{"openapi":"3.1.0","info":{"title":"BangBang API","version":"0.1.0","description":"Start website audits, compare environments or before/after runs, and read findings and reports. /v1 is the versioned, canonical prefix; the same operations answer under /api. Authenticate with a personal API token: Authorization: Bearer sc_… (super admins create them on /tokens). Tokens carry scopes (runs:read, runs:write, shares:write, admin, load, active); load and active are required to start runs that use those modules. A token may also be limited to client IP ranges and target hostnames. When the external app allowlist (/v1/admin/apps) has entries, every API key works only from an approved app: its IP address or range, a server whose address the listed domain resolves to, or (for browser apps) an Origin of that domain; other calls get 403 with code app_not_allowed. Each external app has its own shared key (copy it from /admin/apps): that key works only from its own app's addresses, only while the app is enabled, and never from another app's. A token acts with its owner's role: customers reach only their own data, admins and super admins reach everything, and the admin scope works only for admins and super admins (external apps only for super admins). This document, the HTML reference at /api/docs and /api/health are public: share their links with anyone building an integration, then give them a key. POST endpoints honour Idempotency-Key. POST /v1/runs accepts callbackUrl/callbackSecret: the finished or failed run is POSTed there, signed with X-BangBang-Signature: sha256=HMAC(body). Requests are rate limited per user; a 429 carries Retry-After, and every response carries X-RateLimit-Limit and X-RateLimit-Remaining.","contact":{"name":"Matter Solutions Pty Ltd","email":"developers@mattersolutions.com","url":"https://www.mattersolutions.com.au"}},"servers":[{"url":"https://bangbang.mattersolutions.co"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"Personal API token, e.g. sc_3f9a…"}},"schemas":{"StartRun":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"}},"additionalProperties":true},"Run":{"type":"object","properties":{"id":{"type":"string"},"project":{"type":"string"},"mode":{"type":"string","enum":["audit","compare","before-after"]},"status":{"type":"string","enum":["running","done","failed"]},"started_at":{"type":"string","format":"date-time"},"finished_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"duration_ms":{"type":["number","null"]},"environments":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"baseUrl":{"type":"string"}},"required":["name","baseUrl"],"additionalProperties":false}},"page_count":{"type":"integer"},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"scores":{"anyOf":[{"type":"object","additionalProperties":{"type":"number"}},{"type":"null"}]},"visibility":{"type":"string","enum":["private","public"]},"tags":{"type":"array","items":{"type":"string"}},"notes":{"type":["string","null"]},"tests":{"anyOf":[{"type":"array","items":{"type":"string","enum":["performance","security","seo","accessibility","responsive","content","runtime","privacy"]}},{"type":"null"}],"description":"the tests the run was limited to; null = all"}},"required":["id","project","mode","status","started_at","finished_at","duration_ms","environments","page_count","counts","scores","visibility","tags","notes"],"additionalProperties":false},"Finding":{"type":"object","properties":{"ruleId":{"type":"string"},"category":{"type":"string"},"severity":{"type":"string","enum":["info","low","medium","high","critical"]},"title":{"type":"string"},"description":{"type":"string"},"page":{"type":"string"},"device":{"type":"string"},"envs":{"type":"array","items":{"type":"string"}},"evidence":{"type":"object","additionalProperties":{}},"remediation":{"type":"string"},"fingerprint":{"type":"string"}},"required":["ruleId","category","severity","title","description","envs","evidence","fingerprint"],"additionalProperties":false},"Job":{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string","enum":["queued","running","done","failed"]},"project":{"type":"string"},"mode":{"type":"string"},"percent":{"type":["number","null"]},"stage":{"type":["string","null"]},"message":{"type":["string","null"]},"error":{"type":["string","null"]}},"required":["id","status","project","mode","percent","stage","message","error"],"additionalProperties":false},"Error":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","description":"invalid_request, unauthorized, forbidden, app_not_allowed, not_found, conflict, rate_limited, ..."}},"required":["error"],"additionalProperties":false},"PageSummary":{"type":"object","properties":{"index":{"type":"integer"},"path":{"type":"string"},"findingCount":{"type":"integer"},"worstSeverity":{"type":"string","enum":["info","low","medium","high","critical"]},"visualMismatch":{"type":"object","additionalProperties":{"type":"number"}},"environments":{"type":"object","additionalProperties":{"anyOf":[{"type":"object","properties":{"url":{"type":"string"},"status":{"type":"integer"},"ttfbMs":{"type":"number"},"title":{"type":"string"}},"required":["url","status"],"additionalProperties":false},{"type":"null"}]}}},"required":["index","path","findingCount","environments"],"additionalProperties":false},"Artifact":{"type":"object","properties":{"path":{"type":"string"},"kind":{"type":"string","enum":["screenshot","diff","report","data","other"]},"bytes":{"type":"integer"},"url":{"type":"string"}},"required":["path","kind","bytes","url"],"additionalProperties":false},"Snapshot":{"type":"object","properties":{"name":{"type":"string"},"url":{"type":"string"},"createdAt":{"type":"string"},"toolVersion":{"type":"string"},"devices":{"type":"array","items":{"type":"string"}},"pageCount":{"type":"integer"},"label":{"type":"string"}},"required":["name","url","createdAt","toolVersion","devices","pageCount"],"additionalProperties":false},"CreateSnapshot":{"type":"object","properties":{"runId":{"type":"string","minLength":1},"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[A-Za-z0-9._-]+$"},"label":{"type":"string","maxLength":200},"env":{"type":"string","maxLength":60}},"required":["runId"],"additionalProperties":false},"Compare":{"type":"object","properties":{"a":{"type":"string","minLength":1,"description":"base run id (before)"},"b":{"type":"string","minLength":1,"description":"run id to compare (after)"}},"required":["a","b"],"additionalProperties":false},"CompareResult":{"type":"object","properties":{"a":{"type":"string"},"b":{"type":"string"},"added":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"category":{"type":"string"},"severity":{"type":"string","enum":["info","low","medium","high","critical"]},"title":{"type":"string"},"description":{"type":"string"},"page":{"type":"string"},"device":{"type":"string"},"envs":{"type":"array","items":{"type":"string"}},"evidence":{"type":"object","additionalProperties":{}},"remediation":{"type":"string"},"fingerprint":{"type":"string"}},"required":["ruleId","category","severity","title","description","envs","evidence","fingerprint"],"additionalProperties":false}},"resolved":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"category":{"type":"string"},"severity":{"type":"string","enum":["info","low","medium","high","critical"]},"title":{"type":"string"},"description":{"type":"string"},"page":{"type":"string"},"device":{"type":"string"},"envs":{"type":"array","items":{"type":"string"}},"evidence":{"type":"object","additionalProperties":{}},"remediation":{"type":"string"},"fingerprint":{"type":"string"}},"required":["ruleId","category","severity","title","description","envs","evidence","fingerprint"],"additionalProperties":false}},"persisting":{"type":"integer"},"scores":{"type":"object","additionalProperties":{"type":"object","properties":{"a":{"type":["number","null"]},"b":{"type":["number","null"]},"delta":{"type":["number","null"]}},"required":["a","b","delta"],"additionalProperties":false}},"counts":{"type":"object","properties":{"a":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"b":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"}},"required":["a","b"],"additionalProperties":false}},"required":["a","b","added","resolved","persisting","scores","counts"],"additionalProperties":false},"Credential":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"type":{"type":"string","enum":["basic","header","cookie","ssh-key"],"description":"ssh-key: a legacy credential of the removed SSH server test; it can only be deleted"},"label":{"type":"string"},"hasSecret":{"type":"boolean","const":true},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","name","type","label","hasSecret","createdAt","updatedAt"],"additionalProperties":false},"CreateCredential":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":120},"type":{"type":"string","enum":["basic","header","cookie"]},"username":{"type":"string","maxLength":190,"description":"basic: user name"},"headerName":{"type":"string","maxLength":190,"description":"header: header name"},"secret":{"type":"string","minLength":1,"maxLength":20000,"description":"password, header value or cookie string; write-only"}},"required":["name","type","secret"],"additionalProperties":false},"UpdateCredential":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":120},"username":{"type":"string","maxLength":190,"description":"basic: user name"},"headerName":{"type":"string","maxLength":190,"description":"header: header name"},"secret":{"type":"string","minLength":1,"maxLength":20000,"description":"password, header value or cookie string; write-only"}},"additionalProperties":false},"CreateToken":{"type":"object","properties":{"name":{"type":"string","maxLength":120},"expiresDays":{"anyOf":[{"type":"integer","minimum":1,"maximum":3650},{"type":"null"}]},"scopes":{"type":"array","items":{"type":"string","enum":["runs:read","runs:write","shares:write","admin","load","active"]},"description":"default: runs:read runs:write shares:write admin; load and active are privileged and must be asked for"},"ipAllow":{"type":"array","items":{"type":"string"},"description":"CIDR ranges or addresses the token may be used from"},"hostAllow":{"type":"array","items":{"type":"string"},"description":"hostname globs (e.g. *.example.com) the token may start runs against"}},"additionalProperties":false},"Token":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"ip_allow":{"type":"array","items":{"type":"string"}},"host_allow":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string"},"last_used_at":{"type":["string","null"]},"expires_at":{"type":["string","null"]}},"required":["id","name","prefix","created_at","last_used_at","expires_at"],"additionalProperties":false},"ShareCreate":{"type":"object","properties":{"expiresDays":{"anyOf":[{"type":"integer","minimum":1,"maximum":3650},{"type":"null"}],"description":"default 30; null never expires"},"password":{"type":"string","minLength":6,"maxLength":200},"audience":{"type":"string","enum":["internal","external"],"description":"external (default) hides secrets, internal hosts and stack traces; internal masks secrets only"},"sections":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","enum":["overview","performance","security","seo","accessibility","responsive","content","runtime","privacy"]},"minItems":1}],"description":"report sections the link shows: \"all\" (default) or a list of overview, performance, security, seo, accessibility, responsive, content, runtime, privacy"}},"additionalProperties":false},"ShareUpdate":{"type":"object","properties":{"sections":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","enum":["overview","performance","security","seo","accessibility","responsive","content","runtime","privacy"]},"minItems":1}],"description":"report sections the link shows: \"all\" (default) or a list of overview, performance, security, seo, accessibility, responsive, content, runtime, privacy"},"expiresDays":{"anyOf":[{"type":"integer","minimum":1,"maximum":3650},{"type":"null"}],"description":"counted from now; null never expires"},"audience":{"type":"string","enum":["internal","external"]},"password":{"anyOf":[{"type":"string","minLength":6,"maxLength":200},{"type":"null"}],"description":"null removes the password"}},"additionalProperties":false},"Share":{"type":"object","properties":{"id":{"type":"integer"},"url":{"type":"string"},"runId":{"type":"string"},"protected":{"type":"boolean"},"expiresAt":{"type":["string","null"]},"createdAt":{"type":"string"},"revoked":{"type":"boolean"},"views":{"type":"integer"},"lastViewedAt":{"type":["string","null"]},"state":{"type":"string","enum":["ok","expired","revoked"]},"audience":{"type":"string","enum":["internal","external"]},"sections":{"type":"array","items":{"type":"string"},"description":"sections the link shows, after the audience cap"},"allSections":{"type":"boolean","description":"true for links that show every section (including those made before sections existed)"},"links":{"type":"object","additionalProperties":{"type":"string"},"description":"public URL of each section's tab"}},"required":["id","url","runId","protected","expiresAt","createdAt","revoked","views","lastViewedAt","state","audience","sections","allSections","links"],"additionalProperties":false},"RunAccepted":{"type":"object","properties":{"id":{"type":"string"},"url":{"type":"string"},"statusUrl":{"type":"string"},"eventsUrl":{"type":"string"}},"required":["id","url"],"additionalProperties":false},"Site":{"type":"object","properties":{"project":{"type":"string","description":"project key: the registrable domain runs are stored under"},"host":{"type":"string"},"baseUrl":{"type":"string"},"runs":{"type":"integer"},"lastRun":{"anyOf":[{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string"},"mode":{"type":"string"},"startedAt":{"type":"string"},"finishedAt":{"type":["string","null"]}},"required":["id","status","mode","startedAt","finishedAt"],"additionalProperties":false},{"type":"null"}]},"latestRunId":{"type":["string","null"]},"averageScore":{"type":["number","null"]},"verdict":{"type":["string","null"]},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"schedules":{"type":"integer"}},"required":["project","host","baseUrl","runs","lastRun","latestRunId","averageScore","verdict","counts","schedules"],"additionalProperties":false},"SiteSummary":{"type":"object","properties":{"project":{"type":"string","description":"project key: the registrable domain runs are stored under"},"host":{"type":"string"},"baseUrl":{"type":"string"},"runs":{"type":"integer"},"lastRun":{"anyOf":[{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string"},"mode":{"type":"string"},"startedAt":{"type":"string"},"finishedAt":{"type":["string","null"]}},"required":["id","status","mode","startedAt","finishedAt"],"additionalProperties":false},{"type":"null"}]},"latestRunId":{"type":["string","null"]},"averageScore":{"type":["number","null"]},"verdict":{"type":["string","null"]},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"schedules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"user_id":{"type":"integer"},"name":{"type":"string"},"frequency":{"type":"string","enum":["hourly","every6h","daily","weekly","every5m","every15m","every30m"],"description":"hourly, every6h, daily, weekly; or every5m, every15m, every30m for an uptime-only schedule (request {\"urls\": [...]}: status, response time and TLS expiry, no browser)"},"frequencyText":{"type":"string"},"hour_utc":{"anyOf":[{"type":"integer"},{"type":"null"}]},"request":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"}},"additionalProperties":true},"enabled":{"type":"boolean"},"next_run_at":{"type":"string"},"last_run_at":{"type":["string","null"]},"last_run_id":{"type":["string","null"]},"last_error":{"type":["string","null"]}},"required":["id","user_id","name","frequency","frequencyText","hour_utc","request","enabled","next_run_at","last_run_at","last_run_id","last_error"],"additionalProperties":false}},"latestRun":{"anyOf":[{"type":"object","properties":{"id":{"type":"string"},"project":{"type":"string"},"mode":{"type":"string","enum":["audit","compare","before-after"]},"status":{"type":"string","enum":["running","done","failed"]},"started_at":{"type":"string","format":"date-time"},"finished_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"duration_ms":{"type":["number","null"]},"environments":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"baseUrl":{"type":"string"}},"required":["name","baseUrl"],"additionalProperties":false}},"page_count":{"type":"integer"},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"scores":{"anyOf":[{"type":"object","additionalProperties":{"type":"number"}},{"type":"null"}]},"visibility":{"type":"string","enum":["private","public"]},"tags":{"type":"array","items":{"type":"string"}},"notes":{"type":["string","null"]},"tests":{"anyOf":[{"type":"array","items":{"type":"string","enum":["performance","security","seo","accessibility","responsive","content","runtime","privacy"]}},{"type":"null"}],"description":"the tests the run was limited to; null = all"}},"required":["id","project","mode","status","started_at","finished_at","duration_ms","environments","page_count","counts","scores","visibility","tags","notes"],"additionalProperties":false},{"type":"null"}]},"scores":{"anyOf":[{"type":"object","additionalProperties":{"type":"number"}},{"type":"null"}]},"trend":{"type":"array","items":{"type":"object","properties":{"runId":{"type":"string"},"startedAt":{"type":"string"},"averageScore":{"type":["number","null"]},"scores":{"anyOf":[{"type":"object","additionalProperties":{"type":"number"}},{"type":"null"}]},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"pageCount":{"type":"integer"}},"required":["runId","startedAt","averageScore","scores","counts","pageCount"],"additionalProperties":false}},"openFindings":{"type":"integer","description":"not baselined and not ignored, on the latest finished run"},"openBySeverity":{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},"settings":{"anyOf":[{"type":"object","properties":{"defaults":{"type":"object","properties":{"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"crawl":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"lighthouse":{"type":"boolean"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5}},"additionalProperties":false},"auth":{"anyOf":[{"anyOf":[{"type":"object","properties":{"type":{"type":"string","const":"basic"},"username":{"type":"string","minLength":1},"password":{"type":"string"}},"required":["type","username","password"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"header"},"name":{"type":"string","minLength":1},"value":{"type":"string"}},"required":["type","name","value"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"cookie"},"cookie":{"type":"string","minLength":1}},"required":["type","cookie"],"additionalProperties":false}]},{"type":"null"}]},"credentialId":{"anyOf":[{"type":"integer","exclusiveMinimum":true,"minimum":0},{"type":"null"}]},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":4000}},"pages":{"type":"object","properties":{"list":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":500},"include":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"exclude":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100}},"additionalProperties":false},"normalize":{"type":"object","properties":{"ignoreSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"maskSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"ignoreTextPatterns":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"blockThirdParty":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":200}},"additionalProperties":false},"notes":{"type":"string","maxLength":5000}},"additionalProperties":false},{"type":"null"}],"description":"secrets masked"},"activeJobs":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string","enum":["queued","running","done","failed"]},"project":{"type":"string"},"mode":{"type":"string"},"percent":{"type":["number","null"]},"stage":{"type":["string","null"]},"message":{"type":["string","null"]},"error":{"type":["string","null"]}},"required":["id","status","project","mode","percent","stage","message","error"],"additionalProperties":false}}},"required":["project","host","baseUrl","runs","lastRun","latestRunId","averageScore","verdict","counts","schedules","latestRun","scores","trend","openFindings","openBySeverity","settings","activeJobs"],"additionalProperties":false},"SiteRunsPage":{"type":"object","properties":{"project":{"type":"string"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"project":{"type":"string"},"mode":{"type":"string","enum":["audit","compare","before-after"]},"status":{"type":"string","enum":["running","done","failed"]},"started_at":{"type":"string","format":"date-time"},"finished_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"duration_ms":{"type":["number","null"]},"environments":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"baseUrl":{"type":"string"}},"required":["name","baseUrl"],"additionalProperties":false}},"page_count":{"type":"integer"},"counts":{"anyOf":[{"type":"object","additionalProperties":{"type":"integer"},"description":"findings per severity"},{"type":"null"}],"description":"findings per severity"},"scores":{"anyOf":[{"type":"object","additionalProperties":{"type":"number"}},{"type":"null"}]},"visibility":{"type":"string","enum":["private","public"]},"tags":{"type":"array","items":{"type":"string"}},"notes":{"type":["string","null"]},"tests":{"anyOf":[{"type":"array","items":{"type":"string","enum":["performance","security","seo","accessibility","responsive","content","runtime","privacy"]}},{"type":"null"}],"description":"the tests the run was limited to; null = all"}},"required":["id","project","mode","status","started_at","finished_at","duration_ms","environments","page_count","counts","scores","visibility","tags","notes"],"additionalProperties":false}},"nextCursor":{"type":["string","null"],"description":"pass as ?cursor= for the next page"}},"required":["project","items","nextCursor"],"additionalProperties":false},"SiteFindingsPage":{"type":"object","properties":{"project":{"type":"string"},"runId":{"type":"string"},"status":{"type":"string","enum":["open","new","all"]},"total":{"type":"integer"},"items":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"category":{"type":"string"},"severity":{"type":"string","enum":["info","low","medium","high","critical"]},"title":{"type":"string"},"description":{"type":"string"},"page":{"type":"string"},"device":{"type":"string"},"envs":{"type":"array","items":{"type":"string"}},"evidence":{"type":"object","additionalProperties":{}},"remediation":{"type":"string"},"fingerprint":{"type":"string"}},"required":["ruleId","category","severity","title","description","envs","evidence","fingerprint"],"additionalProperties":false}},"nextCursor":{"type":["string","null"]}},"required":["project","runId","status","total","items","nextCursor"],"additionalProperties":false},"SitePerformance":{"type":"object","properties":{"project":{"type":"string"},"host":{"type":"string"},"formFactor":{"type":"string","enum":["mobile","desktop"]},"page":{"type":["string","null"]},"series":{"type":"array","items":{"type":"object","properties":{"runId":{"type":"string"},"at":{"type":"string","description":"ISO time of the sample"},"page":{"type":"string"},"url":{"type":"string"},"env":{"type":"string"},"performance":{"anyOf":[{"type":"integer"},{"type":"null"}]},"accessibility":{"anyOf":[{"type":"integer"},{"type":"null"}]},"bestPractices":{"anyOf":[{"type":"integer"},{"type":"null"}]},"seo":{"anyOf":[{"type":"integer"},{"type":"null"}]},"metrics":{"type":"object","properties":{"fcpMs":{"type":["number","null"]},"lcpMs":{"type":["number","null"]},"tbtMs":{"type":["number","null"]},"cls":{"type":["number","null"]},"speedIndexMs":{"type":["number","null"]},"ttiMs":{"type":["number","null"]},"ttfbMs":{"type":["number","null"]}},"required":["fcpMs","lcpMs","tbtMs","cls","speedIndexMs","ttiMs","ttfbMs"],"additionalProperties":false}},"required":["runId","at","page","url","env","performance","accessibility","bestPractices","seo","metrics"],"additionalProperties":false},"description":"Lighthouse samples, oldest first"},"latest":{"anyOf":[{"type":"object","properties":{"runId":{"type":"string"},"at":{"type":"string","description":"ISO time of the sample"},"page":{"type":"string"},"url":{"type":"string"},"env":{"type":"string"},"performance":{"anyOf":[{"type":"integer"},{"type":"null"}]},"accessibility":{"anyOf":[{"type":"integer"},{"type":"null"}]},"bestPractices":{"anyOf":[{"type":"integer"},{"type":"null"}]},"seo":{"anyOf":[{"type":"integer"},{"type":"null"}]},"metrics":{"type":"object","properties":{"fcpMs":{"type":["number","null"]},"lcpMs":{"type":["number","null"]},"tbtMs":{"type":["number","null"]},"cls":{"type":["number","null"]},"speedIndexMs":{"type":["number","null"]},"ttiMs":{"type":["number","null"]},"ttfbMs":{"type":["number","null"]}},"required":["fcpMs","lcpMs","tbtMs","cls","speedIndexMs","ttiMs","ttfbMs"],"additionalProperties":false}},"required":["runId","at","page","url","env","performance","accessibility","bestPractices","seo","metrics"],"additionalProperties":false},{"type":"null"}]},"change":{"anyOf":[{"type":"object","properties":{"previousRunId":{"type":"string"},"previousAt":{"type":"string"},"performance":{"type":["number","null"]},"accessibility":{"type":["number","null"]},"bestPractices":{"type":["number","null"]},"seo":{"type":["number","null"]},"lcpMs":{"type":["number","null"]},"tbtMs":{"type":["number","null"]},"cls":{"type":["number","null"]}},"required":["previousRunId","previousAt","performance","accessibility","bestPractices","seo","lcpMs","tbtMs","cls"],"additionalProperties":false},{"type":"null"}],"description":"latest minus the previous sample of the same page"}},"required":["project","host","formFactor","page","series","latest","change"],"additionalProperties":false},"SiteRun":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"},"url":{"type":"string","maxLength":2000,"description":"page to audit; must be on the site's host. Default: the site's last tested base URL, else https://{host}/"}},"additionalProperties":true},"SiteLookupMiss":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","const":"not_found"},"project":{"type":"string"},"host":{"type":"string"},"url":{"type":"string"},"site":{"type":"string","description":"value to use as {site}"}},"required":["error","code","project","host","url","site"],"additionalProperties":false},"Schedule":{"type":"object","properties":{"id":{"type":"integer"},"user_id":{"type":"integer"},"name":{"type":"string"},"frequency":{"type":"string","enum":["hourly","every6h","daily","weekly","every5m","every15m","every30m"],"description":"hourly, every6h, daily, weekly; or every5m, every15m, every30m for an uptime-only schedule (request {\"urls\": [...]}: status, response time and TLS expiry, no browser)"},"frequencyText":{"type":"string"},"hour_utc":{"anyOf":[{"type":"integer"},{"type":"null"}]},"request":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"}},"additionalProperties":true},"enabled":{"type":"boolean"},"next_run_at":{"type":"string"},"last_run_at":{"type":["string","null"]},"last_run_id":{"type":["string","null"]},"last_error":{"type":["string","null"]}},"required":["id","user_id","name","frequency","frequencyText","hour_utc","request","enabled","next_run_at","last_run_at","last_run_id","last_error"],"additionalProperties":false},"CreateSchedule":{"type":"object","properties":{"name":{"type":"string","maxLength":120},"frequency":{"type":"string","enum":["hourly","every6h","daily","weekly","every5m","every15m","every30m"],"description":"hourly, every6h, daily, weekly; or every5m, every15m, every30m for an uptime-only schedule (request {\"urls\": [...]}: status, response time and TLS expiry, no browser)"},"hourUtc":{"anyOf":[{"type":"integer","minimum":0,"maximum":23},{"type":"null"}],"description":"daily and weekly (Mondays)"},"enabled":{"type":"boolean"},"request":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"}},"additionalProperties":true,"description":"the run to repeat (same body as POST /v1/runs, incl. credentialId); under /v1/sites the URL defaults to the site"}},"required":["frequency"],"additionalProperties":false},"UpdateSchedule":{"type":"object","properties":{"name":{"type":"string","maxLength":120},"frequency":{"type":"string","enum":["hourly","every6h","daily","weekly","every5m","every15m","every30m"],"description":"hourly, every6h, daily, weekly; or every5m, every15m, every30m for an uptime-only schedule (request {\"urls\": [...]}: status, response time and TLS expiry, no browser)"},"hourUtc":{"anyOf":[{"type":"integer","minimum":0,"maximum":23},{"type":"null"}],"description":"daily and weekly (Mondays)"},"enabled":{"type":"boolean"},"request":{"type":"object","properties":{"mode":{"type":"string","enum":["audit","compare"],"description":"audit (one URL) or compare (two or more); default audit"},"urls":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":5,"description":"one URL for audit, two for compare"},"names":{"type":"array","items":{"type":"string","maxLength":60}},"tags":{"type":"array","items":{"type":"string","maxLength":40},"description":"per environment: \"\", \"production\" or \"non-production\""},"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"browser":{"type":"boolean"},"crawl":{"type":"boolean"},"configFile":{"type":"string","description":"admins only: the config file the server was started with"},"against":{"type":"string","maxLength":80,"description":"audit only: \"latest\" or an earlier run id; makes a before/after run"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"lighthouse":{"type":"boolean","description":"Lighthouse scores for one desktop and one phone profile on the first sampled pages; adds ~15 s per page"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5,"description":"pages Lighthouse samples (default 2)"},"load":{"type":"boolean","description":"load test; needs ownTarget, and the \"load\" scope for tokens"},"loadProfile":{"type":"string","enum":["smoke","ramp","spike","soak","breakpoint"]},"active":{"type":"boolean","description":"active security probes; needs ownTarget, and the \"active\" scope for tokens"},"ownTarget":{"type":"boolean"},"credentialId":{"type":"integer","exclusiveMinimum":true,"minimum":0,"description":"a saved credential (see /v1/credentials) used to sign in to the site"},"callbackUrl":{"type":"string","format":"uri","maxLength":2000,"description":"POSTed a signed JSON payload when the run finishes or fails"},"callbackSecret":{"type":"string","minLength":8,"maxLength":200,"description":"HMAC-SHA256 key for the X-BangBang-Signature header"},"tests":{"anyOf":[{"type":"string","const":"all"},{"type":"array","items":{"type":"string","maxLength":40},"minItems":1,"maxItems":9}],"description":"\"all\" (default) or a list of performance, security, seo, accessibility, responsive, content, runtime, privacy; only the selected tests run, are scored and get report tabs"},"flows":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":60},"template":{"type":"string","enum":["login","search","checkout"]},"options":{"type":"object","additionalProperties":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"steps":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","enum":["goto","click","fill","select","press","wait","expectText","expectUrl","expectVisible","screenshot"]},"selector":{"type":"string","minLength":1,"maxLength":300},"value":{"anyOf":[{"type":"string","maxLength":500},{"type":"object","properties":{"credential":{"type":"integer","exclusiveMinimum":true,"minimum":0},"field":{"type":"string","enum":["username","password"]}},"required":["credential","field"],"additionalProperties":false}]}},"required":["action"],"additionalProperties":false},"maxItems":20},"start":{"type":"string","minLength":1,"maxLength":500},"devices":{"type":"array","items":{"type":"string","enum":["phone","tablet","laptop","desktop"]},"minItems":1,"maxItems":4},"script":{"not":{}}},"required":["name"],"additionalProperties":false},"maxItems":5,"description":"user journeys run in each environment with the runtime test: a template (login, search, checkout) with options, or up to 20 declarative steps (goto, click, fill, select, press, wait up to 10 s, expectText, expectUrl, expectVisible, screenshot). Navigation stays on the run's own hosts; a fill value may be {\"credential\": <saved basic credential id>, \"field\": \"username\"|\"password\"}. Scripts are refused."},"api":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500,"description":"a path on the site, e.g. /api/status"},"method":{"type":"string","const":"GET","description":"GET only: a run never changes data on the site"},"ignore":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":50,"description":"field paths left out of the cross-environment diff (a.b, items[0].id, meta.*)"},"schema":{"anyOf":[{"type":"object","properties":{"openapi":{"type":"string","maxLength":2000,"description":"the OpenAPI document: a path on the site or a URL on one of the run's hosts"},"path":{"type":"string","maxLength":500,"description":"operation path as written in the document, e.g. /users/{id}; default: the endpoint path"},"method":{"type":"string","maxLength":8}},"required":["openapi"],"additionalProperties":false},{"type":"object","additionalProperties":{},"description":"an inline JSON Schema (up to 64 KB)"}]}},"required":["path"],"additionalProperties":false},"maxItems":10,"description":"JSON endpoints checked per environment with the runtime test (errors, API-010 schema mismatches, API-011 undocumented status codes) and diffed across environments with content"},"expect":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200},{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":2000,"description":"a path on the site (/about) or a URL on one of the run's hosts"},"title":{"type":"string","maxLength":1000},"description":{"type":"string","maxLength":1000},"canonical":{"type":"string","maxLength":1000},"h1":{"type":"string","maxLength":1000}},"required":["path"],"additionalProperties":false},"maxItems":200}},"required":["pages"],"additionalProperties":false}],"description":"approved metadata per page, checked with the seo test (SEO-065: exact comparison after trimming and collapsing whitespace); listed pages are always tested. {\"pages\": [...]} is accepted too"},"redirects":{"type":"array","items":{"type":"object","properties":{"from":{"type":"string","maxLength":2000,"description":"old address: a path or a URL on one of the run's hosts"},"to":{"type":"string","maxLength":2000,"description":"agreed target: a path or a URL on one of the run's hosts"},"status":{"type":"integer","description":"expected status: 301 (default), 302, 307 or 308"}},"required":["from","to"],"additionalProperties":false},"maxItems":500,"description":"redirect map checked with the runtime test: HTTP-080 wrong status, HTTP-081 wrong target or target not 200, HTTP-082 chain, HTTP-083 loop, HTTP-084 summary"}},"additionalProperties":true,"description":"the run to repeat (same body as POST /v1/runs, incl. credentialId); under /v1/sites the URL defaults to the site"}},"additionalProperties":false,"description":"request is merged over the saved one; changing frequency, hourUtc or enabling recomputes the next firing"},"SettingsResponse":{"type":"object","properties":{"project":{"type":"string"},"settings":{"anyOf":[{"type":"object","properties":{"defaults":{"type":"object","properties":{"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"crawl":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"lighthouse":{"type":"boolean"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5}},"additionalProperties":false},"auth":{"anyOf":[{"anyOf":[{"type":"object","properties":{"type":{"type":"string","const":"basic"},"username":{"type":"string","minLength":1},"password":{"type":"string"}},"required":["type","username","password"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"header"},"name":{"type":"string","minLength":1},"value":{"type":"string"}},"required":["type","name","value"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"cookie"},"cookie":{"type":"string","minLength":1}},"required":["type","cookie"],"additionalProperties":false}]},{"type":"null"}]},"credentialId":{"anyOf":[{"type":"integer","exclusiveMinimum":true,"minimum":0},{"type":"null"}]},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":4000}},"pages":{"type":"object","properties":{"list":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":500},"include":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"exclude":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100}},"additionalProperties":false},"normalize":{"type":"object","properties":{"ignoreSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"maskSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"ignoreTextPatterns":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"blockThirdParty":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":200}},"additionalProperties":false},"notes":{"type":"string","maxLength":5000}},"additionalProperties":false},{"type":"null"}]}},"required":["project","settings"],"additionalProperties":false},"ProjectSettings":{"type":"object","properties":{"defaults":{"type":"object","properties":{"devices":{"type":"string","enum":["quick","standard","full","none"]},"maxPages":{"type":"integer","minimum":1,"maximum":500},"crawl":{"type":"boolean"},"dns":{"type":"boolean"},"sensitivePaths":{"type":"boolean"},"screenshots":{"type":"boolean"},"a11y":{"type":"boolean"},"lighthouse":{"type":"boolean"},"lighthousePages":{"type":"integer","minimum":1,"maximum":5}},"additionalProperties":false},"auth":{"anyOf":[{"anyOf":[{"type":"object","properties":{"type":{"type":"string","const":"basic"},"username":{"type":"string","minLength":1},"password":{"type":"string"}},"required":["type","username","password"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"header"},"name":{"type":"string","minLength":1},"value":{"type":"string"}},"required":["type","name","value"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","const":"cookie"},"cookie":{"type":"string","minLength":1}},"required":["type","cookie"],"additionalProperties":false}]},{"type":"null"}]},"credentialId":{"anyOf":[{"type":"integer","exclusiveMinimum":true,"minimum":0},{"type":"null"}]},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":4000}},"pages":{"type":"object","properties":{"list":{"type":"array","items":{"type":"string","maxLength":2000},"maxItems":500},"include":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"exclude":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100}},"additionalProperties":false},"normalize":{"type":"object","properties":{"ignoreSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"maskSelectors":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"ignoreTextPatterns":{"type":"array","items":{"type":"string","maxLength":500},"maxItems":100},"blockThirdParty":{"type":"array","items":{"type":"string","maxLength":200},"maxItems":200}},"additionalProperties":false},"notes":{"type":"string","maxLength":5000}},"additionalProperties":false},"IgnoreCreate":{"type":"object","properties":{"fingerprint":{"type":"string"},"ruleId":{"type":"string"},"page":{"type":"string"},"scope":{"type":"string","enum":["finding","rule-page","rule"]},"reason":{"type":"string","maxLength":500},"until":{"type":"string","description":"YYYY-MM-DD or ISO time; the ignore expires then"},"runId":{"type":"string","description":"fills ruleId and page from this run's finding"}},"required":["reason"],"additionalProperties":false},"IgnoreRemove":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"fingerprints":{"type":"array","items":{"type":"string"}}},"additionalProperties":false},"Fingerprints":{"type":"object","properties":{"fingerprints":{"type":"array","items":{"type":"string"},"minItems":1},"reason":{"type":"string","maxLength":500},"runId":{"type":"string"}},"required":["fingerprints"],"additionalProperties":false},"UpdateRun":{"type":"object","properties":{"notes":{"anyOf":[{"type":"string","maxLength":5000},{"type":"null"}],"description":"free text; null or \"\" clears"},"tags":{"anyOf":[{"type":"array","items":{"type":"string","maxLength":40},"maxItems":12},{"type":"string","maxLength":500}],"description":"replaces the tags; lower-cased, at most 12"},"visibility":{"type":"string","enum":["private","public"],"description":"legacy flag, super admins only (scope shares:write); it no longer opens a run to other users"}},"additionalProperties":false},"AppEntry":{"type":"object","properties":{"id":{"type":"integer"},"app_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"description":"the external app it belongs to; null = global entry"},"kind":{"type":"string","enum":["domain","ip","cidr"]},"value":{"type":"string"},"label":{"type":["string","null"]},"allow_browser":{"type":"boolean"},"enabled":{"type":"boolean"},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"resolved":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"domain entries: public addresses it currently resolves to"},"resolvedAt":{"type":["string","null"]},"dnsError":{"type":["string","null"]}},"required":["id","app_id","kind","value","label","allow_browser","enabled","created_by","created_at","resolved","resolvedAt","dnsError"],"additionalProperties":false},"AppEntryCreate":{"type":"object","properties":{"value":{"type":"string","minLength":1,"maxLength":300,"description":"domain or URL (https://app.example/ becomes app.example), IPv4/IPv6 address or CIDR range"},"kind":{"type":"string","enum":["domain","ip","cidr"],"description":"detected from the value when left out"},"label":{"anyOf":[{"type":"string","maxLength":190},{"type":"null"}]},"allowBrowser":{"type":"boolean","description":"domain entries: also accept browser calls whose Origin is that domain, and allow it as a CORS origin"},"enabled":{"type":"boolean"}},"required":["value"],"additionalProperties":false},"AppEntryUpdate":{"type":"object","properties":{"label":{"anyOf":[{"type":"string","maxLength":190},{"type":"null"}]},"allowBrowser":{"type":"boolean"},"enabled":{"type":"boolean"},"appId":{"anyOf":[{"type":"integer","exclusiveMinimum":true,"minimum":0},{"type":"null"}],"description":"move the entry to this app; null makes it a global entry"}},"additionalProperties":false},"AppCheck":{"type":"object","properties":{"ip":{"type":"string"},"origin":{"type":["string","null"]},"allowed":{"type":"boolean"},"enforced":{"type":"boolean","description":"false while the list has no enabled entry"},"matched":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"app_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"description":"the external app it belongs to; null = global entry"},"kind":{"type":"string","enum":["domain","ip","cidr"]},"value":{"type":"string"},"label":{"type":["string","null"]},"allow_browser":{"type":"boolean"},"enabled":{"type":"boolean"},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"resolved":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"domain entries: public addresses it currently resolves to"},"resolvedAt":{"type":["string","null"]},"dnsError":{"type":["string","null"]}},"required":["id","app_id","kind","value","label","allow_browser","enabled","created_by","created_at","resolved","resolvedAt","dnsError"],"additionalProperties":false},{"type":"null"}]},"app":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"additionalProperties":false},{"type":"null"}],"description":"the app whose entry matched"},"reason":{"type":"string"}},"required":["ip","origin","allowed","enforced","matched","app","reason"],"additionalProperties":false},"ExternalApp":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"description":{"type":["string","null"]},"enabled":{"type":"boolean"},"owner_user_id":{"type":"integer"},"owner":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"email":{"type":"string"},"name":{"type":"string"},"role":{"type":"string"}},"required":["id","email","name","role"],"additionalProperties":false},{"type":"null"}]},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"last_revealed_at":{"type":["string","null"]},"entries":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"app_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"description":"the external app it belongs to; null = global entry"},"kind":{"type":"string","enum":["domain","ip","cidr"]},"value":{"type":"string"},"label":{"type":["string","null"]},"allow_browser":{"type":"boolean"},"enabled":{"type":"boolean"},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"resolved":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"domain entries: public addresses it currently resolves to"},"resolvedAt":{"type":["string","null"]},"dnsError":{"type":["string","null"]}},"required":["id","app_id","kind","value","label","allow_browser","enabled","created_by","created_at","resolved","resolvedAt","dnsError"],"additionalProperties":false}},"key":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"prefix":{"type":"string"},"masked":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string"},"last_used_at":{"type":["string","null"]},"expires_at":{"type":["string","null"]}},"required":["id","prefix","masked","scopes","created_at","last_used_at","expires_at"],"additionalProperties":false},{"type":"null"}],"description":"the current key, masked; never the key itself"}},"required":["id","name","description","enabled","owner_user_id","owner","created_by","created_at","last_revealed_at","entries","key"],"additionalProperties":false},"AppCreate":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":120},"description":{"anyOf":[{"type":"string","maxLength":500},{"type":"null"}]},"owner":{"anyOf":[{"type":"string","maxLength":190},{"type":"integer","exclusiveMinimum":true,"minimum":0}],"description":"email or user id of the account the app acts as; default: you"},"entries":{"type":"array","items":{"type":"object","properties":{"value":{"type":"string","minLength":1,"maxLength":300,"description":"domain or URL (https://app.example/ becomes app.example), IPv4/IPv6 address or CIDR range"},"kind":{"type":"string","enum":["domain","ip","cidr"],"description":"detected from the value when left out"},"label":{"anyOf":[{"type":"string","maxLength":190},{"type":"null"}]},"allowBrowser":{"type":"boolean","description":"domain entries: also accept browser calls whose Origin is that domain, and allow it as a CORS origin"}},"required":["value"],"additionalProperties":false},"maxItems":50,"description":"first domains, IP addresses or ranges"},"entry":{"type":"string","maxLength":300,"description":"shorthand for one first entry"},"allowBrowser":{"type":"boolean","description":"with entry: also accept browser calls from that domain"},"scopes":{"type":"array","items":{"type":"string","enum":["runs:read","runs:write","shares:write","admin","load","active"]},"minItems":1,"description":"default runs:read runs:write shares:write; admin, load and active only when listed"},"expiresDays":{"anyOf":[{"type":"integer","minimum":1,"maximum":3650},{"type":"null"}],"description":"default: no expiry"},"generateKey":{"type":"boolean","description":"default true: create the key now and return it once"}},"required":["name"],"additionalProperties":false},"AppUpdate":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":120},"description":{"anyOf":[{"type":"string","maxLength":500},{"type":"null"}]},"enabled":{"type":"boolean","description":"a disabled app's key is refused and its entries stop counting"},"owner":{"anyOf":[{"type":"string","maxLength":190},{"type":"integer","exclusiveMinimum":true,"minimum":0}],"description":"only while the app has no active key"}},"additionalProperties":false},"AppKeyIssue":{"type":"object","properties":{"scopes":{"type":"array","items":{"type":"string","enum":["runs:read","runs:write","shares:write","admin","load","active"]},"minItems":1,"description":"default: the old key's scopes, else runs:read runs:write shares:write"},"expiresDays":{"anyOf":[{"type":"integer","minimum":1,"maximum":3650},{"type":"null"}]},"graceHours":{"type":"integer","minimum":0,"maximum":168,"description":"rotation: keep the old key valid this many hours (default 0: revoked at once)"}},"additionalProperties":false},"IssuedAppKey":{"type":"object","properties":{"id":{"type":"integer"},"key":{"type":"string","description":"the full key; shown once here, later only via GET /admin/apps/{id}/key"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"expiresAt":{"type":["string","null"]}},"required":["id","key","prefix","scopes","expiresAt"],"additionalProperties":false},"AppCreated":{"type":"object","properties":{"app":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"description":{"type":["string","null"]},"enabled":{"type":"boolean"},"owner_user_id":{"type":"integer"},"owner":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"email":{"type":"string"},"name":{"type":"string"},"role":{"type":"string"}},"required":["id","email","name","role"],"additionalProperties":false},{"type":"null"}]},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"last_revealed_at":{"type":["string","null"]},"entries":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"app_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"description":"the external app it belongs to; null = global entry"},"kind":{"type":"string","enum":["domain","ip","cidr"]},"value":{"type":"string"},"label":{"type":["string","null"]},"allow_browser":{"type":"boolean"},"enabled":{"type":"boolean"},"created_by":{"type":["string","null"]},"created_at":{"type":"string"},"resolved":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"domain entries: public addresses it currently resolves to"},"resolvedAt":{"type":["string","null"]},"dnsError":{"type":["string","null"]}},"required":["id","app_id","kind","value","label","allow_browser","enabled","created_by","created_at","resolved","resolvedAt","dnsError"],"additionalProperties":false}},"key":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"prefix":{"type":"string"},"masked":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string"},"last_used_at":{"type":["string","null"]},"expires_at":{"type":["string","null"]}},"required":["id","prefix","masked","scopes","created_at","last_used_at","expires_at"],"additionalProperties":false},{"type":"null"}],"description":"the current key, masked; never the key itself"}},"required":["id","name","description","enabled","owner_user_id","owner","created_by","created_at","last_revealed_at","entries","key"],"additionalProperties":false},"key":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"key":{"type":"string","description":"the full key; shown once here, later only via GET /admin/apps/{id}/key"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"expiresAt":{"type":["string","null"]}},"required":["id","key","prefix","scopes","expiresAt"],"additionalProperties":false},{"type":"null"}]}},"required":["app","key"],"additionalProperties":false},"AppKeyReveal":{"type":"object","properties":{"appId":{"type":"integer"},"name":{"type":"string"},"key":{"type":"string"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string"},"last_used_at":{"type":["string","null"]},"expires_at":{"type":["string","null"]},"revealedAt":{"type":"string"}},"required":["appId","name","key","prefix","scopes","created_at","last_used_at","expires_at","revealedAt"],"additionalProperties":false}}},"paths":{"/v1/health":{"get":{"summary":"Liveness, database status and running job count","tags":["health"],"operationId":"getHealth","security":[],"responses":{"200":{"description":"success"}}}},"/v1/openapi.json":{"get":{"summary":"This OpenAPI document (public)","tags":["docs"],"operationId":"getOpenapiJson","security":[],"responses":{"200":{"description":"success"}}}},"/v1/docs":{"get":{"summary":"This reference as an HTML page (public)","tags":["docs"],"operationId":"getDocs","security":[],"responses":{"200":{"description":"success"}}}},"/v1/check":{"post":{"summary":"Start a free website check of a public site (no sign-in): a few pages, quick devices, passive tests only. Guests get BANGBANG_FREE_CHECKS_PER_DAY (default 3) per client address per day. Body: {url}. Returns {id, url} where url is the progress page /check/{id}","tags":["check"],"operationId":"postCheck","security":[],"parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"202":{"description":"success"},"400":{"description":"no address, or not a public website","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"the daily limit of free checks for this address is used up (body has signup: true)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"checks unavailable (database not connected)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/check/{id}":{"get":{"summary":"Progress and, once done, the result of a free check: status, percent, stage, scores, counts, the top findings and the report link. Visible to whoever started it (same browser or account)","tags":["check"],"operationId":"getCheckById","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"404":{"description":"no such check, or started by someone else","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/tests":{"get":{"summary":"The test types a run can be limited to (public): name, what it checks, the analyzers it runs and the opt-in modules it gates. Pass names as tests when starting a run","tags":["tests"],"operationId":"getTests","security":[],"responses":{"200":{"description":"success"}}}},"/v1/sites":{"get":{"summary":"Sites (projects) you can see: base URL, last run, average score, verdict, finding counts, schedule count","tags":["sites"],"operationId":"getSites","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Site"}}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/lookup":{"get":{"summary":"Resolve a URL to its site key; 404 (with the computed key) when it has no runs, settings or schedules yet","tags":["sites"],"operationId":"getSitesLookup","parameters":[{"name":"url","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Site"}}}},"401":{"description":"not signed in or bad token"},"404":{"description":"unknown site; the body still carries project, host and site (SiteLookupMiss)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/sites/{site}":{"get":{"summary":"Site summary: latest run and scores, score trend, open findings by severity, settings (masked), schedules, active jobs. {site} is a hostname or a URL-encoded URL","tags":["sites"],"operationId":"getSitesBySite","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"trend","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteSummary"}}}},"401":{"description":"not signed in or bad token"},"404":{"description":"no such site, or not visible to this token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/sites/{site}/runs":{"get":{"summary":"Runs of the site, newest first (cursor pagination)","tags":["sites"],"operationId":"getSitesBySiteRuns","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"schema":{"type":"string"}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string"}},{"name":"before","in":"query","required":false,"schema":{"type":"string"}},{"name":"status","in":"query","required":false,"schema":{"type":"string"}},{"name":"mode","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteRunsPage"}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Start an audit of the site; same options, validation, scopes, limits, idempotency and callbacks as POST /v1/runs","tags":["sites"],"operationId":"postSitesBySiteRuns","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteRun"}}}},"responses":{"202":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunAccepted"}}}},"400":{"description":"invalid input or a URL not on the site","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"},"403":{"description":"token scope, IP or host allowlist refused","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"site not visible to this token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Idempotency-Key reused with a different body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"too many runs in progress or hourly limit reached","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/sites/{site}/runs/latest":{"get":{"summary":"The latest finished run of the site","tags":["sites"],"operationId":"getSitesBySiteRunsLatest","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Run"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/{site}/findings":{"get":{"summary":"Findings of the latest finished run (or ?run=): status open (default), new or all; severity=high means high and above, a comma list is exact; test (performance, security, seo, accessibility, responsive, content, runtime; comma list), category, ruleId, q; cursor pagination","tags":["sites"],"operationId":"getSitesBySiteFindings","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"run","in":"query","required":false,"schema":{"type":"string"}},{"name":"severity","in":"query","required":false,"schema":{"type":"string"}},{"name":"test","in":"query","required":false,"schema":{"type":"string"}},{"name":"category","in":"query","required":false,"schema":{"type":"string"}},{"name":"ruleId","in":"query","required":false,"schema":{"type":"string"}},{"name":"status","in":"query","required":false,"schema":{"type":"string"}},{"name":"q","in":"query","required":false,"schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"schema":{"type":"string"}},{"name":"cursor","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteFindingsPage"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/{site}/performance":{"get":{"summary":"Lighthouse performance over time (PageSpeed-style): category scores and lab metrics per sample, the latest one and its change against the previous sample of the same page. Needs runs with lighthouse: true","tags":["sites"],"operationId":"getSitesBySitePerformance","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"form_factor","in":"query","required":false,"schema":{"type":"string"}},{"name":"page","in":"query","required":false,"schema":{"type":"string"}},{"name":"limit","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SitePerformance"}}}},"400":{"description":"form_factor is not mobile or desktop","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"},"404":{"description":"no such site, or not visible to this token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"MySQL not connected","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/sites/{site}/settings":{"get":{"summary":"Your run settings for the site, secrets masked","tags":["settings"],"operationId":"getSitesBySiteSettings","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SettingsResponse"}}}},"401":{"description":"not signed in or bad token"}}},"put":{"summary":"Replace the site's settings (send the mask back to keep a secret)","tags":["settings"],"operationId":"putSitesBySiteSettings","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectSettings"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SettingsResponse"}}}},"401":{"description":"not signed in or bad token"}}},"patch":{"summary":"Merge into the site's settings (JSON merge patch: nested objects merge, null removes, arrays replace)","tags":["settings"],"operationId":"patchSitesBySiteSettings","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectSettings"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SettingsResponse"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Clear the site's settings","tags":["settings"],"operationId":"deleteSitesBySiteSettings","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/{site}/schedules":{"get":{"summary":"Schedules that test the site","tags":["schedules"],"operationId":"getSitesBySiteSchedules","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Schedule"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Create a schedule for the site; the request URL defaults to the site","tags":["schedules"],"operationId":"postSitesBySiteSchedules","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSchedule"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Schedule"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/{site}/ignores":{"get":{"summary":"Ignore rules of the site, each with an active flag","tags":["baseline"],"operationId":"getSitesBySiteIgnores","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Ignore a finding, a rule on a page or a rule site-wide (reason required)","tags":["baseline"],"operationId":"postSitesBySiteIgnores","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IgnoreCreate"}}}},"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Remove ignore rules by id or fingerprint (body or ?ids= / ?fingerprints=)","tags":["baseline"],"operationId":"deleteSitesBySiteIgnores","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IgnoreRemove"}}}},"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/sites/{site}/accepted":{"get":{"summary":"Findings accepted into the site's baseline","tags":["baseline"],"operationId":"getSitesBySiteAccepted","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Accept findings into the baseline","tags":["baseline"],"operationId":"postSitesBySiteAccepted","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Fingerprints"}}}},"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Remove findings from the baseline (body or ?fingerprints=)","tags":["baseline"],"operationId":"deleteSitesBySiteAccepted","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Fingerprints"}}}},"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}":{"patch":{"summary":"Update notes, tags and visibility of a run in one call (visibility: admins and super admins only, scope shares:write; it no longer opens a run to other users)","tags":["runs"],"operationId":"patchRunsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateRun"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Run"}}}},"401":{"description":"not signed in or bad token"}}},"get":{"summary":"One run","tags":["runs"],"operationId":"getRunsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Run"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Delete a run","tags":["runs"],"operationId":"deleteRunsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/schedules/{id}":{"get":{"summary":"One schedule","tags":["schedules"],"operationId":"getSchedulesById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Schedule"}}}},"401":{"description":"not signed in or bad token"}}},"patch":{"summary":"Update a schedule: name, frequency, hourUtc, request (merged) or enabled","tags":["schedules"],"operationId":"patchSchedulesById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSchedule"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Schedule"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Delete a schedule","tags":["schedules"],"operationId":"deleteSchedulesById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs":{"get":{"summary":"List runs visible to you","tags":["runs"],"operationId":"getRuns","parameters":[{"name":"project","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Run"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Start a run (asynchronous). Honours Idempotency-Key. With sign-in on, load tests (load) and active probes (active) need every target domain verified by the caller (see /domains; super admins exempt).","tags":["runs"],"operationId":"postRuns","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartRun"}}}},"responses":{"202":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunAccepted"}}}},"400":{"description":"invalid input, including the removed server test or an ssh block","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"},"403":{"description":"token scope, IP or host allowlist refused, or load/active against a domain the caller has not verified","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Idempotency-Key reused with a different body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"too many runs in progress or hourly limit reached","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/runs/preview":{"post":{"summary":"Validate a run request and return the resolved configuration without starting it","tags":["runs"],"operationId":"postRunsPreview","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartRun"}}}},"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/cancel":{"post":{"summary":"Stop a queued or running run: its pipeline is aborted and the run is marked failed. Returns {ok, id, status}","tags":["runs"],"operationId":"postRunsByIdCancel","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"},"404":{"description":"no such running job, or not visible to you","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"the run already finished or failed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/runs/{id}/findings":{"get":{"summary":"Findings of a run; test=seo (or a comma list) keeps those test types","tags":["runs"],"operationId":"getRunsByIdFindings","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"severity","in":"query","required":false,"schema":{"type":"string"}},{"name":"category","in":"query","required":false,"schema":{"type":"string"}},{"name":"test","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Finding"}}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/tests":{"get":{"summary":"Each test type's result in the run: selected, has data, its scores, finding counts by severity, and the URL of its detail","tags":["tests"],"operationId":"getRunsByIdTests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/tests/{test}":{"get":{"summary":"One test type in the run: scores, findings, and per page, environment and device the evidence it was judged on (performance: vitals and Lighthouse; security: headers, cookies, TLS; seo: meta and headings; accessibility: axe violations; responsive: screenshots and layout issues; content: screenshots and diff images; runtime: status, redirects, console errors, failed requests). Files are artifact URLs","tags":["tests"],"operationId":"getRunsByIdTestsByTest","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"test","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"},"404":{"description":"unknown test or run","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/runs/{id}/pages":{"get":{"summary":"Pages of a run with per-environment status and finding counts","tags":["runs"],"operationId":"getRunsByIdPages","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/PageSummary"}}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/pages/{pageId}":{"get":{"summary":"Capture summary of one page (pageId is the index from /pages or the URL-encoded path)","tags":["runs"],"operationId":"getRunsByIdPagesByPageId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"pageId","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/artifacts":{"get":{"summary":"Screenshots, diffs and report files of a run","tags":["runs"],"operationId":"getRunsByIdArtifacts","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Artifact"}}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/artifacts/{path}":{"get":{"summary":"Download one artifact (path relative to the run folder)","tags":["runs"],"operationId":"getRunsByIdArtifactsByPath","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"path","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/regression":{"get":{"summary":"New, resolved and persisting findings against your previous run of the project","tags":["runs"],"operationId":"getRunsByIdRegression","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"against","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/brief":{"get":{"summary":"Plain-text client brief","tags":["runs"],"operationId":"getRunsByIdBrief","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/export/{format}":{"get":{"summary":"Download the run as json, findings, md, html, sarif, junit, pdf or zip","tags":["runs"],"operationId":"getRunsByIdExportByFormat","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"format","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/meta":{"put":{"summary":"Set notes and tags on a run","tags":["runs"],"operationId":"putRunsByIdMeta","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/visibility":{"post":{"summary":"Set the legacy public/private flag (admins and super admins only; scope shares:write). It no longer opens a run to other users: customers only ever see their own runs; use a share link instead","tags":["runs"],"operationId":"postRunsByIdVisibility","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/shares":{"get":{"summary":"Public share links of a run, with the sections each one shows","tags":["runs"],"operationId":"getRunsByIdShares","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Share"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Create a public share link limited to some report sections (scope shares:write)","tags":["runs"],"operationId":"postRunsByIdShares","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareCreate"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Share"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/public-link":{"post":{"summary":"The run's one public link (no sign-in needed, external view, all sections): reused when it exists; password or expiresDays make a separate link (scope shares:write)","tags":["runs"],"operationId":"postRunsByIdPublicLink","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Share"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/runs/{id}/findings/{fingerprint}/comments":{"get":{"summary":"Comments on one finding, including those left on the same finding in earlier runs","tags":["runs"],"operationId":"getRunsByIdFindingsByFingerprintComments","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"fingerprint","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Comment on a finding; decision accept or ignore also accepts or ignores it","tags":["runs"],"operationId":"postRunsByIdFindingsByFingerprintComments","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"fingerprint","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"201":{"description":"success"},"400":{"description":"empty comment","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/comments/{id}":{"delete":{"summary":"Delete a comment (its author, an admin or a super admin)","tags":["comments"],"operationId":"deleteCommentsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/shares/{id}":{"patch":{"summary":"Change a link's sections, expiry, audience or password; the URL stays (owner or admin; scope shares:write)","tags":["runs"],"operationId":"patchSharesById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUpdate"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Share"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Revoke a share link (scope shares:write)","tags":["runs"],"operationId":"deleteSharesById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/compare":{"post":{"summary":"Regression diff of two runs you can see: added, resolved and persisting findings, score deltas","tags":["runs"],"operationId":"postCompare","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Compare"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompareResult"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/snapshots":{"get":{"summary":"Your stored snapshots","tags":["snapshots"],"operationId":"getSnapshots","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Snapshot"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Store a finished run's captures as a named snapshot","tags":["snapshots"],"operationId":"postSnapshots","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSnapshot"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Snapshot"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/snapshots/{name}":{"delete":{"summary":"Delete a snapshot","tags":["snapshots"],"operationId":"deleteSnapshotsByName","parameters":[{"name":"name","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/credentials":{"get":{"summary":"Your saved site credentials (secrets are never returned)","tags":["credentials"],"operationId":"getCredentials","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Credential"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Save a credential; the secret is encrypted at rest (AES-256-GCM)","tags":["credentials"],"operationId":"postCredentials","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCredential"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Credential"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/credentials/{id}":{"get":{"summary":"One credential, without its secret","tags":["credentials"],"operationId":"getCredentialsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Credential"}}}},"401":{"description":"not signed in or bad token"}}},"put":{"summary":"Rename or replace the secret","tags":["credentials"],"operationId":"putCredentialsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCredential"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Credential"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Delete a credential","tags":["credentials"],"operationId":"deleteCredentialsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/previous-runs":{"get":{"summary":"Earlier finished runs of a site, for before/after","tags":["runs"],"operationId":"getPreviousRuns","parameters":[{"name":"url","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/jobs":{"get":{"summary":"Jobs known to this server, with status and progress","tags":["runs"],"operationId":"getJobs","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Job"}}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/jobs/{id}/events":{"get":{"summary":"Server-sent events: progress, done, failed (text/event-stream)","tags":["runs"],"operationId":"getJobsByIdEvents","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/baseline/accept":{"post":{"summary":"Accept findings into the project baseline","tags":["baseline"],"operationId":"postBaselineAccept","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/baseline/remove":{"post":{"summary":"Remove findings from the project baseline","tags":["baseline"],"operationId":"postBaselineRemove","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/baseline/ignore":{"post":{"summary":"Ignore a finding, a rule on a page or a rule project-wide (reason required, optional until date)","tags":["baseline"],"operationId":"postBaselineIgnore","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/baseline/unignore":{"post":{"summary":"Remove ignore rules by id, fingerprint or rule id","tags":["baseline"],"operationId":"postBaselineUnignore","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/baseline":{"get":{"summary":"Accepted and ignored findings of a project (?project=)","tags":["baseline"],"operationId":"getBaseline","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/projects/{project}/history.csv":{"get":{"summary":"One CSV row per run you can see for the project","tags":["settings"],"operationId":"getProjectsByProjectHistoryCsv","parameters":[{"name":"project","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/projects/{project}/settings":{"get":{"summary":"Per-project run settings, secrets masked","tags":["settings"],"operationId":"getProjectsByProjectSettings","parameters":[{"name":"project","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"put":{"summary":"Save per-project run settings; secrets are encrypted at rest","tags":["settings"],"operationId":"putProjectsByProjectSettings","parameters":[{"name":"project","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Clear per-project run settings","tags":["settings"],"operationId":"deleteProjectsByProjectSettings","parameters":[{"name":"project","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/project-settings":{"get":{"summary":"Resolve the project for a URL and return its settings","tags":["settings"],"operationId":"getProjectSettings","parameters":[{"name":"url","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/schedules":{"get":{"summary":"Your schedules","tags":["schedules"],"operationId":"getSchedules","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Create a schedule that repeats a run request","tags":["schedules"],"operationId":"postSchedules","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"201":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/schedules/{id}/toggle":{"post":{"summary":"Pause or resume a schedule","tags":["schedules"],"operationId":"postSchedulesByIdToggle","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/schedules/{id}/run-now":{"post":{"summary":"Start the scheduled run immediately (202); an uptime-only schedule checks its URLs now and returns the results (200)","tags":["schedules"],"operationId":"postSchedulesByIdRunNow","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"202":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/uptime":{"get":{"summary":"Uptime-only schedules you can see: per URL the latest status, response time, TLS days to expiry and availability over the last 24 hours","tags":["uptime"],"operationId":"getUptime","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/notify-targets":{"get":{"summary":"Your notification targets","tags":["notify-targets"],"operationId":"getNotifyTargets","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Add a Slack, Teams, webhook or email target","tags":["notify-targets"],"operationId":"postNotifyTargets","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"201":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/notify-targets/{id}":{"delete":{"summary":"Remove a notification target","tags":["notify-targets"],"operationId":"deleteNotifyTargetsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/notify-targets/{id}/test":{"post":{"summary":"Send a sample notification","tags":["notify-targets"],"operationId":"postNotifyTargetsByIdTest","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/notify-targets/{id}/toggle":{"post":{"summary":"Pause or resume a notification target","tags":["notify-targets"],"operationId":"postNotifyTargetsByIdToggle","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/digest":{"get":{"summary":"Your weekly digest settings","tags":["digest"],"operationId":"getDigest","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"put":{"summary":"Save weekly digest settings","tags":["digest"],"operationId":"putDigest","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/digest/send-now":{"post":{"summary":"Email the digest now","tags":["digest"],"operationId":"postDigestSendNow","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/digest/preview":{"get":{"summary":"The digest as HTML","tags":["digest"],"operationId":"getDigestPreview","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/activity":{"get":{"summary":"Jobs with progress, next scheduled runs, slots in use, uptime and memory","tags":["activity"],"operationId":"getActivity","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/overview":{"get":{"summary":"Every user with runs, schedules, tokens and targets (administrators; scope admin)","tags":["admin"],"operationId":"getAdminOverview","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/retention":{"get":{"summary":"Report retention overview (administrators; scope admin)","tags":["admin"],"operationId":"getAdminRetention","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/prune":{"post":{"summary":"Remove report folders past the retention policy now (administrators; scope admin)","tags":["admin"],"operationId":"postAdminPrune","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps":{"get":{"summary":"External apps with their entries and masked keys (super admins; scope admin)","tags":["admin"],"operationId":"getAdminApps","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ExternalApp"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Create an external app with optional first entries and its shared key (returned once)","tags":["admin"],"operationId":"postAdminApps","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppCreate"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppCreated"}}}},"400":{"description":"invalid name, owner, entry or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"},"409":{"description":"name or entry already used","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/admin/apps/{id}":{"get":{"summary":"One external app","tags":["admin"],"operationId":"getAdminAppsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApp"}}}},"401":{"description":"not signed in or bad token"},"404":{"description":"no such app","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"patch":{"summary":"Rename, describe, enable or disable an app (a disabled app's key is refused)","tags":["admin"],"operationId":"patchAdminAppsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppUpdate"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApp"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Delete an app: its key is revoked and its entries removed","tags":["admin"],"operationId":"deleteAdminAppsById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps/{id}/entries":{"post":{"summary":"Add a domain, URL, IP address or CIDR range to the app","tags":["admin"],"operationId":"postAdminAppsByIdEntries","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntryCreate"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntry"}}}},"400":{"description":"not a public domain, address or range","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"},"409":{"description":"already on the list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/admin/apps/{id}/entries/{entryId}":{"patch":{"summary":"Change an app's entry (label, browser access, enabled) or move it (appId)","tags":["admin"],"operationId":"patchAdminAppsByIdEntriesByEntryId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"entryId","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntryUpdate"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntry"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Remove an entry from the app","tags":["admin"],"operationId":"deleteAdminAppsByIdEntriesByEntryId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"entryId","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps/{id}/key":{"post":{"summary":"Generate the app's key, or rotate it (the old key stops working at once unless graceHours). The new key is returned once","tags":["admin"],"operationId":"postAdminAppsByIdKey","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppKeyIssue"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuedAppKey"}}}},"401":{"description":"not signed in or bad token"}}},"get":{"summary":"Reveal the app's current key (super admins only; every reveal is logged)","tags":["admin"],"operationId":"getAdminAppsByIdKey","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"action","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppKeyReveal"}}}},"401":{"description":"not signed in or bad token"},"404":{"description":"no such app, or it has no active key","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"delete":{"summary":"Revoke the app's key at once; the app keeps its entries","tags":["admin"],"operationId":"deleteAdminAppsByIdKey","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps/entries":{"get":{"summary":"Every allowlist entry, with its app_id (null = global entry)","tags":["admin"],"operationId":"getAdminAppsEntries","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AppEntry"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Add a global entry (any general key may be used from it)","tags":["admin"],"operationId":"postAdminAppsEntries","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntryCreate"}}}},"responses":{"201":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntry"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps/entries/{entryId}":{"patch":{"summary":"Change any entry, or move it to an app (appId)","tags":["admin"],"operationId":"patchAdminAppsEntriesByEntryId","parameters":[{"name":"entryId","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntryUpdate"}}}},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppEntry"}}}},"401":{"description":"not signed in or bad token"}}},"delete":{"summary":"Remove any entry","tags":["admin"],"operationId":"deleteAdminAppsEntriesByEntryId","parameters":[{"name":"entryId","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/admin/apps/check":{"get":{"summary":"Would a bearer request from this ip (default: yours) and Origin be allowed, and which app matches? appId tests that app's key","tags":["admin"],"operationId":"getAdminAppsCheck","parameters":[{"name":"ip","in":"query","required":false,"schema":{"type":"string"}},{"name":"origin","in":"query","required":false,"schema":{"type":"string"}},{"name":"appId","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppCheck"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/tokens":{"get":{"summary":"Your API tokens (super admins only; ?all=1 for every user's)","tags":["tokens"],"operationId":"getTokens","responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Token"}}}}},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Create a token (super admins, browser session only; plaintext returned once)","tags":["tokens"],"operationId":"postTokens","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateToken"}}}},"responses":{"201":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/tokens/{id}":{"delete":{"summary":"Revoke any token (super admins only)","tags":["tokens"],"operationId":"deleteTokensById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/auth/me":{"get":{"summary":"Who am I","tags":["auth"],"operationId":"getAuthMe","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}}},"/v1/domains":{"get":{"summary":"Your domain verifications: {required, domains:[{domain, token, verified, verifiedAt, method, checkedAt, lastError, record, txtNames, fileUrl}]}. required is false for admins and super admins","tags":["domains"],"operationId":"getDomains","responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"}}},"post":{"summary":"Get (or create) the verification token for a domain. Body: {host} or {url}. Publish the returned record as a DNS TXT record on one of txtNames, or the token at fileUrl (/.well-known/bangbang-verify.txt)","tags":["domains"],"operationId":"postDomains","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"400":{"description":"no host given, or a local address","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/domains/verify":{"post":{"summary":"Check DNS TXT and the well-known file now. Body: {host} or {url}. Returns the verification; error says what was missing when not verified yet","tags":["domains"],"operationId":"postDomainsVerify","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"schema":{"type":"string"},"description":"replays the first response for 24 h; a different body with the same key is 409"}],"responses":{"200":{"description":"success"},"400":{"description":"no host given, or a local address","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"not signed in or bad token"}}}},"/v1/domains/{domain}":{"get":{"summary":"One domain's verification","tags":["domains"],"operationId":"getDomainsByDomain","parameters":[{"name":"domain","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"},"404":{"description":"no verification for this domain yet","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"delete":{"summary":"Forget a domain's verification","tags":["domains"],"operationId":"deleteDomainsByDomain","parameters":[{"name":"domain","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"success"},"401":{"description":"not signed in or bad token"},"404":{"description":"not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/health":{"$ref":"#/paths/~1v1~1health"},"/api/openapi.json":{"$ref":"#/paths/~1v1~1openapi.json"},"/api/docs":{"$ref":"#/paths/~1v1~1docs"},"/api/check":{"$ref":"#/paths/~1v1~1check"},"/api/check/{id}":{"$ref":"#/paths/~1v1~1check~1{id}"},"/api/tests":{"$ref":"#/paths/~1v1~1tests"},"/api/sites":{"$ref":"#/paths/~1v1~1sites"},"/api/sites/lookup":{"$ref":"#/paths/~1v1~1sites~1lookup"},"/api/sites/{site}":{"$ref":"#/paths/~1v1~1sites~1{site}"},"/api/sites/{site}/runs":{"$ref":"#/paths/~1v1~1sites~1{site}~1runs"},"/api/sites/{site}/runs/latest":{"$ref":"#/paths/~1v1~1sites~1{site}~1runs~1latest"},"/api/sites/{site}/findings":{"$ref":"#/paths/~1v1~1sites~1{site}~1findings"},"/api/sites/{site}/performance":{"$ref":"#/paths/~1v1~1sites~1{site}~1performance"},"/api/sites/{site}/settings":{"$ref":"#/paths/~1v1~1sites~1{site}~1settings"},"/api/sites/{site}/schedules":{"$ref":"#/paths/~1v1~1sites~1{site}~1schedules"},"/api/sites/{site}/ignores":{"$ref":"#/paths/~1v1~1sites~1{site}~1ignores"},"/api/sites/{site}/accepted":{"$ref":"#/paths/~1v1~1sites~1{site}~1accepted"},"/api/runs/{id}":{"$ref":"#/paths/~1v1~1runs~1{id}"},"/api/schedules/{id}":{"$ref":"#/paths/~1v1~1schedules~1{id}"},"/api/runs":{"$ref":"#/paths/~1v1~1runs"},"/api/runs/preview":{"$ref":"#/paths/~1v1~1runs~1preview"},"/api/runs/{id}/cancel":{"$ref":"#/paths/~1v1~1runs~1{id}~1cancel"},"/api/runs/{id}/findings":{"$ref":"#/paths/~1v1~1runs~1{id}~1findings"},"/api/runs/{id}/tests":{"$ref":"#/paths/~1v1~1runs~1{id}~1tests"},"/api/runs/{id}/tests/{test}":{"$ref":"#/paths/~1v1~1runs~1{id}~1tests~1{test}"},"/api/runs/{id}/pages":{"$ref":"#/paths/~1v1~1runs~1{id}~1pages"},"/api/runs/{id}/pages/{pageId}":{"$ref":"#/paths/~1v1~1runs~1{id}~1pages~1{pageId}"},"/api/runs/{id}/artifacts":{"$ref":"#/paths/~1v1~1runs~1{id}~1artifacts"},"/api/runs/{id}/artifacts/{path}":{"$ref":"#/paths/~1v1~1runs~1{id}~1artifacts~1{path}"},"/api/runs/{id}/regression":{"$ref":"#/paths/~1v1~1runs~1{id}~1regression"},"/api/runs/{id}/brief":{"$ref":"#/paths/~1v1~1runs~1{id}~1brief"},"/api/runs/{id}/export/{format}":{"$ref":"#/paths/~1v1~1runs~1{id}~1export~1{format}"},"/api/runs/{id}/meta":{"$ref":"#/paths/~1v1~1runs~1{id}~1meta"},"/api/runs/{id}/visibility":{"$ref":"#/paths/~1v1~1runs~1{id}~1visibility"},"/api/runs/{id}/shares":{"$ref":"#/paths/~1v1~1runs~1{id}~1shares"},"/api/runs/{id}/public-link":{"$ref":"#/paths/~1v1~1runs~1{id}~1public-link"},"/api/runs/{id}/findings/{fingerprint}/comments":{"$ref":"#/paths/~1v1~1runs~1{id}~1findings~1{fingerprint}~1comments"},"/api/comments/{id}":{"$ref":"#/paths/~1v1~1comments~1{id}"},"/api/shares/{id}":{"$ref":"#/paths/~1v1~1shares~1{id}"},"/api/compare":{"$ref":"#/paths/~1v1~1compare"},"/api/snapshots":{"$ref":"#/paths/~1v1~1snapshots"},"/api/snapshots/{name}":{"$ref":"#/paths/~1v1~1snapshots~1{name}"},"/api/credentials":{"$ref":"#/paths/~1v1~1credentials"},"/api/credentials/{id}":{"$ref":"#/paths/~1v1~1credentials~1{id}"},"/api/previous-runs":{"$ref":"#/paths/~1v1~1previous-runs"},"/api/jobs":{"$ref":"#/paths/~1v1~1jobs"},"/api/jobs/{id}/events":{"$ref":"#/paths/~1v1~1jobs~1{id}~1events"},"/api/baseline/accept":{"$ref":"#/paths/~1v1~1baseline~1accept"},"/api/baseline/remove":{"$ref":"#/paths/~1v1~1baseline~1remove"},"/api/baseline/ignore":{"$ref":"#/paths/~1v1~1baseline~1ignore"},"/api/baseline/unignore":{"$ref":"#/paths/~1v1~1baseline~1unignore"},"/api/baseline":{"$ref":"#/paths/~1v1~1baseline"},"/api/projects/{project}/history.csv":{"$ref":"#/paths/~1v1~1projects~1{project}~1history.csv"},"/api/projects/{project}/settings":{"$ref":"#/paths/~1v1~1projects~1{project}~1settings"},"/api/project-settings":{"$ref":"#/paths/~1v1~1project-settings"},"/api/schedules":{"$ref":"#/paths/~1v1~1schedules"},"/api/schedules/{id}/toggle":{"$ref":"#/paths/~1v1~1schedules~1{id}~1toggle"},"/api/schedules/{id}/run-now":{"$ref":"#/paths/~1v1~1schedules~1{id}~1run-now"},"/api/uptime":{"$ref":"#/paths/~1v1~1uptime"},"/api/notify-targets":{"$ref":"#/paths/~1v1~1notify-targets"},"/api/notify-targets/{id}":{"$ref":"#/paths/~1v1~1notify-targets~1{id}"},"/api/notify-targets/{id}/test":{"$ref":"#/paths/~1v1~1notify-targets~1{id}~1test"},"/api/notify-targets/{id}/toggle":{"$ref":"#/paths/~1v1~1notify-targets~1{id}~1toggle"},"/api/digest":{"$ref":"#/paths/~1v1~1digest"},"/api/digest/send-now":{"$ref":"#/paths/~1v1~1digest~1send-now"},"/api/digest/preview":{"$ref":"#/paths/~1v1~1digest~1preview"},"/api/activity":{"$ref":"#/paths/~1v1~1activity"},"/api/admin/overview":{"$ref":"#/paths/~1v1~1admin~1overview"},"/api/admin/retention":{"$ref":"#/paths/~1v1~1admin~1retention"},"/api/admin/prune":{"$ref":"#/paths/~1v1~1admin~1prune"},"/api/admin/apps":{"$ref":"#/paths/~1v1~1admin~1apps"},"/api/admin/apps/{id}":{"$ref":"#/paths/~1v1~1admin~1apps~1{id}"},"/api/admin/apps/{id}/entries":{"$ref":"#/paths/~1v1~1admin~1apps~1{id}~1entries"},"/api/admin/apps/{id}/entries/{entryId}":{"$ref":"#/paths/~1v1~1admin~1apps~1{id}~1entries~1{entryId}"},"/api/admin/apps/{id}/key":{"$ref":"#/paths/~1v1~1admin~1apps~1{id}~1key"},"/api/admin/apps/entries":{"$ref":"#/paths/~1v1~1admin~1apps~1entries"},"/api/admin/apps/entries/{entryId}":{"$ref":"#/paths/~1v1~1admin~1apps~1entries~1{entryId}"},"/api/admin/apps/check":{"$ref":"#/paths/~1v1~1admin~1apps~1check"},"/api/tokens":{"$ref":"#/paths/~1v1~1tokens"},"/api/tokens/{id}":{"$ref":"#/paths/~1v1~1tokens~1{id}"},"/api/auth/me":{"$ref":"#/paths/~1v1~1auth~1me"},"/api/domains":{"$ref":"#/paths/~1v1~1domains"},"/api/domains/verify":{"$ref":"#/paths/~1v1~1domains~1verify"},"/api/domains/{domain}":{"$ref":"#/paths/~1v1~1domains~1{domain}"}}}