: enabled
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListTelemetryConfigsResponse'
          description: Success
      summary: ListTelemetryConfigs
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: Create telemetry config
      operationId: agentrouter.admin.v1.AdminService.CreateTelemetryConfig
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateTelemetryConfigRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateTelemetryConfigResponse'
          description: Success
      summary: CreateTelemetryConfig
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/telemetry-configs/test-forward:
    post:
      description: "Test an audit-log SIEM sink by sending a synthetic OTLP-Logs record\
        \ via the\n same path the forwarder uses (POST /v1/logs with the resolved\
        \ auth). Proves\n the actual log endpoint + auth, unlike the trace-based bellhop\
        \ tester."
      operationId: agentrouter.admin.v1.AdminService.TestAuditForward
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.TestAuditForwardRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.TestAuditForwardResponse'
          description: Success
      summary: TestAuditForward
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/telemetry-configs/trigger-forward:
    post:
      description: "Trigger an immediate audit-log forward run (real-time push). The\
        \ management\n plane kicks the in-process forwarder; the cron ticker is the\
        \ backstop."
      operationId: agentrouter.admin.v1.AdminService.TriggerAuditForward
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.TriggerAuditForwardRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.TriggerAuditForwardResponse'
          description: Success
      summary: TriggerAuditForward
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/telemetry-configs/{id}:
    delete:
      description: Delete telemetry config
      operationId: agentrouter.admin.v1.AdminService.DeleteTelemetryConfig
      parameters:
      - description: Forwarding config ID to delete.
        in: path
        name: id
        required: true
        schema:
          description: Forwarding config ID to delete.
          maxLength: 64
          minLength: 1
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteTelemetryConfigResponse'
          description: Success
      summary: DeleteTelemetryConfig
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      description: Get telemetry config
      operationId: agentrouter.admin.v1.AdminService.GetTelemetryConfig
      parameters:
      - description: Forwarding config ID to fetch.
        in: path
        name: id
        required: true
        schema:
          description: Forwarding config ID to fetch.
          maxLength: 64
          minLength: 1
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetTelemetryConfigResponse'
          description: Success
      summary: GetTelemetryConfig
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      description: Update telemetry config
      operationId: agentrouter.admin.v1.AdminService.UpdateTelemetryConfig
      parameters:
      - description: Forwarding config ID to update.
        in: path
        name: id
        required: true
        schema:
          description: Forwarding config ID to update.
          maxLength: 64
          minLength: 1
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                apiKeyHeader:
                  description: New API key header name; unset leaves it unchanged.
                  maxLength: 256
                  nullable: true
                  title: api_key_header
                  type: string
                authType:
                  description: New auth scheme; unset leaves it unchanged.
                  enum:
                  - none
                  - bearer
                  - basic
                  - api_key
                  nullable: true
                  title: auth_type
                  type: string
                authValue:
                  description: Plain text auth value to be encrypted
                  nullable: true
                  title: auth_value
                  type: string
                enabled:
                  description: New enabled flag; unset leaves it unchanged.
                  nullable: true
                  title: enabled
                  type: boolean
                forwardIntervalSeconds:
                  description: New audit-log forward interval in seconds; unset leaves
                    it unchanged.
                  format: int32
                  maximum: 86400
                  minimum: 0
                  nullable: true
                  title: forward_interval_seconds
                  type: integer
                protocol:
                  description: New OTLP protocol; unset leaves it unchanged.
                  enum:
                  - grpc
                  - http/json
                  - http/protobuf
                  nullable: true
                  title: protocol
                  type: string
                sinkUrl:
                  description: New sink URL; unset leaves it unchanged.
                  format: uri
                  nullable: true
                  title: sink_url
                  type: string
                status:
                  description: Override the connection status (connected/disconnected/error/testing).
                  enum:
                  - connected
                  - disconnected
                  - error
                  - testing
                  nullable: true
                  title: status
                  type: string
              title: UpdateTelemetryConfigRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateTelemetryConfigResponse'
          description: Success
      summary: UpdateTelemetryConfig
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/user-tokens:
    get:
      description: List user tokens
      operationId: agentrouter.admin.v1.AdminService.ListUserTokens
      parameters:
      - description: Optional filter by issuing user ID.
        in: query
        name: userId
        schema:
          description: Optional filter by issuing user ID.
          maxLength: 255
          title: user_id
          type: string
      - description: Optional filter by token status.
        in: query
        name: status
        schema:
          $ref: '#/components/schemas/agentrouter.admin.v1.UserTokenStatus'
          description: Optional filter by token status.
          title: status
      - description: Max results per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max results per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque pagination cursor from a prior response.
        in: query
        name: pageToken
        schema:
          description: Opaque pagination cursor from a prior response.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListUserTokensResponse'
          description: Success
      summary: ListUserTokens
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: "Create user token\n Generates a JWT token for user authentication\
        \ with gatekeeper."
      operationId: agentrouter.admin.v1.AdminService.CreateUserToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateUserTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateUserTokenResponse'
          description: Success
      summary: CreateUserToken
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/user-tokens/{jti}:
    get:
      description: Get user token
      operationId: agentrouter.admin.v1.AdminService.GetUserToken
      parameters:
      - description: JWT ID (jti) of the token to fetch.
        in: path
        name: jti
        required: true
        schema:
          description: JWT ID (jti) of the token to fetch.
          maxLength: 64
          minLength: 1
          title: jti
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetUserTokenResponse'
          description: Success
      summary: GetUserToken
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/user-tokens/{jti}:revoke:
    post:
      description: "Revoke user token\n Revokes a user token by its JTI (JWT ID)."
      operationId: agentrouter.admin.v1.AdminService.RevokeUserToken
      parameters:
      - description: JWT ID (jti) of the token to revoke.
        in: path
        name: jti
        required: true
        schema:
          description: JWT ID (jti) of the token to revoke.
          maxLength: 64
          minLength: 1
          title: jti
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                reason:
                  description: Optional human-readable revocation reason (audit trail).
                  maxLength: 500
                  nullable: true
                  title: reason
                  type: string
              title: RevokeUserTokenRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.RevokeUserTokenResponse'
          description: Success
      summary: RevokeUserToken
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/workspaces:
    get:
      description: List workspaces
      operationId: agentrouter.admin.v1.AdminService.ListWorkspaces
      parameters:
      - description: 'Optional filter: only return workspaces owned by this customer
          slug.'
        in: query
        name: customerId
        schema:
          description: 'Optional filter: only return workspaces owned by this customer
            slug.'
          maxLength: 63
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
          title: customer_id
          type: string
      - description: Max workspaces to return per page (0 = server default).
        in: query
        name: pageSize
        schema:
          description: Max workspaces to return per page (0 = server default).
          format: int32
          maximum: 1000
          minimum: 0
          title: page_size
          type: integer
      - description: Opaque cursor from a previous response's next_page_token.
        in: query
        name: pageToken
        schema:
          description: Opaque cursor from a previous response's next_page_token.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.ListWorkspacesResponse'
          description: Success
      summary: ListWorkspaces
      tags:
      - agentrouter.admin.v1.AdminService
    post:
      description: Create workspace
      operationId: agentrouter.admin.v1.AdminService.CreateWorkspace
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.admin.v1.CreateWorkspaceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.CreateWorkspaceResponse'
          description: Success
      summary: CreateWorkspace
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/workspaces/{id}:
    delete:
      description: Delete workspace (soft delete)
      operationId: agentrouter.admin.v1.AdminService.DeleteWorkspace
      parameters:
      - description: Workspace UUID to soft-delete.
        in: path
        name: id
        required: true
        schema:
          description: Workspace UUID to soft-delete.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.DeleteWorkspaceResponse'
          description: Success
      summary: DeleteWorkspace
      tags:
      - agentrouter.admin.v1.AdminService
    get:
      description: Get workspace
      operationId: agentrouter.admin.v1.AdminService.GetWorkspace
      parameters:
      - description: Workspace UUID (the internal `id`, not the customer-chosen workspace_id).
        in: path
        name: id
        required: true
        schema:
          description: Workspace UUID (the internal `id`, not the customer-chosen
            workspace_id).
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.GetWorkspaceResponse'
          description: Success
      summary: GetWorkspace
      tags:
      - agentrouter.admin.v1.AdminService
    patch:
      description: Update workspace
      operationId: agentrouter.admin.v1.AdminService.UpdateWorkspace
      parameters:
      - description: Workspace UUID to update.
        in: path
        name: id
        required: true
        schema:
          description: Workspace UUID to update.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: New description; unset leaves the existing value.
                  maxLength: 1000
                  nullable: true
                  title: description
                  type: string
                labels:
                  additionalProperties:
                    maxLength: 255
                    title: value
                    type: string
                  description: Replacement set of labels.
                  maxProperties: 50
                  title: labels
                  type: object
                name:
                  description: New display name; unset leaves the existing value.
                  maxLength: 255
                  nullable: true
                  title: name
                  type: string
              title: UpdateWorkspaceRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.UpdateWorkspaceResponse'
          description: Success
      summary: UpdateWorkspace
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/workspaces/{id}/project:
    post:
      description: Assign workspace to a project (or clear back to default project
        by omitting project_id)
      operationId: agentrouter.admin.v1.AdminService.SetWorkspaceProject
      parameters:
      - description: Workspace UUID to reassign.
        in: path
        name: id
        required: true
        schema:
          description: Workspace UUID to reassign.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                projectId:
                  description: project_id to assign. Omit or set to empty string to
                    clear back to the default project (NULL).
                  maxLength: 255
                  nullable: true
                  title: project_id
                  type: string
              title: SetWorkspaceProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetWorkspaceProjectResponse'
          description: Success
      summary: SetWorkspaceProject
      tags:
      - agentrouter.admin.v1.AdminService
  /admin/v1/workspaces/{id}/url:
    post:
      description: "Set the customer-facing gateway URL for a workspace data plane.\n\
        \ Writes system_settings.dataplane-url:<workspace_id> and optionally fires\
        \ a PROXY_URL config event."
      operationId: agentrouter.admin.v1.AdminService.SetWorkspaceURL
      parameters:
      - description: Workspace UUID whose data-plane URL is being set.
        in: path
        name: id
        required: true
        schema:
          description: Workspace UUID whose data-plane URL is being set.
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                triggerUpdate:
                  description: trigger_update fires a PROXY_URL config event to the
                    data plane after persisting the URL.
                  title: trigger_update
                  type: boolean
                url:
                  description: url is the full https:// URL of the data plane's customer-facing
                    gateway endpoint.
                  maxLength: 2048
                  minLength: 1
                  title: url
                  type: string
              title: SetWorkspaceURLRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.admin.v1.SetWorkspaceURLResponse'
          description: Success
      summary: SetWorkspaceURL
      tags:
      - agentrouter.admin.v1.AdminService
  /configurator/v1/acknowledge-event:
    post:
      description: "AcknowledgeEvent marks an event as acknowledged by a worker.\n\
        \ This prevents other workers from processing the same event."
      operationId: agentrouter.configurator.v1.ConfiguratorService.AcknowledgeEvent
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.AcknowledgeEventRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.AcknowledgeEventResponse'
          description: Success
      summary: AcknowledgeEvent
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/active-providers:
    get:
      description: "ListActiveProviders returns a list of active (enabled) AI providers.\n\
        \ Used for monitoring, debugging, and querying available provider configurations."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ListActiveProviders
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ListActiveProvidersResponse'
          description: Success
      summary: ListActiveProviders
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/active-users:
    get:
      description: "ListActiveUsers returns a list of user IDs that have active configurations.\n\
        \ Used for monitoring and debugging."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ListActiveUsers
      parameters:
      - description: "Maximum number of users to return.\n If not specified, defaults\
          \ to 100."
        in: query
        name: limit
        schema:
          description: "Maximum number of users to return.\n If not specified, defaults\
            \ to 100."
          format: int32
          title: limit
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ListActiveUsersResponse'
          description: Success
      summary: ListActiveUsers
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/byok-backends:
    post:
      description: "SaveBYOKBackends saves BYOK provider backends configuration.\n\
        \ Used by workers to persist BYOK backend metadata to database."
      operationId: agentrouter.configurator.v1.ConfiguratorService.SaveBYOKBackends
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.SaveBYOKBackendsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.SaveBYOKBackendsResponse'
          description: Success
      summary: SaveBYOKBackends
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/byok-backends/{user_id}:
    delete:
      description: "DeleteBYOKBackends deletes BYOK provider backends configuration.\n\
        \ Used by workers to remove BYOK backend metadata from database."
      operationId: agentrouter.configurator.v1.ConfiguratorService.DeleteBYOKBackends
      parameters:
      - description: User ID who owns these backends.
        in: path
        name: user_id
        required: true
        schema:
          description: User ID who owns these backends.
          title: user_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.DeleteBYOKBackendsResponse'
          description: Success
      summary: DeleteBYOKBackends
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/complete-event:
    post:
      description: CompleteEvent marks an event as successfully applied or failed.
      operationId: agentrouter.configurator.v1.ConfiguratorService.CompleteEvent
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.CompleteEventRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.CompleteEventResponse'
          description: Success
      summary: CompleteEvent
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/config:
    post:
      description: "GetConfiguration retrieves the latest configuration for a user.\n\
        \ Returns configuration only if the version is newer than the provided\n version.\
        \ Supports batch queries for multiple users for efficiency."
      operationId: agentrouter.configurator.v1.ConfiguratorService.GetConfiguration
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.GetConfigurationRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.GetConfigurationResponse'
          description: Success
      summary: GetConfiguration
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/configs:
    get:
      description: "ListConfigurations lists all configurations with optional filtering.\n\
        \ Used for debugging and monitoring."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ListConfigurations
      parameters:
      - description: Filter by user ID (optional).
        in: query
        name: userId
        schema:
          description: Filter by user ID (optional).
          title: user_id
          type: string
      - description: Filter by config type (optional).
        in: query
        name: configType
        schema:
          $ref: '#/components/schemas/agentrouter.configurator.v1.ConfigType'
          description: Filter by config type (optional).
          title: config_type
      - description: Pagination.
        in: query
        name: pageSize
        schema:
          description: Pagination.
          format: int32
          title: page_size
          type: integer
      - description: Page token returned by a prior call's next_page_token.
        in: query
        name: pageToken
        schema:
          description: Page token returned by a prior call's next_page_token.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ListConfigurationsResponse'
          description: Success
      summary: ListConfigurations
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-upgrade-credentials:
    post:
      description: "SubmitDataplaneUpgradeCredentials stores operator-provided registry\n\
        \ credentials for a DATAPLANE_UPGRADE event parked in NeedsCredentials.\n\
        \ Payload is KEK-envelope encrypted at MP and stored in\n dataplane_upgrade_credentials.\
        \ Dashboard (admin) is the only caller."
      operationId: agentrouter.configurator.v1.ConfiguratorService.SubmitDataplaneUpgradeCredentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.SubmitDataplaneUpgradeCredentialsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.SubmitDataplaneUpgradeCredentialsResponse'
          description: Success
      summary: SubmitDataplaneUpgradeCredentials
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-upgrade-credentials/ack:
    post:
      description: "AckDataplaneUpgradeCredentials confirms the worker successfully\n\
        \ materialised the credentials Secret in-cluster. MP DELETEs the\n ciphertext\
        \ row immediately — no 30-day retention. Workspace claim\n must match. Idempotent:\
        \ a second Ack on an already-deleted row\n returns success."
      operationId: agentrouter.configurator.v1.ConfiguratorService.AckDataplaneUpgradeCredentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.AckDataplaneUpgradeCredentialsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.AckDataplaneUpgradeCredentialsResponse'
          description: Success
      summary: AckDataplaneUpgradeCredentials
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-upgrade-credentials/get:
    post:
      description: "GetDataplaneUpgradeCredentials returns the operator-submitted\n\
        \ credentials for an upgrade event. MP decrypts server-side and\n returns\
        \ plaintext over TLS — the worker (DP cluster) never has\n KEK access. Caller's\
        \ workspace claim must match the event's\n workspace. Read-only — no state\
        \ change until AckDataplaneUpgradeCredentials."
      operationId: agentrouter.configurator.v1.ConfiguratorService.GetDataplaneUpgradeCredentials
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.GetDataplaneUpgradeCredentialsRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.GetDataplaneUpgradeCredentialsResponse'
          description: Success
      summary: GetDataplaneUpgradeCredentials
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-upgrade/cancel:
    post:
      description: "CancelDataplaneUpgrade emits a pending UPGRADE_CANCEL event against\n\
        \ the workspace. The liaison worker picks it up via the normal\n ListPendingEvents\
        \ poll, matches the in-flight TarsUpgrade CR by name\n (= upgrade_event_id),\
        \ and patches spec.cancel so the running Job\n initiates helm --atomic rollback\
        \ at its next 5s poll tick. Idempotent:\n a no-op when the CR already has\
        \ spec.cancel=true or has reached a\n terminal phase."
      operationId: agentrouter.configurator.v1.ConfiguratorService.CancelDataplaneUpgrade
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.CancelDataplaneUpgradeRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.CancelDataplaneUpgradeResponse'
          description: Success
      summary: CancelDataplaneUpgrade
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-upgrade/rollback:
    post:
      description: "RollbackDataplaneUpgrade emits a pending UPGRADE_ROLLBACK event\n\
        \ against the workspace. Operator-initiated post-Completed rollback:\n dashboard\
        \ shows a Rollback button after a successful upgrade so the\n operator can\
        \ return to the prior helm revision (e.g. they want to\n unwind a release\
        \ that's behaving badly under real traffic). Worker\n spawns a new rollback\
        \ Job that runs\n `helm rollback tars <prev-revision> --wait --atomic`. The\
        \ new event\n becomes the latest dataplane-upgrade view so the dashboard renders\n\
        \ the in-flight rollback through phase RollingBack → RolledBack."
      operationId: agentrouter.configurator.v1.ConfiguratorService.RollbackDataplaneUpgrade
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.RollbackDataplaneUpgradeRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.RollbackDataplaneUpgradeResponse'
          description: Success
      summary: RollbackDataplaneUpgrade
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/dataplane-url:
    post:
      description: "SetDataplaneURL persists the customer-facing gateway URL for a\
        \ data plane\n (workspace). Called by `tare install` to register the URL at\
        \ install time\n and by the management-plane dashboard when an admin edits\
        \ it later.\n\n trigger_update=false (install path) only writes the system_settings\
        \ row.\n trigger_update=true (admin-edit path) additionally fires a PROXY_URL\n\
        \ configuration event so the running data plane converges on the new URL\n\
        \ via the worker's existing event-handling loop."
      operationId: agentrouter.configurator.v1.ConfiguratorService.SetDataplaneURL
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.SetDataplaneURLRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.SetDataplaneURLResponse'
          description: Success
      summary: SetDataplaneURL
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/event-metadata:
    post:
      description: "Replaces metadata JSON on an existing liaison_configuration_events\
        \ row.\n Lets workers push mid-flight progress onto an event without changing\n\
        \ its status (AcknowledgeEvent/CompleteEvent are terminal-only).\n Worker\
        \ writes are scoped to the caller's workspace claim."
      operationId: agentrouter.configurator.v1.ConfiguratorService.UpdateEventMetadata
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.UpdateEventMetadataRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.UpdateEventMetadataResponse'
          description: Success
      summary: UpdateEventMetadata
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/full-sync-workspace:
    post:
      description: "FullSyncWorkspace is the heavier \"last resort\" replay path:\
        \ walks\n `liaison_configurations` directly rather than sibling events, so\
        \ it\n can recover legacy unscoped events the drift sweep can't see. Worker\n\
        \ calls this once on startup and every Nth drift sweep tick. Workspace\n and\
        \ customer are resolved from the caller's auth claims."
      operationId: agentrouter.configurator.v1.ConfiguratorService.FullSyncWorkspace
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.FullSyncWorkspaceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.FullSyncWorkspaceResponse'
          description: Success
      summary: FullSyncWorkspace
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/mcp-catalog/upsert:
    post:
      description: "UpsertMCPCatalogServer wires a deployed in-cluster MCP server\
        \ into the\n customer's catalog. Used by `tare mcp enable <server>`: the CLI\
        \ looks\n up the server's seed entry in mcp-catalog-tare-mcp-with-tools.json,\
        \ asks\n the operator for the in-cluster URL, and submits this RPC to set\n\
        \ is_enabled=true on the corresponding mcp_catalog_servers row.\n\n Default\
        \ behaviour (force_overwrite=false): if the row exists, only\n url + is_enabled\
        \ (+updated_at) are updated; dashboard-set fields\n (description / icon /\
        \ categories / tools / etc.) are preserved.\n If the row is new, the seed-provided\
        \ fields are used to populate it.\n\n force_overwrite=true: every seed field\
        \ is written, clobbering any\n dashboard edits. Use sparingly — intended for\
        \ \"reset this row to\n seed defaults\" repairs."
      operationId: agentrouter.configurator.v1.ConfiguratorService.UpsertMCPCatalogServer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.UpsertMCPCatalogServerRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.UpsertMCPCatalogServerResponse'
          description: Success
      summary: UpsertMCPCatalogServer
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/mcp-route-status:
    post:
      description: "ReportMCPRouteStatus carries a data plane's observed readiness\
        \ of a\n per-owner MCP route (the RouteDeployment + its child MCPRoute \"\
        Accepted\"\n condition) back to the management plane so it can set the owning\
        \ MCP\n profiles' status. owner_kind=gateway -> owner_id is the Project Gateway\n\
        \ UUID; owner_kind=user -> owner_id is the user id (per-user MCP path). One\n\
        \ route covers all that owner's profiles, so they move together: ready=true\n\
        \ -> active (error cleared); ready=false -> error with the message. Called\
        \ by\n the worker on its poll cadence; workspace is resolved from the SA claim."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ReportMCPRouteStatus
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.ReportMCPRouteStatusRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ReportMCPRouteStatusResponse'
          description: Success
      summary: ReportMCPRouteStatus
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/pending-events:
    get:
      description: "ListPendingEvents returns configuration events that need processing.\n\
        \ Used by workers to discover which configurations have updates. The worker\n\
        \ piggybacks its tare-doctor runtime observation onto this poll\n (request.doctor_runtime)\
        \ so MP can explain a stale doctor report — hence\n this is no longer NO_SIDE_EFFECTS:\
        \ a poll updates the data plane's\n doctor-runtime state."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ListPendingEvents
      parameters:
      - description: "Maximum number of events to return.\n If not specified, defaults\
          \ to 100."
        in: query
        name: limit
        schema:
          description: "Maximum number of events to return.\n If not specified, defaults\
            \ to 100."
          format: int32
          title: limit
          type: integer
      - description: Worker pod identity (hostname / pod name) of the reporting instance.
        in: query
        name: doctorRuntime.instanceId
        schema:
          description: Worker pod identity (hostname / pod name) of the reporting
            instance.
          title: instance_id
          type: string
      - description: Running liaison build version, from the worker binary's embedded
          version.
        in: query
        name: doctorRuntime.tareVersion
        schema:
          description: Running liaison build version, from the worker binary's embedded
            version.
          title: tare_version
          type: string
      - description: "Verdict for the doctor CronJob: \"ok\" (recent success / currently\
          \ running),\n \"failing\" (last Job failed), or \"suspended\"."
        in: query
        name: doctorRuntime.state
        schema:
          description: "Verdict for the doctor CronJob: \"ok\" (recent success / currently\
            \ running),\n \"failing\" (last Job failed), or \"suspended\"."
          title: state
          type: string
      - description: "Human-readable failure reason when state=\"failing\" (e.g.\n\
          \ \"ImagePullBackOff\", \"CrashLoopBackOff\", \"exit code 1\")."
        in: query
        name: doctorRuntime.reason
        schema:
          description: "Human-readable failure reason when state=\"failing\" (e.g.\n\
            \ \"ImagePullBackOff\", \"CrashLoopBackOff\", \"exit code 1\")."
          title: reason
          type: string
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: doctorRuntime.lastSuccessfulRun.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: doctorRuntime.lastSuccessfulRun.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ListPendingEventsResponse'
          description: Success
      summary: ListPendingEvents
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/reconcile-workspace:
    post:
      description: "ReconcileWorkspace re-enqueues missing or stale slot events for\n\
        \ the caller's workspace by cloning the latest sibling event of each\n slot\
        \ the workspace has not yet converged on. Used by the worker's\n periodic\
        \ drift sweep. Workspace is resolved from the caller's auth\n claims; callers\
        \ without a workspace claim are rejected."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ReconcileWorkspace
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.ReconcileWorkspaceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ReconcileWorkspaceResponse'
          description: Success
      summary: ReconcileWorkspace
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/trigger:
    post:
      description: "TriggerUpdate triggers a configuration update for a specific user\
        \ and\n config type. This is called by the dashboard when configuration changes."
      operationId: agentrouter.configurator.v1.ConfiguratorService.TriggerUpdate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.TriggerUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.TriggerUpdateResponse'
          description: Success
      summary: TriggerUpdate
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/user-tokens/{jti}:revoke:
    post:
      description: "RevokeUserToken revokes a user token by JTI.\n Used by workers\
        \ in enterprise mode to revoke tokens when API keys are deleted."
      operationId: agentrouter.configurator.v1.ConfiguratorService.RevokeUserToken
      parameters:
      - description: JWT ID (JTI) of the token to revoke.
        in: path
        name: jti
        required: true
        schema:
          description: JWT ID (JTI) of the token to revoke.
          title: jti
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              description: RevokeUserTokenRequest revokes a user token by JTI.
              properties:
                reason:
                  description: Optional reason for revocation.
                  nullable: true
                  title: reason
                  type: string
                userId:
                  description: "User ID who owns the token being revoked.\n Used to\
                    \ populate revoked_by field."
                  title: user_id
                  type: string
              title: RevokeUserTokenRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.RevokeUserTokenResponse'
          description: Success
      summary: RevokeUserToken
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /configurator/v1/validate-dataplane:
    post:
      description: "ValidateDataplane lets a data plane's filter confirm that this\
        \ DP is\n still a valid (non-revoked) member of the customer and fetch the\n\
        \ customer's current gatekeeper public keys. Authentication is via the\n caller's\
        \ service-account JWT signed with its DP keypair\n (kid=`instance-<...>`).\
        \ When the DP keypair has been soft-deleted at\n MP, the auth layer rejects\
        \ the call with Unauthenticated — the filter\n treats that as \"revoked\"\
        \ without needing a separate response field.\n On success, the response carries\
        \ the customer's gatekeeper public\n keys so the filter can repopulate its\
        \ in-memory cache (and the\n worker can repopulate `tars-config[gatekeeper-public-keys]`)."
      operationId: agentrouter.configurator.v1.ConfiguratorService.ValidateDataplane
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.configurator.v1.ValidateDataplaneRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.configurator.v1.ValidateDataplaneResponse'
          description: Success
      summary: ValidateDataplane
      tags:
      - agentrouter.configurator.v1.ConfiguratorService
  /v1/api-keys:
    post:
      description: CreateApiKey creates a new JWT user-token API key for a user and
        returns the plaintext token exactly once.
      operationId: agentrouter.api_keys.v1.ApiKeysService.CreateApiKey
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.api_keys.v1.CreateApiKeyRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.api_keys.v1.CreateApiKeyResponse'
          description: Success
      summary: CreateApiKey
      tags:
      - agentrouter.api_keys.v1.ApiKeysService
  /v1/api-keys/{key_id}:
    delete:
      description: DeleteApiKey soft-deletes an API key (sets deleted_at).
      operationId: agentrouter.api_keys.v1.ApiKeysService.DeleteApiKey
      parameters:
      - description: Key ID (UUID).
        in: path
        name: key_id
        required: true
        schema:
          description: Key ID (UUID).
          title: key_id
          type: string
      - description: User ID that owns the API key.
        in: query
        name: userId
        schema:
          description: User ID that owns the API key.
          title: user_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.api_keys.v1.DeleteApiKeyResponse'
          description: Success
      summary: DeleteApiKey
      tags:
      - agentrouter.api_keys.v1.ApiKeysService
    patch:
      description: UpdateApiKey updates mutable fields of an API key (name and/or
        active state).
      operationId: agentrouter.api_keys.v1.ApiKeysService.UpdateApiKey
      parameters:
      - description: Key ID (UUID).
        in: path
        name: key_id
        required: true
        schema:
          description: Key ID (UUID).
          title: key_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                isActive:
                  description: Optional active state.
                  nullable: true
                  title: is_active
                  type: boolean
                name:
                  description: Optional new name.
                  nullable: true
                  title: name
                  type: string
                userId:
                  description: User ID that owns the API key.
                  title: user_id
                  type: string
              title: UpdateApiKeyRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.api_keys.v1.UpdateApiKeyResponse'
          description: Success
      summary: UpdateApiKey
      tags:
      - agentrouter.api_keys.v1.ApiKeysService
  /v1/auth/login:
    post:
      description: "Login initiates an OIDC authorization-code + PKCE flow. Returns\
        \ an\n authorization_url the caller must redirect the user's browser to.\n\
        \ After the IdP authenticates and redirects to redirect_uri, the\n platform\
        \ establishes a session cookie for subsequent requests."
      operationId: agentrouter.identity.v1.MeService.Login
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.identity.v1.LoginRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.LoginResponse'
          description: Success
      summary: Login
      tags:
      - agentrouter.identity.v1.MeService
  /v1/auth/logout:
    post:
      description: "Logout invalidates the caller's current OIDC session. Subsequent\n\
        \ requests using the session cookie return 401 unauthenticated. Does\n not\
        \ revoke API keys the identity may have issued."
      operationId: agentrouter.identity.v1.MeService.Logout
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.identity.v1.LogoutRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.LogoutResponse'
          description: Success
      summary: Logout
      tags:
      - agentrouter.identity.v1.MeService
  /v1/catalog/models:
    get:
      description: "ListModels returns catalog models, optionally filtered to a single\n\
        \ provider via the provider_id query parameter."
      operationId: agentrouter.catalog.v1.CatalogService.ListModels
      parameters:
      - description: "Filter to models belonging to this provider. Empty returns all\n\
          \ models."
        in: query
        name: providerId
        schema:
          description: "Filter to models belonging to this provider. Empty returns\
            \ all\n models."
          title: provider_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.ListModelsResponse'
          description: Success
      summary: ListModels
      tags:
      - agentrouter.catalog.v1.CatalogService
    post:
      description: UpsertModel creates or fully replaces a model record.
      operationId: agentrouter.catalog.v1.CatalogService.UpsertModel
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.catalog.v1.UpsertModelRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.Model'
          description: Success
      summary: UpsertModel
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/catalog/models/{id}:
    delete:
      description: DeleteModel removes a model entry.
      operationId: agentrouter.catalog.v1.CatalogService.DeleteModel
      parameters:
      - description: Id of the model to delete. mdl_<ulid>.
        in: path
        name: id
        required: true
        schema:
          description: Id of the model to delete. mdl_<ulid>.
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteModel
      tags:
      - agentrouter.catalog.v1.CatalogService
    get:
      description: "GetModel returns a single model by id (UUID) or by unique model\
        \ name,\n including its pricing, context window, and capabilities."
      operationId: agentrouter.catalog.v1.CatalogService.GetModel
      parameters:
      - description: "Model id (UUID) or unique model name. A UUID is looked up by\
          \ id; any\n other value is resolved by model name across the visible catalog.\
          \ A\n name that matches models from multiple providers is rejected with\n\
          \ InvalidArgument naming the candidates."
        in: path
        name: id
        required: true
        schema:
          description: "Model id (UUID) or unique model name. A UUID is looked up\
            \ by id; any\n other value is resolved by model name across the visible\
            \ catalog. A\n name that matches models from multiple providers is rejected\
            \ with\n InvalidArgument naming the candidates."
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.GetModelResponse'
          description: Success
      summary: GetModel
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/catalog/providers:
    get:
      description: "ListProviders returns all registered AI providers. Supports\n\
        \ cursor-based pagination via page_size and page_token."
      operationId: agentrouter.catalog.v1.CatalogService.ListProviders
      parameters:
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.ListProvidersResponse'
          description: Success
      summary: ListProviders
      tags:
      - agentrouter.catalog.v1.CatalogService
    post:
      description: UpsertProvider creates or fully replaces a provider record.
      operationId: agentrouter.catalog.v1.CatalogService.UpsertProvider
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.catalog.v1.UpsertProviderRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.Provider'
          description: Success
      summary: UpsertProvider
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/catalog/providers/{id}:
    delete:
      description: "DeleteProvider removes a provider. Refuses while any model still\n\
        \ references it."
      operationId: agentrouter.catalog.v1.CatalogService.DeleteProvider
      parameters:
      - description: Id of the provider to delete. prov_<ulid>.
        in: path
        name: id
        required: true
        schema:
          description: Id of the provider to delete. prov_<ulid>.
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteProvider
      tags:
      - agentrouter.catalog.v1.CatalogService
    get:
      description: GetProvider returns a single provider by id.
      operationId: agentrouter.catalog.v1.CatalogService.GetProvider
      parameters:
      - description: Provider id to fetch. prov_<ulid>.
        in: path
        name: id
        required: true
        schema:
          description: Provider id to fetch. prov_<ulid>.
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.GetProviderResponse'
          description: Success
      summary: GetProvider
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/catalog/providers/{id}/credential:
    post:
      description: "SetProviderCredential stores or rotates the credential used to\n\
        \ authenticate requests to this provider. The plaintext is never\n returned;\
        \ the provider's credential_suffix reflects the last 4\n characters."
      operationId: agentrouter.catalog.v1.CatalogService.SetProviderCredential
      parameters:
      - description: Provider id / slug.
        in: path
        name: id
        required: true
        schema:
          description: Provider id / slug.
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                credential:
                  description: "Plaintext credential (API key, bearer token, etc.).\
                    \ Stored\n server-side under envelope encryption and never returned.\n\
                    \ Provider.credential_suffix reflects the last 4 chars."
                  title: credential
                  type: string
              required:
              - credential
              title: SetProviderCredentialRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.Provider'
          description: Success
      summary: SetProviderCredential
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/customers:
    get:
      description: ListCustomers lists all customers visible to the caller.
      operationId: agentrouter.tenancy.v1.TenancyService.ListCustomers
      parameters:
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.ListCustomersResponse'
          description: Success
      summary: ListCustomers
      tags:
      - agentrouter.tenancy.v1.TenancyService
    post:
      description: "CreateCustomer creates a new customer record. A customer owns\n\
        \ projects, identities, and billing. Typically called once during\n provisioning\
        \ of a new tenant."
      operationId: agentrouter.tenancy.v1.TenancyService.CreateCustomer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.tenancy.v1.CreateCustomerRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Customer'
          description: Success
      summary: CreateCustomer
      tags:
      - agentrouter.tenancy.v1.TenancyService
  /v1/customers/{customer_id}:
    delete:
      description: "ArchiveCustomer soft-deletes a customer. The row stays in the\n\
        \ database with deleted_at set; future Get / List calls treat it as\n missing."
      operationId: agentrouter.tenancy.v1.TenancyService.ArchiveCustomer
      parameters:
      - description: 'Required: slug of the customer to soft-delete.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: slug of the customer to soft-delete.'
          title: customer_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: ArchiveCustomer
      tags:
      - agentrouter.tenancy.v1.TenancyService
    get:
      description: GetCustomer returns a single customer by id.
      operationId: agentrouter.tenancy.v1.TenancyService.GetCustomer
      parameters:
      - description: 'Required: slug of the customer to fetch.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: slug of the customer to fetch.'
          title: customer_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Customer'
          description: Success
      summary: GetCustomer
      tags:
      - agentrouter.tenancy.v1.TenancyService
    patch:
      description: "UpdateCustomer updates mutable customer fields (display_name,\n\
        \ description, labels). `customer_id` is immutable."
      operationId: agentrouter.tenancy.v1.TenancyService.UpdateCustomer
      parameters:
      - description: 'Required: the customer to update.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: the customer to update.'
          title: customer_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: 'Optional: new description.'
                  title: description
                  type: string
                displayName:
                  description: 'Optional: new display name.'
                  title: display_name
                  type: string
              title: UpdateCustomerRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Customer'
          description: Success
      summary: UpdateCustomer
      tags:
      - agentrouter.tenancy.v1.TenancyService
  /v1/customers/{customer_id}/projects:
    get:
      description: ListProjects lists projects within a customer scope.
      operationId: agentrouter.tenancy.v1.ProjectsService.ListProjects
      parameters:
      - description: 'Required: customer scope whose projects to list.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: customer scope whose projects to list.'
          title: customer_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.ListProjectsResponse'
          description: Success
      summary: ListProjects
      tags:
      - agentrouter.tenancy.v1.ProjectsService
    post:
      description: CreateProject creates a project within a customer scope.
      operationId: agentrouter.tenancy.v1.ProjectsService.CreateProject
      parameters:
      - description: Owning customer slug.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug.
          title: customer_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: 'Optional: freeform description.'
                  title: description
                  type: string
                displayName:
                  description: 'Optional: human-friendly display name.'
                  title: display_name
                  type: string
                projectId:
                  description: 'Required: customer-scoped project slug.'
                  title: project_id
                  type: string
              required:
              - projectId
              title: CreateProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Project'
          description: Success
      summary: CreateProject
      tags:
      - agentrouter.tenancy.v1.ProjectsService
  /v1/customers/{customer_id}/projects/{project_id}:
    delete:
      description: "ArchiveProject soft-deletes a project. Refuses to archive the\n\
        \ default project, matching the existing admin.v1 behaviour."
      operationId: agentrouter.tenancy.v1.ProjectsService.ArchiveProject
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: the project to soft-delete (the default project cannot
          be archived).'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: the project to soft-delete (the default project
            cannot be archived).'
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: ArchiveProject
      tags:
      - agentrouter.tenancy.v1.ProjectsService
    get:
      description: GetProject returns a single project by id.
      operationId: agentrouter.tenancy.v1.ProjectsService.GetProject
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: customer-scoped slug of the project to fetch.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: customer-scoped slug of the project to fetch.'
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Project'
          description: Success
      summary: GetProject
      tags:
      - agentrouter.tenancy.v1.ProjectsService
    patch:
      description: UpdateProject updates mutable project fields.
      operationId: agentrouter.tenancy.v1.ProjectsService.UpdateProject
      parameters:
      - description: 'Required: owning customer slug. Immutable.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug. Immutable.'
          title: customer_id
          type: string
      - description: 'Required: the project to update. Immutable.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: the project to update. Immutable.'
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: 'Optional: new description.'
                  title: description
                  type: string
                displayName:
                  description: 'Optional: new display name.'
                  title: display_name
                  type: string
              title: UpdateProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.Project'
          description: Success
      summary: UpdateProject
      tags:
      - agentrouter.tenancy.v1.ProjectsService
  /v1/customers/{customer_id}/projects/{project_id}/aikeys:
    get:
      description: "List lists BYOK keys registered under a project. Returns metadata\n\
        \ only -- id, provider, name, display_suffix, creation timestamp, and\n revocation\
        \ timestamp if revoked. The result includes the project's\n shared keys plus\
        \ the caller's own user-scoped keys (other users'\n user-scoped keys are not\
        \ returned).\n\n Scope: account-tier; membership is enforced in-handler."
      operationId: agentrouter.aikeys.v1.AiKeysService.List
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.aikeys.v1.ListResponse'
          description: Success
      summary: List
      tags:
      - agentrouter.aikeys.v1.AiKeysService
    post:
      description: "Register encrypts and stores a provider API key under a project.\n\
        \ After this call, inference requests routed to the matching provider\n for\
        \ this project will use this key.\n\n Scope: account-tier so any project member\
        \ can register their OWN\n user-scoped key (user_scope=true). Registering\
        \ a PROJECT-level key\n (user_scope=false) additionally requires the caller\
        \ to be the\n project's owner -- enforced in-handler against project_members."
      operationId: agentrouter.aikeys.v1.AiKeysService.Register
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                name:
                  description: Operator-supplied label for the key, e.g. "openai-prod".
                  title: name
                  type: string
                provider:
                  $ref: '#/components/schemas/agentrouter.aikeys.v1.Provider'
                  description: Provider this key authenticates against.
                  title: provider
                secret:
                  description: "Plaintext provider key, e.g. sk-.... Sent over TLS\
                    \ only; the server\n immediately wraps with secrets-svc and discards\
                    \ the plaintext."
                  title: secret
                  type: string
                userScope:
                  description: "user_scope registers a per-user key private to the\
                    \ caller that\n overrides the project key for the caller's inference\
                    \ traffic. When\n false (default) the key is project-level (shared)\
                    \ and requires the\n caller to be the project owner."
                  title: user_scope
                  type: boolean
              required:
              - provider
              - name
              - secret
              title: RegisterRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.aikeys.v1.RegisterResponse'
          description: Success
      summary: Register
      tags:
      - agentrouter.aikeys.v1.AiKeysService
  /v1/customers/{customer_id}/projects/{project_id}/aikeys/{id}:
    delete:
      description: "Revoke marks the key revoked; subsequent Fetches return\n permission_denied.\
        \ Inflight cached keys on dataplanes invalidate\n within sub-second via the\
        \ revocation channel (milestone C).\n\n Scope: account-tier so a member can\
        \ revoke their OWN user-scoped key.\n Revoking a PROJECT-level key additionally\
        \ requires project ownership\n (enforced in-handler); a member may never revoke\
        \ another user's\n user-scoped key."
      operationId: agentrouter.aikeys.v1.AiKeysService.Revoke
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: byok_<ulid> identifying the key to revoke.
        in: path
        name: id
        required: true
        schema:
          description: byok_<ulid> identifying the key to revoke.
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.aikeys.v1.RevokeResponse'
          description: Success
      summary: Revoke
      tags:
      - agentrouter.aikeys.v1.AiKeysService
    get:
      description: "Get returns the metadata record for a single BYOK key. Never returns\n\
        \ the plaintext.\n\n Scope: account-tier. Any project member may read keys\
        \ in the project\n (project-level and the caller's own user-scoped keys);\
        \ membership is\n enforced in-handler."
      operationId: agentrouter.aikeys.v1.AiKeysService.Get
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: byok_<ulid> identifying the key to fetch.
        in: path
        name: id
        required: true
        schema:
          description: byok_<ulid> identifying the key to fetch.
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.aikeys.v1.GetResponse'
          description: Success
      summary: Get
      tags:
      - agentrouter.aikeys.v1.AiKeysService
  /v1/customers/{customer_id}/projects/{project_id}/clients:
    get:
      description: "ListClients returns every client owned by the caller within the\n\
        \ given (customer_id, project_id) scope."
      operationId: agentrouter.clients.v1.ClientsService.ListClients
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.ListClientsResponse'
          description: Success
      summary: ListClients
      tags:
      - agentrouter.clients.v1.ClientsService
    post:
      description: "CreateClientWithKey creates a new client and a new API key attached\n\
        \ 1:1 (client_id == key_id at bootstrap)."
      operationId: agentrouter.clients.v1.ClientsService.CreateClientWithKey
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                enterpriseContext:
                  $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
                  description: Optional enterprise tenancy context (legacy AdminServer
                    path).
                  title: enterprise_context
                keyName:
                  description: Backing key name; defaults to title when empty.
                  title: key_name
                  type: string
                title:
                  description: Human-friendly title for the client.
                  title: title
                  type: string
              title: CreateClientWithKeyRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.CreateClientWithKeyResponse'
          description: Success
      summary: CreateClientWithKey
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}:
    get:
      description: GetClient returns a single client by id within the scope.
      operationId: agentrouter.clients.v1.ClientsService.GetClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) to fetch.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) to fetch.
          title: client_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.GetClientResponse'
          description: Success
      summary: GetClient
      tags:
      - agentrouter.clients.v1.ClientsService
    patch:
      description: UpdateClientTitle updates the editable client title.
      operationId: agentrouter.clients.v1.ClientsService.UpdateClientTitle
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) whose title is being updated.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) whose title is being updated.
          title: client_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                title:
                  description: New human-friendly title for the client.
                  title: title
                  type: string
              required:
              - title
              title: UpdateClientTitleRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.UpdateClientTitleResponse'
          description: Success
      summary: UpdateClientTitle
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys:
    post:
      description: AddKeyToClient attaches an existing key to a client.
      operationId: agentrouter.clients.v1.ClientsService.AddKeyToClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) to attach the key to.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) to attach the key to.
          title: client_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                keyId:
                  description: Id (UUID) of the existing key to attach.
                  title: key_id
                  type: string
              required:
              - keyId
              title: AddKeyToClientRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.AddKeyToClientResponse'
          description: Success
      summary: AddKeyToClient
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys/rotate:
    post:
      description: "RotateKeyInClient creates a new key attached to client_id and\
        \ may\n schedule the prior key's disable/destroy lifecycle."
      operationId: agentrouter.clients.v1.ClientsService.RotateKeyInClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) whose key is being rotated.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) whose key is being rotated.
          title: client_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                destroyAfter:
                  title: destroy_after
                  type: string
                disableAfter:
                  description: "Convenience flags for the CLI: durations relative\
                    \ to now. When set\n they override old_key_disable_at / old_key_destroy_at."
                  title: disable_after
                  type: string
                enterpriseContext:
                  $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
                  description: Optional enterprise tenancy context (legacy AdminServer
                    path).
                  title: enterprise_context
                keyName:
                  description: Name for the new key version. Required.
                  title: key_name
                  type: string
                oldKeyDestroyAt:
                  $ref: '#/components/schemas/google.protobuf.Timestamp'
                  description: Absolute time to auto-destroy the old key; overridden
                    by destroy_after when set.
                  title: old_key_destroy_at
                oldKeyDisableAt:
                  $ref: '#/components/schemas/google.protobuf.Timestamp'
                  description: Absolute time to auto-disable the old key; overridden
                    by disable_after when set.
                  title: old_key_disable_at
                oldKeyId:
                  description: Id (UUID) of the prior key to schedule disable/destroy
                    for; empty skips scheduling.
                  title: old_key_id
                  type: string
                userKeyAddress:
                  description: 'Deprecated/ignored: key address is system-generated,
                    not user-chosen.'
                  title: user_key_address
                  type: string
              title: RotateKeyInClientRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.RotateKeyInClientResponse'
          description: Success
      summary: RotateKeyInClient
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys/{key_version}:
    delete:
      description: DestroyKeyVersionInClient permanently destroys a key version.
      operationId: agentrouter.clients.v1.ClientsService.DestroyKeyVersionInClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) that owns the key version.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
      - description: Key version id (UUID) to permanently destroy.
        in: path
        name: key_version
        required: true
        schema:
          description: Key version id (UUID) to permanently destroy.
          title: key_version
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.DestroyKeyVersionInClientResponse'
          description: Success
      summary: DestroyKeyVersionInClient
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys/{key_version}/disable:
    post:
      description: DisableKeyVersionInClient disables a key version immediately (reversible).
      operationId: agentrouter.clients.v1.ClientsService.DisableKeyVersionInClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) that owns the key version.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
      - description: "Key version id (UUID). Named key_version to match IA's vocabulary;\n\
          \ fraser stores one row per version in api_keys."
        in: path
        name: key_version
        required: true
        schema:
          description: "Key version id (UUID). Named key_version to match IA's vocabulary;\n\
            \ fraser stores one row per version in api_keys."
          title: key_version
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.DisableKeyVersionInClientResponse'
          description: Success
      summary: DisableKeyVersionInClient
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys/{key_version}/emergency-revoke:
    post:
      description: "EmergencyRevokeKeyVersion disables a key immediately and optionally\n\
        \ creates a replacement."
      operationId: agentrouter.clients.v1.ClientsService.EmergencyRevokeKeyVersion
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) that owns the key version being revoked.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) that owns the key version being revoked.
          title: client_id
          type: string
      - description: Key version id (UUID) to revoke (disable immediately).
        in: path
        name: key_version
        required: true
        schema:
          description: Key version id (UUID) to revoke (disable immediately).
          title: key_version
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                generateReplacement:
                  description: When true, also rotate in a replacement key after revoking.
                  title: generate_replacement
                  type: boolean
                replacementEnterpriseContext:
                  $ref: '#/components/schemas/agentrouter.clients.v1.EnterpriseContext'
                  description: Optional enterprise tenancy context for the replacement
                    key.
                  title: replacement_enterprise_context
                replacementKeyName:
                  description: Name for the replacement key; required when generate_replacement
                    is true.
                  title: replacement_key_name
                  type: string
                replacementUserKeyAddress:
                  description: 'Deprecated/ignored: replacement key address is system-generated.'
                  title: replacement_user_key_address
                  type: string
              title: EmergencyRevokeKeyVersionRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.EmergencyRevokeKeyVersionResponse'
          description: Success
      summary: EmergencyRevokeKeyVersion
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/clients/{client_id}/keys/{key_version}/enable:
    post:
      description: EnableKeyVersionInClient re-enables a disabled key version.
      operationId: agentrouter.clients.v1.ClientsService.EnableKeyVersionInClient
      parameters:
      - description: Owning customer slug. Defaults to the caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer slug. Defaults to the caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project slug. Defaults to the caller's session project
          when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project slug. Defaults to the caller's session project
            when empty.
          title: project_id
          type: string
      - description: Client id (UUID) that owns the key version.
        in: path
        name: client_id
        required: true
        schema:
          description: Client id (UUID) that owns the key version.
          title: client_id
          type: string
      - description: Key version id (UUID) to re-enable.
        in: path
        name: key_version
        required: true
        schema:
          description: Key version id (UUID) to re-enable.
          title: key_version
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.clients.v1.EnableKeyVersionInClientResponse'
          description: Success
      summary: EnableKeyVersionInClient
      tags:
      - agentrouter.clients.v1.ClientsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails:
    get:
      description: ListGuardrails returns guardrails matching the specified filters.
      operationId: agentrouter.guardrails.v1.GuardrailsService.ListGuardrails
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      - description: Optional substring search on guardrail name.
        in: query
        name: search
        schema:
          description: Optional substring search on guardrail name.
          title: search
          type: string
      - description: Filter to guardrails of these types.
        in: query
        name: types
        schema:
          description: Filter to guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: types
          type: array
      - description: Exclude guardrails of these types.
        in: query
        name: excludeTypes
        schema:
          description: Exclude guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: exclude_types
          type: array
      - description: Filter to guardrails in these statuses.
        in: query
        name: statuses
        schema:
          description: Filter to guardrails in these statuses.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailStatus'
          title: statuses
          type: array
      - description: Filter to guardrails with these severity levels.
        in: query
        name: severities
        schema:
          description: Filter to guardrails with these severity levels.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailSeverity'
          title: severities
          type: array
      - description: Filter to guardrails in these categories.
        in: query
        name: categories
        schema:
          description: Filter to guardrails in these categories.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailCategory'
          title: categories
          type: array
      - description: When true, include platform template rows (is_template=true).
        in: query
        name: includeTemplates
        schema:
          description: When true, include platform template rows (is_template=true).
          title: include_templates
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ListGuardrailsResponse'
          description: Success
      summary: ListGuardrails
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
    post:
      description: CreateGuardrail creates a new guardrail.
      operationId: agentrouter.guardrails.v1.GuardrailsService.CreateGuardrail
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                guardrail:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
                  description: 'Required: guardrail to create. id must be absent or
                    empty (server-assigned).'
                  title: guardrail
              required:
              - guardrail
              title: CreateGuardrailRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.CreateGuardrailResponse'
          description: Success
      summary: CreateGuardrail
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/dashboard:
    get:
      description: "GetDashboard returns a combined summary of guardrail posture and\
        \ recent\n trigger activity for the dashboard view."
      operationId: agentrouter.guardrails.v1.GuardrailTriggersService.GetDashboard
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetDashboardResponse'
          description: Success
      summary: GetDashboard
      tags:
      - agentrouter.guardrails.v1.GuardrailTriggersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/from-template:
    post:
      description: "CreateGuardrailFromTemplate instantiates a new guardrail from\
        \ a platform\n template row (is_template=true). The resulting guardrail is\
        \ editable and\n scoped to (customer_id, project_id).\n Returns NOT_FOUND\
        \ when template_id does not reference an existing template\n guardrail (non-template\
        \ ids are treated as not found)."
      operationId: agentrouter.guardrails.v1.GuardrailsService.CreateGuardrailFromTemplate
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: Optional description for the new guardrail.
                  title: description
                  type: string
                name:
                  description: 'Required: display name for the new guardrail.'
                  title: name
                  type: string
                templateId:
                  description: 'Required: id of the template guardrail (is_template=true)
                    to clone.'
                  title: template_id
                  type: string
              required:
              - templateId
              - name
              title: CreateGuardrailFromTemplateRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.CreateGuardrailFromTemplateResponse'
          description: Success
      summary: CreateGuardrailFromTemplate
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/patterns:
    get:
      description: "ListPatterns returns patterns visible to the requested scope,\
        \ including\n built-in patterns which are globally visible."
      operationId: agentrouter.guardrails.v1.PatternsService.ListPatterns
      parameters:
      - description: "Owning customer scope; defaults to caller's session customer\
          \ when empty.\n Built-in patterns are always included regardless of this\
          \ value."
        in: path
        name: customer_id
        required: true
        schema:
          description: "Owning customer scope; defaults to caller's session customer\
            \ when empty.\n Built-in patterns are always included regardless of this\
            \ value."
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      - description: Optional filter by category (e.g., "pii", "credentials").
        in: query
        name: category
        schema:
          description: Optional filter by category (e.g., "pii", "credentials").
          title: category
          type: string
      - description: When true, return only built-in patterns (is_builtin=true).
        in: query
        name: builtinOnly
        schema:
          description: When true, return only built-in patterns (is_builtin=true).
          title: builtin_only
          type: boolean
      - description: Optional substring search on pattern name or display_name.
        in: query
        name: search
        schema:
          description: Optional substring search on pattern name or display_name.
          title: search
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ListPatternsResponse'
          description: Success
      summary: ListPatterns
      tags:
      - agentrouter.guardrails.v1.PatternsService
    post:
      description: "CreatePattern creates a new user-defined pattern.\n Returns PERMISSION_DENIED\
        \ when attempting to create a pattern with\n is_builtin=true."
      operationId: agentrouter.guardrails.v1.PatternsService.CreatePattern
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                pattern:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
                  description: 'Required: pattern to create. id must be absent or
                    empty (server-assigned).'
                  title: pattern
              required:
              - pattern
              title: CreatePatternRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.CreatePatternResponse'
          description: Success
      summary: CreatePattern
      tags:
      - agentrouter.guardrails.v1.PatternsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/patterns/{id}:
    delete:
      description: "DeletePattern soft-deletes a user-defined pattern (sets deleted_at;\
        \ the\n row disappears from List/Get). Historical trigger records referencing\
        \ this\n pattern REMAIN queryable.\n Returns PERMISSION_DENIED when attempting\
        \ to delete a built-in pattern."
      operationId: agentrouter.guardrails.v1.PatternsService.DeletePattern
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the pattern to delete.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the pattern to delete.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.DeletePatternResponse'
          description: Success
      summary: DeletePattern
      tags:
      - agentrouter.guardrails.v1.PatternsService
    get:
      description: GetPattern returns a single pattern by id.
      operationId: agentrouter.guardrails.v1.PatternsService.GetPattern
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the pattern to fetch.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the pattern to fetch.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetPatternResponse'
          description: Success
      summary: GetPattern
      tags:
      - agentrouter.guardrails.v1.PatternsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/patterns/{pattern.id}:
    patch:
      description: "UpdatePattern updates mutable fields of a user-defined pattern.\
        \ Omitted/\n empty scalar string fields leave the existing value untouched.\
        \ Enum fields\n set to *_UNSPECIFIED leave the existing value untouched.\n\
        \ Returns PERMISSION_DENIED when attempting to modify a built-in pattern."
      operationId: agentrouter.guardrails.v1.PatternsService.UpdatePattern
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: Server-assigned uuid. Output-only.
        in: path
        name: pattern.id
        required: true
        schema:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                pattern:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.Pattern'
                  description: "Required: pattern to update. pattern.id must be set.\
                    \ Partial update\n semantics: omitted/empty scalar string fields\
                    \ leave the existing value\n untouched; enum fields set to *_UNSPECIFIED\
                    \ leave the existing value\n untouched."
                  title: pattern
              required:
              - pattern
              title: UpdatePatternRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.UpdatePatternResponse'
          description: Success
      summary: UpdatePattern
      tags:
      - agentrouter.guardrails.v1.PatternsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/providers:
    get:
      description: "ListGuardrailProviders returns providers visible to the requested\
        \ scope,\n including globally-seeded providers."
      operationId: agentrouter.guardrails.v1.GuardrailProvidersService.ListGuardrailProviders
      parameters:
      - description: "Owning customer scope; defaults to caller's session customer\
          \ when empty.\n Globally-seeded providers are always included."
        in: path
        name: customer_id
        required: true
        schema:
          description: "Owning customer scope; defaults to caller's session customer\
            \ when empty.\n Globally-seeded providers are always included."
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      - description: Optional substring search on provider name.
        in: query
        name: search
        schema:
          description: Optional substring search on provider name.
          title: search
          type: string
      - description: When set, filter to enabled or disabled providers only.
        in: query
        name: enabled
        schema:
          description: When set, filter to enabled or disabled providers only.
          title: enabled
          type: boolean
      - description: When true, include template rows (is_template=true).
        in: query
        name: includeTemplates
        schema:
          description: When true, include template rows (is_template=true).
          title: include_templates
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ListGuardrailProvidersResponse'
          description: Success
      summary: ListGuardrailProviders
      tags:
      - agentrouter.guardrails.v1.GuardrailProvidersService
    post:
      description: "CreateGuardrailProvider registers a new guardrail provider.\n\
        \ Returns PERMISSION_DENIED when attempting to create a globally-seeded\n\
        \ provider kind (regexp / builtin / tetrate)."
      operationId: agentrouter.guardrails.v1.GuardrailProvidersService.CreateGuardrailProvider
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                provider:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
                  description: 'Required: provider to create. id must be absent or
                    empty (server-assigned).'
                  title: provider
              required:
              - provider
              title: CreateGuardrailProviderRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.CreateGuardrailProviderResponse'
          description: Success
      summary: CreateGuardrailProvider
      tags:
      - agentrouter.guardrails.v1.GuardrailProvidersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/providers/{id}:
    delete:
      description: "DeleteGuardrailProvider soft-deletes a user-defined provider (sets\n\
        \ deleted_at; the row disappears from List/Get). Historical trigger records\n\
        \ referencing this provider REMAIN queryable.\n Returns PERMISSION_DENIED\
        \ when attempting to delete a globally-seeded\n provider row."
      operationId: agentrouter.guardrails.v1.GuardrailProvidersService.DeleteGuardrailProvider
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the provider to delete.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the provider to delete.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.DeleteGuardrailProviderResponse'
          description: Success
      summary: DeleteGuardrailProvider
      tags:
      - agentrouter.guardrails.v1.GuardrailProvidersService
    get:
      description: GetGuardrailProvider returns a single provider by id.
      operationId: agentrouter.guardrails.v1.GuardrailProvidersService.GetGuardrailProvider
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the provider to fetch.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the provider to fetch.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailProviderResponse'
          description: Success
      summary: GetGuardrailProvider
      tags:
      - agentrouter.guardrails.v1.GuardrailProvidersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/providers/{provider.id}:
    patch:
      description: "UpdateGuardrailProvider updates mutable fields of a user-defined\
        \ provider.\n Omitted/empty scalar string fields leave the existing value\
        \ untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched.\
        \ Absent\n message fields (config) leave the existing value untouched; a present\n\
        \ config Struct REPLACES the stored configuration wholesale (no deep merge).\n\
        \ Returns PERMISSION_DENIED when attempting to modify a globally-seeded\n\
        \ provider row."
      operationId: agentrouter.guardrails.v1.GuardrailProvidersService.UpdateGuardrailProvider
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: Server-assigned uuid. Output-only.
        in: path
        name: provider.id
        required: true
        schema:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                provider:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailProvider'
                  description: "Required: provider to update. provider.id must be\
                    \ set. Partial update\n semantics: omitted/empty scalar string\
                    \ fields leave the existing value\n untouched; enum fields set\
                    \ to *_UNSPECIFIED leave the existing value\n untouched; absent\
                    \ message fields (config) leave the existing value\n untouched;\
                    \ a present config Struct REPLACES the stored configuration\n\
                    \ wholesale (no deep merge)."
                  title: provider
              required:
              - provider
              title: UpdateGuardrailProviderRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.UpdateGuardrailProviderResponse'
          description: Success
      summary: UpdateGuardrailProvider
      tags:
      - agentrouter.guardrails.v1.GuardrailProvidersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/stats:
    get:
      description: GetGuardrailStats returns aggregate statistics for guardrails in
        scope.
      operationId: agentrouter.guardrails.v1.GuardrailsService.GetGuardrailStats
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailStatsResponse'
          description: Success
      summary: GetGuardrailStats
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/triggers:
    get:
      description: ListGuardrailTriggers lists trigger events matching the specified
        filters.
      operationId: agentrouter.guardrails.v1.GuardrailTriggersService.ListGuardrailTriggers
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      - description: Filter to events for these guardrail ids.
        in: query
        name: guardrailIds
        schema:
          description: Filter to events for these guardrail ids.
          items:
            type: string
          title: guardrail_ids
          type: array
      - description: Filter to events for these consumer ids.
        in: query
        name: consumerIds
        schema:
          description: Filter to events for these consumer ids.
          items:
            type: string
          title: consumer_ids
          type: array
      - description: Filter to events for these resource ids.
        in: query
        name: resourceIds
        schema:
          description: Filter to events for these resource ids.
          items:
            type: string
          title: resource_ids
          type: array
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: dateFrom.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: dateFrom.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: Filter to events with execution_duration_ms >= this value.
        in: query
        name: minExecutionDurationMs
        schema:
          description: Filter to events with execution_duration_ms >= this value.
          format: int32
          title: min_execution_duration_ms
          type: integer
      - description: Filter to events with execution_duration_ms <= this value.
        in: query
        name: maxExecutionDurationMs
        schema:
          description: Filter to events with execution_duration_ms <= this value.
          format: int32
          title: max_execution_duration_ms
          type: integer
      - description: Filter to events for guardrails of these types.
        in: query
        name: guardrailTypes
        schema:
          description: Filter to events for guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: guardrail_types
          type: array
      - description: Exclude events for guardrails of these types.
        in: query
        name: excludeGuardrailTypes
        schema:
          description: Exclude events for guardrails of these types.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailType'
          title: exclude_guardrail_types
          type: array
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ListGuardrailTriggersResponse'
          description: Success
      summary: ListGuardrailTriggers
      tags:
      - agentrouter.guardrails.v1.GuardrailTriggersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/triggers/stats:
    get:
      description: "GetGuardrailTriggerStats returns aggregate statistics for trigger\
        \ events\n in scope."
      operationId: agentrouter.guardrails.v1.GuardrailTriggersService.GetGuardrailTriggerStats
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailTriggerStatsResponse'
          description: Success
      summary: GetGuardrailTriggerStats
      tags:
      - agentrouter.guardrails.v1.GuardrailTriggersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/triggers/{id}:
    get:
      description: GetGuardrailTrigger returns a single trigger event by id.
      operationId: agentrouter.guardrails.v1.GuardrailTriggersService.GetGuardrailTrigger
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: id of the trigger event to fetch.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: id of the trigger event to fetch.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailTriggerResponse'
          description: Success
      summary: GetGuardrailTrigger
      tags:
      - agentrouter.guardrails.v1.GuardrailTriggersService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{guardrail.id}:
    patch:
      description: "UpdateGuardrail updates mutable guardrail fields. Omitted/empty\
        \ scalar\n string fields leave the existing value untouched. Enum fields set\
        \ to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n\
        \ (triggered_response) leave the existing value untouched; a present\n triggered_response\
        \ replaces it wholesale. The guardrail id must be set\n inside the guardrail\
        \ field.\n Returns PERMISSION_DENIED when the target guardrail is a template\n\
        \ (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate,\
        \ never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.UpdateGuardrail
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: Server-assigned uuid. Output-only.
        in: path
        name: guardrail.id
        required: true
        schema:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                guardrail:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.Guardrail'
                  description: "Required: guardrail to update. guardrail.id must be\
                    \ set. Partial update\n semantics: omitted/empty scalar string\
                    \ fields leave the existing value\n untouched; enum fields set\
                    \ to *_UNSPECIFIED leave the existing value\n untouched; absent\
                    \ message fields (triggered_response) leave the existing\n value\
                    \ untouched."
                  title: guardrail
              required:
              - guardrail
              title: UpdateGuardrailRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.UpdateGuardrailResponse'
          description: Success
      summary: UpdateGuardrail
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{guardrail_id}/rules:
    get:
      description: ListGuardrailRules returns rules for the specified guardrail.
      operationId: agentrouter.guardrails.v1.GuardrailsService.ListGuardrailRules
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: parent guardrail id.'
        in: path
        name: guardrail_id
        required: true
        schema:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      - description: Optional substring search on rule name.
        in: query
        name: search
        schema:
          description: Optional substring search on rule name.
          title: search
          type: string
      - description: When set, filter to active or inactive rules only.
        in: query
        name: active
        schema:
          description: When set, filter to active or inactive rules only.
          title: active
          type: boolean
      - description: Filter to rules with these execute_on values.
        in: query
        name: executeOn
        schema:
          description: Filter to rules with these execute_on values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.ExecuteOn'
          title: execute_on
          type: array
      - description: Filter to rules referencing these provider ids.
        in: query
        name: providerIds
        schema:
          description: Filter to rules referencing these provider ids.
          items:
            type: string
          title: provider_ids
          type: array
      - description: Filter to rules with these check_type values.
        in: query
        name: checkTypes
        schema:
          description: Filter to rules with these check_type values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.CheckType'
          title: check_types
          type: array
      - description: Filter to rules with these action values.
        in: query
        name: actions
        schema:
          description: Filter to rules with these action values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleAction'
          title: actions
          type: array
      - description: Filter to rules with these mode values.
        in: query
        name: modes
        schema:
          description: Filter to rules with these mode values.
          items:
            $ref: '#/components/schemas/agentrouter.guardrails.v1.RuleMode'
          title: modes
          type: array
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ListGuardrailRulesResponse'
          description: Success
      summary: ListGuardrailRules
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
    post:
      description: "CreateGuardrailRule adds a new rule to a guardrail.\n Returns\
        \ PERMISSION_DENIED when the target guardrail is a template\n (is_template=true);\
        \ templates are instantiated via\n CreateGuardrailFromTemplate, never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.CreateGuardrailRule
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: parent guardrail id (must match rule.guardrail_id
          when both are set).'
        in: path
        name: guardrail_id
        required: true
        schema:
          description: 'Required: parent guardrail id (must match rule.guardrail_id
            when both are set).'
          title: guardrail_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                rule:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
                  description: 'Required: rule to create. id must be absent or empty
                    (server-assigned).'
                  title: rule
              required:
              - rule
              title: CreateGuardrailRuleRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.CreateGuardrailRuleResponse'
          description: Success
      summary: CreateGuardrailRule
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{guardrail_id}/rules/{id}:
    delete:
      description: "DeleteGuardrailRule soft-deletes a rule (sets deleted_at; the\
        \ row\n disappears from List/Get). Historical trigger records referencing\
        \ this rule\n REMAIN queryable.\n Returns NOT_FOUND when the rule does not\
        \ exist under the given guardrail_id.\n Returns PERMISSION_DENIED when the\
        \ target rule's parent guardrail is a\n template (is_template=true); templates\
        \ are instantiated via\n CreateGuardrailFromTemplate, never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.DeleteGuardrailRule
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: parent guardrail id.'
        in: path
        name: guardrail_id
        required: true
        schema:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
      - description: 'Required: uuid of the rule to delete.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the rule to delete.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.DeleteGuardrailRuleResponse'
          description: Success
      summary: DeleteGuardrailRule
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
    get:
      description: "GetGuardrailRule returns a single rule by id.\n Returns NOT_FOUND\
        \ when the rule does not exist under the given guardrail_id."
      operationId: agentrouter.guardrails.v1.GuardrailsService.GetGuardrailRule
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: parent guardrail id.'
        in: path
        name: guardrail_id
        required: true
        schema:
          description: 'Required: parent guardrail id.'
          title: guardrail_id
          type: string
      - description: 'Required: uuid of the rule to fetch.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the rule to fetch.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailRuleResponse'
          description: Success
      summary: GetGuardrailRule
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{guardrail_id}/rules/{rule.id}:
    patch:
      description: "UpdateGuardrailRule updates mutable rule fields. Omitted/empty\
        \ scalar\n string fields leave the existing value untouched. Enum fields set\
        \ to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n\
        \ (triggered_response, configuration) leave the existing value untouched;\
        \ a\n present configuration Struct REPLACES the stored configuration wholesale\n\
        \ (no deep merge). The rule id must be set inside the rule field.\n Returns\
        \ PERMISSION_DENIED when the target rule's parent guardrail is a\n template\
        \ (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate,\
        \ never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.UpdateGuardrailRule
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: parent guardrail id (must match rule.guardrail_id
          when both are set).'
        in: path
        name: guardrail_id
        required: true
        schema:
          description: 'Required: parent guardrail id (must match rule.guardrail_id
            when both are set).'
          title: guardrail_id
          type: string
      - description: Server-assigned uuid. Output-only.
        in: path
        name: rule.id
        required: true
        schema:
          description: Server-assigned uuid. Output-only.
          readOnly: true
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                rule:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailRule'
                  description: "Required: rule to update. rule.id must be set. Partial\
                    \ update semantics:\n omitted/empty scalar string fields leave\
                    \ the existing value untouched; enum\n fields set to *_UNSPECIFIED\
                    \ leave the existing value untouched; absent\n message fields\
                    \ (triggered_response, configuration) leave the existing value\n\
                    \ untouched; a present configuration Struct REPLACES the stored\
                    \ configuration\n wholesale (no deep merge)."
                  title: rule
              required:
              - rule
              title: UpdateGuardrailRuleRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.UpdateGuardrailRuleResponse'
          description: Success
      summary: UpdateGuardrailRule
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{id}:
    delete:
      description: "DeleteGuardrail soft-deletes a guardrail (sets deleted_at; the\
        \ row\n disappears from List/Get). Child rules of the soft-deleted guardrail\
        \ are\n no longer served. Historical trigger records referencing this guardrail\n\
        \ REMAIN queryable.\n Returns PERMISSION_DENIED when the target guardrail\
        \ is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate,\
        \ never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.DeleteGuardrail
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the guardrail to delete.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the guardrail to delete.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.DeleteGuardrailResponse'
          description: Success
      summary: DeleteGuardrail
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
    get:
      description: GetGuardrail returns a single guardrail by id.
      operationId: agentrouter.guardrails.v1.GuardrailsService.GetGuardrail
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the guardrail to fetch.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the guardrail to fetch.'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.GetGuardrailResponse'
          description: Success
      summary: GetGuardrail
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/guardrails/{id}/status:
    post:
      description: "SetGuardrailStatus updates the status and/or enabled flag of a\
        \ guardrail.\n At least one of status/enabled must be provided; otherwise\
        \ INVALID_ARGUMENT.\n Returns PERMISSION_DENIED when the target guardrail\
        \ is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate,\
        \ never mutated."
      operationId: agentrouter.guardrails.v1.GuardrailsService.SetGuardrailStatus
      parameters:
      - description: Owning customer scope; defaults to caller's session customer
          when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Owning customer scope; defaults to caller's session customer
            when empty.
          title: customer_id
          type: string
      - description: Owning project scope; defaults to caller's session project when
          empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Owning project scope; defaults to caller's session project
            when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the guardrail to update.'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the guardrail to update.'
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                enabled:
                  description: New enabled state. When absent the enabled field is
                    left unchanged.
                  nullable: true
                  title: enabled
                  type: boolean
                status:
                  $ref: '#/components/schemas/agentrouter.guardrails.v1.GuardrailStatus'
                  description: "New operational status for the guardrail.\n GUARDRAIL_STATUS_UNSPECIFIED\
                    \ leaves the stored status unchanged."
                  title: status
              title: SetGuardrailStatusRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.SetGuardrailStatusResponse'
          description: Success
      summary: SetGuardrailStatus
      tags:
      - agentrouter.guardrails.v1.GuardrailsService
  /v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients:
    get:
      description: "ListMcpOAuthClients lists every non-deleted OAuth client in the\n\
        \ (customer, project) scope. Account tier: any project member may read."
      operationId: agentrouter.mcp.v1.McpOAuthClientsService.ListMcpOAuthClients
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.ListMcpOAuthClientsResponse'
          description: Success
      summary: ListMcpOAuthClients
      tags:
      - agentrouter.mcp.v1.McpOAuthClientsService
    post:
      description: "CreateMcpOAuthClient registers a new OAuth client under a project.\n\
        \ The client_secret is wrapped by the secret service and discarded;\n only\
        \ an sm:// reference is persisted."
      operationId: agentrouter.mcp.v1.McpOAuthClientsService.CreateMcpOAuthClient
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                authorizationUrl:
                  description: 'Required: OAuth authorization endpoint URL.'
                  title: authorization_url
                  type: string
                clientId:
                  description: 'Required: OAuth client id from the provider.'
                  title: client_id
                  type: string
                clientSecret:
                  description: "Required: OAuth client secret. WRITE-ONLY -- wrapped\
                    \ by the secret\n service and never returned on any response."
                  title: client_secret
                  type: string
                metadata:
                  additionalProperties:
                    title: value
                    type: string
                  description: 'Optional: free-form provider configuration.'
                  title: metadata
                  type: object
                provider:
                  description: 'Required: stable provider key, e.g. "github".'
                  title: provider
                  type: string
                providerName:
                  description: 'Required: human-friendly provider display name.'
                  title: provider_name
                  type: string
                redirectUris:
                  description: 'Optional: allowed redirect URIs.'
                  items:
                    type: string
                  title: redirect_uris
                  type: array
                scopes:
                  description: 'Optional: requested OAuth scopes.'
                  items:
                    type: string
                  title: scopes
                  type: array
                serverIds:
                  description: 'Optional: MCP server ids this client serves.'
                  items:
                    type: string
                  title: server_ids
                  type: array
                status:
                  description: "Optional: initial status (\"active\" | \"inactive\"\
                    ). Defaults to\n \"active\" when empty."
                  title: status
                  type: string
                tokenUrl:
                  description: 'Required: OAuth token endpoint URL.'
                  title: token_url
                  type: string
              required:
              - provider
              - providerName
              - clientId
              - clientSecret
              - authorizationUrl
              - tokenUrl
              title: CreateMcpOAuthClientRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.McpOAuthClient'
          description: Success
      summary: CreateMcpOAuthClient
      tags:
      - agentrouter.mcp.v1.McpOAuthClientsService
  /v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients/{id}:
    delete:
      description: DeleteMcpOAuthClient soft-deletes a client (deleted_at set).
      operationId: agentrouter.mcp.v1.McpOAuthClientsService.DeleteMcpOAuthClient
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the client to soft-delete (McpOAuthClient.id).'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the client to soft-delete (McpOAuthClient.id).'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteMcpOAuthClient
      tags:
      - agentrouter.mcp.v1.McpOAuthClientsService
    get:
      description: "GetMcpOAuthClient returns a single OAuth client by id. Never returns\n\
        \ the client_secret. Account tier: any project member may read."
      operationId: agentrouter.mcp.v1.McpOAuthClientsService.GetMcpOAuthClient
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the client to fetch (McpOAuthClient.id).'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the client to fetch (McpOAuthClient.id).'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.McpOAuthClient'
          description: Success
      summary: GetMcpOAuthClient
      tags:
      - agentrouter.mcp.v1.McpOAuthClientsService
    patch:
      description: "UpdateMcpOAuthClient applies a partial patch. Omitted scalar strings\n\
        \ (\"\") leave the existing value untouched. A non-empty client_secret\n rotates\
        \ the wrapped secret in place."
      operationId: agentrouter.mcp.v1.McpOAuthClientsService.UpdateMcpOAuthClient
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: 'Required: uuid of the client to update (McpOAuthClient.id).'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: uuid of the client to update (McpOAuthClient.id).'
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                authorizationUrl:
                  title: authorization_url
                  type: string
                clientId:
                  title: client_id
                  type: string
                clientSecret:
                  description: "Optional: a non-empty value rotates the wrapped client\
                    \ secret in\n place. Empty leaves the stored secret untouched.\
                    \ WRITE-ONLY."
                  title: client_secret
                  type: string
                metadata:
                  additionalProperties:
                    title: value
                    type: string
                  title: metadata
                  type: object
                providerName:
                  description: "Mutable scalar fields. Empty string leaves the existing\
                    \ value\n untouched."
                  title: provider_name
                  type: string
                redirectUris:
                  items:
                    type: string
                  title: redirect_uris
                  type: array
                replaceMetadata:
                  title: replace_metadata
                  type: boolean
                replaceRedirectUris:
                  title: replace_redirect_uris
                  type: boolean
                replaceScopes:
                  description: "Because proto3 cannot distinguish an omitted repeated/map\
                    \ field from\n an explicit \"set to empty\", these booleans opt\
                    \ in to clearing the\n matching collection. When false, an empty\
                    \ scopes/redirect_uris/\n metadata/server_ids is treated as \"\
                    leave untouched\"."
                  title: replace_scopes
                  type: boolean
                replaceServerIds:
                  title: replace_server_ids
                  type: boolean
                scopes:
                  description: "Repeated / map fields: a non-nil value REPLACES the\
                    \ stored value;\n a nil/omitted value leaves it untouched (see\
                    \ the replace_* flags)."
                  items:
                    type: string
                  title: scopes
                  type: array
                serverIds:
                  items:
                    type: string
                  title: server_ids
                  type: array
                status:
                  title: status
                  type: string
                tokenUrl:
                  title: token_url
                  type: string
              title: UpdateMcpOAuthClientRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.McpOAuthClient'
          description: Success
      summary: UpdateMcpOAuthClient
      tags:
      - agentrouter.mcp.v1.McpOAuthClientsService
  /v1/customers/{customer_id}/projects/{project_id}/members:
    get:
      description: ListProjectMembers lists all members of a project and their roles.
      operationId: agentrouter.tenancy.v1.ProjectsService.ListProjectMembers
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: project whose members to list.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: project whose members to list.'
          title: project_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.ListProjectMembersResponse'
          description: Success
      summary: ListProjectMembers
      tags:
      - agentrouter.tenancy.v1.ProjectsService
    post:
      description: "AddProjectMember grants an identity access to a project with the\n\
        \ given role bundle."
      operationId: agentrouter.tenancy.v1.ProjectsService.AddProjectMember
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: project the identity is being granted access to.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: project the identity is being granted access to.'
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                identityId:
                  description: Identity row id (authn.user.id). Required.
                  title: identity_id
                  type: string
                role:
                  description: 'Role bundle: "admin" or "member".'
                  title: role
                  type: string
              required:
              - identityId
              - role
              title: AddProjectMemberRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.ProjectMember'
          description: Success
      summary: AddProjectMember
      tags:
      - agentrouter.tenancy.v1.ProjectsService
  /v1/customers/{customer_id}/projects/{project_id}/members/{identity_id}:
    delete:
      description: RemoveProjectMember revokes an identity's membership in a project.
      operationId: agentrouter.tenancy.v1.ProjectsService.RemoveProjectMember
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: project the membership belongs to.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: project the membership belongs to.'
          title: project_id
          type: string
      - description: 'Required: identity row id (authn.user.id) whose membership is
          revoked.'
        in: path
        name: identity_id
        required: true
        schema:
          description: 'Required: identity row id (authn.user.id) whose membership
            is revoked.'
          title: identity_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: RemoveProjectMember
      tags:
      - agentrouter.tenancy.v1.ProjectsService
    patch:
      description: UpdateProjectMember updates an existing project member's role.
      operationId: agentrouter.tenancy.v1.ProjectsService.UpdateProjectMember
      parameters:
      - description: 'Required: owning customer slug.'
        in: path
        name: customer_id
        required: true
        schema:
          description: 'Required: owning customer slug.'
          title: customer_id
          type: string
      - description: 'Required: project the membership belongs to.'
        in: path
        name: project_id
        required: true
        schema:
          description: 'Required: project the membership belongs to.'
          title: project_id
          type: string
      - description: 'Required: identity row id (authn.user.id) whose role is being
          changed.'
        in: path
        name: identity_id
        required: true
        schema:
          description: 'Required: identity row id (authn.user.id) whose role is being
            changed.'
          title: identity_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                role:
                  description: 'Required: new role bundle: "admin" or "member".'
                  title: role
                  type: string
              required:
              - role
              title: UpdateProjectMemberRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tenancy.v1.ProjectMember'
          description: Success
      summary: UpdateProjectMember
      tags:
      - agentrouter.tenancy.v1.ProjectsService
  /v1/customers/{customer_id}/projects/{project_id}/models:
    get:
      description: ListProjectModels returns every catalog model assigned to a project.
      operationId: agentrouter.catalog.v1.CatalogService.ListProjectModels
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.ListProjectModelsResponse'
          description: Success
      summary: ListProjectModels
      tags:
      - agentrouter.catalog.v1.CatalogService
    post:
      description: "AssignModelToProject grants a project access to a catalog model.\n\
        \ Idempotent: re-assigning a model is a no-op."
      operationId: agentrouter.catalog.v1.CatalogService.AssignModelToProject
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                modelId:
                  description: Catalog model id (uuid).
                  title: model_id
                  type: string
              required:
              - modelId
              title: AssignModelToProjectRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.AssignModelToProjectResponse'
          description: Success
      summary: AssignModelToProject
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/customers/{customer_id}/projects/{project_id}/models/{model_id}:
    delete:
      description: UnassignModelFromProject removes a project's access to a catalog
        model.
      operationId: agentrouter.catalog.v1.CatalogService.UnassignModelFromProject
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Catalog model id (uuid) to unassign from the project.
        in: path
        name: model_id
        required: true
        schema:
          description: Catalog model id (uuid) to unassign from the project.
          title: model_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.catalog.v1.UnassignModelFromProjectResponse'
          description: Success
      summary: UnassignModelFromProject
      tags:
      - agentrouter.catalog.v1.CatalogService
  /v1/customers/{customer_id}/projects/{project_id}/prompts:
    post:
      description: "Prompt sends a prompt to an upstream LLM and returns the model's\n\
        \ completion. The gateway selects an eligible data plane, retrieves\n and\
        \ applies the project's BYOK key, enforces quota, records a\n request log\
        \ entry, and proxies the call to the upstream provider.\n Streaming, multi-turn\
        \ conversations, tools, and vision are not yet\n supported on this path."
      operationId: agentrouter.inference.v1.InferenceIngressService.Prompt
      parameters:
      - description: "Customer the prompt is billed/scoped against. When empty the\
          \ server\n resolves the caller's default customer from their session identity\n\
          \ (the first customer the caller is a member of, ordered by oldest\n membership).\
          \ Supply explicitly to override the session default."
        in: path
        name: customer_id
        required: true
        schema:
          description: "Customer the prompt is billed/scoped against. When empty the\
            \ server\n resolves the caller's default customer from their session identity\n\
            \ (the first customer the caller is a member of, ordered by oldest\n membership).\
            \ Supply explicitly to override the session default."
          title: customer_id
          type: string
      - description: "Project the prompt is logged against. When empty the server\
          \ resolves\n the caller's default project from their session identity (the\
          \ first\n project the caller is a member of, ordered by oldest membership).\n\
          \ Supply explicitly to override the session default."
        in: path
        name: project_id
        required: true
        schema:
          description: "Project the prompt is logged against. When empty the server\
            \ resolves\n the caller's default project from their session identity\
            \ (the first\n project the caller is a member of, ordered by oldest membership).\n\
            \ Supply explicitly to override the session default."
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                idempotencyKey:
                  description: Idempotency key for safe retry of mutating prompts.
                  title: idempotency_key
                  type: string
                keyId:
                  description: "Optional client_keys / api_keys row id (UUID) to bind\
                    \ this request\n to a specific customer-owned key for per-key\
                    \ ratelimit + fallback\n accounting on the dataplane. Empty means\
                    \ \"use the latest active\n client key for the customer\". The\
                    \ id flows through the minted MP\n JWT's jti claim, which the\
                    \ dataplane reads in its ext-authz filter."
                  title: key_id
                  type: string
                model:
                  description: "Model selector. A bare model name (e.g. gpt-4o) is\
                    \ accepted when it is\n unique across the catalog; the server\
                    \ resolves its provider. Use the\n provider/model form (e.g. openai/gpt-4o)\
                    \ to disambiguate when the same\n model name exists under more\
                    \ than one provider. Empty selects the\n project's default model."
                  title: model
                  type: string
                prompt:
                  description: "The user prompt as plain text. Multi-message conversations\
                    \ land\n when the proto grows a `messages` repeated field; the\
                    \ skeleton path\n is a single user turn."
                  title: prompt
                  type: string
              required:
              - prompt
              title: PromptRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.inference.v1.PromptResponse'
          description: Success
      summary: Prompt
      tags:
      - agentrouter.inference.v1.InferenceIngressService
  /v1/customers/{customer_id}/projects/{project_id}/request-logs:
    get:
      description: "ListCustomerRequestLogs returns the caller's own request logs,\n\
        \ filtered by the supplied tenancy scope. Forced filter:\n `user_id = caller.UserID`."
      operationId: agentrouter.insights.v1.CustomerRequestLogsService.ListCustomerRequestLogs
      parameters:
      - description: "Tenancy scope. Defaults to the caller's session customer_id\
          \ /\n project_id when empty."
        in: path
        name: customer_id
        required: true
        schema:
          description: "Tenancy scope. Defaults to the caller's session customer_id\
            \ /\n project_id when empty."
          title: customer_id
          type: string
      - description: Project within the customer to scope the query to.
        in: path
        name: project_id
        required: true
        schema:
          description: Project within the customer to scope the query to.
          title: project_id
          type: string
      - description: "Optional filters. Mirror QueryRequestLogsRequest minus user_id\n\
          \ (forced to caller).\n Restrict to logs produced by this API key (UUID)."
        in: query
        name: apiKeyId
        schema:
          description: "Optional filters. Mirror QueryRequestLogsRequest minus user_id\n\
            \ (forced to caller).\n Restrict to logs produced by this API key (UUID)."
          title: api_key_id
          type: string
      - description: Restrict to a single model name (e.g. "claude-3-opus", "gpt-4").
        in: query
        name: modelName
        schema:
          description: Restrict to a single model name (e.g. "claude-3-opus", "gpt-4").
          title: model_name
          type: string
      - description: Restrict by logical status (e.g. "success", "error", "timeout").
        in: query
        name: status
        schema:
          description: Restrict by logical status (e.g. "success", "error", "timeout").
          title: status
          type: string
      - description: Restrict by HTTP status code returned to the client.
        in: query
        name: statusCode
        schema:
          description: Restrict by HTTP status code returned to the client.
          format: int32
          title: status_code
          type: integer
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: startTime.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: startTime.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: Only include requests at least this many milliseconds long.
        in: query
        name: minDurationMs
        schema:
          description: Only include requests at least this many milliseconds long.
          format: int32
          title: min_duration_ms
          type: integer
      - description: Only include requests at most this many milliseconds long.
        in: query
        name: maxDurationMs
        schema:
          description: Only include requests at most this many milliseconds long.
          format: int32
          title: max_duration_ms
          type: integer
      - description: "Pagination.\n Maximum logs per page (server applies a default\
          \ and cap)."
        in: query
        name: pageSize
        schema:
          description: "Pagination.\n Maximum logs per page (server applies a default\
            \ and cap)."
          format: int32
          title: page_size
          type: integer
      - description: Opaque token from a prior response's next_page_token to fetch
          the next page.
        in: query
        name: pageToken
        schema:
          description: Opaque token from a prior response's next_page_token to fetch
            the next page.
          title: page_token
          type: string
      - description: "Ordering. Valid order_by: timestamp, duration_ms, input_tokens,\n\
          \ output_tokens. Valid order_direction: asc, desc."
        in: query
        name: orderBy
        schema:
          description: "Ordering. Valid order_by: timestamp, duration_ms, input_tokens,\n\
            \ output_tokens. Valid order_direction: asc, desc."
          title: order_by
          type: string
      - description: 'Sort direction for order_by: "asc" or "desc".'
        in: query
        name: orderDirection
        schema:
          description: 'Sort direction for order_by: "asc" or "desc".'
          title: order_direction
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.ListCustomerRequestLogsResponse'
          description: Success
      summary: ListCustomerRequestLogs
      tags:
      - agentrouter.insights.v1.CustomerRequestLogsService
  /v1/customers/{customer_id}/projects/{project_id}/request-logs/stats:
    get:
      description: "GetCustomerRequestLogStats returns aggregated statistics over\
        \ the\n calling user's request logs within the supplied tenancy scope."
      operationId: agentrouter.insights.v1.CustomerRequestLogsService.GetCustomerRequestLogStats
      parameters:
      - description: Defaults to the caller's session customer_id / project_id when
          empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer_id / project_id when
            empty.
          title: customer_id
          type: string
      - in: path
        name: project_id
        required: true
        schema:
          title: project_id
          type: string
      - description: Optional filter restricting stats to a single model name.
        in: query
        name: modelName
        schema:
          description: Optional filter restricting stats to a single model name.
          title: model_name
          type: string
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: startTime.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: startTime.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: 'Dimension to group by: "model", "user", "api_key", "status",
          "hour", "day".'
        in: query
        name: groupBy
        schema:
          description: 'Dimension to group by: "model", "user", "api_key", "status",
            "hour", "day".'
          title: group_by
          type: string
      - description: 'Metric to compute: "count", "tokens", "cost", "latency", "errors".'
        in: query
        name: metric
        schema:
          description: 'Metric to compute: "count", "tokens", "cost", "latency", "errors".'
          title: metric
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.RequestLogStatsResponse'
          description: Success
      summary: GetCustomerRequestLogStats
      tags:
      - agentrouter.insights.v1.CustomerRequestLogsService
  /v1/customers/{customer_id}/projects/{project_id}/request-logs/{request_id}:
    get:
      description: "GetCustomerRequestLog returns a single request log row owned by\
        \ the\n calling user. Cross-user NotFound: the user cannot read another\n\
        \ user's log even within the same customer/project."
      operationId: agentrouter.insights.v1.CustomerRequestLogsService.GetCustomerRequestLog
      parameters:
      - description: Defaults to the caller's session customer_id / project_id when
          empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer_id / project_id when
            empty.
          title: customer_id
          type: string
      - in: path
        name: project_id
        required: true
        schema:
          title: project_id
          type: string
      - description: Identifier of the request log to fetch; must be owned by the
          caller.
        in: path
        name: request_id
        required: true
        schema:
          description: Identifier of the request log to fetch; must be owned by the
            caller.
          title: request_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.RequestLog'
          description: Success
      summary: GetCustomerRequestLog
      tags:
      - agentrouter.insights.v1.CustomerRequestLogsService
  /v1/customers/{customer_id}/projects/{project_id}/telemetry:
    get:
      description: "ListTelemetryConfigs lists every configuration owned by the caller\n\
        \ within the (customer, project) scope."
      operationId: agentrouter.telemetry.v1.TelemetryService.ListTelemetryConfigs
      parameters:
      - description: customer_id scopes the request path; used for path-level validation.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
      - description: project_id scopes the request path; used for path-level validation.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      - description: Optional telemetry_type filter.
        in: query
        name: telemetryType
        schema:
          description: Optional telemetry_type filter.
          title: telemetry_type
          type: string
      - description: "enabled is a tri-state encoded as a string: \"\" (no filter),\
          \ \"true\",\n \"false\". Avoids `optional bool` because the CLI generator\
          \ does not\n yet emit pointer assignments."
        in: query
        name: enabled
        schema:
          description: "enabled is a tri-state encoded as a string: \"\" (no filter),\
            \ \"true\",\n \"false\". Avoids `optional bool` because the CLI generator\
            \ does not\n yet emit pointer assignments."
          title: enabled
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.ListTelemetryConfigsResponse'
          description: Success
      summary: ListTelemetryConfigs
      tags:
      - agentrouter.telemetry.v1.TelemetryService
    post:
      description: CreateTelemetryConfig creates a new OTel export configuration.
      operationId: agentrouter.telemetry.v1.TelemetryService.CreateTelemetryConfig
      parameters:
      - description: customer_id scopes the request path; used for path-level validation.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
      - description: project_id scopes the request path; used for path-level validation.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                apiKeyHeader:
                  description: api_key_header is the header name when auth_type is
                    api_key.
                  title: api_key_header
                  type: string
                authType:
                  description: auth_type defaults to "none" when empty.
                  title: auth_type
                  type: string
                authValue:
                  description: auth_value is the plaintext credential to encrypt at
                    rest.
                  title: auth_value
                  type: string
                enabled:
                  description: "enabled toggles the configuration; defaults to true\
                    \ when unset.\n Use the \"yes\"/\"no\"/\"true\"/\"false\" CLI\
                    \ form; absent is treated as\n true."
                  title: enabled
                  type: boolean
                endpoint:
                  description: endpoint is the OTLP sink URL.
                  title: endpoint
                  type: string
                headers:
                  additionalProperties:
                    title: value
                    type: string
                  description: "headers is sugar for the CLI: any of these are appended\
                    \ as basic\n headers on outbound exports. Currently advisory --\
                    \ the backing\n configuration carries auth_type + auth_value."
                  title: headers
                  type: object
                protocol:
                  description: protocol defaults to "http/protobuf" when empty.
                  title: protocol
                  type: string
                telemetryType:
                  description: telemetry_type partitions sinks; defaults to "traces"
                    when empty.
                  title: telemetry_type
                  type: string
              required:
              - endpoint
              title: CreateTelemetryConfigRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          description: Success
      summary: CreateTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
  /v1/customers/{customer_id}/projects/{project_id}/telemetry/project:
    get:
      description: "GetProjectTelemetryConfig returns the PROJECT-level telemetry\
        \ config.\n Project-owner-tier (the shared project default is managed by owners)."
      operationId: agentrouter.telemetry.v1.TelemetryService.GetProjectTelemetryConfig
      parameters:
      - description: customer_id identifies the project's customer.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id identifies the project's customer.
          title: customer_id
          type: string
      - description: project_id identifies the project whose shared config is requested.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id identifies the project whose shared config is requested.
          title: project_id
          type: string
      - description: telemetry_type partitions sinks; defaults to "traces" when empty.
        in: query
        name: telemetryType
        schema:
          description: telemetry_type partitions sinks; defaults to "traces" when
            empty.
          title: telemetry_type
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          description: Success
      summary: GetProjectTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
    put:
      description: "SetProjectTelemetryConfig upserts the PROJECT-level telemetry\
        \ export\n config (the shared default applied to project members who have\
        \ no\n config of their own). Project-owner-tier: only the project's owner\
        \ may\n set it. A user's own per-user config OVERRIDES this at emit time."
      operationId: agentrouter.telemetry.v1.TelemetryService.SetProjectTelemetryConfig
      parameters:
      - description: customer_id identifies the project's customer.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id identifies the project's customer.
          title: customer_id
          type: string
      - description: project_id identifies the project whose shared config is being
          set.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id identifies the project whose shared config is being
            set.
          title: project_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                apiKeyHeader:
                  description: api_key_header is the header name when auth_type is
                    api_key.
                  title: api_key_header
                  type: string
                authType:
                  description: auth_type defaults to "none" when empty.
                  title: auth_type
                  type: string
                authValue:
                  description: auth_value is the plaintext credential to encrypt at
                    rest.
                  title: auth_value
                  type: string
                enabled:
                  description: enabled toggles the configuration; defaults to true
                    when unset.
                  title: enabled
                  type: boolean
                endpoint:
                  description: endpoint is the OTLP sink URL.
                  title: endpoint
                  type: string
                protocol:
                  description: protocol defaults to "http/protobuf" when empty.
                  title: protocol
                  type: string
                telemetryType:
                  description: telemetry_type partitions sinks; defaults to "traces"
                    when empty.
                  title: telemetry_type
                  type: string
              required:
              - endpoint
              title: SetProjectTelemetryConfigRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          description: Success
      summary: SetProjectTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
  /v1/customers/{customer_id}/projects/{project_id}/telemetry/{config_id}:
    delete:
      description: DeleteTelemetryConfig removes a configuration.
      operationId: agentrouter.telemetry.v1.TelemetryService.DeleteTelemetryConfig
      parameters:
      - description: customer_id scopes the request path; used for path-level validation.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
      - description: project_id scopes the request path; used for path-level validation.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      - description: config_id is the id of the config to delete.
        in: path
        name: config_id
        required: true
        schema:
          description: config_id is the id of the config to delete.
          title: config_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
    get:
      description: GetTelemetryConfig returns a single configuration by id.
      operationId: agentrouter.telemetry.v1.TelemetryService.GetTelemetryConfig
      parameters:
      - description: customer_id scopes the request path; used for path-level validation.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
      - description: project_id scopes the request path; used for path-level validation.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      - description: config_id is the id of the config to fetch.
        in: path
        name: config_id
        required: true
        schema:
          description: config_id is the id of the config to fetch.
          title: config_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          description: Success
      summary: GetTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
    patch:
      description: UpdateTelemetryConfig updates a configuration's mutable fields.
      operationId: agentrouter.telemetry.v1.TelemetryService.UpdateTelemetryConfig
      parameters:
      - description: customer_id scopes the request path; used for path-level validation.
        in: path
        name: customer_id
        required: true
        schema:
          description: customer_id scopes the request path; used for path-level validation.
          title: customer_id
          type: string
      - description: project_id scopes the request path; used for path-level validation.
        in: path
        name: project_id
        required: true
        schema:
          description: project_id scopes the request path; used for path-level validation.
          title: project_id
          type: string
      - description: config_id is the id of the config to update.
        in: path
        name: config_id
        required: true
        schema:
          description: config_id is the id of the config to update.
          title: config_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                apiKeyHeader:
                  description: api_key_header -- header name for api_key auth; empty
                    leaves unchanged.
                  title: api_key_header
                  type: string
                authType:
                  description: auth_type -- empty leaves unchanged; otherwise none,
                    bearer, basic, api_key.
                  title: auth_type
                  type: string
                authValue:
                  description: auth_value -- new plaintext credential to encrypt;
                    empty leaves unchanged.
                  title: auth_value
                  type: string
                enabled:
                  description: enabled tri-state encoded as "" (unchanged), "true",
                    "false".
                  title: enabled
                  type: string
                endpoint:
                  description: Empty string means "leave unchanged".
                  title: endpoint
                  type: string
                protocol:
                  description: protocol -- empty leaves unchanged; otherwise grpc,
                    http/json, http/protobuf.
                  title: protocol
                  type: string
                status:
                  description: status -- reported connection state; empty leaves unchanged.
                  title: status
                  type: string
              title: UpdateTelemetryConfigRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.telemetry.v1.TelemetryConfig'
          description: Success
      summary: UpdateTelemetryConfig
      tags:
      - agentrouter.telemetry.v1.TelemetryService
  /v1/customers/{customer_id}/projects/{project_id}/users/{user_id}/mcp-profiles:
    get:
      description: "ListMCPProfiles lists every profile owned by the given\n (user_id,\
        \ customer_id, project_id) scope."
      operationId: agentrouter.mcp.v1.MCPProfilesService.ListMCPProfiles
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Defaults to the caller's session user when empty.
        in: path
        name: user_id
        required: true
        schema:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.ListMCPProfilesResponse'
          description: Success
      summary: ListMCPProfiles
      tags:
      - agentrouter.mcp.v1.MCPProfilesService
    post:
      description: CreateMCPProfile registers a new MCP server for a user.
      operationId: agentrouter.mcp.v1.MCPProfilesService.CreateMCPProfile
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Defaults to the caller's session user when empty.
        in: path
        name: user_id
        required: true
        schema:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  description: Optional description.
                  title: description
                  type: string
                name:
                  description: 'Required: human-friendly profile name.'
                  title: name
                  type: string
                securityPolicyType:
                  description: 'Required: security policy type ("oauth" | "api_key"
                    | "none").'
                  title: security_policy_type
                  type: string
                securityPolicyValue:
                  description: 'Optional: JSON-encoded security policy value. Empty
                    for "none".'
                  title: security_policy_value
                  type: string
              required:
              - name
              - securityPolicyType
              title: CreateMCPProfileRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPProfile'
          description: Success
      summary: CreateMCPProfile
      tags:
      - agentrouter.mcp.v1.MCPProfilesService
  /v1/customers/{customer_id}/projects/{project_id}/users/{user_id}/mcp-profiles/{profile_id}:
    delete:
      description: "DeleteMCPProfile soft-deletes a profile (deleted_at set; row kept\n\
        \ for FK integrity against historical request logs)."
      operationId: agentrouter.mcp.v1.MCPProfilesService.DeleteMCPProfile
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Defaults to the caller's session user when empty.
        in: path
        name: user_id
        required: true
        schema:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      - description: 'Required: uuid of the profile to soft-delete (MCPProfile.id).'
        in: path
        name: profile_id
        required: true
        schema:
          description: 'Required: uuid of the profile to soft-delete (MCPProfile.id).'
          title: profile_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteMCPProfile
      tags:
      - agentrouter.mcp.v1.MCPProfilesService
    get:
      description: GetMCPProfile returns a single profile by uuid.
      operationId: agentrouter.mcp.v1.MCPProfilesService.GetMCPProfile
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Defaults to the caller's session user when empty.
        in: path
        name: user_id
        required: true
        schema:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      - description: 'Required: uuid of the profile to fetch (MCPProfile.id).'
        in: path
        name: profile_id
        required: true
        schema:
          description: 'Required: uuid of the profile to fetch (MCPProfile.id).'
          title: profile_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPProfile'
          description: Success
      summary: GetMCPProfile
      tags:
      - agentrouter.mcp.v1.MCPProfilesService
    patch:
      description: "UpdateMCPProfile updates mutable profile fields. Omitted scalar\n\
        \ strings (\"\") leave the existing value untouched."
      operationId: agentrouter.mcp.v1.MCPProfilesService.UpdateMCPProfile
      parameters:
      - description: Defaults to the caller's session customer when empty.
        in: path
        name: customer_id
        required: true
        schema:
          description: Defaults to the caller's session customer when empty.
          title: customer_id
          type: string
      - description: Defaults to the caller's session project when empty.
        in: path
        name: project_id
        required: true
        schema:
          description: Defaults to the caller's session project when empty.
          title: project_id
          type: string
      - description: Defaults to the caller's session user when empty.
        in: path
        name: user_id
        required: true
        schema:
          description: Defaults to the caller's session user when empty.
          title: user_id
          type: string
      - description: 'Required: uuid of the profile to update (MCPProfile.id).'
        in: path
        name: profile_id
        required: true
        schema:
          description: 'Required: uuid of the profile to update (MCPProfile.id).'
          title: profile_id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                description:
                  title: description
                  type: string
                name:
                  description: "Mutable scalar fields. Empty string leaves the existing\
                    \ value\n untouched -- callers explicitly pass \" \" when they\
                    \ want to clear\n a free-form description (the server trims that\
                    \ to \"\")."
                  title: name
                  type: string
                securityPolicyType:
                  title: security_policy_type
                  type: string
                securityPolicyValue:
                  title: security_policy_value
                  type: string
              title: UpdateMCPProfileRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPProfile'
          description: Success
      summary: UpdateMCPProfile
      tags:
      - agentrouter.mcp.v1.MCPProfilesService
  /v1/dataplane-url:
    get:
      description: "GetDataplaneURL returns the dataplane (gateway) URL for a single\
        \ project.\n The project is deduced from the caller's credential -- no input\
        \ is required\n in the common case: a caller who belongs to one project gets\
        \ that project's\n dataplane; one whose identity spans several gets their\
        \ default (the oldest\n membership). Pass project_id to disambiguate or target\
        \ a specific project\n (it is membership-checked). The customer is derived\
        \ the same way. When the\n credential itself already pins a workspace, that\
        \ workspace is used directly."
      operationId: agentrouter.inference.v1.InferenceIngressService.GetDataplaneURL
      parameters:
      - description: "Optional project override. Empty resolves to the workspace the\
          \ credential\n pins (when it carries one) or the caller's default project\
          \ (the oldest\n membership). Supply explicitly to pick a specific project\
          \ when the identity\n spans several; the chosen project is membership-checked."
        in: query
        name: projectId
        schema:
          description: "Optional project override. Empty resolves to the workspace\
            \ the credential\n pins (when it carries one) or the caller's default\
            \ project (the oldest\n membership). Supply explicitly to pick a specific\
            \ project when the identity\n spans several; the chosen project is membership-checked."
          title: project_id
          type: string
      - description: "Optional customer override. Empty resolves to the customer deduced\
          \ from\n the credential. Honored only for principals not already bound to\
          \ a\n customer; a cross-customer value is rejected unless the caller is\
          \ a member."
        in: query
        name: customerId
        schema:
          description: "Optional customer override. Empty resolves to the customer\
            \ deduced from\n the credential. Honored only for principals not already\
            \ bound to a\n customer; a cross-customer value is rejected unless the\
            \ caller is a member."
          title: customer_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.inference.v1.GetDataplaneURLResponse'
          description: Success
      summary: GetDataplaneURL
      tags:
      - agentrouter.inference.v1.InferenceIngressService
  /v1/dataplane-urls:
    get:
      description: "ListDataplaneURLs returns every dataplane URL the caller can reach\
        \ -- one\n per workspace under the customer deduced from the credential. Key-deduced;\n\
        \ no input. Use GetDataplaneURL when a single project's URL is wanted."
      operationId: agentrouter.inference.v1.InferenceIngressService.ListDataplaneURLs
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.inference.v1.ListDataplaneURLsResponse'
          description: Success
      summary: ListDataplaneURLs
      tags:
      - agentrouter.inference.v1.InferenceIngressService
  /v1/guardrails/triggers/report:
    post:
      description: "ReportGuardrailTriggers ingests a batch of trigger events from\
        \ the data\n plane. Idempotent on trigger.id (duplicate ids return success=true\
        \ with no\n error). Per-item failure model: a malformed or unknown-reference\
        \ trigger\n yields success=false for that item only; the RPC itself fails\
        \ only for auth\n errors, an empty batch, or a batch exceeding 1000 triggers\n\
        \ (INVALID_ARGUMENT). Authenticated as a service account only."
      operationId: agentrouter.guardrails.v1.GuardrailTriggersService.ReportGuardrailTriggers
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.guardrails.v1.ReportGuardrailTriggersRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.guardrails.v1.ReportGuardrailTriggersResponse'
          description: Success
      summary: ReportGuardrailTriggers
      tags:
      - agentrouter.guardrails.v1.GuardrailTriggersService
  /v1/mcp/catalog/servers:
    get:
      description: "ListCatalogServers returns every catalog entry, including disabled\n\
        \ rows so operators can re-enable them. The dashboard's read-only\n view filters\
        \ to is_enabled=true."
      operationId: agentrouter.mcp.v1.MCPCatalogService.ListCatalogServers
      parameters:
      - description: "When true, include is_enabled=false entries. The dashboard sets\n\
          \ this false; the operator CLI defaults to true so disabled servers\n are\
          \ visible."
        in: query
        name: includeDisabled
        schema:
          description: "When true, include is_enabled=false entries. The dashboard\
            \ sets\n this false; the operator CLI defaults to true so disabled servers\n\
            \ are visible."
          title: include_disabled
          type: boolean
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.ListCatalogServersResponse'
          description: Success
      summary: ListCatalogServers
      tags:
      - agentrouter.mcp.v1.MCPCatalogService
    post:
      description: "UpsertCatalogServer creates or replaces a catalog entry. Idempotent\n\
        \ on `id`. Operator-only."
      operationId: agentrouter.mcp.v1.MCPCatalogService.UpsertCatalogServer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.mcp.v1.UpsertCatalogServerRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPCatalogServer'
          description: Success
      summary: UpsertCatalogServer
      tags:
      - agentrouter.mcp.v1.MCPCatalogService
  /v1/mcp/catalog/servers/{id}:
    delete:
      description: DeleteCatalogServer removes a catalog entry by id. Operator-only.
      operationId: agentrouter.mcp.v1.MCPCatalogService.DeleteCatalogServer
      parameters:
      - description: 'Required: stable id of the catalog entry to delete (e.g. "github").'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: stable id of the catalog entry to delete (e.g. "github").'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/google.protobuf.Empty'
          description: Success
      summary: DeleteCatalogServer
      tags:
      - agentrouter.mcp.v1.MCPCatalogService
    get:
      description: GetCatalogServer returns a single catalog entry by id.
      operationId: agentrouter.mcp.v1.MCPCatalogService.GetCatalogServer
      parameters:
      - description: 'Required: stable catalog entry id (e.g. "github").'
        in: path
        name: id
        required: true
        schema:
          description: 'Required: stable catalog entry id (e.g. "github").'
          title: id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPCatalogServer'
          description: Success
      summary: GetCatalogServer
      tags:
      - agentrouter.mcp.v1.MCPCatalogService
  /v1/mcp/catalog/servers/{id}/enabled:
    post:
      description: "SetCatalogServerEnabled flips the operator visibility toggle on\
        \ a\n catalog entry. Split from UpsertCatalogServer so a re-upsert that\n\
        \ refreshes content fields (display_name, url, ...) cannot silently\n re-enable\
        \ a previously-disabled row through the proto bool zero\n value."
      operationId: agentrouter.mcp.v1.MCPCatalogService.SetCatalogServerEnabled
      parameters:
      - description: Stable catalog entry id, e.g. "github".
        in: path
        name: id
        required: true
        schema:
          description: Stable catalog entry id, e.g. "github".
          title: id
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                enabled:
                  description: "Target visibility. true -> entry is visible to the\
                    \ customer-facing\n list; false -> hidden (row kept, is_enabled\
                    \ set to false)."
                  title: enabled
                  type: boolean
              required:
              - enabled
              title: SetCatalogServerEnabledRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.mcp.v1.MCPCatalogServer'
          description: Success
      summary: SetCatalogServerEnabled
      tags:
      - agentrouter.mcp.v1.MCPCatalogService
  /v1/me:
    get:
      description: "GetMe returns the full identity record for the authenticated caller.\n\
        \ Use to verify which identity a credential belongs to, populate a\n \"logged\
        \ in as\" UI element, or confirm role assignments before making\n permission-gated\
        \ calls."
      operationId: agentrouter.identity.v1.MeService.GetMe
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.GetMeResponse'
          description: Success
      summary: GetMe
      tags:
      - agentrouter.identity.v1.MeService
  /v1/me/keys:
    get:
      description: "ListMyKeys lists all API keys belonging to the caller. Returns\n\
        \ metadata (id, name, creation timestamp, last-used timestamp) but\n never\
        \ the plaintext secret."
      operationId: agentrouter.identity.v1.MeService.ListMyKeys
      parameters:
      - description: "Maximum items the server should return. The server may cap this;\
          \ default\n page size and cap are documented per-RPC. Zero means \"use server\
          \ default\"."
        in: query
        name: page.pageSize
        schema:
          description: "Maximum items the server should return. The server may cap\
            \ this; default\n page size and cap are documented per-RPC. Zero means\
            \ \"use server default\"."
          format: int32
          title: page_size
          type: integer
      - description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
          \ Treat as opaque; clients MUST NOT decode or construct one."
        in: query
        name: page.pageToken
        schema:
          description: "Continuation token returned by a prior PageResponse.next_page_token.\n\
            \ Treat as opaque; clients MUST NOT decode or construct one."
          title: page_token
          type: string
      - description: "Optional server-side filter expression (AIP-160 syntax). Empty\
          \ means\n \"no filter\"."
        in: query
        name: page.filter
        schema:
          description: "Optional server-side filter expression (AIP-160 syntax). Empty\
            \ means\n \"no filter\"."
          title: filter
          type: string
      - description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
          \ \"server default order\"."
        in: query
        name: page.orderBy
        schema:
          description: "Optional sort expression, e.g. `created_at desc`. Empty means\n\
            \ \"server default order\"."
          title: order_by
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.ListMyKeysResponse'
          description: Success
      summary: ListMyKeys
      tags:
      - agentrouter.identity.v1.MeService
    post:
      description: "IssueMyKey issues a new long-lived API key for the caller. The\n\
        \ secret field in the response is returned exactly once and cannot be\n retrieved\
        \ again. Store it in a secrets manager immediately."
      operationId: agentrouter.identity.v1.MeService.IssueMyKey
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.identity.v1.IssueMyKeyRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.IssueMyKeyResponse'
          description: Success
      summary: IssueMyKey
      tags:
      - agentrouter.identity.v1.MeService
  /v1/me/keys/{key_id}:
    delete:
      description: "RevokeMyKey permanently and irrevocably revokes an API key.\n\
        \ Revocation propagates to all active data planes within sub-second;\n requests\
        \ already in flight that passed authentication before\n propagation may still\
        \ complete."
      operationId: agentrouter.identity.v1.MeService.RevokeMyKey
      parameters:
      - description: Id (key_<ulid>) of the caller-owned key to revoke.
        in: path
        name: key_id
        required: true
        schema:
          description: Id (key_<ulid>) of the caller-owned key to revoke.
          title: key_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.RevokeMyKeyResponse'
          description: Success
      summary: RevokeMyKey
      tags:
      - agentrouter.identity.v1.MeService
  /v1/request-logs:
    get:
      description: QueryRequestLogs retrieves request logs with filtering and pagination.
      operationId: agentrouter.insights.v1.RequestLogsService.QueryRequestLogs
      parameters:
      - description: Filter by user ID
        in: query
        name: userId
        schema:
          description: Filter by user ID
          title: user_id
          type: string
      - description: Filter by API key ID
        in: query
        name: apiKeyId
        schema:
          description: Filter by API key ID
          title: api_key_id
          type: string
      - description: Filter by model name (e.g., "claude-3-opus", "gpt-4")
        in: query
        name: modelName
        schema:
          description: Filter by model name (e.g., "claude-3-opus", "gpt-4")
          title: model_name
          type: string
      - description: Filter by status (e.g., "success", "error", "timeout")
        in: query
        name: status
        schema:
          description: Filter by status (e.g., "success", "error", "timeout")
          title: status
          type: string
      - description: Filter by HTTP status code
        in: query
        name: statusCode
        schema:
          description: Filter by HTTP status code
          format: int32
          title: status_code
          type: integer
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: startTime.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: startTime.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: Minimum duration in milliseconds
        in: query
        name: minDurationMs
        schema:
          description: Minimum duration in milliseconds
          format: int32
          title: min_duration_ms
          type: integer
      - description: Maximum duration in milliseconds
        in: query
        name: maxDurationMs
        schema:
          description: Maximum duration in milliseconds
          format: int32
          title: max_duration_ms
          type: integer
      - description: 'Page size (default: 50, max: 1000)'
        in: query
        name: pageSize
        schema:
          description: 'Page size (default: 50, max: 1000)'
          format: int32
          title: page_size
          type: integer
      - description: Page token for pagination
        in: query
        name: pageToken
        schema:
          description: Page token for pagination
          title: page_token
          type: string
      - description: "Order by field (default: \"timestamp\")\n Valid values: \"timestamp\"\
          , \"duration_ms\", \"input_tokens\", \"output_tokens\""
        in: query
        name: orderBy
        schema:
          description: "Order by field (default: \"timestamp\")\n Valid values: \"\
            timestamp\", \"duration_ms\", \"input_tokens\", \"output_tokens\""
          title: order_by
          type: string
      - description: 'Order direction: "asc" or "desc" (default: "desc")'
        in: query
        name: orderDirection
        schema:
          description: 'Order direction: "asc" or "desc" (default: "desc")'
          title: order_direction
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.QueryRequestLogsResponse'
          description: Success
      summary: QueryRequestLogs
      tags:
      - agentrouter.insights.v1.RequestLogsService
  /v1/request-logs/stats:
    get:
      description: GetRequestLogStats returns aggregated statistics for request logs.
      operationId: agentrouter.insights.v1.RequestLogsService.GetRequestLogStats
      parameters:
      - description: Filter by user ID
        in: query
        name: userId
        schema:
          description: Filter by user ID
          title: user_id
          type: string
      - description: Filter by model name
        in: query
        name: modelName
        schema:
          description: Filter by model name
          title: model_name
          type: string
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: startTime.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: startTime.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: "Group by dimension\n Valid values: \"model\", \"user\", \"api_key\"\
          , \"status\", \"hour\", \"day\""
        in: query
        name: groupBy
        schema:
          description: "Group by dimension\n Valid values: \"model\", \"user\", \"\
            api_key\", \"status\", \"hour\", \"day\""
          title: group_by
          type: string
      - description: "Metric to calculate\n Valid values: \"count\", \"tokens\", \"\
          cost\", \"latency\", \"errors\""
        in: query
        name: metric
        schema:
          description: "Metric to calculate\n Valid values: \"count\", \"tokens\"\
            , \"cost\", \"latency\", \"errors\""
          title: metric
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.RequestLogStatsResponse'
          description: Success
      summary: GetRequestLogStats
      tags:
      - agentrouter.insights.v1.RequestLogsService
  /v1/request-logs/{request_id}:
    get:
      description: GetRequestLog retrieves a single request log by request ID.
      operationId: agentrouter.insights.v1.RequestLogsService.GetRequestLog
      parameters:
      - description: Request identifier
        in: path
        name: request_id
        required: true
        schema:
          description: Request identifier
          title: request_id
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.insights.v1.RequestLog'
          description: Success
      summary: GetRequestLog
      tags:
      - agentrouter.insights.v1.RequestLogsService
  /v1/secrets:
    get:
      description: "ListSecrets lists all secrets for the authenticated user.\n Returns\
        \ metadata only, not plaintext values."
      operationId: agentrouter.secret.v1.SecretService.ListSecrets
      parameters:
      - description: Filter by realm (optional).
        in: query
        name: realm
        schema:
          description: Filter by realm (optional).
          title: realm
          type: string
      - description: Filter by status (optional).
        in: query
        name: status
        schema:
          $ref: '#/components/schemas/agentrouter.secret.v1.SecretStatus'
          description: Filter by status (optional).
          title: status
      - in: query
        name: tags.key
        schema:
          title: key
          type: string
      - in: query
        name: tags.value
        schema:
          title: value
          type: string
      - description: "Pagination.\n Maximum number of secrets to return per page."
        in: query
        name: pageSize
        schema:
          description: "Pagination.\n Maximum number of secrets to return per page."
          format: int32
          title: page_size
          type: integer
      - description: Opaque token from a previous response's next_page_token to fetch
          the next page.
        in: query
        name: pageToken
        schema:
          description: Opaque token from a previous response's next_page_token to
            fetch the next page.
          title: page_token
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.ListSecretsResponse'
          description: Success
      summary: ListSecrets
      tags:
      - agentrouter.secret.v1.SecretService
    post:
      description: "CreateSecret creates or updates a secret.\n If a secret with the\
        \ same name exists, it will be updated."
      operationId: agentrouter.secret.v1.SecretService.CreateSecret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.secret.v1.CreateSecretRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.CreateSecretResponse'
          description: Success
      summary: CreateSecret
      tags:
      - agentrouter.secret.v1.SecretService
  /v1/secrets/{name}:
    delete:
      description: DeleteSecret deletes a secret by name.
      operationId: agentrouter.secret.v1.SecretService.DeleteSecret
      parameters:
      - description: Name of the secret to delete.
        in: path
        name: name
        required: true
        schema:
          description: Name of the secret to delete.
          title: name
          type: string
      - description: Realm of the secret (optional, defaults to user's current realm).
        in: query
        name: realm
        schema:
          description: Realm of the secret (optional, defaults to user's current realm).
          title: realm
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.DeleteSecretResponse'
          description: Success
      summary: DeleteSecret
      tags:
      - agentrouter.secret.v1.SecretService
    get:
      description: "GetSecret retrieves a secret by name.\n Returns metadata only,\
        \ not the plaintext value."
      operationId: agentrouter.secret.v1.SecretService.GetSecret
      parameters:
      - description: Name of the secret.
        in: path
        name: name
        required: true
        schema:
          description: Name of the secret.
          title: name
          type: string
      - description: Realm of the secret (optional, defaults to user's current realm).
        in: query
        name: realm
        schema:
          description: Realm of the secret (optional, defaults to user's current realm).
          title: realm
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.GetSecretResponse'
          description: Success
      summary: GetSecret
      tags:
      - agentrouter.secret.v1.SecretService
  /v1/secrets/{name}/rotate:
    post:
      description: "RotateSecret rotates a secret by creating a new version.\n The\
        \ old version is marked as rotated_pending for graceful transition."
      operationId: agentrouter.secret.v1.SecretService.RotateSecret
      parameters:
      - description: Name of the secret to rotate.
        in: path
        name: name
        required: true
        schema:
          description: Name of the secret to rotate.
          title: name
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              description: RotateSecretRequest rotates a secret to a new value.
              properties:
                newValue:
                  description: New secret value.
                  title: new_value
                  type: string
                realm:
                  description: Realm of the secret (optional).
                  title: realm
                  type: string
              title: RotateSecretRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.RotateSecretResponse'
          description: Success
      summary: RotateSecret
      tags:
      - agentrouter.secret.v1.SecretService
  /v1/secrets/{name}/validate:
    post:
      description: "ValidateSecret validates that a secret can be decrypted.\n Used\
        \ for health checks and troubleshooting."
      operationId: agentrouter.secret.v1.SecretService.ValidateSecret
      parameters:
      - description: Name of the secret to validate.
        in: path
        name: name
        required: true
        schema:
          description: Name of the secret to validate.
          title: name
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              description: ValidateSecretRequest validates a secret can be decrypted.
              properties:
                realm:
                  description: Realm of the secret (optional).
                  title: realm
                  type: string
              title: ValidateSecretRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.ValidateSecretResponse'
          description: Success
      summary: ValidateSecret
      tags:
      - agentrouter.secret.v1.SecretService
  /v1/secrets/{name}/value:
    post:
      description: "GetSecretValue retrieves the plaintext value of a secret.\n INTERNAL\
        \ USE ONLY - This endpoint decrypts and returns the actual secret\n value.\
        \ Should only be called by internal services (Liaison, Butler2, etc.)"
      operationId: agentrouter.secret.v1.SecretService.GetSecretValue
      parameters:
      - description: Name of the secret.
        in: path
        name: name
        required: true
        schema:
          description: Name of the secret.
          title: name
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              description: GetSecretValueRequest requests the plaintext value of a
                secret.
              properties:
                realm:
                  description: Realm of the secret.
                  title: realm
                  type: string
                userId:
                  description: "User ID who owns the secret.\n For system secrets\
                    \ (KEKs, LLM keys), use \"system\"."
                  title: user_id
                  type: string
              title: GetSecretValueRequest
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.secret.v1.GetSecretValueResponse'
          description: Success
      summary: GetSecretValue
      tags:
      - agentrouter.secret.v1.SecretService
  /v1/tokens/revocations:
    get:
      description: "GetRevocationList returns a list of revoked token JTIs.\n This\
        \ is used by dataplane to cache and check token revocations locally."
      operationId: agentrouter.tokens.v1.TokensService.GetRevocationList
      parameters:
      - description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
          \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
          \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
        in: query
        name: since.seconds
        schema:
          description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z.\
            \ Must\n be between -315576000000 and 315576000000 inclusive (which corresponds\
            \ to\n 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z)."
          format: int64
          title: seconds
          type:
          - integer
          - string
      - description: "Non-negative fractions of a second at nanosecond resolution.\
          \ This field is\n the nanosecond portion of the duration, not an alternative\
          \ to seconds.\n Negative second values with fractions must still have non-negative\
          \ nanos\n values that count forward in time. Must be between 0 and 999,999,999\n\
          \ inclusive."
        in: query
        name: since.nanos
        schema:
          description: "Non-negative fractions of a second at nanosecond resolution.\
            \ This field is\n the nanosecond portion of the duration, not an alternative\
            \ to seconds.\n Negative second values with fractions must still have\
            \ non-negative nanos\n values that count forward in time. Must be between\
            \ 0 and 999,999,999\n inclusive."
          format: int32
          title: nanos
          type: integer
      - description: "Optional: Maximum number of entries to return.\n If not specified,\
          \ returns all revoked tokens."
        in: query
        name: limit
        schema:
          description: "Optional: Maximum number of entries to return.\n If not specified,\
            \ returns all revoked tokens."
          format: int32
          title: limit
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tokens.v1.GetRevocationListResponse'
          description: Success
      summary: GetRevocationList
      tags:
      - agentrouter.tokens.v1.TokensService
  /v1/tokens/usage:
    post:
      description: "UpdateLastUsed updates the last used timestamp for a token.\n\
        \ Called by dataplane when a token is used for authentication."
      operationId: agentrouter.tokens.v1.TokensService.UpdateLastUsed
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.tokens.v1.UpdateLastUsedRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.tokens.v1.UpdateLastUsedResponse'
          description: Success
      summary: UpdateLastUsed
      tags:
      - agentrouter.tokens.v1.TokensService
  /v1/users:
    post:
      description: "CreateUser provisions a user identity (an authn.user row). Admin-scoped:\n\
        \ only platform operators (admin scope) may create users. Intended for tenant\n\
        \ onboarding and automated provisioning where users do not arrive via\n interactive\
        \ SSO. When issue_session is true a session is also created and\n its token\
        \ returned ONCE, so the caller can immediately act as the new user."
      operationId: agentrouter.identity.v1.MeService.CreateUser
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agentrouter.identity.v1.CreateUserRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agentrouter.identity.v1.CreateUserResponse'
          description: Success
      summary: CreateUser
      tags:
      - agentrouter.identity.v1.MeService
security:
- bearerAuth: []
tags:
- description: Health Check
  name: agentrouter.admin.v1.AdminService
- description: AiKeysService exposes the customer-facing CRUD plus the internal Fetch.
  name: agentrouter.aikeys.v1.AiKeysService
- description: "ApiKeysService provides management-plane APIs for creating and managing\
    \ user API keys.\n These endpoints are intended to be called by internal services\
    \ (e.g. the Next.js app)\n using an admin-scoped management-plane API key."
  name: agentrouter.api_keys.v1.ApiKeysService
- name: agentrouter.auth.v1.AuthService
- description: CatalogService is the read surface for providers and models.
  name: agentrouter.catalog.v1.CatalogService
- description: "ClientsService provides management-plane APIs for managing Clients\
    \ and\n their API keys, project-scoped under (customer_id, project_id)."
  name: agentrouter.clients.v1.ClientsService
- description: "ConfiguratorService manages liaison configuration state.\n This service\
    \ replaces the pub/sub mechanism with a polling-based approach.\n\n Flow:\n 1.\
    \ Dashboard triggers configuration update via TriggerUpdate\n 2. Valet generates\
    \ configuration and stores in database with version\n 3. Liaison worker polls\
    \ GetConfiguration periodically\n 4. Worker detects version changes and downloads\
    \ new configuration\n 5. Worker applies configuration to cluster"
  name: agentrouter.configurator.v1.ConfiguratorService
- description: "GuardrailProvidersService is the CRUD surface for GuardrailProvider\n\
    \ resources."
  name: agentrouter.guardrails.v1.GuardrailProvidersService
- description: "GuardrailTriggersService provides APIs for reporting and querying\
    \ guardrail\n trigger events."
  name: agentrouter.guardrails.v1.GuardrailTriggersService
- description: "GuardrailsService is the (customer_id, project_id)-scoped CRUD surface\n\
    \ for guardrails and guardrail rules."
  name: agentrouter.guardrails.v1.GuardrailsService
- description: PatternsService is the CRUD surface for Pattern resources.
  name: agentrouter.guardrails.v1.PatternsService
- description: "IdentityService carries the admin-side endpoints that the auth\n middleware\
    \ and onboarding paths need. ResolveApiKey is the only RPC\n landed in milestones\
    \ A+B; the rest of the admin surface ships in\n milestone C."
  name: agentrouter.identity.v1.IdentityService
- description: "MeService is the caller-bound surface -- every RPC operates on the\n\
    \ authenticated identity, with no path-level identity selector. The\n CLI's `ia\
    \ whoami`, `ia keys ...`, `ia login` consume this."
  name: agentrouter.identity.v1.MeService
- description: InferenceIngressService is the customer-visible inference surface.
  name: agentrouter.inference.v1.InferenceIngressService
- description: "CustomerRequestLogsService is the customer-facing read surface over\n\
    \ request_logs. Identical wire shape to RequestLogsService but the\n handler resolves\
    \ the calling user via the identitysvc.Authenticator\n (the same path the inference\
    \ handler uses) and enforces\n `user_id = caller.UserID` on every list/get. The\
    \ customer_id /\n project_id flags identify the tenancy scope the caller is querying\n\
    \ against; the underlying `request_logs` table does not yet carry\n customer_id\
    \ / project_id columns, so the physical isolation today is\n user_id-based --\
    \ a customer's users only see their own rows. Adding\n customer_id / project_id\
    \ columns to request_logs in a future migration\n will let the handler tighten\
    \ the filter to a true WHERE customer_id =\n $1 AND project_id = $2 without breaking\
    \ the wire contract."
  name: agentrouter.insights.v1.CustomerRequestLogsService
- description: "RequestLogsService provides access to historical request logs for\
    \ debugging,\n cost analysis, billing, and compliance auditing."
  name: agentrouter.insights.v1.RequestLogsService
- description: "MCPCatalogService manages the platform-curated catalog of MCP\n servers.\
    \ Operator-only surface -- end users only read from it via\n the dashboard."
  name: agentrouter.mcp.v1.MCPCatalogService
- description: "MCPProfilesService is the (user, customer, project)-scoped CRUD\n\
    \ surface for mcp_profiles."
  name: agentrouter.mcp.v1.MCPProfilesService
- description: "McpOAuthClientsService is the (customer, project)-scoped CRUD surface\n\
    \ for mcp_server_oauth_clients."
  name: agentrouter.mcp.v1.McpOAuthClientsService
- description: "SecretService provides secure key management for LLM provider keys,\n\
    \ BYOK (Bring Your Own Key) scenarios, and other sensitive configuration.\n\n\
    \ Security model:\n - All secrets are encrypted at rest using envelope encryption\
    \ (KEK + DEK)\n - KEK (Key Encryption Key) is stored in external KMS (GCP Secret\
    \ Manager or\n local file)\n - DEK (Data Encryption Key) is generated per secret\
    \ and encrypted with KEK\n - Secrets are scoped to user_id and realm for multi-tenancy"
  name: agentrouter.secret.v1.SecretService
- description: "TelemetryService manages OTel export configurations (one per\n telemetry_type\
    \ per user)."
  name: agentrouter.telemetry.v1.TelemetryService
- description: "ProjectsService manages projects within a customer scope and their\n\
    \ member assignments."
  name: agentrouter.tenancy.v1.ProjectsService
- description: "TenancyService manages customers (the top-level tenant). Cross-\n\
    \ customer operations are platform-scoped."
  name: agentrouter.tenancy.v1.TenancyService
- description: "TokensService provides APIs for user token management from dataplane.\n\
    \ These endpoints are called by dataplane instances using service account\n tokens."
  name: agentrouter.tokens.v1.TokensService