{"items":[{"type":"link","label":"Titan Public API","link":"/openapi.public","routeSlug":"/openapi.public","content":{"contentType":"overview","meta":{"name":"Titan Public API"},"children":[{"nodeType":"container","panels":[{"title":"Download OpenAPI description","titleTranslationKey":"download.description.title","children":[{"kind":"download","label":"openapi.public.json","url":"/_bundle/openapi.public.json?download"},{"kind":"download","label":"openapi.public.yaml","url":"/_bundle/openapi.public.yaml?download"}]},{"title":"Overview","titleTranslationKey":"info.title","children":[]},{"title":"Languages","titleTranslationKey":"languages.title","children":[{"kind":"languages","options":[{"key":"curl","title":"curl","lang":"curl"},{"key":"javascript","title":"JavaScript","lang":"JavaScript"},{"key":"node","title":"Node.js","lang":"Node.js"},{"key":"python","title":"Python","lang":"Python"},{"key":"java","title":"Java","lang":"Java"},{"key":"csharp","title":"C#","lang":"C#"},{"key":"php","title":"PHP","lang":"PHP"},{"key":"go","title":"Go","lang":"Go"},{"key":"ruby","title":"Ruby","lang":"Ruby"},{"key":"r","title":"R","lang":"R"},{"key":"payload","title":"Payload","lang":"Payload"}]}]},{"title":"Servers","titleTranslationKey":"servers.title","children":[{"kind":"servers","servers":[{"url":"/_mock/openapi.public","description":"Mock server","isMockServer":true}],"mode":"default"}]}],"children":[{"nodeType":"overview-section-wrapper","children":[{"nodeType":"header","level":1,"label":"Titan Public API (Beta)","showPageActions":true},{"nodeType":"overview-section-wrapper","children":[{"nodeType":"markdoc","content":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Programmatic access to the Titan platform's public surface. Endpoints"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"live under the "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"/public/<major>/"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" path prefix and use OAuth 2.0"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"client-credentials authentication (see the Getting Started guide in"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the sidebar). Lifecycle state —"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"stability, deprecation, sunset — is surfaced on each operation via"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the lifecycle overlays under "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"openapi/overlays/lifecycle/"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}],"sectionId":"/openapi.public"}],"sectionId":"/openapi.public"}]}]}},{"type":"group","label":"Observations","link":"/openapi.public/observations","routeSlug":"/openapi.public/observations","items":[{"label":"List observations","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi.public/observations/getobservations","routeSlug":"/openapi.public/observations/getobservations","metadata":{"seo":{"title":"List observations","description":"Lists observations with paging, filters, and open/resolved mode. View is server-determined from the caller's domain entitlement."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"GetObservations","name":"List observations","isWebhook":false,"pointer":"/paths/~1public~1v1~1observations/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List observations","badges":[{"name":"Beta","color":"blue","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":"Lists observations with paging, filters, and open/resolved mode. View is server-determined from the caller's domain entitlement."},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/GetObservationsRequest"}},"schemaId":"components/schemas/GetObservationsRequest","pointer":"/paths/~1public~1v1~1observations/post/requestBody","description":"Pagination, filters, and open/resolved mode for listing observations on the public API.\nView (VRM vs self) is determined server-side from the caller's entitlement and is not a request input."}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/public/v1/observations","servers":[{"url":"/_mock/openapi.public","description":"Mock server","isMockServer":true}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/GetObservationsRequest"}},"responseCodes":["200","400","401","403","default"],"pointer":"/public/v1/observations","href":"observations/getobservations","openApiOperationId":"GetObservations","summary":"List observations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"/_mock/openapi.public","description":"Mock server","isMockServer":true}],"schemaId":"components/schemas/GetObservationsRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/GetObservationsRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"A successful response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetObservationsResponse"}},"schemaId":"components/schemas/GetObservationsResponse"},{"code":"400","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT: one or more filter expressions are invalid, or limit/offset/cursor values are out of range."},"children":[]}]}]}],"mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"401","description":"UNAUTHENTICATED: access token is absent, malformed, or missing the required organization-domain claim.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"403","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PERMISSION_DENIED: access token does not include the findings.read scope."},"children":[]}]}]}],"mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"default","description":"An unexpected error response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Status"}},"schemaId":"components/schemas/Status"}],"pointer":"/paths/~1public~1v1~1observations/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetObservationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetObservationsResponse"}}},{"code":"400","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"401","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"403","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"default","schemaId":"components/schemas/Status","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Status"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/observations/getobservations"}],"panels":[]}]},"badges":[{"name":"Beta","color":"blue","position":"before"}],"httpPath":"/public/v1/observations"},{"label":"Flag observations","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/openapi.public/observations/flagobservations","routeSlug":"/openapi.public/observations/flagobservations","metadata":{"seo":{"title":"Flag observations","description":"Flags observations for follow-up using filter criteria. Returns counts of newly-flagged and already-flagged observations."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"FlagObservations","name":"Flag observations","isWebhook":false,"pointer":"/paths/~1public~1v1~1observations~1actions~1flag/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Flag observations","badges":[{"name":"Beta","color":"blue","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":"Flags observations for follow-up using filter criteria. Returns counts of newly-flagged and already-flagged observations."},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/FlagObservationsRequest"}},"schemaId":"components/schemas/FlagObservationsRequest","pointer":"/paths/~1public~1v1~1observations~1actions~1flag/post/requestBody","description":"Identifies observations to flag using either an explicit ORN list or filter expressions."}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/public/v1/observations/actions/flag","servers":[{"url":"/_mock/openapi.public","description":"Mock server","isMockServer":true}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[],"requestBody":{"application/json":{"schemaId":"components/schemas/FlagObservationsRequest"}},"responseCodes":["200","400","401","403","default"],"pointer":"/public/v1/observations/actions/flag","href":"observations/flagobservations","openApiOperationId":"FlagObservations","summary":"Flag observations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"/_mock/openapi.public","description":"Mock server","isMockServer":true}],"schemaId":"components/schemas/FlagObservationsRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/FlagObservationsRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"A successful response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/FlagObservationsResponse"}},"schemaId":"components/schemas/FlagObservationsResponse"},{"code":"400","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT: one or more filter expressions are invalid."},"children":[]}]}]}],"mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"401","description":"UNAUTHENTICATED: access token is absent, malformed, or missing the required organization-domain claim.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"403","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"PERMISSION_DENIED: access token does not include the findings.flag scope."},"children":[]}]}]}],"mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}},"schemaId":"schema_1"},{"code":"default","description":"An unexpected error response.","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Status"}},"schemaId":"components/schemas/Status"}],"pointer":"/paths/~1public~1v1~1observations~1actions~1flag/post/responses"}],"panels":[{"children":[{"kind":"response","headerTitle":"Response","responseCodes":[{"code":"200","schemaId":"components/schemas/FlagObservationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/FlagObservationsResponse"}}},{"code":"400","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"401","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"403","schemaId":"schema_1","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_1"}}},{"code":"default","schemaId":"components/schemas/Status","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Status"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/observations/flagobservations"}],"panels":[]}]},"badges":[{"name":"Beta","color":"blue","position":"before"}],"httpPath":"/public/v1/observations/actions/flag"}],"content":{"contentType":"group","meta":{"name":"Observations"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Observations","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/public/v1/observations","summary":"List observations","prefix":{"name":"post","color":"post"},"badges":[{"name":"Beta","color":"blue","position":"before"}],"link":"/observations/getobservations","deprecated":false},{"title":"/public/v1/observations/actions/flag","summary":"Flag observations","prefix":{"name":"post","color":"post"},"badges":[{"name":"Beta","color":"blue","position":"before"}],"link":"/observations/flagobservations","deprecated":false}]}]}]}]}}],"store":{"schemaStore":{"components/schemas/AccessType":{"id":"components/schemas/AccessType","kind":"json-schema","title":"AccessType","data":{"type":"string","enum":["ACCESS_TYPE_UNSPECIFIED","ACCESS_TYPE_NO_ACCESS","ACCESS_TYPE_PHYSICAL_ACCESS_ONLY","ACCESS_TYPE_NETWORK_LEVEL_ACCESS","ACCESS_TYPE_SYSTEM_APPLICATION_ACCESS","ACCESS_TYPE_DATA_PROCESSING_STORAGE_ACCESS","ACCESS_TYPE_INFRASTRUCTURE_HOSTING_ACCESS"],"default":"ACCESS_TYPE_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Type of access granted to a vendor, as exposed on the public API. Curated"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"public copy of the internal factor_protos.vendor_relationship.v1.AccessType."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ordinals are kept IDENTICAL to the internal enum for the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"cross-boundary-safety reason as VendorLifecycleStatus above."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_UNSPECIFIED: Default zero value; access type was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_NO_ACCESS: The vendor has no access to systems, data, or facilities."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_PHYSICAL_ACCESS_ONLY: The vendor has physical access to facilities only (e.g. on-site maintenance);"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"no system or data access."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_NETWORK_LEVEL_ACCESS: The vendor has network-level connectivity (e.g. VPN or network segment access)"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"without direct application or data access."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_SYSTEM_APPLICATION_ACCESS: The vendor has access to specific systems or applications (e.g. a hosted SaaS"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"account) beyond bare network connectivity."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_DATA_PROCESSING_STORAGE_ACCESS: The vendor processes or stores the customer's data directly (e.g. acting as a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"data processor or subprocessor)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ACCESS_TYPE_INFRASTRUCTURE_HOSTING_ACCESS: The vendor hosts or manages underlying infrastructure (e.g. a cloud/hosting"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"provider) that the customer's systems run on."},"children":[]}]}]}]}]}},"components/schemas/AddVendorToGroupBody":{"id":"components/schemas/AddVendorToGroupBody","kind":"json-schema","title":"AddVendorToGroupBody","data":{"type":"object","properties":{"vendorIds":{"type":"array","items":{"type":"string"},"description":"Vendor ids to add. Required, non-empty, capped at 500 per call. A vendor\nalready a member is a no-op, not an error."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Vendor ids to add as members of a vendor group. Organization scope is derived"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"from the access token — this message carries no organization field."},"children":[]}]}]}],"required":["vendorIds"]}},"components/schemas/AddVendorToGroupResponse":{"id":"components/schemas/AddVendorToGroupResponse","kind":"json-schema","title":"AddVendorToGroupResponse","data":{"type":"object","properties":{"vendorGroup":{"$ref":"#/components/schemas/VendorGroup"}},"description":"The vendor group after AddVendorToGroup applies.","required":["vendorGroup"]}},"components/schemas/Any":{"id":"components/schemas/Any","kind":"json-schema","title":"Any","data":{"type":"object","properties":{"@type":{"type":"string"}},"additionalProperties":{},"required":["typeUrl","value"]}},"components/schemas/ApprovalStatus":{"id":"components/schemas/ApprovalStatus","kind":"json-schema","title":"/ Approvaltatus of the remediation from the Vrm/SSC Support/SSC automated system perspective","data":{"type":"string","enum":["APPROVAL_STATUS_UNSPECIFIED","APPROVAL_STATUS_BACKLOG","APPROVAL_STATUS_TRIAGED_INTERNAL","APPROVAL_STATUS_TRIAGED_EXTERNAL","APPROVAL_STATUS_RESOLVED","APPROVAL_STATUS_EXCLUDED"],"default":"APPROVAL_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"APPROVAL_STATUS_BACKLOG: An observation that needs to be reviewed. All observations should default to this status"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"APPROVAL_STATUS_TRIAGED_INTERNAL: An observation transitions to this status automatically when a user action takes place using the internal remediation workflow."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"APPROVAL_STATUS_TRIAGED_EXTERNAL: An observation transitions to this status automatically when a user action takes place using the vendor remediation workflow"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"APPROVAL_STATUS_RESOLVED: An observation that has been determined to be “fixed”."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"APPROVAL_STATUS_EXCLUDED: The event will usually occur as part of a UX workflow where the user decides to acknowledge and change the state of the observation."},"children":[]}]}]}]}],"title":"/ Approvaltatus of the remediation from the Vrm/SSC Support/SSC automated system perspective"}},"components/schemas/AssetDns":{"id":"components/schemas/AssetDns","kind":"json-schema","title":"/ AssetDns class","data":{"type":"object","properties":{"recordType":{"$ref":"#/components/schemas/AssetDnsType"},"domain":{"type":"string","description":"Fully-qualified domain name that owns the DNS record."},"record":{"type":"string","description":"DNS record name (left-hand side of the zone file entry); absent when not applicable."},"recordValue":{"type":"string","description":"Resolved value of the DNS record (right-hand side of the zone file entry); absent when not applicable."}},"title":"/ AssetDns class","required":["recordType","domain"]}},"components/schemas/AssetDnsType":{"id":"components/schemas/AssetDnsType","kind":"json-schema","title":"AssetDnsType","data":{"type":"string","enum":["ASSET_DNS_TYPE_UNSPECIFIED","ASSET_DNS_TYPE_A","ASSET_DNS_TYPE_AAAA","ASSET_DNS_TYPE_CNAME","ASSET_DNS_TYPE_MX","ASSET_DNS_TYPE_NS","ASSET_DNS_TYPE_PTR","ASSET_DNS_TYPE_SOA","ASSET_DNS_TYPE_SRV","ASSET_DNS_TYPE_TXT","ASSET_DNS_TYPE_CAA","ASSET_DNS_TYPE_DNSKEY","ASSET_DNS_TYPE_DS","ASSET_DNS_TYPE_NAPTR","ASSET_DNS_TYPE_RRSIG","ASSET_DNS_TYPE_TLSA","ASSET_DNS_TYPE_URI"],"default":"ASSET_DNS_TYPE_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"/ AssetDnsType enumeration. Maps to the different record types in DNS."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_A: IPv4 address"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_AAAA: IPv6 address"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_CNAME: Canonical name"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_MX: Mail exchange"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_NS: Name server"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_PTR: Pointer record"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_SOA: Start of authority"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_SRV: Service locator"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_TXT: Text record"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_CAA: Certification Authority Authorization"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_DNSKEY: DNSSEC key"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_DS: Delegation signer"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_NAPTR: Naming authority pointer"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_RRSIG: DNSSEC signature"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_TLSA: TLS authentication"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ASSET_DNS_TYPE_URI: URI record"},"children":[]}]}]}]}]}},"components/schemas/AssetIpPort":{"id":"components/schemas/AssetIpPort","kind":"json-schema","title":"/ AssetIpPort class - generic for IPv4 and IPv6\n/ Replaces connection_attributes in the metrics API","data":{"type":"object","properties":{"address":{"type":"string","description":"IPv4 or IPv6 address of the network endpoint being observed."},"port":{"type":"integer","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"TCP/UDP port number (0–65535) of the endpoint; 0 when not applicable."},"children":[]}]}]}]},"protocol":{"$ref":"#/components/schemas/AssetIpPortProtocol"}},"title":"/ AssetIpPort class - generic for IPv4 and IPv6\n/ Replaces connection_attributes in the metrics API","required":["address","port","protocol"]}},"components/schemas/AssetIpPortProtocol":{"id":"components/schemas/AssetIpPortProtocol","kind":"json-schema","title":"/ AssetIpPortProtocol enumeration","data":{"type":"string","enum":["ASSET_IP_PORT_PROTOCOL_UNSPECIFIED","ASSET_IP_PORT_PROTOCOL_TCP","ASSET_IP_PORT_PROTOCOL_UDP"],"default":"ASSET_IP_PORT_PROTOCOL_UNSPECIFIED","title":"/ AssetIpPortProtocol enumeration"}},"components/schemas/AssetType":{"id":"components/schemas/AssetType","kind":"json-schema","title":"/ AssetType enumeration","data":{"type":"string","enum":["ASSET_TYPE_UNSPECIFIED","ASSET_TYPE_IP_PORT","ASSET_TYPE_URL","ASSET_TYPE_DNS","ASSET_TYPE_CREDENTIALS"],"default":"ASSET_TYPE_UNSPECIFIED","title":"/ AssetType enumeration"}},"components/schemas/AssetUrl":{"id":"components/schemas/AssetUrl","kind":"json-schema","title":"/ AssetUrl class","data":{"type":"object","properties":{"url":{"type":"string","description":"Fully-qualified URL of the web asset (scheme, host, path, and optional query)."}},"title":"/ AssetUrl class","required":["url"]}},"components/schemas/BulkCreateVendorResult":{"id":"components/schemas/BulkCreateVendorResult","kind":"json-schema","title":"BulkCreateVendorResult","data":{"type":"object","properties":{"index":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Position of this row in the request's vendors list (0-based), so callers can"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"pair a result back to its input without relying on domain_name uniqueness."},"children":[]}]}]}]},"domainName":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"domain_name as submitted (normalized), echoed for convenience."},"children":[]}]}]}]},"status":{"$ref":"#/components/schemas/BulkVendorMutationStatus"},"vendorId":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Id of the vendor, set when status is SUCCESS or ALREADY_EXISTS."},"children":[]}]}]}]},"errorMessage":{"type":"string","description":"Human-readable detail, set when status is ERROR."}},"description":"Outcome of a single row in a BulkCreateVendors call.","required":["index","domainName","status"]}},"components/schemas/BulkCreateVendorsRequest":{"id":"components/schemas/BulkCreateVendorsRequest","kind":"json-schema","title":"BulkCreateVendorsRequest","data":{"type":"object","properties":{"vendors":{"type":"array","items":{"$ref":"#/components/schemas/BulkCreateVendorsRequestEntry"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Rows to create, in the order results are returned. Required and non-empty;"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"bounded server-side at 500 entries — a larger batch is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT before any row is processed."},"children":[]}]}]}]}},"description":"Batch of vendors to create in the caller's directory in one call.\nOrganization scope is derived from the access token, not from this message.","required":["vendors"]}},"components/schemas/BulkCreateVendorsRequestEntry":{"id":"components/schemas/BulkCreateVendorsRequestEntry","kind":"json-schema","title":"BulkCreateVendorsRequestEntry","data":{"type":"object","properties":{"domainName":{"type":"string","description":"Primary domain name of the vendor (e.g. \"acme.com\"). Required; normalized and\nvalidated server-side."},"companyName":{"type":"string","description":"Display name of the vendor company. Optional; resolved server-side when omitted."},"dataRegion":{"$ref":"#/components/schemas/DataRegion"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Writable, curated subset for creating a vendor as one row of a bulk-create batch."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Deliberately narrower than CreateVendorRequest: the internal bulk-create path only"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"accepts a domain and display name per row, so risk/contract/monitoring fields are"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"not available here — set them afterward with UpdateVendor."},"children":[]}]}]}],"required":["domainName"]}},"components/schemas/BulkCreateVendorsResponse":{"id":"components/schemas/BulkCreateVendorsResponse","kind":"json-schema","title":"BulkCreateVendorsResponse","data":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/BulkCreateVendorResult"},"description":"Outcome of each row, in request order."},"summary":{"$ref":"#/components/schemas/BulkCreateVendorsResponse.Summary"}},"description":"Per-row results and aggregate summary of a BulkCreateVendors call.","required":["results","summary"]}},"components/schemas/BulkCreateVendorsResponse.Summary":{"id":"components/schemas/BulkCreateVendorsResponse.Summary","kind":"json-schema","title":"BulkCreateVendorsResponse.Summary","data":{"type":"object","properties":{"total":{"type":"integer","format":"int32","description":"Total rows in the request."},"succeeded":{"type":"integer","format":"int32","description":"Rows with status SUCCESS."},"alreadyExists":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Rows with status ALREADY_EXISTS."},"children":[]}]}]}]},"failed":{"type":"integer","format":"int32","description":"Rows with status ERROR."}},"description":"Aggregate counts of the batch: total, succeeded, already existing, and failed.","required":["total","succeeded","alreadyExists","failed"]}},"components/schemas/BulkDeleteVendorsRequest":{"id":"components/schemas/BulkDeleteVendorsRequest","kind":"json-schema","title":"BulkDeleteVendorsRequest","data":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ids of the vendors to delete, in the order results are returned. Required and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"non-empty; bounded server-side at 500 entries — a larger batch is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT before any id is processed."},"children":[]}]}]}]}},"description":"Batch of vendor ids to permanently delete in one call.\nOrganization scope is derived from the access token, not from this message.","required":["ids"]}},"components/schemas/BulkDeleteVendorsResponse":{"id":"components/schemas/BulkDeleteVendorsResponse","kind":"json-schema","title":"BulkDeleteVendorsResponse","data":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/BulkVendorIdMutationResult"},"description":"Outcome of each id, in request order."},"summary":{"$ref":"#/components/schemas/BulkDeleteVendorsResponse.Summary"}},"description":"Per-row results and aggregate summary of a BulkDeleteVendors call.","required":["results","summary"]}},"components/schemas/BulkDeleteVendorsResponse.Summary":{"id":"components/schemas/BulkDeleteVendorsResponse.Summary","kind":"json-schema","title":"BulkDeleteVendorsResponse.Summary","data":{"type":"object","properties":{"total":{"type":"integer","format":"int32","description":"Total ids in the request."},"succeeded":{"type":"integer","format":"int32","description":"Ids with status SUCCESS."},"notFound":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ids with status NOT_FOUND."},"children":[]}]}]}]},"failed":{"type":"integer","format":"int32","description":"Ids with status ERROR."}},"description":"Aggregate counts of the batch: total, succeeded, not found, and failed.","required":["total","succeeded","notFound","failed"]}},"components/schemas/BulkOffboardVendorsRequest":{"id":"components/schemas/BulkOffboardVendorsRequest","kind":"json-schema","title":"BulkOffboardVendorsRequest","data":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ids of the vendors to offboard, in the order results are returned. Required and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"non-empty; bounded server-side at 500 entries — a larger batch is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT before any id is processed."},"children":[]}]}]}]},"reason":{"type":"string","description":"Optional caller-supplied audit reason recorded with each offboarding action in\nthis batch."}},"description":"Batch of vendor ids to offboard (archive) in one call, with an optional shared\naudit reason. Organization scope is derived from the access token, not from\nthis message.","required":["ids"]}},"components/schemas/BulkOffboardVendorsResponse":{"id":"components/schemas/BulkOffboardVendorsResponse","kind":"json-schema","title":"BulkOffboardVendorsResponse","data":{"type":"object","properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/BulkVendorIdMutationResult"},"description":"Outcome of each id, in request order."},"summary":{"$ref":"#/components/schemas/BulkOffboardVendorsResponse.Summary"}},"description":"Per-row results and aggregate summary of a BulkOffboardVendors call.","required":["results","summary"]}},"components/schemas/BulkOffboardVendorsResponse.Summary":{"id":"components/schemas/BulkOffboardVendorsResponse.Summary","kind":"json-schema","title":"BulkOffboardVendorsResponse.Summary","data":{"type":"object","properties":{"total":{"type":"integer","format":"int32","description":"Total ids in the request."},"succeeded":{"type":"integer","format":"int32","description":"Ids with status SUCCESS (including a no-op on an already-offboarded vendor)."},"notFound":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ids with status NOT_FOUND."},"children":[]}]}]}]},"failed":{"type":"integer","format":"int32","description":"Ids with status ERROR."}},"description":"Aggregate counts of the batch: total, succeeded (including already-offboarded\nno-ops), not found, and failed.","required":["total","succeeded","notFound","failed"]}},"components/schemas/BulkUpsertVendorsFromCsvRequest":{"id":"components/schemas/BulkUpsertVendorsFromCsvRequest","kind":"json-schema","title":"BulkUpsertVendorsFromCsvRequest","data":{"type":"object","properties":{"csv":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Raw CSV text to import; column layout matches the vendor directory's curated"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"writable fields (domain_name, company_name, and the other columns supported for"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the caller's organization). Required and non-empty."},"children":[]}]}]}]},"dryRun":{"type":"boolean","description":"When true, validates every row and returns the per-row outcomes it would produce\nwithout persisting any changes. Optional; defaults to false."}},"description":"Body for BulkUpsertVendorsFromCsv: raw CSV text of vendors to upsert in the\ncaller's directory. Organization scope is derived from the access token, not\nfrom this message.","required":["csv"]}},"components/schemas/BulkUpsertVendorsFromCsvResponse":{"id":"components/schemas/BulkUpsertVendorsFromCsvResponse","kind":"json-schema","title":"BulkUpsertVendorsFromCsvResponse","data":{"type":"object","properties":{"rowResults":{"type":"array","items":{"$ref":"#/components/schemas/BulkVendorCsvRowResult"},"description":"Per-row outcome, in the order rows appeared in the submitted CSV."},"summary":{"$ref":"#/components/schemas/BulkUpsertVendorsFromCsvResponse.Summary"}},"description":"Aggregate counts and per-row results after processing a vendor bulk CSV import.","required":["rowResults","summary"]}},"components/schemas/BulkUpsertVendorsFromCsvResponse.Summary":{"id":"components/schemas/BulkUpsertVendorsFromCsvResponse.Summary","kind":"json-schema","title":"BulkUpsertVendorsFromCsvResponse.Summary","data":{"type":"object","properties":{"total":{"type":"integer","format":"int32","description":"Total rows in the submitted CSV, excluding the header row."},"accepted":{"type":"integer","format":"int32","description":"Rows with outcome ACCEPTED."},"rejected":{"type":"integer","format":"int32","description":"Rows with outcome REJECTED."},"skipped":{"type":"integer","format":"int32","description":"Rows with outcome SKIPPED."}},"description":"Aggregate counts of the batch: total, accepted, rejected, and skipped.","required":["total","accepted","rejected","skipped"]}},"components/schemas/BulkVendorCsvRowOutcome":{"id":"components/schemas/BulkVendorCsvRowOutcome","kind":"json-schema","title":"BulkVendorCsvRowOutcome","data":{"type":"string","enum":["BULK_VENDOR_CSV_ROW_OUTCOME_UNSPECIFIED","BULK_VENDOR_CSV_ROW_OUTCOME_ACCEPTED","BULK_VENDOR_CSV_ROW_OUTCOME_REJECTED","BULK_VENDOR_CSV_ROW_OUTCOME_SKIPPED"],"default":"BULK_VENDOR_CSV_ROW_OUTCOME_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Outcome of a single row in a BulkUpsertVendorsFromCsv call."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_CSV_ROW_OUTCOME_UNSPECIFIED: Default zero value; outcome was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_CSV_ROW_OUTCOME_ACCEPTED: The row was validated and (unless dry_run) applied successfully."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_CSV_ROW_OUTCOME_REJECTED: The row failed validation and was not applied; code/message carry detail."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_CSV_ROW_OUTCOME_SKIPPED: The row was structurally valid but not applied for a non-error reason (e.g. a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"duplicate row within the same file); code/message carry detail."},"children":[]}]}]}]}]}},"components/schemas/BulkVendorCsvRowResult":{"id":"components/schemas/BulkVendorCsvRowResult","kind":"json-schema","title":"BulkVendorCsvRowResult","data":{"type":"object","properties":{"rowIndex":{"type":"integer","format":"int64","description":"1-based row number in the submitted CSV, excluding the header row."},"outcome":{"$ref":"#/components/schemas/BulkVendorCsvRowOutcome"},"code":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Machine-readable reason code, set when outcome is REJECTED or SKIPPED"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(e.g. \"INVALID_DOMAIN\", \"DUPLICATE_ROW\")."},"children":[]}]}]}]},"message":{"type":"string","description":"Human-readable detail, set when outcome is REJECTED or SKIPPED."}},"description":"Per-row result from a bulk CSV import.","required":["rowIndex","outcome"]}},"components/schemas/BulkVendorIdMutationResult":{"id":"components/schemas/BulkVendorIdMutationResult","kind":"json-schema","title":"BulkVendorIdMutationResult","data":{"type":"object","properties":{"id":{"type":"string","description":"Id as submitted, echoed for convenience."},"status":{"$ref":"#/components/schemas/BulkVendorMutationStatus"},"errorMessage":{"type":"string","description":"Human-readable detail, set when status is ERROR."}},"description":"Outcome of a single id in a BulkDeleteVendors or BulkOffboardVendors call.","required":["id","status"]}},"components/schemas/BulkVendorMutationStatus":{"id":"components/schemas/BulkVendorMutationStatus","kind":"json-schema","title":"BulkVendorMutationStatus","data":{"type":"string","enum":["BULK_VENDOR_MUTATION_STATUS_UNSPECIFIED","BULK_VENDOR_MUTATION_STATUS_SUCCESS","BULK_VENDOR_MUTATION_STATUS_ALREADY_EXISTS","BULK_VENDOR_MUTATION_STATUS_NOT_FOUND","BULK_VENDOR_MUTATION_STATUS_ERROR"],"default":"BULK_VENDOR_MUTATION_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Outcome of a single row in a bulk vendor mutation (create, delete, or offboard)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Shared across BulkCreateVendors, BulkDeleteVendors, and BulkOffboardVendors so"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"callers handle partial failure the same way regardless of which bulk call they made."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_MUTATION_STATUS_UNSPECIFIED: Default zero value; status was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_MUTATION_STATUS_SUCCESS: The row was applied successfully."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_MUTATION_STATUS_ALREADY_EXISTS: BulkCreateVendors only: a vendor with the same domain already exists in the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"caller's directory; no new row was created."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_MUTATION_STATUS_NOT_FOUND: BulkDeleteVendors / BulkOffboardVendors only: no vendor with the given id"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"exists within the caller's organization."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BULK_VENDOR_MUTATION_STATUS_ERROR: The row failed for a reason not covered above (e.g. malformed domain_name);"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"error_message on the row carries detail."},"children":[]}]}]}]}]}},"components/schemas/BusinessImpact":{"id":"components/schemas/BusinessImpact","kind":"json-schema","title":"BusinessImpact","data":{"type":"string","enum":["BUSINESS_IMPACT_UNSPECIFIED","BUSINESS_IMPACT_NONE","BUSINESS_IMPACT_LOW","BUSINESS_IMPACT_MEDIUM","BUSINESS_IMPACT_HIGH","BUSINESS_IMPACT_CRITICAL"],"default":"BUSINESS_IMPACT_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Business impact if a vendor is compromised, as exposed on the public API."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Curated public copy of the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor_protos.vendor_relationship.v1.BusinessImpact. Ordinals are kept"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"IDENTICAL to the internal enum for the same cross-boundary-safety reason as"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VendorLifecycleStatus above."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_UNSPECIFIED: Default zero value; business impact was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_NONE: No material impact to the business if this vendor is compromised."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_LOW: Limited, easily contained disruption."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_MEDIUM: Noticeable disruption to some business functions."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_HIGH: Significant disruption to core business functions."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"BUSINESS_IMPACT_CRITICAL: Severe, potentially existential disruption to the business."},"children":[]}]}]}]}]}},"components/schemas/CapecData":{"id":"components/schemas/CapecData","kind":"json-schema","title":"/ CapecData class","data":{"type":"object","properties":{"capecId":{"type":"string","description":"CAPEC identifier for the attack pattern (e.g. \"CAPEC-66\")."},"summary":{"type":"string","description":"Short, one-sentence summary of the attack pattern."},"description":{"type":"string","description":"Full narrative describing how the attack is carried out and what it targets."}},"title":"/ CapecData class","required":["capecId","summary","description"]}},"components/schemas/CompanyContact":{"id":"components/schemas/CompanyContact","kind":"json-schema","title":"CompanyContact","data":{"type":"object","properties":{"domain":{"type":"string","description":"Domain of the company the contacts belong to."},"contacts":{"type":"array","items":{"$ref":"#/components/schemas/v1.Contact"},"description":"Contacts at this company to receive the remediation-request email."}},"description":"A company domain with the contacts at that company to receive remediation-request emails.","required":["domain","contacts"]}},"components/schemas/CreateQuestionnaireRequest":{"id":"components/schemas/CreateQuestionnaireRequest","kind":"json-schema","title":"CreateQuestionnaireRequest","data":{"type":"object","properties":{"templateId":{"type":"string","description":"Id of the template to create the questionnaire from. Required."},"vendorId":{"type":"string","description":"Id of the vendor (in the caller's directory) to create the questionnaire for. Required."}},"description":"Request to create a questionnaire from a template for a vendor.","required":["templateId","vendorId"]}},"components/schemas/CreateQuestionnaireResponse":{"id":"components/schemas/CreateQuestionnaireResponse","kind":"json-schema","title":"CreateQuestionnaireResponse","data":{"type":"object","properties":{"questionnaire":{"$ref":"#/components/schemas/Questionnaire"}},"description":"Response containing the newly created questionnaire.","required":["questionnaire"]}},"components/schemas/CreateVendorGroupRequest":{"id":"components/schemas/CreateVendorGroupRequest","kind":"json-schema","title":"CreateVendorGroupRequest","data":{"type":"object","properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Human-readable display name for the new group. Required and must be non-blank after"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"surrounding whitespace is trimmed; at most 255 characters. Must not duplicate the name"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"of an active group in the caller's organization — a duplicate is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ALREADY_EXISTS rather than creating a second group."},"children":[]}]}]}]},"description":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Free-text description of the group; at most 1024 characters. Omit when the caller has"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"no copy to store — an omitted description reads back absent on the created group."},"children":[]}]}]}]}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The curated writable subset accepted when creating a vendor group."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Deliberately narrow: everything else on the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor_protos.vendor_relationship.v1.CreateVendorGroupRequest is server-owned and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"never accepted from a public caller. Intentionally excluded:"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"customer_organization_id – derived from the caller's access token, so accepting it"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"would let a caller assert another org's directory."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"organizational_unit_id   – an internal scoping mechanism, not a customer-facing"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"concept; the service mirrors it from the organization."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"created_by / updated_by  – internal audit subject identifiers, set server-side from"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the OAuth2 client."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"member_count             – maintained by the service; a new group always starts empty."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"created_at / updated_at  – server-assigned timestamps."},"children":[]}]}]}],"required":["name"]}},"components/schemas/CreateVendorGroupResponse":{"id":"components/schemas/CreateVendorGroupResponse","kind":"json-schema","title":"CreateVendorGroupResponse","data":{"type":"object","properties":{"vendorGroup":{"$ref":"#/components/schemas/VendorGroup"}},"description":"The vendor group created by CreateVendorGroup.","required":["vendorGroup"]}},"components/schemas/CreateVendorRequest":{"id":"components/schemas/CreateVendorRequest","kind":"json-schema","title":"CreateVendorRequest","data":{"type":"object","properties":{"domainName":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Primary domain name of the vendor (e.g. \"acme.com\"). Required; normalized and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"validated server-side, and deduplicated against the caller's existing directory"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(organization + domain_name) — a domain already present is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ALREADY_EXISTS."},"children":[]}]}]}]},"companyName":{"type":"string","description":"Display name of the vendor company. Optional; resolved server-side when omitted."},"vendorId":{"type":"string","description":"Customer-defined free-text identifier for the vendor (the caller's own external\nreference, not the internal entity id). Optional."},"isMonitored":{"type":"boolean","description":"Whether the vendor should be actively monitored. Optional; when omitted the\nvendor is created not monitored (consumes no monitoring slot)."},"riskLevel":{"$ref":"#/components/schemas/RiskLevel"},"businessImpact":{"$ref":"#/components/schemas/BusinessImpact"},"dataTypesShared":{"type":"array","items":{"$ref":"#/components/schemas/DataTypeShared"},"description":"Categories of data shared with the vendor. Optional; repeated."},"accessTypes":{"type":"array","items":{"$ref":"#/components/schemas/AccessType"},"description":"Types of access granted to the vendor. Optional; repeated."},"contractValue":{"type":"string","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Monetary value of the contract, in the minor units of the customer account's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"currency (e.g. cents for a USD account) — the same representation as"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Vendor.contract_value. Optional."},"children":[]}]}]}]},"contractEndDate":{"type":"string","format":"date-time","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Date the vendor contract expires. Optional; absent when not set. Same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"representation as Vendor.contract_end_date."},"children":[]}]}]}]},"dataRegion":{"$ref":"#/components/schemas/DataRegion"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Writable, curated subset for creating a vendor in the caller's directory."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Deliberately narrow: it carries ONLY the fields a public caller may set at"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"create time. It has NO customer_organization_id — the organization is derived"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"server-side from the caller's access token, never this message — and no internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ids, audit actors, or contact PII. Field numbers are scoped to this message and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"are independent of the internal create contract; field TYPES intentionally mirror"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the curated Vendor response (same enums, same contract_value minor-units and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"contract_end_date Timestamp representation) so input and output speak the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"shapes."},"children":[]}]}]}],"required":["domainName","dataTypesShared","accessTypes","contractEndDate"]}},"components/schemas/CreateVendorResponse":{"id":"components/schemas/CreateVendorResponse","kind":"json-schema","title":"CreateVendorResponse","data":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/vendor.v1.Vendor"}},"description":"Response containing the newly created vendor.","required":["vendor"]}},"components/schemas/CvssScore":{"id":"components/schemas/CvssScore","kind":"json-schema","title":"/ CvssScore class","data":{"type":"object","properties":{"version":{"$ref":"#/components/schemas/CvssScoreVersion"},"baseScore":{"type":"number","format":"float","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Numeric base score on a 0.0–10.0 scale as defined by the CVSS standard."},"children":[]}]}]}]},"baseSeverity":{"$ref":"#/components/schemas/CvssScoreSeverity"},"cvssVector":{"type":"string","description":"Compact CVSS vector string encoding all metric values (e.g. \"CVSS:3.1/AV:N/AC:L/...\")."},"exploitabilityScore":{"type":"number","format":"float","description":"Sub-score measuring ease of exploitation; absent when the scoring source did not compute it."},"impactScore":{"type":"number","format":"float","description":"Sub-score measuring the consequence to confidentiality, integrity, and availability; absent when not computed."},"scoreSource":{"type":"string","description":"Organization or feed that published this score (e.g. \"NVD\", \"vendor\")."},"firstSeen":{"type":"string","format":"date-time","description":"When this CVSS score was first recorded for the CVE."},"references":{"type":"array","items":{"$ref":"#/components/schemas/CvssScoreReference"},"description":"External references (advisories, patches, NVD entries) that support this score."}},"title":"/ CvssScore class","required":["version","baseScore","baseSeverity","cvssVector","scoreSource","firstSeen","references"]}},"components/schemas/CvssScoreReference":{"id":"components/schemas/CvssScoreReference","kind":"json-schema","title":"/ CvssScoreReference class","data":{"type":"object","properties":{"url":{"type":"string","description":"URL of the external advisory, patch note, or NVD/vendor page that supports this score."},"description":{"type":"string","description":"Human-readable summary of what the reference describes; absent when not provided by the source."}},"title":"/ CvssScoreReference class","required":["url"]}},"components/schemas/CvssScoreSeverity":{"id":"components/schemas/CvssScoreSeverity","kind":"json-schema","title":"/ CvssScoreSeverity enumeration","data":{"type":"string","enum":["CVSS_SCORE_SEVERITY_UNSPECIFIED","CVSS_SCORE_SEVERITY_LOW","CVSS_SCORE_SEVERITY_MEDIUM","CVSS_SCORE_SEVERITY_HIGH","CVSS_SCORE_SEVERITY_CRITICAL"],"default":"CVSS_SCORE_SEVERITY_UNSPECIFIED","title":"/ CvssScoreSeverity enumeration"}},"components/schemas/CvssScoreVersion":{"id":"components/schemas/CvssScoreVersion","kind":"json-schema","title":"/ CvssScoreVersion enumeration","data":{"type":"string","enum":["CVSS_SCORE_VERSION_UNSPECIFIED","CVSS_SCORE_VERSION_1_0","CVSS_SCORE_VERSION_2_0","CVSS_SCORE_VERSION_3_0","CVSS_SCORE_VERSION_3_1","CVSS_SCORE_VERSION_4"],"default":"CVSS_SCORE_VERSION_UNSPECIFIED","title":"/ CvssScoreVersion enumeration"}},"components/schemas/CweData":{"id":"components/schemas/CweData","kind":"json-schema","title":"/ CweData class","data":{"type":"object","properties":{"cweId":{"type":"string","description":"CWE identifier for the weakness class (e.g. \"CWE-79\")."},"summary":{"type":"string","description":"Short, one-sentence summary of the weakness."},"description":{"type":"string","description":"Full narrative describing the root-cause weakness and its consequences."},"relatedCapec":{"type":"array","items":{"$ref":"#/components/schemas/CapecData"},"description":"CAPEC attack patterns that exploit this weakness, when available."}},"title":"/ CweData class","required":["cweId","summary","description","relatedCapec"]}},"components/schemas/DataRegion":{"id":"components/schemas/DataRegion","kind":"json-schema","title":"DataRegion","data":{"type":"string","enum":["DATA_REGION_UNSPECIFIED","DATA_REGION_US","DATA_REGION_EU","DATA_REGION_UK","DATA_REGION_CA","DATA_REGION_AU","DATA_REGION_APAC"],"default":"DATA_REGION_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Data region where a vendor operates, as exposed on the public API. Curated public"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"copy of the internal DataRegion. Ordinals are kept IDENTICAL to the internal enum"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"for the same reason as VendorLifecycleStatus above (enum values can cross the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"public/internal boundary by number, so the numbers must stay aligned). It happens"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"to be value-for-value identical today; keep it that way as the internal enum evolves."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_UNSPECIFIED: Default zero value; data region was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_US: United States."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_EU: European Union."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_UK: United Kingdom."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_CA: Canada."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_AU: Australia."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_REGION_APAC: Asia-Pacific."},"children":[]}]}]}]}]}},"components/schemas/DataTypeShared":{"id":"components/schemas/DataTypeShared","kind":"json-schema","title":"DataTypeShared","data":{"type":"string","enum":["DATA_TYPE_SHARED_UNSPECIFIED","DATA_TYPE_SHARED_PII","DATA_TYPE_SHARED_PHI","DATA_TYPE_SHARED_SENSITIVE","DATA_TYPE_SHARED_FINANCIAL","DATA_TYPE_SHARED_INTELLECTUAL_PROPERTY"],"default":"DATA_TYPE_SHARED_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Category of data shared with a vendor, as exposed on the public API. Curated"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"public copy of the internal factor_protos.vendor_relationship.v1.DataTypeShared."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ordinals are kept IDENTICAL to the internal enum for the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"cross-boundary-safety reason as VendorLifecycleStatus above."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_UNSPECIFIED: Default zero value; data type was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_PII: Personally identifiable information (e.g. names, government IDs, contact details)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_PHI: Protected health information (e.g. medical records, health insurance data)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_SENSITIVE: Other sensitive data not covered by PII/PHI/financial (e.g. credentials, trade secrets)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_FINANCIAL: Financial data (e.g. payment card numbers, bank account details, transaction records)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"DATA_TYPE_SHARED_INTELLECTUAL_PROPERTY: Intellectual property (e.g. proprietary source code, patents, unpublished research)."},"children":[]}]}]}]}]}},"components/schemas/DateRange":{"id":"components/schemas/DateRange","kind":"json-schema","title":"DateRange","data":{"type":"object","properties":{"startTime":{"type":"string","format":"date-time","title":"Inclusive"},"endTime":{"type":"string","format":"date-time","title":"Inclusive"},"live":{"type":"boolean"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Wall-clock window for time-based filters; optional live flag for rolling “now” semantics."},"children":[]}]}]}]}},"components/schemas/DateRangeBounds":{"id":"components/schemas/DateRangeBounds","kind":"json-schema","title":"DateRangeBounds","data":{"type":"object","properties":{"earliestDate":{"type":"string","format":"date-time","title":"Earliest allowable date (inclusive)"},"latestDate":{"type":"string","format":"date-time","title":"Latest allowable date (inclusive)"}},"description":"Earliest and latest timestamps permitted for date or datetime filters."}},"components/schemas/DiscreteFilterValues":{"id":"components/schemas/DiscreteFilterValues","kind":"json-schema","title":"DiscreteFilterValues","data":{"type":"object","properties":{"values":{"type":"array","items":{"$ref":"#/components/schemas/FilterOptionValue"}}},"description":"Enumerated pick-list entries returned to populate filter dropdowns or chips.","required":["values"]}},"components/schemas/EpssHistory":{"id":"components/schemas/EpssHistory","kind":"json-schema","title":"/ EpssHistory class","data":{"type":"object","properties":{"date":{"type":"string","format":"date-time","description":"Date on which the EPSS score was recorded."},"score":{"type":"number","format":"float","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"EPSS probability score (0.0–1.0) on the given date; absent if not available for that date."},"children":[]}]}]}]}},"title":"/ EpssHistory class","required":["date"]}},"components/schemas/Evidence":{"id":"components/schemas/Evidence","kind":"json-schema","title":"Evidence","data":{"type":"object","properties":{"advertising":{"$ref":"#/components/schemas/EvidenceAdvertising"},"appsec":{"$ref":"#/components/schemas/EvidenceAppsec"},"clearWebCert":{"$ref":"#/components/schemas/EvidenceClearWebCert"},"clearWebEvidence":{"$ref":"#/components/schemas/EvidenceClearWebEvidence"},"compromisedStealer":{"$ref":"#/components/schemas/EvidenceCompromisedStealer"},"cookie":{"$ref":"#/components/schemas/EvidenceCookie"},"domainSquatting":{"$ref":"#/components/schemas/EvidenceDomainSquatting"},"exploitedProduct":{"$ref":"#/components/schemas/EvidenceExploitedProduct"},"hackerChatter":{"$ref":"#/components/schemas/EvidenceHackerChatter"},"leakedCredentialsV2":{"$ref":"#/components/schemas/EvidenceLeakedCredentialsV2"},"malware":{"$ref":"#/components/schemas/EvidenceMalware"},"openSslVuln":{"$ref":"#/components/schemas/EvidenceOpenSSLVuln"},"patchingAnalysis":{"$ref":"#/components/schemas/EvidencePatchingAnalysis"},"potentiallyVulnerable":{"$ref":"#/components/schemas/EvidencePotentiallyVulnerable"},"ransomwareAssociation":{"$ref":"#/components/schemas/EvidenceRansomwareAssociation"},"ransomwareVictim":{"$ref":"#/components/schemas/EvidenceRansomwareVictim"},"spf":{"$ref":"#/components/schemas/EvidenceSPF"},"ssh":{"$ref":"#/components/schemas/EvidenceSSH"},"service":{"$ref":"#/components/schemas/EvidenceService"},"skynet":{"$ref":"#/components/schemas/EvidenceSkynet"},"synthHighRiskAppsecAccess":{"$ref":"#/components/schemas/EvidenceSynthHighRiskAppsecAccess"},"synthPossibleInitialAccess":{"$ref":"#/components/schemas/EvidenceSynthPossibleInitialAccess"},"tls":{"$ref":"#/components/schemas/EvidenceTLS"},"torExitNode":{"$ref":"#/components/schemas/EvidenceTorExitNode"},"vulnerability":{"$ref":"#/components/schemas/EvidenceVulnerability"},"x509":{"$ref":"#/components/schemas/EvidenceX509"},"breach":{"$ref":"#/components/schemas/EvidenceBreach"},"serviceScan":{"$ref":"#/components/schemas/EvidenceServiceScan"},"productsDetected":{"$ref":"#/components/schemas/EvidenceProductsDetected"},"detectedVendor":{"$ref":"#/components/schemas/EvidenceDetectedVendor"}},"description":"Discriminated union of all structured evidence blobs that can justify a raw observation."}},"components/schemas/EvidenceAdvertising":{"id":"components/schemas/EvidenceAdvertising","kind":"json-schema","title":"EvidenceAdvertising","data":{"type":"object","properties":{"productManufacturer":{"type":"string","description":"Vendor or company that produced the detected product."},"productName":{"type":"string","description":"Name of the identified software product or library."},"productVersion":{"type":"string","description":"Detected version string of the product."},"productStateStatus":{"type":"string","description":"Observed operational state of the product (e.g. \"active\", \"deprecated\")."},"userAgent":{"type":"string","description":"HTTP User-Agent header value captured during the crawl."},"evidence":{"type":"array","items":{"type":"string"},"description":"Raw proof strings from the crawl that confirm the product presence."}},"description":"Ad-tech or client fingerprint leak: product metadata, user agent, and free-form proof strings from the crawl.","required":["productManufacturer","productName","productVersion","productStateStatus","userAgent","evidence"]}},"components/schemas/EvidenceAppsec":{"id":"components/schemas/EvidenceAppsec","kind":"json-schema","title":"EvidenceAppsec","data":{"type":"object","properties":{"analysis":{"type":"string"},"scheme":{"type":"string"},"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceAppsecObservation"}}},"description":"AppSec narrative for an asset: high-level analysis, scheme context, and supporting URL-level observations.","required":["analysis","scheme","observations"]}},"components/schemas/EvidenceAppsecObservation":{"id":"components/schemas/EvidenceAppsecObservation","kind":"json-schema","title":"EvidenceAppsecObservation","data":{"type":"object","properties":{"initialUrl":{"type":"string","description":"URL at which the crawl request originated (before any redirects)."},"finalUrl":{"type":"string","description":"Final URL reached after following the redirect chain."},"evidence":{"type":"array","items":{"type":"string"},"description":"Raw proof strings captured during the crawl that confirm the finding."},"lastSeenAt":{"type":"string","format":"date-time","description":"When this crawl observation was last confirmed active."}},"description":"Single app-security crawl hop: redirect chain, textual proof points, and recency for an exposed issue.","required":["initialUrl","finalUrl","evidence","lastSeenAt"]}},"components/schemas/EvidenceBreach":{"id":"components/schemas/EvidenceBreach","kind":"json-schema","title":"EvidenceBreach","data":{"type":"object","properties":{"clusterId":{"type":"string","title":"UUID representing the cluster of entries"},"title":{"type":"string"},"summary":{"type":"string"},"breachItems":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceBreachItem"},"title":"all the BreachItems"},"createdAt":{"type":"string","title":"ISO-8601 string without timezone"},"publishedDate":{"type":"string","title":"ISO-8601 string without timezone"},"breachDate":{"type":"string","title":"ISO-8601 string without timezone"},"recordsLost":{"type":"integer","format":"int32","title":"maximum of all the records lost from breach_items"},"confirmed":{"type":"boolean"},"originatingParty":{"type":"string"}},"description":"Clustered public-breach narrative with summary metadata and all supporting breach item rows.","required":["clusterId","title","summary","breachItems","createdAt","publishedDate","confirmed"]}},"components/schemas/EvidenceBreachItem":{"id":"components/schemas/EvidenceBreachItem","kind":"json-schema","title":"EvidenceBreachItem","data":{"type":"object","properties":{"clusterId":{"type":"string","title":"FK to BreachObject"},"itemId":{"type":"string","title":"Primary key"},"title":{"type":"string"},"link":{"type":"string"},"sourceType":{"type":"string"},"publishedDate":{"type":"string","title":"ISO-8601 string"},"originatingParty":{"type":"string"},"affectedParties":{"type":"array","items":{"type":"string"}},"threatActors":{"type":"array","items":{"type":"string"}},"breachDate":{"type":"string","title":"ISO-8601 string"},"recordsLost":{"type":"integer","format":"int32"},"sourceReliability":{"type":"number","format":"float"},"createdAt":{"type":"string","title":"ISO-8601 string"},"updatedAt":{"type":"string","title":"ISO-8601 string"},"infoLeaked":{"type":"array","items":{"type":"string"}}},"description":"One article or OSINT record inside a broader breach cluster (actors, victims, dates, reliability).","required":["clusterId","itemId","title","link","sourceType","publishedDate","affectedParties","threatActors","sourceReliability","createdAt","updatedAt","infoLeaked"]}},"components/schemas/EvidenceClearWebCert":{"id":"components/schemas/EvidenceClearWebCert","kind":"json-schema","title":"EvidenceClearWebCert","data":{"type":"object","properties":{"organization":{"type":"string","description":"Organization name from the certificate's Subject field."},"signatureAlgorithm":{"type":"string","description":"Signature algorithm used to sign the certificate (e.g. \"sha256WithRSAEncryption\")."},"notbefore":{"type":"string","description":"Certificate validity start date (ISO-8601 string)."},"notafter":{"type":"string","description":"Certificate expiry date (ISO-8601 string)."},"cn":{"type":"string","description":"Common Name from the certificate's Subject field (typically the primary hostname)."},"issuerName":{"type":"string","description":"Distinguished name of the certificate authority that issued this certificate."},"dataSource":{"type":"string","description":"Feed or scanner that discovered this certificate."}},"description":"X.509 attributes captured from clear-web discovery: subject, validity window, issuer, and provenance source.","required":["organization","signatureAlgorithm","notbefore","notafter","cn","issuerName","dataSource"]}},"components/schemas/EvidenceClearWebEvidence":{"id":"components/schemas/EvidenceClearWebEvidence","kind":"json-schema","title":"EvidenceClearWebEvidence","data":{"type":"object","properties":{"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceClearWebEvidenceObservation"}},"dataSource":{"type":"string"}},"description":"Batched clear-web findings plus the data source that produced them.","required":["observations","dataSource"]}},"components/schemas/EvidenceClearWebEvidenceObservation":{"id":"components/schemas/EvidenceClearWebEvidenceObservation","kind":"json-schema","title":"EvidenceClearWebEvidenceObservation","data":{"type":"object","properties":{"content":{"type":"string"},"match":{"type":"string"},"specific":{"type":"string"}},"description":"Clear-web crawl hit: raw content excerpt, matched pattern, and specificity hint for DLP-style issues.","required":["content","match","specific"]}},"components/schemas/EvidenceCompromisedStealer":{"id":"components/schemas/EvidenceCompromisedStealer","kind":"json-schema","title":"EvidenceCompromisedStealer","data":{"type":"object","properties":{"location":{"type":"string","description":"Country or city where the compromised host was located at the time of infection."},"region":{"type":"string","description":"Sub-national region or state of the compromised host."},"userName":{"type":"string","description":"Username or account name extracted from the stealer log."},"operatingSystem":{"type":"string","description":"Operating system of the compromised host (e.g. \"Windows 10\")."},"eventDate":{"type":"string","description":"Date the stealer malware logged the credential theft (ISO-8601 string)."},"informationLeaked":{"type":"string","description":"Summary of credential types or data categories captured (e.g. \"passwords, cookies\")."}},"description":"Stealer-log style compromise row: geography, host, user, OS, leaked data summary, and event timing.","required":["location","region","userName","operatingSystem","eventDate","informationLeaked"]}},"components/schemas/EvidenceCookie":{"id":"components/schemas/EvidenceCookie","kind":"json-schema","title":"EvidenceCookie","data":{"type":"object","properties":{"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceCookieObservation"}}},"description":"Aggregated risky HTTP cookies for an asset by rolling up repeated EvidenceCookieObservation samples.","required":["observations"]}},"components/schemas/EvidenceCookieObservation":{"id":"components/schemas/EvidenceCookieObservation","kind":"json-schema","title":"EvidenceCookieObservation","data":{"type":"object","properties":{"cookieName":{"type":"string"},"rawCookie":{"type":"string"},"lastSeenAt":{"type":"string","format":"date-time"}},"description":"One sighting of a sensitive HTTP cookie: optional name, raw value, and last time it was observed.","required":["lastSeenAt"]}},"components/schemas/EvidenceDetectedVendor":{"id":"components/schemas/EvidenceDetectedVendor","kind":"json-schema","title":"EvidenceDetectedVendor","data":{"type":"object","properties":{"detectedVendors":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceDetectedVendorObservation"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"One entry per (vendor_asset, vendor_connection_type) tuple derived from this observation"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(with "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"vendor_organization_domain"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" rolling up that asset to its owning organization where"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"available). Empty lists are NOT expected."},"children":[]}]}]}]}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Wrapper carrying all vendor-connection observations derived from a single RawObservation."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A RawObservation is 1:N over the (vendor_asset, vendor_connection_type) tuples exposed here;"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the consumer fan-outs to one storage row per entry in {@code detected_vendors}."},"children":[]}]}]}],"required":["detectedVendors"]}},"components/schemas/EvidenceDetectedVendorObservation":{"id":"components/schemas/EvidenceDetectedVendorObservation","kind":"json-schema","title":"EvidenceDetectedVendorObservation","data":{"type":"object","properties":{"vendorIpAndPort":{"$ref":"#/components/schemas/AssetIpPort"},"vendorUrl":{"$ref":"#/components/schemas/AssetUrl"},"vendorDns":{"$ref":"#/components/schemas/AssetDns"},"vendorOrganizationDomain":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Apex domain of the vendor's owning organization / scorecard (e.g. "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"abc.xyz"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"google.com"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" vendor asset). The producer fills this when it can attribute the vendor asset"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"to a parent organization; left empty otherwise."},"children":[]}]}]}]},"vendorConnectionType":{"$ref":"#/components/schemas/VendorConnectionType"},"vendorConnectionRelationship":{"$ref":"#/components/schemas/VendorConnectionRelationship"},"vendorConnectionDetails":{"$ref":"#/components/schemas/VendorConnectionDetails"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Single customer <-> vendor connection detected on an asset, with connection channel,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"relationship class, and supporting details."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Identity model (TDR: AVD Data Pipeline for Titan, \"Data Model (3rd party)\"):"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The CUSTOMER side of the connection is taken from the enclosing RawObservation: typed"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"RawObservation.asset"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for the customer asset (e.g. the DNS hostname being scored), with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"RawObservation.organization_domain"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" as the customer organization."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The VENDOR side is split into two layers on this message: typed "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"vendor_asset"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"individual endpoint that justified the connection (the apex hostname / IP+port / URL the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"producer extracted from the underlying evidence) and "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"vendor_organization_domain"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" for the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"vendor's owning organization / scorecard apex when attribution is available."},"children":[]}]}]}]}],"required":["vendorOrganizationDomain","vendorConnectionType","vendorConnectionRelationship","vendorConnectionDetails"]}},"components/schemas/EvidenceDomainSquatting":{"id":"components/schemas/EvidenceDomainSquatting","kind":"json-schema","title":"EvidenceDomainSquatting","data":{"type":"object","properties":{"typoSquattedDomain":{"type":"string"},"squattingEvidence":{"type":"string"},"algorithm":{"type":"string"},"method":{"type":"string"},"time":{"type":"string"}},"description":"Typosquat or lookalike domain finding: algorithm metadata, evidence string, and timing of detection.","required":["typoSquattedDomain","squattingEvidence","algorithm","method","time"]}},"components/schemas/EvidenceExploitedProduct":{"id":"components/schemas/EvidenceExploitedProduct","kind":"json-schema","title":"EvidenceExploitedProduct","data":{"type":"object","properties":{"productName":{"type":"string"},"serviceName":{"type":"string"},"cveId":{"type":"string"},"ransomwareName":{"type":"array","items":{"type":"string"}},"productVersion":{"type":"string"},"banner":{"type":"string"}},"description":"Confirmed exploitation context: product, service, CVE, optional ransomware linkage, version, and banner proof.","required":["productName","serviceName","cveId","ransomwareName","productVersion","banner"]}},"components/schemas/EvidenceHackerChatter":{"id":"components/schemas/EvidenceHackerChatter","kind":"json-schema","title":"EvidenceHackerChatter","data":{"type":"object","properties":{"eventDate":{"type":"string"},"evidence":{"type":"array","items":{"type":"string"}},"language":{"type":"string"},"messages":{"type":"array","items":{"type":"string"}},"dataSource":{"type":"string"}},"description":"Underground or forum-style chatter: dated snippets, language, channel/source, and raw message excerpts.","required":["eventDate","evidence","language","messages","dataSource"]}},"components/schemas/EvidenceLeakedCredentialsV2":{"id":"components/schemas/EvidenceLeakedCredentialsV2","kind":"json-schema","title":"EvidenceLeakedCredentialsV2","data":{"type":"object","properties":{"ip":{"type":"string","description":"IP address of the compromised host recorded in the stealer log."},"password":{"type":"string","description":"Leaked password value extracted from the stealer log."},"infectionDate":{"type":"string","description":"Date the stealer malware captured these credentials (ISO-8601 string)."},"userName":{"type":"string","description":"Username or email address associated with the leaked credential."},"url":{"type":"string","description":"Target URL or service for which the credential was captured."},"country":{"type":"string","description":"Country of the compromised host at the time of infection."},"zipCode":{"type":"string","description":"Postal code of the compromised host's reported location."},"location":{"type":"string","description":"City or locality of the compromised host."},"currentLanguage":{"type":"string","description":"System locale or UI language configured on the compromised host."},"os":{"type":"string","description":"Operating system of the compromised host."},"stealerName":{"type":"string","description":"Name of the stealer malware family that captured this credential."},"filename":{"type":"string","description":"Log file or archive name from which this credential row was extracted."}},"description":"Stealer- or breach-derived credential row: user context, geo hints, stealer metadata, and exposure details.","required":["ip","password","infectionDate","userName","url","country","zipCode","location","currentLanguage","os","stealerName","filename"]}},"components/schemas/EvidenceMalware":{"id":"components/schemas/EvidenceMalware","kind":"json-schema","title":"EvidenceMalware","data":{"type":"object","properties":{"family":{"type":"string"},"dstIp":{"type":"string"},"detectionMethods":{"type":"array","items":{"type":"string"}},"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceMalwareObservation"}},"userAgent":{"type":"string"}},"description":"Malware family and network observations aggregated with detection methods and optional user-agent context.","required":["family","dstIp","detectionMethods","observations","userAgent"]}},"components/schemas/EvidenceMalwareObservation":{"id":"components/schemas/EvidenceMalwareObservation","kind":"json-schema","title":"EvidenceMalwareObservation","data":{"type":"object","properties":{"srcIp":{"type":"string","description":"IPv4 source address of the infected or C2-communicating host."},"srcPort":{"type":"integer","format":"int64","description":"Source port of the observed malicious connection."},"srcHost":{"type":"string","description":"Hostname resolved for the source IP, if available."},"dstIp":{"type":"string","description":"IPv4 destination address of the C2 server or targeted host."},"dstIpv6":{"type":"string","description":"IPv6 destination address; reserved for future use.\n\nReserved for the future use."},"dstPort":{"type":"integer","format":"int64","description":"Destination port of the observed malicious connection."},"dstHost":{"type":"string","description":"Hostname resolved for the destination IP, if available."},"protocol":{"type":"string","description":"Transport protocol observed (e.g. \"TCP\", \"UDP\")."},"lastSeenAt":{"type":"string","format":"date-time","description":"When this network flow was last confirmed active."}},"description":"Single-flow malware sighting: endpoints, ports, protocol, and last-seen timestamp for aggregation into EvidenceMalware.","required":["srcIp","srcPort","srcHost","dstIp","dstIpv6","dstPort","dstHost","protocol","lastSeenAt"]}},"components/schemas/EvidenceOpenSSLVuln":{"id":"components/schemas/EvidenceOpenSSLVuln","kind":"json-schema","title":"EvidenceOpenSSLVuln","data":{"type":"object","properties":{"productName":{"type":"string"},"cveId":{"type":"string"},"userAgent":{"type":"string"},"banner":{"type":"string"}},"description":"OpenSSL-specific vulnerability signal: affected product, CVE, client fingerprint, and observed banner.","required":["productName","cveId","userAgent","banner"]}},"components/schemas/EvidencePatchingAnalysis":{"id":"components/schemas/EvidencePatchingAnalysis","kind":"json-schema","title":"EvidencePatchingAnalysis","data":{"type":"object","properties":{"issueCount":{"type":"integer","format":"int64","description":"Total number of open vulnerability observations included in this analysis."},"resolvedIssues":{"type":"integer","format":"int64","description":"Number of observations that have been resolved."},"resolvedPerc":{"type":"integer","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Percentage of observations resolved (0–100)."},"children":[]}]}]}]},"timeToPatchAvg":{"type":"integer","format":"int64","description":"Average number of days taken to patch a vulnerability, across all resolved observations."},"range060":{"type":"integer","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of observations patched within 0–60 days of first detection."},"children":[]}]}]}]},"range61120":{"type":"integer","format":"int64","description":"Number of observations patched between 61 and 120 days of first detection."},"range121180":{"type":"integer","format":"int64","description":"Number of observations patched between 121 and 180 days of first detection."},"rangeOver180":{"type":"integer","format":"int64","description":"Number of observations still unpatched after more than 180 days."}},"description":"Patch velocity statistics for an organization: open vs resolved counts and age bucket histogram.","required":["issueCount","resolvedIssues","resolvedPerc","timeToPatchAvg","range060","range61120","range121180","rangeOver180"]}},"components/schemas/EvidencePotentiallyVulnerable":{"id":"components/schemas/EvidencePotentiallyVulnerable","kind":"json-schema","title":"EvidencePotentiallyVulnerable","data":{"type":"object","properties":{"productName":{"type":"string"},"cveId":{"type":"string"},"banner":{"type":"string"}},"description":"Banner- or fingerprint-based hint that a product build may be affected by a CVE without confirmed exploitation.","required":["productName","cveId","banner"]}},"components/schemas/EvidenceProductObservation":{"id":"components/schemas/EvidenceProductObservation","kind":"json-schema","title":"EvidenceProductObservation","data":{"type":"object","properties":{"part":{"type":"string"},"vendor":{"type":"string"},"product":{"type":"string"},"version":{"type":"string"},"update":{"type":"string"},"edition":{"type":"string"},"language":{"type":"string"},"swEdition":{"type":"string"},"targetSw":{"type":"string"},"targetHw":{"type":"string"},"other":{"type":"string"}},"description":"Single CPE-style software component tuple (vendor/product/version facets) detected on an asset.","required":["part","vendor","product","version","update","edition","language","swEdition","targetSw","targetHw","other"]}},"components/schemas/EvidenceProductsDetected":{"id":"components/schemas/EvidenceProductsDetected","kind":"json-schema","title":"EvidenceProductsDetected","data":{"type":"object","properties":{"products":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceProductObservation"}}},"description":"Full list of CPE component observations aggregated from a product-detection pass.","required":["products"]}},"components/schemas/EvidenceRansomwareAssociation":{"id":"components/schemas/EvidenceRansomwareAssociation","kind":"json-schema","title":"EvidenceRansomwareAssociation","data":{"type":"object","properties":{"services":{"type":"string"},"assets":{"type":"string"}},"description":"Summarizes services and assets tied to a ransomware correlation finding.","required":["services","assets"]}},"components/schemas/EvidenceRansomwareVictim":{"id":"components/schemas/EvidenceRansomwareVictim","kind":"json-schema","title":"EvidenceRansomwareVictim","data":{"type":"object","properties":{"title":{"type":"string","description":"Page title or listing heading as it appeared on the ransomware leak site."},"publishedDate":{"type":"string","description":"Date the victim was listed on the leak site (ISO-8601 string)."},"leakUrl":{"type":"string","description":"URL of the specific leak-site page or post referencing this victim."},"victimSite":{"type":"string","description":"Primary domain of the victim organization as identified on the leak site."},"victimName":{"type":"string","description":"Display name of the victim organization as listed by the threat actor."},"ransomwareName":{"type":"string","description":"Name of the ransomware group or family that claimed this victim."},"year":{"type":"integer","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Calendar year the victim was listed; useful for trend analysis without parsing published_date."},"children":[]}]}]}]}},"description":"Ransomware leak-site style evidence: victim branding, leak URL, family, and publication timeline.","required":["title","publishedDate","leakUrl","victimSite","victimName","ransomwareName","year"]}},"components/schemas/EvidenceSPF":{"id":"components/schemas/EvidenceSPF","kind":"json-schema","title":"EvidenceSPF","data":{"type":"object","properties":{"record":{"type":"string"},"analysis":{"type":"string"},"explanation":{"type":"string"}},"description":"Parsed SPF/DMARC-related DNS record content with human-readable analysis and explanation.","required":["record","analysis","explanation"]}},"components/schemas/EvidenceSSH":{"id":"components/schemas/EvidenceSSH","kind":"json-schema","title":"EvidenceSSH","data":{"type":"object","properties":{"banner":{"type":"string"},"evidence":{"type":"array","items":{"type":"string"}}},"description":"SSH service evidence: negotiated banner plus supporting proof strings from the scan.","required":["banner","evidence"]}},"components/schemas/EvidenceService":{"id":"components/schemas/EvidenceService","kind":"json-schema","title":"EvidenceService","data":{"type":"object","properties":{"productName":{"type":"string"},"productVersion":{"type":"string"},"cloudProvider":{"type":"string"},"region":{"type":"string"},"banner":{"type":"string"}},"description":"Network listener or product fingerprint evidence (name, version, optional cloud/region, raw banner).","required":["productName","productVersion","banner"]}},"components/schemas/EvidenceServiceScan":{"id":"components/schemas/EvidenceServiceScan","kind":"json-schema","title":"EvidenceServiceScan","data":{"type":"object","properties":{"protocol":{"type":"string","description":"Transport or application protocol detected on the port (e.g. \"http\", \"ssh\")."},"method":{"type":"string","description":"Scan or probe method used to identify the service (e.g. \"SYN\", \"version\")."},"name":{"type":"string","description":"Nmap service name matched for this port."},"product":{"type":"string","description":"Identified product or software name (e.g. \"Apache httpd\", \"OpenSSH\")."},"version":{"type":"string","description":"Detected version string of the product."},"tunnel":{"type":"string","description":"Tunnel type wrapping the service, if any (e.g. \"ssl\")."},"serviceFp":{"type":"string","description":"Raw service fingerprint string from the scanner."},"deviceType":{"type":"string","description":"Device category inferred from the fingerprint (e.g. \"router\", \"printer\")."},"osType":{"type":"string","description":"Operating system type inferred from the scan (e.g. \"Linux\", \"Windows\")."},"extraInfo":{"type":"string","description":"Additional scan notes not captured by the structured fields above."},"httpHeader":{"type":"string","description":"HTTP response headers captured during the version probe, if applicable."},"refinedNames":{"type":"array","items":{"type":"string"},"description":"Canonical service names after post-processing or normalization."},"cpes":{"type":"array","items":{"type":"string"},"description":"CPE strings identifying the software stack detected on this service."},"vulnersCpes":{"type":"array","items":{"type":"string"},"description":"CPE strings used specifically by the Vulners vulnerability correlation feed."},"banners":{"type":"array","items":{"type":"string"},"description":"Raw banner strings returned by the service during the scan."}},"description":"Rich Nmap-style service fingerprint: protocol stack, CPE guesses, banners, and HTTP headers.","required":["protocol","method","name","product","version","tunnel","serviceFp","deviceType","osType","extraInfo","httpHeader","refinedNames","cpes","vulnersCpes","banners"]}},"components/schemas/EvidenceSkynet":{"id":"components/schemas/EvidenceSkynet","kind":"json-schema","title":"EvidenceSkynet","data":{"type":"object","properties":{"region":{"type":"string"},"affectedProduct":{"type":"array","items":{"type":"string"}},"attackTarget":{"type":"array","items":{"type":"string"}},"extra":{"type":"string"}},"description":"Skynet-style regional threat context: affected products, attack targets, and supplemental notes.","required":["region","affectedProduct","attackTarget","extra"]}},"components/schemas/EvidenceSynthHighRiskAppsecAccess":{"id":"components/schemas/EvidenceSynthHighRiskAppsecAccess","kind":"json-schema","title":"EvidenceSynthHighRiskAppsecAccess","data":{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"}}},"description":"Synthetic high-risk app-sec signal listing domains that imply dangerous external exposure.","required":["domains"]}},"components/schemas/EvidenceSynthPossibleInitialAccess":{"id":"components/schemas/EvidenceSynthPossibleInitialAccess","kind":"json-schema","title":"EvidenceSynthPossibleInitialAccess","data":{"type":"object","properties":{"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceSynthPossibleInitialAccessObservation"}}},"description":"Aggregated synthetic initial-access hypothesis built from repeated endpoint observations.","required":["observations"]}},"components/schemas/EvidenceSynthPossibleInitialAccessObservation":{"id":"components/schemas/EvidenceSynthPossibleInitialAccessObservation","kind":"json-schema","title":"EvidenceSynthPossibleInitialAccessObservation","data":{"type":"object","properties":{"ip":{"type":"string"},"port":{"type":"integer","format":"int64"},"service":{"type":"string"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"One network endpoint contributing to a synthetic “possible initial access” story (IP, port, service label)."},"children":[]}]}]}],"required":["ip","port","service"]}},"components/schemas/EvidenceTLS":{"id":"components/schemas/EvidenceTLS","kind":"json-schema","title":"EvidenceTLS","data":{"type":"object","properties":{"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceTLSObservation"}}},"description":"Rolled-up TLS evidence across multiple observations of the same logical finding.","required":["observations"]}},"components/schemas/EvidenceTLSObservation":{"id":"components/schemas/EvidenceTLSObservation","kind":"json-schema","title":"EvidenceTLSObservation","data":{"type":"object","properties":{"ip":{"type":"string"},"ipv6":{"type":"string","description":"Reserved for the future use."},"sni":{"type":"string"},"evidence":{"type":"array","items":{"type":"string"}},"lastSeenAt":{"type":"string","format":"date-time"}},"description":"TLS handshake or certificate sighting at a specific IP/SNI with textual proof and last seen time.","required":["ip","ipv6","sni","evidence","lastSeenAt"]}},"components/schemas/EvidenceTorExitNode":{"id":"components/schemas/EvidenceTorExitNode","kind":"json-schema","title":"EvidenceTorExitNode","data":{"type":"object","properties":{"url":{"type":"string"},"evidence":{"type":"array","items":{"type":"string"}},"userAgent":{"type":"string"}},"description":"Tor exit-node usage evidence: source URL, supporting strings, and client user agent when available.","required":["url","evidence","userAgent"]}},"components/schemas/EvidenceVulnerability":{"id":"components/schemas/EvidenceVulnerability","kind":"json-schema","title":"EvidenceVulnerability","data":{"type":"object","properties":{"cveId":{"type":"string"}},"description":"Minimal CVE-focused evidence when the observation is driven by a single vulnerability identifier.","required":["cveId"]}},"components/schemas/EvidenceX509":{"id":"components/schemas/EvidenceX509","kind":"json-schema","title":"EvidenceX509","data":{"type":"object","properties":{"sha256Fingerprint":{"type":"string"},"serialNumber":{"type":"string"},"issuerName":{"type":"string"},"observations":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceX509Observation"}},"evidence":{"type":"array","items":{"type":"string"}}},"description":"Certificate material and observations: fingerprint, serial, issuer, repeated sightings, and proof strings.","required":["sha256Fingerprint","serialNumber","issuerName","observations","evidence"]}},"components/schemas/EvidenceX509Observation":{"id":"components/schemas/EvidenceX509Observation","kind":"json-schema","title":"EvidenceX509Observation","data":{"type":"object","properties":{"ip":{"type":"string"},"ipv6":{"type":"string","description":"Reserved for the future use."},"port":{"type":"integer","format":"int64"},"sni":{"type":"string"},"lastSeenAt":{"type":"string","format":"date-time"}},"description":"Single X.509 presentation on the wire: IP, port, optional SNI, and when the cert was last observed.","required":["ip","ipv6","port","sni","lastSeenAt"]}},"components/schemas/File":{"id":"components/schemas/File","kind":"json-schema","title":"/ File class","data":{"type":"object","properties":{"orn":{"type":"string","description":"ORN identifying this attachment within the platform."},"name":{"type":"string","description":"Original filename as uploaded by the user."},"url":{"type":"string","description":"Pre-signed or permanent URL from which the file can be downloaded."},"size":{"type":"integer","format":"int64","description":"File size in bytes."}},"title":"/ File class","required":["orn","name","url","size"]}},"components/schemas/FilterComparison":{"id":"components/schemas/FilterComparison","kind":"json-schema","title":"FilterComparison","data":{"type":"string","enum":["COMPARISON_UNSPECIFIED","COMPARISON_EQ","COMPARISON_NEQ","COMPARISON_GT","COMPARISON_GTE","COMPARISON_LT","COMPARISON_LTE","COMPARISON_BETWEEN","COMPARISON_CONTAINS"],"default":"COMPARISON_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Predicate operators for comparing a field to one or more literal values (equality, range, substring)."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_GT: Greater than"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_GTE: Greater than or equal"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_LT: Less than"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_LTE: Less than or equal"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_BETWEEN: Between two values (inclusive range)"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"COMPARISON_CONTAINS: Contains substring (case-insensitive)"},"children":[]}]}]}]}]}},"components/schemas/FilterOperator":{"id":"components/schemas/FilterOperator","kind":"json-schema","title":"FilterOperator","data":{"type":"string","enum":["OPERATOR_UNSPECIFIED","OPERATOR_AND","OPERATOR_OR"],"default":"OPERATOR_UNSPECIFIED","description":"Boolean combiner for nested filter lists (match all vs match any)."}},"components/schemas/FilterOptionValue":{"id":"components/schemas/FilterOptionValue","kind":"json-schema","title":"FilterOptionValue","data":{"type":"object","properties":{"label":{"type":"string"},"value":{"$ref":"#/components/schemas/FilterValue"}},"description":"One labeled choice in a filter dropdown, carrying the encoded value clients send back.","required":["label","value"]}},"components/schemas/FilterRangeBounds":{"id":"components/schemas/FilterRangeBounds","kind":"json-schema","title":"FilterRangeBounds","data":{"type":"object","properties":{"numberBounds":{"$ref":"#/components/schemas/NumberRangeBounds"},"dateBounds":{"$ref":"#/components/schemas/DateRangeBounds"}},"description":"Min/max boundaries for a range filter, either numeric or date-based."}},"components/schemas/FilterValue":{"id":"components/schemas/FilterValue","kind":"json-schema","title":"FilterValue","data":{"type":"object","properties":{"stringValue":{"type":"string"},"numberValue":{"type":"number","format":"double"},"boolValue":{"type":"boolean"},"stringListValue":{"$ref":"#/components/schemas/StringList"},"numberRangeValue":{"$ref":"#/components/schemas/NumberRange"},"dateRangeValue":{"$ref":"#/components/schemas/DateRange"},"dateValue":{"type":"string","format":"date-time"}},"description":"Holds the right-hand operand of a filter comparison."}},"components/schemas/FlagObservationsRequest":{"id":"components/schemas/FlagObservationsRequest","kind":"json-schema","title":"FlagObservationsRequest","data":{"type":"object","properties":{"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilter"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter expressions identifying the observations to flag. Used when observation_orns"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"is empty; ignored when observation_orns is non-empty."},"children":[]}]}]}]},"observationOrns":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Explicit ORNs (format: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"orn:<version>:observation:<view>:<key>:<view-owner-domain>"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":") of the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"observations to flag. When non-empty, the server flags exactly these observations and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ignores "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"filters"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":". When empty, the server falls back to selecting observations via "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"filters"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"."},"children":[]}]}]}]}},"description":"Identifies observations to flag using either an explicit ORN list or filter expressions.","required":["filters","observationOrns"]}},"components/schemas/FlagObservationsResponse":{"id":"components/schemas/FlagObservationsResponse","kind":"json-schema","title":"FlagObservationsResponse","data":{"type":"object","properties":{"flaggedCount":{"type":"integer","format":"int32","description":"Number of observations that were newly flagged by this request."},"alreadyFlaggedCount":{"type":"integer","format":"int32","description":"Number of observations that were already flagged before this request."}},"description":"Observation-level flagging result: how many were newly flagged vs already flagged.","required":["flaggedCount","alreadyFlaggedCount"]}},"components/schemas/GetFilterOptionValuesResponse":{"id":"components/schemas/GetFilterOptionValuesResponse","kind":"json-schema","title":"GetFilterOptionValuesResponse","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicFilterableField"},"fieldValues":{"$ref":"#/components/schemas/DiscreteFilterValues"},"totalCount":{"type":"integer","format":"int32","description":"Total number of values available for the field (before pagination)."}},"description":"The discrete values available for the requested field, with a total count for pagination.","required":["field","fieldValues","totalCount"]}},"components/schemas/GetFourthPartiesRequest":{"id":"components/schemas/GetFourthPartiesRequest","kind":"json-schema","title":"GetFourthPartiesRequest","data":{"type":"object","properties":{"sortField":{"type":"string","description":"Field name to sort results by."},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"limit":{"type":"integer","format":"int32","description":"Maximum number of items to return per page."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilter"},"description":"Filter expressions applied to narrow the result set."},"includeFilterOptions":{"type":"boolean","description":"When true, the response includes available filter option values for the current result set."},"vendor":{"type":"string","description":"When set, restricts results to connections originating from this portfolio vendor display name."},"fourthParty":{"type":"string","description":"When set, restricts results to connections pointing at this fourth-party display name."},"isMonitored":{"type":"boolean","description":"When set, restricts results to pairs where the fourth party is (true) or is not (false) directly monitored."}},"description":"Pagination, sort, filters, and optional scoping for the flat fourth-party relationship list.","required":["filters"]}},"components/schemas/GetFourthPartiesResponse":{"id":"components/schemas/GetFourthPartiesResponse","kind":"json-schema","title":"GetFourthPartiesResponse","data":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PublicFourthPartyRelationshipItem"},"description":"One entry per (portfolio vendor, fourth-party domain) pair."},"totalCount":{"type":"integer","format":"int32","description":"Total number of pairs matching the request filters, before pagination."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the current result set; populated when include_filter_options is true."},"children":[]}]}]}]}},"description":"Paginated fourth-party relationship rows with optional filter options.","required":["items","totalCount","filterOptions"]}},"components/schemas/GetFourthPartyGroupsRequest":{"id":"components/schemas/GetFourthPartyGroupsRequest","kind":"json-schema","title":"GetFourthPartyGroupsRequest","data":{"type":"object","properties":{"sortField":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Field name to sort results by (e.g. \"connected_vendor_count\")."},"children":[]}]}]}]},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"limit":{"type":"integer","format":"int32","description":"Maximum number of items to return per page."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilter"},"description":"Filter expressions applied to narrow the result set."},"includeFilterOptions":{"type":"boolean","description":"When true, the response includes available filter option values for the current result set."}},"description":"Pagination, sort, and filters for the grouped fourth-party list.","required":["filters"]}},"components/schemas/GetFourthPartyGroupsResponse":{"id":"components/schemas/GetFourthPartyGroupsResponse","kind":"json-schema","title":"GetFourthPartyGroupsResponse","data":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PublicFourthPartyGroupItem"},"description":"One entry per distinct fourth-party domain observed across the portfolio."},"totalCount":{"type":"integer","format":"int32","description":"Total number of distinct fourth-party domains matching the request filters, before pagination."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the current result set; populated when include_filter_options is true."},"children":[]}]}]}]}},"description":"Paginated grouped fourth-party rows with optional filter options.","required":["items","totalCount","filterOptions"]}},"components/schemas/GetFourthPartyVendorsRequest":{"id":"components/schemas/GetFourthPartyVendorsRequest","kind":"json-schema","title":"GetFourthPartyVendorsRequest","data":{"type":"object","properties":{"fourthParty":{"type":"string","description":"Display name of the fourth party whose connected portfolio vendors are requested."},"sortField":{"type":"string","description":"Field name to sort results by."},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"limit":{"type":"integer","format":"int32","description":"Maximum number of items to return per page."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilter"},"description":"Filter expressions applied to narrow the result set."},"includeFilterOptions":{"type":"boolean","description":"When true, the response includes available filter option values for the current result set."}},"description":"Identifies the fourth party to drill into, plus pagination, sort, and filters.","required":["fourthParty","filters"]}},"components/schemas/GetFourthPartyVendorsResponse":{"id":"components/schemas/GetFourthPartyVendorsResponse","kind":"json-schema","title":"GetFourthPartyVendorsResponse","data":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PublicFourthPartyVendorItem"},"description":"One entry per portfolio vendor with at least one connection to the requested fourth party."},"totalCount":{"type":"integer","format":"int32","description":"Total number of portfolio vendors connected to the requested fourth party, before pagination."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the current result set; populated when include_filter_options is true."},"children":[]}]}]}]}},"description":"Paginated portfolio vendors connecting to the requested fourth party, with optional filter options.","required":["items","totalCount","filterOptions"]}},"components/schemas/GetImpactedCompaniesRequest":{"id":"components/schemas/GetImpactedCompaniesRequest","kind":"json-schema","title":"GetImpactedCompaniesRequest","data":{"type":"object","properties":{"orgDomain":{"type":"string","description":"Domain of the organization the security event belongs to."},"eventId":{"type":"string","description":"Unique identifier of the security event."},"limit":{"type":"integer","format":"int32","description":"Maximum rows to return. When unset, the server defaults to 10."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset into the full list. When unset, defaults to 0."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicSecurityEventFilter"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter expressions applied to the impacted-company rows. For tab filtering,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"use SECURITY_EVENTS_FIELD_IMPACT_REASONING with COMPARISON_EQ and a list value."},"children":[]}]}]}]},"sortField":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Sort key for the returned rows. When unset, the server defaults to impact_reasoning then organization domain."},"children":[]}]}]}]},"sortOrder":{"$ref":"#/components/schemas/SortOrder"}},"description":"Keys, pagination, filters, and sort for listing companies impacted by one security event.","required":["orgDomain","eventId","filters"]}},"components/schemas/GetImpactedCompaniesResponse":{"id":"components/schemas/GetImpactedCompaniesResponse","kind":"json-schema","title":"GetImpactedCompaniesResponse","data":{"type":"object","properties":{"impactedCompanies":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventImpactedCompany"},"description":"Companies impacted by the security event, matching the request filters and pagination."},"totalCount":{"type":"integer","format":"int32","description":"Total rows matching the applied filters, before pagination."},"namedVictimsCount":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of named victims (impact_reasoning in VICTIM_ENTITY or NAMED_VICTIM)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Event-wide; not affected by the applied filters."},"children":[]}]}]}]},"detectedConnectionsCount":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Number of companies with impact_reasoning CONNECTION_DETECTED."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Event-wide; not affected by the applied filters."},"children":[]}]}]}]},"impactedCount":{"type":"integer","format":"int32","description":"Number of companies confirmed impacted. Event-wide; not affected by the applied filters."},"notImpactedCount":{"type":"integer","format":"int32","description":"Number of companies confirmed not impacted. Event-wide; not affected by the applied filters."},"impactedUnknownCount":{"type":"integer","format":"int32","description":"Number of companies whose impacted status is unknown. Event-wide; not affected by the applied filters."},"lastActivityDate":{"type":"string","format":"date-time","description":"Most recent activity across all impacted companies for this event; absent\nwhen no activity has been recorded yet."}},"description":"Summary counts plus paginated rows of companies impacted by a security event.","required":["impactedCompanies","totalCount","namedVictimsCount","detectedConnectionsCount","impactedCount","notImpactedCount","impactedUnknownCount"]}},"components/schemas/GetObservationByOrnResponse":{"id":"components/schemas/GetObservationByOrnResponse","kind":"json-schema","title":"GetObservationByOrnResponse","data":{"type":"object","properties":{"observation":{"$ref":"#/components/schemas/Observation"}},"description":"A single observation record identified by its ORN.","required":["observation"]}},"components/schemas/GetObservationGroupsRequest":{"id":"components/schemas/GetObservationGroupsRequest","kind":"json-schema","title":"GetObservationGroupsRequest","data":{"type":"object","properties":{"sortField":{"type":"string","description":"Field name to sort results by."},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"limit":{"type":"integer","format":"int32","description":"Maximum number of observation groups to return per page."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilter"},"description":"Filter expressions applied to narrow the result set."},"includeFilterOptions":{"type":"boolean","description":"When true, the response includes available filter option values for the current result set."},"queryMode":{"$ref":"#/components/schemas/ObservationsQueryMode"}},"description":"Pagination, filters, and open/resolved mode for listing observation groups on the public API.\nView (VRM vs self) is determined server-side from the caller's entitlement and is not a request input.","required":["filters","queryMode"]}},"components/schemas/GetObservationGroupsResponse":{"id":"components/schemas/GetObservationGroupsResponse","kind":"json-schema","title":"GetObservationGroupsResponse","data":{"type":"object","properties":{"observationGroups":{"type":"array","items":{"$ref":"#/components/schemas/ObservationGroup"},"description":"The observation groups matching the request filters."},"totalCount":{"type":"integer","format":"int32","description":"Total number of observation groups matching the query (before pagination)."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the current result set; populated when include_filter_options is true."},"children":[]}]}]}]}},"description":"Paginated observation groups matching the request filters, with optional filter options.","required":["observationGroups","totalCount","filterOptions"]}},"components/schemas/GetObservationsRequest":{"id":"components/schemas/GetObservationsRequest","kind":"json-schema","title":"GetObservationsRequest","data":{"type":"object","properties":{"sortField":{"type":"string","description":"Field name to sort results by."},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"limit":{"type":"integer","format":"int32","description":"Maximum number of observations to return per page."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination; ignored when cursor is provided."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilter"},"description":"Filter expressions applied to narrow the result set."},"includeFilterOptions":{"type":"boolean","description":"When true, the response includes available filter option values for the current result set."},"queryMode":{"$ref":"#/components/schemas/ObservationsQueryMode"},"cursor":{"type":"string","description":"Opaque cursor for keyset pagination. Set to \"\" to request the first page;\nomit (leave unset) to use offset-based pagination instead."},"observationGroupOrn":{"type":"string","title":"ORN identifying an observation group (format: `orn:<version>:observation:group:<key>:<view-owner-domain>`).\nWhen provided, the server narrows results to observations in that group by appending an\ninternal filter on the observation name key derived from the ORN"}},"description":"Pagination, filters, and open/resolved mode for listing observations on the public API.\nView (VRM vs self) is determined server-side from the caller's entitlement and is not a request input.","required":["filters","queryMode"]}},"components/schemas/GetObservationsResponse":{"id":"components/schemas/GetObservationsResponse","kind":"json-schema","title":"GetObservationsResponse","data":{"type":"object","properties":{"observations":{"type":"array","items":{"$ref":"#/components/schemas/Observation"},"description":"The observations matching the request filters and group."},"totalCount":{"type":"integer","format":"int32","description":"Total number of observations matching the query (before pagination)."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the current result set; populated when include_filter_options is true."},"children":[]}]}]}]},"nextCursor":{"type":"string","description":"Opaque cursor to pass as cursor in the next request. Absent when no further pages exist."}},"description":"Paginated observations matching the request filters, with optional filter options and a cursor for subsequent pages.","required":["observations","totalCount","filterOptions"]}},"components/schemas/GetQuestionnaireResponse":{"id":"components/schemas/GetQuestionnaireResponse","kind":"json-schema","title":"GetQuestionnaireResponse","data":{"type":"object","properties":{"questionnaire":{"$ref":"#/components/schemas/Questionnaire"}},"description":"Response containing the requested questionnaire.","required":["questionnaire"]}},"components/schemas/GetQuestionnaireTemplateResponse":{"id":"components/schemas/GetQuestionnaireTemplateResponse","kind":"json-schema","title":"GetQuestionnaireTemplateResponse","data":{"type":"object","properties":{"template":{"$ref":"#/components/schemas/QuestionnaireTemplate"}},"description":"Response containing the requested questionnaire template.","required":["template"]}},"components/schemas/GetSecurityEventActionsRequest":{"id":"components/schemas/GetSecurityEventActionsRequest","kind":"json-schema","title":"GetSecurityEventActionsRequest","data":{"type":"object","properties":{"orgDomain":{"type":"string","description":"Domain of the organization the security event belongs to."},"eventId":{"type":"string","description":"Unique identifier of the security event."},"vendorDomain":{"type":"string","description":"Domain of the vendor whose action thread is being requested. Required when the\ncaller is resolved to the VRM view."},"vrmDomain":{"type":"string","description":"Domain of the VRM organization whose action thread is being requested. Required\nwhen the caller is resolved to the vendor (self) view."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Keys for fetching a vendor's action feed on a security event. Exactly one of"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"vendor_domain/vrm_domain is required, depending on the server-resolved view: a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VRM-entitled caller must supply vendor_domain (which of its monitored vendors);"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"a non-VRM caller (self/vendor view) must supply vrm_domain (which VRM counterparty)."},"children":[]}]}]}],"required":["orgDomain","eventId"]}},"components/schemas/GetSecurityEventActionsResponse":{"id":"components/schemas/GetSecurityEventActionsResponse","kind":"json-schema","title":"GetSecurityEventActionsResponse","data":{"type":"object","properties":{"entries":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventActivityEntry"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Action entries in descending order by event time (most recent first). Not"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"paginated: bounded by one vendor's workflow activity on one event, the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"scope and cardinality as SecurityEventVendorDetail.communication_log, which"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"returns the same SecurityEventActivityEntry type unpaginated for the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"reason. Revisit if this proves unbounded in practice before promoting past"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the current "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"internal"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" stability."},"children":[]}]}]}]}},"description":"Chronological action feed for a vendor on a security event, newest first.","required":["entries"]}},"components/schemas/GetSecurityEventResponse":{"id":"components/schemas/GetSecurityEventResponse","kind":"json-schema","title":"GetSecurityEventResponse","data":{"type":"object","properties":{"event":{"$ref":"#/components/schemas/SecurityEvent"}},"description":"Single security event matching the requested keys.","required":["event"]}},"components/schemas/GetSecurityEventsFeedRequest":{"id":"components/schemas/GetSecurityEventsFeedRequest","kind":"json-schema","title":"GetSecurityEventsFeedRequest","data":{"type":"object","properties":{"limit":{"type":"integer","format":"int32","description":"Maximum number of security events to return per page. When unset, the server defaults to 10."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination. When unset, defaults to 0."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicSecurityEventFilter"},"description":"Filter expressions applied to narrow the result set."},"sortField":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Field name to sort results by (supports last_updated, first_detected, event_date)."},"children":[]}]}]}]},"sortOrder":{"$ref":"#/components/schemas/SortOrder"},"view":{"$ref":"#/components/schemas/SecurityEventView"}},"description":"Pagination, filters, and sort for listing security events on the public API.\nView (VRM vs vendor) defaults to VRM when unset.","required":["filters"]}},"components/schemas/GetSecurityEventsFeedResponse":{"id":"components/schemas/GetSecurityEventsFeedResponse","kind":"json-schema","title":"GetSecurityEventsFeedResponse","data":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventSummary"},"description":"One page of feed rows in server sort order (may be empty)."},"totalCount":{"type":"integer","format":"int32","description":"Total events matching the request filters, before pagination."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Paginated security events matching the request filters, with the total count"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"matching the query before pagination. An empty events list with total_count"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"of zero is valid when no rows match."},"children":[]}]}]}],"required":["events","totalCount"]}},"components/schemas/GetVendorPortfoliosResponse":{"id":"components/schemas/GetVendorPortfoliosResponse","kind":"json-schema","title":"GetVendorPortfoliosResponse","data":{"type":"object","properties":{"portfolios":{"type":"array","items":{"$ref":"#/components/schemas/VendorPortfolio"},"description":"Active, non-watchlist portfolios the vendor belongs to, on this page."},"totalCount":{"type":"integer","format":"int32","description":"Total number of matching portfolios (before pagination)."},"nextCursor":{"type":"string","description":"Opaque cursor to pass as cursor in the next request. Absent when no further\npages exist."}},"description":"A page of the vendor's portfolios, with paging metadata.","required":["portfolios","totalCount"]}},"components/schemas/GetVendorResponse":{"id":"components/schemas/GetVendorResponse","kind":"json-schema","title":"GetVendorResponse","data":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/vendor.v1.Vendor"}},"description":"Response containing the requested vendor.","required":["vendor"]}},"components/schemas/GetVendorScoresRequest":{"id":"components/schemas/GetVendorScoresRequest","kind":"json-schema","title":"GetVendorScoresRequest","data":{"type":"object","properties":{"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilter"},"description":"Filter selecting which vendor domain(s) to return scores for (required; VENDOR field only)."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Selects one or more vendor domains to fetch scores for. Only a VENDOR field filter is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"supported (EQ for a single domain, or an IN-style string_list_value for a batch); any other"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"filter field is rejected with INVALID_ARGUMENT. VRM entitlement per domain, and the domain"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"count limit, are enforced server-side — not part of this request shape."},"children":[]}]}]}],"required":["filters"]}},"components/schemas/GetVendorScoresResponse":{"id":"components/schemas/GetVendorScoresResponse","kind":"json-schema","title":"GetVendorScoresResponse","data":{"type":"object","properties":{"vendorScores":{"type":"array","items":{"$ref":"#/components/schemas/VendorScoreResult"},"description":"One score result per requested domain the caller is entitled to see; requested domains\nthat are absent were not found or not VRM-entitled (indistinguishable by design)."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Scores for every requested domain the caller is entitled to see. A domain that was requested"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"but omitted from the response was either not found or not VRM-entitled — the two are"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"indistinguishable by design, so this response shape cannot be used as an entitlement oracle."},"children":[]}]}]}],"required":["vendorScores"]}},"components/schemas/GetVendorSecurityEventDetailResponse":{"id":"components/schemas/GetVendorSecurityEventDetailResponse","kind":"json-schema","title":"GetVendorSecurityEventDetailResponse","data":{"type":"object","properties":{"vendorDetail":{"$ref":"#/components/schemas/SecurityEventVendorDetail"}},"description":"Vendor detail payload for a single vendor on a security event.","required":["vendorDetail"]}},"components/schemas/GetVendorSummaryRequest":{"id":"components/schemas/GetVendorSummaryRequest","kind":"json-schema","title":"GetVendorSummaryRequest","data":{"type":"object","properties":{"vendorDomain":{"type":"string","description":"Registered domain of the vendor to look up."},"rangeDays":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Lookback window in days used to compute company_connection_count_change; defaults to 30 when unset."},"children":[]}]}]}]}},"description":"Identifies the vendor to summarize and the lookback window for change counts.","required":["vendorDomain"]}},"components/schemas/GetVendorSummaryResponse":{"id":"components/schemas/GetVendorSummaryResponse","kind":"json-schema","title":"GetVendorSummaryResponse","data":{"type":"object","properties":{"isFourthParty":{"type":"boolean","description":"True when this vendor appears as a fourth party in the caller organization's portfolio AVD data."},"companyConnectionCount":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Total distinct companies this vendor connects to across the full AVD dataset —"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"a global vendor-footprint metric, not limited to the caller's organization or portfolio."},"children":[]}]}]}]},"companyConnectionCountChange":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Net change in company_connection_count over the request's range_days window (can be negative)."},"children":[]}]}]}]},"companyConnectionCountAdded":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Active connections first observed within the request's range_days window (the \"+N new\" additions)."},"children":[]}]}]}]},"monitoredCompanyConnectionCount":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Of company_connection_count, connections to companies directly monitored by the caller's organization."},"children":[]}]}]}]},"unmonitoredCompanyConnectionCount":{"type":"integer","format":"int32","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Of company_connection_count, connections to companies not monitored by the caller's organization."},"children":[]}]}]}]}},"description":"Fourth-party status and company-connection counts for the requested vendor domain.","required":["isFourthParty","companyConnectionCount","companyConnectionCountChange"]}},"components/schemas/ListAuditLogsResponse":{"id":"components/schemas/ListAuditLogsResponse","kind":"json-schema","title":"ListAuditLogsResponse","data":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/PublicAuditLogEvent"}},"nextCursor":{"type":"string","description":"Absent on the last page."}},"description":"A page of audit events, newest first. There is no total count.","required":["items"]}},"components/schemas/ListQuestionnaireTemplatesResponse":{"id":"components/schemas/ListQuestionnaireTemplatesResponse","kind":"json-schema","title":"ListQuestionnaireTemplatesResponse","data":{"type":"object","properties":{"templates":{"type":"array","items":{"$ref":"#/components/schemas/QuestionnaireTemplate"},"description":"The templates visible to the caller, curated for public consumption."},"totalCount":{"type":"integer","format":"int32","description":"Total number of templates visible to the caller (before pagination)."},"nextCursor":{"type":"string","description":"Opaque cursor to pass as cursor in the next request. Absent when no further\npages exist."}},"description":"A page of questionnaire templates visible to the caller's organization, with\npaging metadata.","required":["templates","totalCount"]}},"components/schemas/ListVendorGroupsResponse":{"id":"components/schemas/ListVendorGroupsResponse","kind":"json-schema","title":"ListVendorGroupsResponse","data":{"type":"object","properties":{"vendorGroups":{"type":"array","items":{"$ref":"#/components/schemas/VendorGroup"},"description":"The vendor groups on this page, curated for public consumption, newest first."},"totalCount":{"type":"integer","format":"int32","description":"Total number of groups in the caller's organization (before pagination)."},"nextCursor":{"type":"string","description":"Opaque cursor to pass as cursor in the next request. Absent when no further\npages exist, which is the caller's signal to stop paging."}},"description":"A page of vendor groups from the caller's directory, with paging metadata.","required":["vendorGroups","totalCount"]}},"components/schemas/ListVendorsRequest":{"id":"components/schemas/ListVendorsRequest","kind":"json-schema","title":"ListVendorsRequest","data":{"type":"object","properties":{"limit":{"type":"integer","format":"int32","description":"Maximum number of vendors to return per page. Bounded server-side: values\nabove the server maximum are clamped, and an unset or zero value uses a\nserver default. Must not be negative."},"offset":{"type":"integer","format":"int32","description":"Zero-based offset for page-based pagination; ignored when cursor is\nprovided. Must not be negative."},"cursor":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Opaque pagination cursor, echoed from a prior response's next_cursor."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Set to \"\" or leave unset to request the first page."},"children":[]}]}]}]},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicVendorFilter"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter expressions applied to narrow the result set. Only the fields and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"operators in PublicVendorsFilterableField are accepted; anything else, or a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"tree that exceeds the server's complexity limits, is rejected with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT."},"children":[]}]}]}]},"includeFilterOptions":{"type":"boolean","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"When true, the response includes the available filter option values for the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"caller's directory in filter_options."},"children":[]}]}]}]}},"description":"Pagination inputs for listing vendors from the caller's directory.\nOrganization scope is derived from the access token, not from this message.","required":["filters"]}},"components/schemas/ListVendorsResponse":{"id":"components/schemas/ListVendorsResponse","kind":"json-schema","title":"ListVendorsResponse","data":{"type":"object","properties":{"vendors":{"type":"array","items":{"$ref":"#/components/schemas/vendor.v1.Vendor"},"description":"The vendors on this page, curated for public consumption."},"totalCount":{"type":"integer","format":"int32","description":"Total number of vendors in the caller's directory (before pagination)."},"nextCursor":{"type":"string","description":"Opaque cursor to pass as cursor in the next request. Absent when no further\npages exist."},"filterOptions":{"type":"array","items":{"$ref":"#/components/schemas/PublicVendorFilterOption"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Filter option values available for the caller's directory; populated when"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"include_filter_options is true."},"children":[]}]}]}]}},"description":"A page of vendors from the caller's directory, with paging metadata.","required":["vendors","totalCount","filterOptions"]}},"components/schemas/NumberRange":{"id":"components/schemas/NumberRange","kind":"json-schema","title":"NumberRange","data":{"type":"object","properties":{"min":{"type":"number","format":"double","title":"Inclusive"},"max":{"type":"number","format":"double","title":"Inclusive"}},"description":"Numeric closed interval used for BETWEEN or bounded comparisons on metrics."}},"components/schemas/NumberRangeBounds":{"id":"components/schemas/NumberRangeBounds","kind":"json-schema","title":"NumberRangeBounds","data":{"type":"object","properties":{"minValue":{"type":"number","format":"double","title":"Minimum allowable value (inclusive)"},"maxValue":{"type":"number","format":"double","title":"Maximum allowable value (inclusive)"}},"description":"Minimum and maximum numeric values permitted when constraining a filter."}},"components/schemas/Observation":{"id":"components/schemas/Observation","kind":"json-schema","title":"/ Observation class\n/ Represents an individual observation on a single asset\n/ Designed to unify DNS hostname, URL, (IP, port, proto) tuple\n/ Also contains the evidence because evidence is always tied to an observation","data":{"type":"object","properties":{"observationCategory":{"$ref":"#/components/schemas/ObservationCategory"},"observationType":{"$ref":"#/components/schemas/ObservationType"},"observationGroupIdentifier":{"type":"string","title":"This can be CVE ID or any other identifier that can uniquely identify an observation group with the category and type"},"ownerOrganizationOrn":{"type":"string","title":"`orn:<version>:organization:<top-level domain>`"},"observationGroupOrn":{"type":"string","title":"`orn:<version>:observation:group:[<OBSERVATION_CATEGORY>:<OBSERVATION_TYPE>:CVE-1234-567]:<top-level domain>`"},"observationOrn":{"type":"string","title":"`orn:<version>:observation:[<OBSERVATION_CATEGORY>:<OBSERVATION_TYPE>:CVE-1234-567]:[<ASSET_TYPE_IP_PORT:<address>:<port>:<protocol> | ASSET_TYPE_URL:<url> | ASSET_TYPE_DNS:<dns_type>:<domain>>]:<top-level domain>`"},"assetName":{"type":"string","title":"display name which is either ip, url or domain"},"assetType":{"$ref":"#/components/schemas/AssetType"},"firstSeen":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time","title":"(ai-generated)"},"ipAndPort":{"$ref":"#/components/schemas/AssetIpPort"},"url":{"$ref":"#/components/schemas/AssetUrl"},"dns":{"$ref":"#/components/schemas/AssetDns"},"severity":{"$ref":"#/components/schemas/ObservationSeverity"},"evidence":{"$ref":"#/components/schemas/Evidence"},"impact":{"$ref":"#/components/schemas/ObservationImpact"},"remediationStatus":{"$ref":"#/components/schemas/RemediationStatus"},"approvalStatus":{"$ref":"#/components/schemas/ApprovalStatus"},"vendor":{"$ref":"#/components/schemas/observation.v1.Vendor"},"requestors":{"type":"array","items":{"$ref":"#/components/schemas/Requestor"},"title":"only in Vendor view"},"requestorsCount":{"type":"integer","format":"int32","title":"only in Vendor view"},"message":{"type":"string","title":"The latest remediation action message if available"},"attachments":{"type":"array","items":{"$ref":"#/components/schemas/File"}},"flagged":{"type":"boolean","title":"only in VRM view"},"resolvedAt":{"type":"string","format":"date-time","title":"only in VRM Resolved view"},"updatedAt":{"type":"string","format":"date-time"},"vendorDisplayName":{"type":"string","title":"vendor display name"},"vendorLogoIcon":{"type":"string","title":"vendor logo icon"},"portfolioIds":{"type":"array","items":{"type":"string"},"title":"portfolio ids"},"cve":{"$ref":"#/components/schemas/VulnerabilityDetail"},"name":{"type":"string","title":"user friendly display name for the observation"},"observationDetails":{"$ref":"#/components/schemas/ObservationDetails"},"observationStatus":{"$ref":"#/components/schemas/ObservationStatus"}},"title":"/ Observation class\n/ Represents an individual observation on a single asset\n/ Designed to unify DNS hostname, URL, (IP, port, proto) tuple\n/ Also contains the evidence because evidence is always tied to an observation","required":["observationCategory","observationType","observationGroupIdentifier","ownerOrganizationOrn","observationGroupOrn","observationOrn","assetName","assetType","firstSeen","lastSeen","severity","evidence","remediationStatus","requestors","attachments","portfolioIds","name","observationStatus"]}},"components/schemas/ObservationBreachRisk":{"id":"components/schemas/ObservationBreachRisk","kind":"json-schema","title":"/ ObservationBreachRisk enumeration","data":{"type":"string","enum":["OBSERVATION_BREACH_RISK_UNSPECIFIED","OBSERVATION_BREACH_RISK_INFO","OBSERVATION_BREACH_RISK_LOW","OBSERVATION_BREACH_RISK_MEDIUM","OBSERVATION_BREACH_RISK_HIGH","OBSERVATION_BREACH_RISK_CRITICAL"],"default":"OBSERVATION_BREACH_RISK_UNSPECIFIED","title":"/ ObservationBreachRisk enumeration"}},"components/schemas/ObservationCategory":{"id":"components/schemas/ObservationCategory","kind":"json-schema","title":"/ ObservationCategory enumeration","data":{"type":"string","enum":["OBSERVATION_CATEGORY_UNSPECIFIED","OBSERVATION_CATEGORY_APPLICATION_SECURITY","OBSERVATION_CATEGORY_NETWORK_SECURITY","OBSERVATION_CATEGORY_DNS_HEALTH","OBSERVATION_CATEGORY_INFORMATION_LEAK","OBSERVATION_CATEGORY_VULNERABILITY"],"default":"OBSERVATION_CATEGORY_UNSPECIFIED","title":"/ ObservationCategory enumeration"}},"components/schemas/ObservationDetails":{"id":"components/schemas/ObservationDetails","kind":"json-schema","title":"/ ObservationDetails class","data":{"type":"object","properties":{"title":{"type":"string"},"longDescription":{"type":"string"},"shortDescription":{"type":"string"},"recommendation":{"type":"string"}},"title":"/ ObservationDetails class","required":["title","longDescription","shortDescription","recommendation"]}},"components/schemas/ObservationGroup":{"id":"components/schemas/ObservationGroup","kind":"json-schema","title":"ObservationGroup","data":{"type":"object","properties":{"observationGroupOrn":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ORN identifying this observation group (format: "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"orn:<version>:observation:group:<key>:<view-owner-domain>"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":")."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Pass this to GetObservations' observation_group_orn field to list the group's individual observations."},"children":[]}]}]}]},"name":{"type":"string","description":"Customer-facing name for the group (e.g. the vulnerability/observation name)."},"cve":{"$ref":"#/components/schemas/VulnerabilityDetail"},"severity":{"$ref":"#/components/schemas/ObservationSeverity"},"remediationStatus":{"$ref":"#/components/schemas/RemediationStatus"},"observationCategory":{"$ref":"#/components/schemas/ObservationCategory"},"observationType":{"$ref":"#/components/schemas/ObservationType"},"observationsCount":{"type":"integer","format":"int32","description":"Count of observations rolled up into this group."}},"description":"A rollup of observations sharing the same vulnerability/name key (e.g. all findings for a\nsingle CVE), with aggregate counts across the underlying observations.","required":["observationGroupOrn","name","cve","severity","remediationStatus","observationCategory","observationType","observationsCount"]}},"components/schemas/ObservationImpact":{"id":"components/schemas/ObservationImpact","kind":"json-schema","title":"ObservationImpact","data":{"type":"object","properties":{"v3":{"$ref":"#/components/schemas/ObservationImpactV3"}},"description":"Forward-compatible container for business impact; selects the active encoding (v3 numeric impact today)."}},"components/schemas/ObservationImpactV3":{"id":"components/schemas/ObservationImpactV3","kind":"json-schema","title":"ObservationImpactV3","data":{"type":"object","properties":{"impact":{"type":"integer","format":"int32"}},"description":"Numeric business-impact score used in newer observation payloads (complements threat/breach severity).","required":["impact"]}},"components/schemas/ObservationSeverity":{"id":"components/schemas/ObservationSeverity","kind":"json-schema","title":"ObservationSeverity","data":{"type":"object","properties":{"v3":{"$ref":"#/components/schemas/ObservationSeverityV3"}},"description":"Optional wrapper so clients can consume v3 severity without breaking when future versions are added."}},"components/schemas/ObservationSeverityV3":{"id":"components/schemas/ObservationSeverityV3","kind":"json-schema","title":"ObservationSeverityV3","data":{"type":"object","properties":{"threatLevel":{"$ref":"#/components/schemas/ObservationThreatLevel"},"breachRisk":{"$ref":"#/components/schemas/ObservationBreachRisk"}},"description":"Paired threat level and breach-risk labels that form the v3 severity model for an observation.","required":["threatLevel","breachRisk"]}},"components/schemas/ObservationStatus":{"id":"components/schemas/ObservationStatus","kind":"json-schema","title":"ObservationStatus","data":{"type":"string","enum":["OBSERVATION_STATUS_UNSPECIFIED","OBSERVATION_STATUS_OPEN","OBSERVATION_STATUS_RESOLVED","OBSERVATION_STATUS_IN_PROGRESS","OBSERVATION_STATUS_PENDING_SSC_REVIEW","OBSERVATION_STATUS_REOPENED","OBSERVATION_STATUS_DECAYED","OBSERVATION_STATUS_ASSET_DEATTRIBUTED"],"default":"OBSERVATION_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"High-level workflow state of an observation for UX and reporting (open, resolved, pending review, decayed, etc.)."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_OPEN: Open: Vendor Action = NULL."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_RESOLVED: Vendor Action in {Fixed, Compensating Control, Cannot Reproduce, [Blank]} AND SSC accepted."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OR VRM “My Action” = Risk Accepted"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_IN_PROGRESS: In Progress: Vendor Action = Investigating."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_PENDING_SSC_REVIEW: Pending SSC Review: Vendor Action in {Fixed, Compensating Control, Cannot Reproduce}, awaiting SSC decision."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_REOPENED: Reopened: SSC denied the vendor response and Vendor Action becomes empty again (history shows what it was)"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_DECAYED: SSC no longer observes the issue; decayed reason recorded."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_STATUS_ASSET_DEATTRIBUTED: SSC modified the attribution of the asset to the vendor that removed the observation."},"children":[]}]}]}]}]}},"components/schemas/ObservationThreatLevel":{"id":"components/schemas/ObservationThreatLevel","kind":"json-schema","title":"/ ObservationThreatLevel enumeration","data":{"type":"string","enum":["OBSERVATION_THREAT_LEVEL_UNSPECIFIED","OBSERVATION_THREAT_LEVEL_INFO","OBSERVATION_THREAT_LEVEL_LOW","OBSERVATION_THREAT_LEVEL_MEDIUM","OBSERVATION_THREAT_LEVEL_HIGH","OBSERVATION_THREAT_LEVEL_CRITICAL"],"default":"OBSERVATION_THREAT_LEVEL_UNSPECIFIED","title":"/ ObservationThreatLevel enumeration"}},"components/schemas/ObservationType":{"id":"components/schemas/ObservationType","kind":"json-schema","title":"/ ObservationType enumeration","data":{"type":"string","enum":["OBSERVATION_TYPE_UNSPECIFIED","OBSERVATION_TYPE_VULNERABILITY","OBSERVATION_TYPE_APPLICATION_MISCONFIGURATION","OBSERVATION_TYPE_DNS_MISCONFIGURATION","OBSERVATION_TYPE_INFORMATION_LEAK","OBSERVATION_TYPE_INSECURE_ENDPOINT","OBSERVATION_TYPE_OUT_OF_DATE_PRODUCTS","OBSERVATION_TYPE_POTENTIAL_COMPROMISE","OBSERVATION_TYPE_TYPOSQUATTING","OBSERVATION_TYPE_BREACH"],"default":"OBSERVATION_TYPE_UNSPECIFIED","title":"/ ObservationType enumeration"}},"components/schemas/ObservationsQueryMode":{"id":"components/schemas/ObservationsQueryMode","kind":"json-schema","title":"ObservationsQueryMode","data":{"type":"string","enum":["OBSERVATIONS_QUERY_MODE_UNSPECIFIED","OBSERVATIONS_QUERY_MODE_OPEN","OBSERVATIONS_QUERY_MODE_RESOLVED"],"default":"OBSERVATIONS_QUERY_MODE_UNSPECIFIED","description":"Whether list endpoints return open items, resolved items, or an unspecified default."}},"components/schemas/OffboardVendorBody":{"id":"components/schemas/OffboardVendorBody","kind":"json-schema","title":"OffboardVendorBody","data":{"type":"object","properties":{"reason":{"type":"string","description":"Optional caller-supplied audit reason recorded with the offboarding action."}},"description":"Request to offboard a vendor already in the caller's directory.\nOrganization scope is derived from the access token, not from this message."}},"components/schemas/OffboardVendorResponse":{"id":"components/schemas/OffboardVendorResponse","kind":"json-schema","title":"OffboardVendorResponse","data":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/vendor.v1.Vendor"}},"description":"Response containing the offboarded vendor.","required":["vendor"]}},"components/schemas/PublicAuditLogAction":{"id":"components/schemas/PublicAuditLogAction","kind":"json-schema","title":"PublicAuditLogAction","data":{"type":"string","enum":["PUBLIC_AUDIT_LOG_ACTION_UNSPECIFIED","PUBLIC_AUDIT_LOG_ACTION_CREATE","PUBLIC_AUDIT_LOG_ACTION_UPDATE","PUBLIC_AUDIT_LOG_ACTION_DELETE","PUBLIC_AUDIT_LOG_ACTION_LOGIN","PUBLIC_AUDIT_LOG_ACTION_LOGOUT","PUBLIC_AUDIT_LOG_ACTION_ENABLE","PUBLIC_AUDIT_LOG_ACTION_DISABLE","PUBLIC_AUDIT_LOG_ACTION_EXPORT","PUBLIC_AUDIT_LOG_ACTION_GENERATE","PUBLIC_AUDIT_LOG_ACTION_VIEW","PUBLIC_AUDIT_LOG_ACTION_ADD","PUBLIC_AUDIT_LOG_ACTION_REMOVE","PUBLIC_AUDIT_LOG_ACTION_IMPERSONATE","PUBLIC_AUDIT_LOG_ACTION_RESTORE","PUBLIC_AUDIT_LOG_ACTION_PURGE","PUBLIC_AUDIT_LOG_ACTION_DUPLICATE","PUBLIC_AUDIT_LOG_ACTION_RENAME","PUBLIC_AUDIT_LOG_ACTION_MOVE","PUBLIC_AUDIT_LOG_ACTION_REVOKE","PUBLIC_AUDIT_LOG_ACTION_ARCHIVE","PUBLIC_AUDIT_LOG_ACTION_UNARCHIVE","PUBLIC_AUDIT_LOG_ACTION_SEND","PUBLIC_AUDIT_LOG_ACTION_MARK_READ","PUBLIC_AUDIT_LOG_ACTION_RECEIVE","PUBLIC_AUDIT_LOG_ACTION_DOWNLOAD","PUBLIC_AUDIT_LOG_ACTION_BULK","PUBLIC_AUDIT_LOG_ACTION_BOUNCE","PUBLIC_AUDIT_LOG_ACTION_OPEN","PUBLIC_AUDIT_LOG_ACTION_CLICK","PUBLIC_AUDIT_LOG_ACTION_SPAM","PUBLIC_AUDIT_LOG_ACTION_REJECT","PUBLIC_AUDIT_LOG_ACTION_ACCESS_DENIED"],"default":"PUBLIC_AUDIT_LOG_ACTION_UNSPECIFIED","description":"Allow-listed action verbs. An event recorded with an unlisted verb is\nreturned as UNSPECIFIED rather than dropped."}},"components/schemas/PublicAuditLogActor":{"id":"components/schemas/PublicAuditLogActor","kind":"json-schema","title":"PublicAuditLogActor","data":{"type":"object","properties":{"userId":{"type":"string"},"name":{"type":"string"},"email":{"type":"string"}},"description":"Principal who performed an audited action."}},"components/schemas/PublicAuditLogEntityType":{"id":"components/schemas/PublicAuditLogEntityType","kind":"json-schema","title":"PublicAuditLogEntityType","data":{"type":"string","enum":["PUBLIC_AUDIT_LOG_ENTITY_TYPE_UNSPECIFIED","PUBLIC_AUDIT_LOG_ENTITY_TYPE_USER","PUBLIC_AUDIT_LOG_ENTITY_TYPE_TEAM","PUBLIC_AUDIT_LOG_ENTITY_TYPE_LOGIN","PUBLIC_AUDIT_LOG_ENTITY_TYPE_MFA","PUBLIC_AUDIT_LOG_ENTITY_TYPE_SCIM","PUBLIC_AUDIT_LOG_ENTITY_TYPE_ACCESS_TOKEN","PUBLIC_AUDIT_LOG_ENTITY_TYPE_INVITE","PUBLIC_AUDIT_LOG_ENTITY_TYPE_ORGANIZATION","PUBLIC_AUDIT_LOG_ENTITY_TYPE_PORTFOLIO","PUBLIC_AUDIT_LOG_ENTITY_TYPE_REPORT","PUBLIC_AUDIT_LOG_ENTITY_TYPE_SCORECARD","PUBLIC_AUDIT_LOG_ENTITY_TYPE_AUTH_POLICY","PUBLIC_AUDIT_LOG_ENTITY_TYPE_CUSTOM_FIELD","PUBLIC_AUDIT_LOG_ENTITY_TYPE_DASHBOARD","PUBLIC_AUDIT_LOG_ENTITY_TYPE_RULE","PUBLIC_AUDIT_LOG_ENTITY_TYPE_TEMPLATE","PUBLIC_AUDIT_LOG_ENTITY_TYPE_USER_SETTING","PUBLIC_AUDIT_LOG_ENTITY_TYPE_CONVERSATION","PUBLIC_AUDIT_LOG_ENTITY_TYPE_MESSAGE","PUBLIC_AUDIT_LOG_ENTITY_TYPE_EMAIL_EVENT","PUBLIC_AUDIT_LOG_ENTITY_TYPE_INBOUND_EMAIL","PUBLIC_AUDIT_LOG_ENTITY_TYPE_FILE","PUBLIC_AUDIT_LOG_ENTITY_TYPE_FOLDER","PUBLIC_AUDIT_LOG_ENTITY_TYPE_FILE_VERSION","PUBLIC_AUDIT_LOG_ENTITY_TYPE_VAULT","PUBLIC_AUDIT_LOG_ENTITY_TYPE_SHARE"],"default":"PUBLIC_AUDIT_LOG_ENTITY_TYPE_UNSPECIFIED","description":"Allow-listed target resource kinds. An unlisted kind is returned as\nUNSPECIFIED rather than dropped."}},"components/schemas/PublicAuditLogEvent":{"id":"components/schemas/PublicAuditLogEvent","kind":"json-schema","title":"PublicAuditLogEvent","data":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"service":{"$ref":"#/components/schemas/PublicAuditLogProductArea"},"action":{"$ref":"#/components/schemas/PublicAuditLogAction"},"actor":{"$ref":"#/components/schemas/PublicAuditLogActor"},"organization":{"$ref":"#/components/schemas/PublicAuditLogOrganization"},"target":{"$ref":"#/components/schemas/PublicAuditLogTarget"},"result":{"$ref":"#/components/schemas/PublicAuditLogResult"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A single audit event: who did what, to what, and whether it succeeded."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Curated projection of the internal record — raw request bodies, caller IP and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"user agent, failure diagnostics, HTTP method and route, correlation ids,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"storage metadata, and internal service names are never returned."},"children":[]}]}]}],"required":["service","action","result"]}},"components/schemas/PublicAuditLogOrganization":{"id":"components/schemas/PublicAuditLogOrganization","kind":"json-schema","title":"PublicAuditLogOrganization","data":{"type":"object","properties":{"name":{"type":"string"},"domain":{"type":"string"}},"description":"Organization the audited action belongs to."}},"components/schemas/PublicAuditLogProductArea":{"id":"components/schemas/PublicAuditLogProductArea","kind":"json-schema","title":"PublicAuditLogProductArea","data":{"type":"string","enum":["PUBLIC_AUDIT_LOG_PRODUCT_AREA_UNSPECIFIED","PUBLIC_AUDIT_LOG_PRODUCT_AREA_USERS","PUBLIC_AUDIT_LOG_PRODUCT_AREA_PORTFOLIOS","PUBLIC_AUDIT_LOG_PRODUCT_AREA_REPORTS","PUBLIC_AUDIT_LOG_PRODUCT_AREA_SCORECARDS","PUBLIC_AUDIT_LOG_PRODUCT_AREA_REPORTING","PUBLIC_AUDIT_LOG_PRODUCT_AREA_NOTIFICATIONS","PUBLIC_AUDIT_LOG_PRODUCT_AREA_FILE_VAULT","PUBLIC_AUDIT_LOG_PRODUCT_AREA_RULES_MANAGEMENT"],"default":"PUBLIC_AUDIT_LOG_PRODUCT_AREA_UNSPECIFIED","description":"Customer-facing product areas whose audit events are readable. Exactly one\nscopes every ListAuditLogs call. Internal service names are never exposed."}},"components/schemas/PublicAuditLogResult":{"id":"components/schemas/PublicAuditLogResult","kind":"json-schema","title":"PublicAuditLogResult","data":{"type":"string","enum":["PUBLIC_AUDIT_LOG_RESULT_UNSPECIFIED","PUBLIC_AUDIT_LOG_RESULT_SUCCESS","PUBLIC_AUDIT_LOG_RESULT_FAILURE"],"default":"PUBLIC_AUDIT_LOG_RESULT_UNSPECIFIED","description":"Outcome of an audited action."}},"components/schemas/PublicAuditLogTarget":{"id":"components/schemas/PublicAuditLogTarget","kind":"json-schema","title":"PublicAuditLogTarget","data":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/PublicAuditLogEntityType"},"ids":{"type":"array","items":{"type":"string"}},"display":{"type":"string","description":"For display only; wording is not part of the contract."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Resource an audited action was performed on. "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"ids"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" is repeated so one bulk"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"action can name every resource it touched."},"children":[]}]}]}],"required":["type","ids"]}},"components/schemas/PublicAvdFilter":{"id":"components/schemas/PublicAvdFilter","kind":"json-schema","title":"PublicAvdFilter","data":{"type":"object","properties":{"list":{"$ref":"#/components/schemas/PublicAvdFilterList"},"rule":{"$ref":"#/components/schemas/PublicAvdFilterRule"}},"description":"A single node in a public AVD filter tree: either a composite group or an atomic rule."}},"components/schemas/PublicAvdFilterList":{"id":"components/schemas/PublicAvdFilterList","kind":"json-schema","title":"PublicAvdFilterList","data":{"type":"object","properties":{"operator":{"$ref":"#/components/schemas/FilterOperator"},"isNegated":{"type":"boolean","description":"When true, the combined result of the child filters is negated (logical NOT)."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicAvdFilter"},"description":"Child filters combined by the operator."}},"description":"Nested boolean group: AND/OR of child public AVD filters with optional negation.","required":["filters"]}},"components/schemas/PublicAvdFilterOption":{"id":"components/schemas/PublicAvdFilterOption","kind":"json-schema","title":"PublicAvdFilterOption","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicAvdFilterableFieldRef"},"comparisons":{"type":"array","items":{"$ref":"#/components/schemas/FilterComparison"},"description":"Comparison operators valid for this field."},"fieldValues":{"$ref":"#/components/schemas/DiscreteFilterValues"},"fieldRange":{"$ref":"#/components/schemas/FilterRangeBounds"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Describes a public AVD filterable field's allowed comparisons and available discrete values."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returned in list responses when include_filter_options is true."},"children":[]}]}]}],"required":["comparisons"]}},"components/schemas/PublicAvdFilterRule":{"id":"components/schemas/PublicAvdFilterRule","kind":"json-schema","title":"PublicAvdFilterRule","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicAvdFilterableFieldRef"},"comparison":{"$ref":"#/components/schemas/FilterComparison"},"value":{"$ref":"#/components/schemas/FilterValue"}},"description":"Single predicate: which public AVD field, how to compare, and the bound value."}},"components/schemas/PublicAvdFilterableField":{"id":"components/schemas/PublicAvdFilterableField","kind":"json-schema","title":"PublicAvdFilterableField","data":{"type":"string","enum":["AVD_FIELD_UNSPECIFIED","AVD_FIELD_IS_MONITORED","AVD_FIELD_FOURTH_PARTY","AVD_FIELD_VENDOR","AVD_FIELD_DETECTION_METHOD","AVD_FIELD_FIRST_DETECTED","AVD_FIELD_LAST_DETECTED","AVD_FIELD_PORTFOLIO"],"default":"AVD_FIELD_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD (Automatic Vendor Detection) fields that external callers may filter on"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"via the public API. The server maps each value to its internal counterpart."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Shared across all public API versions — new fields are added here additively."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Access control: the public AVD handlers in factor-svc-observations always"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"derive "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"allowed_domains"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" from the caller's auth metadata and bound every"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"query to it BEFORE any caller-supplied filter is applied, so a filter can"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only match fourth-party data the caller is already entitled to read. No"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"additional per-value validation of caller-supplied domains is required at"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the public layer."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_UNSPECIFIED: Default zero value; no filterable field selected (unset sentinel)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_IS_MONITORED: Whether the fourth-party domain is also directly monitored by the caller's organization."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_FOURTH_PARTY: Fourth-party display name or registered domain."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_VENDOR: Portfolio vendor display name or registered domain."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_DETECTION_METHOD: Connection method by which the vendor -> fourth-party relationship was observed (e.g. HTTP, DNS, LIBRARY)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_FIRST_DETECTED: Timestamp of the earliest observed connection; supports BETWEEN, GTE, LTE."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_LAST_DETECTED: Timestamp of the most recent observed connection; supports BETWEEN, GTE, LTE."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"AVD_FIELD_PORTFOLIO: Portfolio id(s) the connection belongs to; matches if any value matches."},"children":[]}]}]}]}]}},"components/schemas/PublicAvdFilterableFieldRef":{"id":"components/schemas/PublicAvdFilterableFieldRef","kind":"json-schema","title":"PublicAvdFilterableFieldRef","data":{"type":"object","properties":{"avdField":{"$ref":"#/components/schemas/PublicAvdFilterableField"}},"description":"Wraps the public AVD field reference used as a filter target."}},"components/schemas/PublicFilter":{"id":"components/schemas/PublicFilter","kind":"json-schema","title":"PublicFilter","data":{"type":"object","properties":{"list":{"$ref":"#/components/schemas/PublicFilterList"},"rule":{"$ref":"#/components/schemas/PublicFilterRule"}},"description":"A single node in a public filter tree: either a composite group or an atomic rule."}},"components/schemas/PublicFilterList":{"id":"components/schemas/PublicFilterList","kind":"json-schema","title":"PublicFilterList","data":{"type":"object","properties":{"operator":{"$ref":"#/components/schemas/FilterOperator"},"isNegated":{"type":"boolean","description":"When true, the combined result of child filters is negated (logical NOT)."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicFilter"},"description":"Child filters combined by the operator."}},"description":"Nested boolean group: AND/OR of child public filters with optional negation.","required":["filters"]}},"components/schemas/PublicFilterOption":{"id":"components/schemas/PublicFilterOption","kind":"json-schema","title":"PublicFilterOption","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicFilterableField"},"comparisons":{"type":"array","items":{"$ref":"#/components/schemas/FilterComparison"},"description":"Comparison operators valid for this field."},"fieldValues":{"$ref":"#/components/schemas/DiscreteFilterValues"},"fieldRange":{"$ref":"#/components/schemas/FilterRangeBounds"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Describes a public filterable field's allowed comparisons and available discrete values."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returned in GetObservationsResponse when include_filter_options is true."},"children":[]}]}]}],"required":["comparisons"]}},"components/schemas/PublicFilterRule":{"id":"components/schemas/PublicFilterRule","kind":"json-schema","title":"PublicFilterRule","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicFilterableField"},"comparison":{"$ref":"#/components/schemas/FilterComparison"},"value":{"$ref":"#/components/schemas/FilterValue"}},"description":"Single predicate: which public field, how to compare, and the bound value."}},"components/schemas/PublicFilterableField":{"id":"components/schemas/PublicFilterableField","kind":"json-schema","title":"PublicFilterableField","data":{"type":"object","properties":{"observationsField":{"$ref":"#/components/schemas/PublicObservationsFilterableField"}},"description":"Wraps the public observation field reference used as a filter target."}},"components/schemas/PublicFourthPartyGroupItem":{"id":"components/schemas/PublicFourthPartyGroupItem","kind":"json-schema","title":"PublicFourthPartyGroupItem","data":{"type":"object","properties":{"fourthParty":{"type":"string","description":"Display name of the fourth party; falls back to the domain when unavailable."},"isMonitored":{"type":"boolean","description":"True when the fourth-party domain is also directly monitored by the caller's organization."},"connectedVendorCount":{"type":"integer","format":"int32","description":"Number of portfolio vendors that have at least one connection to this fourth party."},"vendorTotal":{"type":"integer","format":"int32","description":"Total number of vendors in the caller's portfolio (denominator for coverage)."},"vendorSample":{"type":"array","items":{"$ref":"#/components/schemas/PublicFourthPartyVendorSample"},"description":"A small preview subset of the portfolio vendors connecting to this fourth party."},"fourthPartyLogoUrl":{"type":"string","description":"URL of the fourth-party company logo, sourced from the legal entities service."},"fourthPartyDomain":{"type":"string","description":"Registered domain of the fourth party; use for lookups/linking rather than the display name."}},"description":"One row in the grouped fourth-party view: aggregates all portfolio vendors\nthat connect to a single fourth-party domain.","required":["fourthParty","isMonitored","connectedVendorCount","vendorTotal","vendorSample","fourthPartyLogoUrl"]}},"components/schemas/PublicFourthPartyRelationshipItem":{"id":"components/schemas/PublicFourthPartyRelationshipItem","kind":"json-schema","title":"PublicFourthPartyRelationshipItem","data":{"type":"object","properties":{"vendor":{"type":"string","description":"Display name of the portfolio vendor originating the connection; falls back to the domain."},"fourthParty":{"type":"string","description":"Display name of the fourth party reached by the vendor; falls back to the domain."},"isMonitored":{"type":"boolean","description":"True when the fourth-party domain is also directly monitored by the caller's organization."},"connectionMethods":{"type":"array","items":{"type":"string"},"description":"Stable codes identifying the connection method(s) observed (e.g. \"HTTP\", \"DNS\", \"LIBRARY\")."},"firstSeen":{"type":"string","format":"date-time","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Earliest timestamp at which this vendor -> fourth-party connection was observed."},"children":[]}]}]}]},"lastSeen":{"type":"string","format":"date-time","description":"Most recent timestamp at which this connection was observed."},"vendorLogoUrl":{"type":"string","description":"URL of the portfolio vendor's company logo, sourced from the legal entities service."},"fourthPartyLogoUrl":{"type":"string","description":"URL of the fourth-party company logo, sourced from the legal entities service."},"vendorDomain":{"type":"string","description":"Registered domain of the portfolio vendor; use for lookups/linking rather than the display name."},"fourthPartyDomain":{"type":"string","description":"Registered domain of the fourth party; use for lookups/linking rather than the display name."}},"description":"A single connection between a portfolio vendor and a fourth-party domain,\nwith the connection signals and temporal bounds observed for that pair.","required":["vendor","fourthParty","isMonitored","connectionMethods","firstSeen","lastSeen","vendorLogoUrl","fourthPartyLogoUrl"]}},"components/schemas/PublicFourthPartyVendorItem":{"id":"components/schemas/PublicFourthPartyVendorItem","kind":"json-schema","title":"PublicFourthPartyVendorItem","data":{"type":"object","properties":{"vendorDomain":{"type":"string","description":"Registered domain of the portfolio vendor."},"lastSeen":{"type":"string","format":"date-time","description":"Most recent timestamp at which any connection from this vendor to the requested fourth party was observed."},"vendorName":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Display name of the portfolio vendor; falls back to vendor_domain when unavailable."},"children":[]}]}]}]},"connectionCount":{"type":"integer","format":"int32","description":"Number of connections from this vendor to the requested fourth party, across all connection methods."}},"description":"One portfolio vendor that connects to a specific fourth party, with the\nrecency of its latest observed connection.","required":["vendorDomain","lastSeen","vendorName","connectionCount"]}},"components/schemas/PublicFourthPartyVendorSample":{"id":"components/schemas/PublicFourthPartyVendorSample","kind":"json-schema","title":"PublicFourthPartyVendorSample","data":{"type":"object","properties":{"name":{"type":"string","description":"Display name of the vendor; falls back to the domain when unavailable."},"domain":{"type":"string","description":"Registered domain of the vendor (e.g. \"acme.com\")."},"logoUrl":{"type":"string","description":"URL of the vendor's company logo, sourced from the legal entities service."}},"description":"A lightweight preview of a portfolio vendor that connects to a fourth party.","required":["name","domain","logoUrl"]}},"components/schemas/PublicLetterGrade":{"id":"components/schemas/PublicLetterGrade","kind":"json-schema","title":"PublicLetterGrade","data":{"type":"string","enum":["PUBLIC_LETTER_GRADE_UNSPECIFIED","PUBLIC_LETTER_GRADE_A","PUBLIC_LETTER_GRADE_B","PUBLIC_LETTER_GRADE_C","PUBLIC_LETTER_GRADE_D","PUBLIC_LETTER_GRADE_F"],"default":"PUBLIC_LETTER_GRADE_UNSPECIFIED","description":"Letter grade classification for a curated public score, mirroring the internal LetterGrade\nenum under a fully-prefixed public name (public enums in this service are never bare tokens)."}},"components/schemas/PublicObservationsFilterableField":{"id":"components/schemas/PublicObservationsFilterableField","kind":"json-schema","title":"PublicObservationsFilterableField","data":{"type":"string","enum":["OBSERVATIONS_FIELD_UNSPECIFIED","OBSERVATIONS_FIELD_SEVERITY","OBSERVATIONS_FIELD_OBSERVATION_TYPE","OBSERVATIONS_FIELD_OBSERVATION_NAME","OBSERVATIONS_FIELD_OBSERVATION_STATUS","OBSERVATIONS_FIELD_ASSET_NAME","OBSERVATIONS_FIELD_ASSET_TYPE","OBSERVATIONS_FIELD_ASSET_KEY","OBSERVATIONS_FIELD_PORT_NUMBER","OBSERVATIONS_FIELD_CVSS_SCORE","OBSERVATIONS_FIELD_EPSS_SCORE","OBSERVATIONS_FIELD_IS_IN_CISA_KEV","OBSERVATIONS_FIELD_FIRST_SEEN","OBSERVATIONS_FIELD_LAST_SEEN","OBSERVATIONS_FIELD_FLAGGED","OBSERVATIONS_FIELD_APPROVAL_STATUS","OBSERVATIONS_FIELD_EXCLUDED_REASON_TYPE","OBSERVATIONS_FIELD_RESOLVED_AT","OBSERVATIONS_FIELD_VENDOR","OBSERVATIONS_FIELD_REMEDIATION_STATUS","OBSERVATIONS_FIELD_PORTFOLIO","OBSERVATIONS_FIELD_OBSERVATION_NAME_KEY","OBSERVATIONS_FIELD_PORTFOLIO_NAME"],"default":"OBSERVATIONS_FIELD_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Observation fields that external callers may filter on via the public API."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The server maps each value to its internal counterpart. Shared across all public API versions —"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"new fields are added here additively."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Access control for tenant-scoped fields (VENDOR, PORTFOLIO):"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"These fields name tenant/organization-scoped concepts and were previously excluded from the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"public surface. They are safe to expose here because the public GetObservations handler in"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor-svc-observations always derives "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"allowed_domains"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" from the caller's auth metadata"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(PublicObservationController throws UNAUTHENTICATED if it is missing) and forwards it into"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"every observation query. ClickHouse rows are bounded to "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"allowed_domains"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" BEFORE any"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"caller-supplied filter is applied, so a VENDOR or PORTFOLIO filter can only match"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"observations the caller is already entitled to read. A caller filtering by a portfolio or"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"vendor they do not own receives an empty result rather than cross-tenant data — there is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"no enumeration oracle because the empty result is indistinguishable from \"no findings\"."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"No additional validation of caller-supplied portfolio ids / vendor domains is required at"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the public layer; do NOT add such a check in this schema or in the public mapper."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Internal fields intentionally excluded from this surface:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATION_GROUP_KEY is an internal grouping key (use OBSERVATION_NAME or OBSERVATION_NAME_KEY)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VIEW_OWNER_DOMAIN is set server-side from auth metadata, not a caller-supplied filter."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REQUESTORS exposes per-user remediation requester identity; gated until a privacy review."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"HAS_REMEDIATION_REQUEST is not yet wired in getPublicFilterOptions; gated until then."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_SEVERITY: Threat severity level (e.g. LOW, MEDIUM, HIGH, CRITICAL)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_OBSERVATION_TYPE: Observation type."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_OBSERVATION_NAME: Human-readable observation name; supports CONTAINS for substring search."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_OBSERVATION_STATUS: Lifecycle status (e.g. OPEN, RESOLVED, IN_PROGRESS)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_ASSET_NAME: IP address, URL, or domain name of the affected asset."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_ASSET_TYPE: Asset category (IP_PORT, URL, DNS, CREDENTIALS)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_ASSET_KEY: Composite asset identifier combining type and address."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_PORT_NUMBER: TCP/UDP port number associated with the asset."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_CVSS_SCORE: CVSS numeric score (0–10); supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_EPSS_SCORE: EPSS exploit-prediction score (0–1); supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_IS_IN_CISA_KEV: Whether the observation is listed in CISA's Known Exploited Vulnerabilities catalog."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_FIRST_SEEN: Timestamp of the earliest detection; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_LAST_SEEN: Timestamp of the most recent detection; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_FLAGGED: Whether the observation has been flagged for review."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_APPROVAL_STATUS: Approval status."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_EXCLUDED_REASON_TYPE: Reason category when an observation is excluded (ACCEPTED_RISK, FALSE_POSITIVE, LOW_RISK, OTHER)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_RESOLVED_AT: Timestamp when the observation was resolved; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_VENDOR: Vendor (third-party organization) domain associated with the observation."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_REMEDIATION_STATUS: Current remediation workflow status (e.g. NOT_STARTED, IN_PROGRESS, COMPLETED)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_PORTFOLIO: Portfolio id(s) the observation belongs to; matches if any value matches."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_OBSERVATION_NAME_KEY: Stable key for the observation name (de-duped, internal identifier)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"OBSERVATIONS_FIELD_PORTFOLIO_NAME: Portfolio name(s) the observation belongs to; matches if any portfolio the observation"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"belongs to has a matching name. The server resolves names to ids within the caller's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"allowed domains before executing the query. Name matching is case-insensitive exact."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Unknown names return NOT_FOUND; names matching multiple portfolios return"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"INVALID_ARGUMENT; empty or whitespace-only names return INVALID_ARGUMENT."},"children":[]}]}]}]}]}]}},"components/schemas/PublicRiskLevel":{"id":"components/schemas/PublicRiskLevel","kind":"json-schema","title":"PublicRiskLevel","data":{"type":"string","enum":["PUBLIC_RISK_LEVEL_UNSPECIFIED","PUBLIC_RISK_LEVEL_VERY_LOW","PUBLIC_RISK_LEVEL_LOW","PUBLIC_RISK_LEVEL_MODERATE","PUBLIC_RISK_LEVEL_HIGH","PUBLIC_RISK_LEVEL_VERY_HIGH","PUBLIC_RISK_LEVEL_NOT_APPLICABLE"],"default":"PUBLIC_RISK_LEVEL_UNSPECIFIED","description":"Risk level classification for a curated public score, mirroring the internal RiskLevel enum."}},"components/schemas/PublicSecurityEventFilter":{"id":"components/schemas/PublicSecurityEventFilter","kind":"json-schema","title":"PublicSecurityEventFilter","data":{"type":"object","properties":{"list":{"$ref":"#/components/schemas/PublicSecurityEventFilterList"},"rule":{"$ref":"#/components/schemas/PublicSecurityEventFilterRule"}},"description":"A single node in a public security-event filter tree: either a composite group\nor an atomic rule."}},"components/schemas/PublicSecurityEventFilterList":{"id":"components/schemas/PublicSecurityEventFilterList","kind":"json-schema","title":"PublicSecurityEventFilterList","data":{"type":"object","properties":{"operator":{"$ref":"#/components/schemas/FilterOperator"},"isNegated":{"type":"boolean","description":"When true, the combined result of child filters is negated (logical NOT)."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicSecurityEventFilter"},"description":"Child filters combined by the operator."}},"description":"Nested boolean group: AND/OR of child public filters with optional negation.","required":["filters"]}},"components/schemas/PublicSecurityEventFilterRule":{"id":"components/schemas/PublicSecurityEventFilterRule","kind":"json-schema","title":"PublicSecurityEventFilterRule","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicSecurityEventFilterableField"},"comparison":{"$ref":"#/components/schemas/FilterComparison"},"value":{"$ref":"#/components/schemas/FilterValue"}},"description":"Single predicate: which public field, how to compare, and the bound value."}},"components/schemas/PublicSecurityEventFilterableField":{"id":"components/schemas/PublicSecurityEventFilterableField","kind":"json-schema","title":"PublicSecurityEventFilterableField","data":{"type":"object","properties":{"securityEventField":{"$ref":"#/components/schemas/PublicSecurityEventsFilterableField"}},"description":"Wraps the public security-event field reference used as a filter target."}},"components/schemas/PublicSecurityEventsFilterableField":{"id":"components/schemas/PublicSecurityEventsFilterableField","kind":"json-schema","title":"PublicSecurityEventsFilterableField","data":{"type":"string","enum":["SECURITY_EVENTS_FIELD_UNSPECIFIED","SECURITY_EVENTS_FIELD_FIRST_DETECTED","SECURITY_EVENTS_FIELD_LAST_UPDATED","SECURITY_EVENTS_FIELD_TITLE","SECURITY_EVENTS_FIELD_NATURE","SECURITY_EVENTS_FIELD_SUBTYPE","SECURITY_EVENTS_FIELD_STATUS","SECURITY_EVENTS_FIELD_SEVERITY","SECURITY_EVENTS_FIELD_IMPACT_REASONING","SECURITY_EVENTS_FIELD_VENDOR"],"default":"SECURITY_EVENTS_FIELD_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Security-event fields external callers may filter on for GetSecurityEventsFeed"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"and GetImpactedCompanies. The server maps each value to its internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"counterpart. Curated, additive-only subset of the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor_protos.utility.filters.v1.BreachesFilterableField."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Access control: as with the public Observations filter surface, these fields"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(including VENDOR) are safe to expose because every handler for this service"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"derives the caller's allowed organization/vendor scope from auth metadata and"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"applies it BEFORE any caller-supplied filter — a caller can only ever narrow"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"results they were already entitled to read."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_FIRST_DETECTED: First detection time on the event cluster; supports BETWEEN, GTE, LTE."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_LAST_UPDATED: Last update time on the event cluster; supports BETWEEN, GTE, LTE."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_TITLE: Headline text; supports CONTAINS for substring search."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_NATURE: Broad classification (compromise vs threat)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_SUBTYPE: Fine-grained classification within nature."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_STATUS: Caller-organization (VRM) lifecycle status."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_SEVERITY: Severity rank derived from nature."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_IMPACT_REASONING: How an impacted company is tied to the event (GetImpactedCompanies tab filter)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENTS_FIELD_VENDOR: Vendor (impacted company) domain associated with the event."},"children":[]}]}]}]}]}},"components/schemas/PublicVendorFilter":{"id":"components/schemas/PublicVendorFilter","kind":"json-schema","title":"PublicVendorFilter","data":{"type":"object","properties":{"list":{"$ref":"#/components/schemas/PublicVendorFilterList"},"rule":{"$ref":"#/components/schemas/PublicVendorFilterRule"}},"description":"A single node in a public vendor filter tree: either a composite group or an atomic rule."}},"components/schemas/PublicVendorFilterList":{"id":"components/schemas/PublicVendorFilterList","kind":"json-schema","title":"PublicVendorFilterList","data":{"type":"object","properties":{"operator":{"$ref":"#/components/schemas/FilterOperator"},"isNegated":{"type":"boolean","description":"When true, the combined result of the child filters is negated (logical NOT)."},"filters":{"type":"array","items":{"$ref":"#/components/schemas/PublicVendorFilter"},"description":"Child filters combined by the operator."}},"description":"Nested boolean group: AND/OR of child public vendor filters with optional negation.","required":["filters"]}},"components/schemas/PublicVendorFilterOption":{"id":"components/schemas/PublicVendorFilterOption","kind":"json-schema","title":"PublicVendorFilterOption","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicVendorFilterableFieldRef"},"comparisons":{"type":"array","items":{"$ref":"#/components/schemas/FilterComparison"},"description":"Comparison operators valid for this field."},"fieldValues":{"$ref":"#/components/schemas/DiscreteFilterValues"},"fieldRange":{"$ref":"#/components/schemas/FilterRangeBounds"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Describes a public vendor filterable field's allowed comparisons and available discrete values."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Returned in ListVendorsResponse when include_filter_options is true."},"children":[]}]}]}],"required":["comparisons"]}},"components/schemas/PublicVendorFilterRule":{"id":"components/schemas/PublicVendorFilterRule","kind":"json-schema","title":"PublicVendorFilterRule","data":{"type":"object","properties":{"field":{"$ref":"#/components/schemas/PublicVendorFilterableFieldRef"},"comparison":{"$ref":"#/components/schemas/FilterComparison"},"value":{"$ref":"#/components/schemas/FilterValue"}},"description":"Single predicate: which public vendor field, how to compare, and the bound value."}},"components/schemas/PublicVendorFilterableFieldRef":{"id":"components/schemas/PublicVendorFilterableFieldRef","kind":"json-schema","title":"PublicVendorFilterableFieldRef","data":{"type":"object","properties":{"vendorsField":{"$ref":"#/components/schemas/PublicVendorsFilterableField"}},"description":"Wraps the public vendor field reference used as a filter target."}},"components/schemas/PublicVendorScore":{"id":"components/schemas/PublicVendorScore","kind":"json-schema","title":"PublicVendorScore","data":{"type":"object","properties":{"score":{"type":"integer","format":"int32","description":"The rounded integer score (0-100)."},"grade":{"$ref":"#/components/schemas/PublicLetterGrade"},"riskLevel":{"$ref":"#/components/schemas/PublicRiskLevel"}},"description":"A single curated score value: a 0-100 rounded score, its letter grade, and risk level."}},"components/schemas/PublicVendorsFilterableField":{"id":"components/schemas/PublicVendorsFilterableField","kind":"json-schema","title":"PublicVendorsFilterableField","data":{"type":"string","enum":["VENDORS_FIELD_UNSPECIFIED","VENDORS_FIELD_DOMAIN_NAME","VENDORS_FIELD_COMPANY_NAME","VENDORS_FIELD_COMPANY_INDUSTRY_CATEGORY","VENDORS_FIELD_LIFECYCLE_STATUS","VENDORS_FIELD_IS_MONITORED","VENDORS_FIELD_DATA_REGION","VENDORS_FIELD_RISK_LEVEL","VENDORS_FIELD_BUSINESS_IMPACT","VENDORS_FIELD_DATA_TYPES_SHARED","VENDORS_FIELD_ACCESS_TYPES","VENDORS_FIELD_VENDOR_ID","VENDORS_FIELD_CONTRACT_VALUE","VENDORS_FIELD_CONTRACT_END_DATE","VENDORS_FIELD_LAST_ASSESSED_DATE","VENDORS_FIELD_CREATED_AT","VENDORS_FIELD_UPDATED_AT"],"default":"VENDORS_FIELD_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Vendor-directory fields that external callers may filter on via the public API."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"The server maps each value to its internal counterpart and rejects any field not"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"listed here with INVALID_ARGUMENT. Shared across all public API versions — new"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"fields are added here additively."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Access control: the public ListVendors handler always derives the caller's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"organization scope from the access token and bounds every query to the caller's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"own vendor directory BEFORE any caller-supplied filter is applied, so a filter can"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only ever narrow results the caller is already entitled to read. No per-value"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"tenant validation of caller-supplied filter values is required at the public layer."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Fields intentionally excluded from this filterable surface:"},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"id is a per-vendor lookup key (use GetVendor), not a directory filter."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"company_logo_url is a display-only asset URL with no meaningful filter semantics."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_UNSPECIFIED: Default zero value; no filterable field selected (unset sentinel)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_DOMAIN_NAME: Primary domain name of the vendor; supports EQ and CONTAINS (substring search)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_COMPANY_NAME: Display name of the vendor company; supports EQ and CONTAINS (substring search)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_COMPANY_INDUSTRY_CATEGORY: Industry category of the vendor company; supports EQ. Match one value with a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"scalar value, or any-of a set with a string_list_value (IN-style)."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_LIFECYCLE_STATUS: Lifecycle status of the vendor (VendorLifecycleStatus token); supports EQ. Match"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"one value with a scalar value, or any-of a set with a string_list_value."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_IS_MONITORED: Whether the vendor is actively monitored; supports EQ."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_DATA_REGION: Data region where the vendor operates (DataRegion token); supports EQ. Match one"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"value with a scalar value, or any-of a set with a string_list_value."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_RISK_LEVEL: Risk level assigned to the vendor (RiskLevel token); supports EQ. Match one value"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"with a scalar value, or any-of a set with a string_list_value."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_BUSINESS_IMPACT: Business impact if the vendor is compromised (BusinessImpact token); supports EQ."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Match one value with a scalar value, or any-of a set with a string_list_value."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_DATA_TYPES_SHARED: Categories of data shared with the vendor (DataTypeShared tokens); supports EQ with"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"a string_list_value for an any-of match."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_ACCESS_TYPES: Types of access granted to the vendor (AccessType tokens); supports EQ with a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"string_list_value for an any-of match."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_VENDOR_ID: Customer-defined free-text identifier for the vendor; supports EQ and CONTAINS."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_CONTRACT_VALUE: Monetary value of the contract in minor currency units; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_CONTRACT_END_DATE: Date the vendor contract expires; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_LAST_ASSESSED_DATE: Date the vendor was last assessed/reviewed; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_CREATED_AT: Timestamp the vendor was created; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDORS_FIELD_UPDATED_AT: Timestamp the vendor was last updated; supports BETWEEN, GTE, LTE."},"children":[]}]}]}]}]}]}},"components/schemas/Questionnaire":{"id":"components/schemas/Questionnaire","kind":"json-schema","title":"Questionnaire","data":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the questionnaire."},"templateId":{"type":"string","description":"Id of the template this questionnaire was created from."},"sent":{"type":"boolean","description":"Whether the questionnaire has been sent to the vendor yet."},"createdAt":{"type":"string","format":"date-time","description":"When the questionnaire was created."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A questionnaire sent (or staged to be sent) to a vendor, curated for public"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"consumption. Excludes internal ids beyond the public id, audit actors,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"reviewer/suggestion provenance, and respondent PII beyond what the caller's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"own organization already provided when creating it. The submitted"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"question/answer schema and attached files are not part of this message —"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"they're planned for a dedicated future endpoint, once curated, matching"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the precedent set for the full template schema in questionnaire_template.proto."},"children":[]}]}]}],"required":["id","templateId","sent","createdAt"]}},"components/schemas/QuestionnaireTemplate":{"id":"components/schemas/QuestionnaireTemplate","kind":"json-schema","title":"QuestionnaireTemplate","data":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the template."},"name":{"type":"string","description":"Display name of the template."},"global":{"type":"boolean","description":"Whether this is an SSC-global template available to every organization,\nas opposed to one authored by the caller's own organization."}},"description":"A questionnaire template available to the caller's organization, curated\nfor public consumption. Excludes internal ids beyond the public id, the\nfull question/answer schema body (fetched separately, once curated, by an\nendpoint story), audit actors, and any internal risk-matrix linkage.","required":["id","name","global"]}},"components/schemas/RemediationStatus":{"id":"components/schemas/RemediationStatus","kind":"json-schema","title":"/ RemediationStatus enumeration","data":{"type":"string","enum":["REMEDIATION_STATUS_UNSPECIFIED","REMEDIATION_STATUS_OPEN","REMEDIATION_STATUS_INVESTIGATING","REMEDIATION_STATUS_WONT_FIX","REMEDIATION_STATUS_COMPENSATING_CONTROL","REMEDIATION_STATUS_COMPENSATING_CONTROL_PENDING","REMEDIATION_STATUS_CANNOT_REPRODUCE","REMEDIATION_STATUS_CANNOT_REPRODUCE_PENDING","REMEDIATION_STATUS_RESOLVED","REMEDIATION_STATUS_RESOLVED_PENDING","REMEDIATION_STATUS_REOPENED"],"default":"REMEDIATION_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_OPEN: Vendor needs to take action to remediate observation"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_INVESTIGATING: Vendor is investigating"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_WONT_FIX: Vendor has decided to not fix the observation. Requires Vrm approval"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_COMPENSATING_CONTROL: Vendor has uploaded evidence for compensating control. Requires SSC Support approval"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_CANNOT_REPRODUCE: Vendor cannot reproduce the observation. Requires SSC Support approval"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_RESOLVED: Vendor has fixed the observation. Requires approval from SSC Support or SSC automated scanning system"},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"REMEDIATION_STATUS_REOPENED: SSC or Vrm has rejected Vendor resolution. Vendor is requested to remediate the observation"},"children":[]}]}]}]}],"title":"/ RemediationStatus enumeration"}},"components/schemas/RemoveVendorFromGroupBody":{"id":"components/schemas/RemoveVendorFromGroupBody","kind":"json-schema","title":"RemoveVendorFromGroupBody","data":{"type":"object","properties":{"vendorIds":{"type":"array","items":{"type":"string"},"description":"Vendor ids to remove. Required, non-empty, capped at 500 per call. A vendor\nthat isn't currently a member is a no-op, not an error."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Vendor ids to remove from a vendor group's membership. Organization scope is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"derived from the access token — this message carries no organization field."},"children":[]}]}]}],"required":["vendorIds"]}},"components/schemas/RemoveVendorFromGroupResponse":{"id":"components/schemas/RemoveVendorFromGroupResponse","kind":"json-schema","title":"RemoveVendorFromGroupResponse","data":{"type":"object","properties":{"vendorGroup":{"$ref":"#/components/schemas/VendorGroup"}},"description":"The vendor group after RemoveVendorFromGroup applies.","required":["vendorGroup"]}},"components/schemas/RequestSecurityEventResponseRequest":{"id":"components/schemas/RequestSecurityEventResponseRequest","kind":"json-schema","title":"RequestSecurityEventResponseRequest","data":{"type":"object","properties":{"orgDomain":{"type":"string","description":"Domain of the organization the security event belongs to."},"eventId":{"type":"string","description":"Unique identifier of the security event."},"contacts":{"type":"array","items":{"$ref":"#/components/schemas/CompanyContact"},"description":"Recipients for the remediation-request email batch; must be non-empty after validation."},"customMessage":{"type":"string","description":"Optional body text merged into the remediation-request email template."}},"description":"Input for sending remediation-request emails for a security event.","required":["orgDomain","eventId","contacts"]}},"components/schemas/RequestSecurityEventResponseResponse":{"id":"components/schemas/RequestSecurityEventResponseResponse","kind":"json-schema","title":"RequestSecurityEventResponseResponse","data":{"type":"object","properties":{"requestsCount":{"type":"integer","format":"int32","description":"Count of remediation-request emails accepted for delivery in this call."},"processedEmails":{"type":"array","items":{"type":"string"},"description":"Recipient email addresses accepted and queued or sent successfully."},"notProcessedEmailsInCooldownPeriod":{"type":"array","items":{"type":"string"},"description":"Recipient email addresses not sent because a request was already sent to them for\nthis security event within the cooldown period."},"invalidContactEmails":{"type":"array","items":{"type":"string"},"description":"Recipient email addresses not sent because they are not a valid contact for their company."}},"description":"Outcome of a remediation-request email send.","required":["requestsCount","processedEmails","notProcessedEmailsInCooldownPeriod","invalidContactEmails"]}},"components/schemas/Requestor":{"id":"components/schemas/Requestor","kind":"json-schema","title":"/ Requestor is a Vrm who requests a Vendor to remediate an observation asset","data":{"type":"object","properties":{"organization":{"$ref":"#/components/schemas/observation.v1.Organization"}},"title":"/ Requestor is a Vrm who requests a Vendor to remediate an observation asset","required":["organization"]}},"components/schemas/RiskLevel":{"id":"components/schemas/RiskLevel","kind":"json-schema","title":"RiskLevel","data":{"type":"string","enum":["RISK_LEVEL_UNSPECIFIED","RISK_LEVEL_NONE","RISK_LEVEL_LOW","RISK_LEVEL_MEDIUM","RISK_LEVEL_HIGH","RISK_LEVEL_CRITICAL"],"default":"RISK_LEVEL_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Risk level assigned to a vendor, as exposed on the public API. Curated public"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"copy of the internal factor_protos.vendor_relationship.v1.RiskLevel. Ordinals"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"are kept IDENTICAL to the internal enum for the same cross-boundary-safety"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"reason as VendorLifecycleStatus above."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_UNSPECIFIED: Default zero value; risk level was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_NONE: No assessed risk to the vendor relationship."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_LOW: Minor or well-mitigated exposure."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_MEDIUM: Moderate exposure that warrants periodic monitoring."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_HIGH: Significant exposure requiring active oversight."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"RISK_LEVEL_CRITICAL: Severe exposure requiring immediate remediation."},"children":[]}]}]}]}]}},"components/schemas/SecurityEvent":{"id":"components/schemas/SecurityEvent","kind":"json-schema","title":"SecurityEvent","data":{"type":"object","properties":{"eventId":{"type":"string","description":"Opaque identifier grouping related source items into a single event."},"title":{"type":"string","description":"Human-readable headline for the event cluster."},"summary":{"type":"string","description":"Multi-sentence description of the event."},"nature":{"$ref":"#/components/schemas/SecurityEventNature"},"subtype":{"$ref":"#/components/schemas/SecurityEventSubtype"},"victimOrganization":{"type":"string","description":"Primary victim of the security event."},"affectedOrganizations":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Dedup union of source items' affected parties — companies named in source articles."},"children":[]}]}]}]},"threatActors":{"type":"array","items":{"type":"string"},"description":"Dedup union of source items' threat actors."},"infoLeaked":{"type":"array","items":{"type":"string"},"description":"Dedup union of source items' leaked information categories."},"recordsLost":{"type":"string","format":"int64","description":"Maximum records lost across the cluster; absent when not estimated."},"timeline":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventTimelineEntry"},"description":"Ordered timeline rail (one EVENT entry plus one SOURCE entry per source item)."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventSourceItem"},"description":"Source citations backing the event."},"severity":{"$ref":"#/components/schemas/SecurityEventSeverity"},"eventDate":{"type":"string","format":"date-time","description":"Primary event date (e.g. reported breach date); absent when not available."},"publishedDate":{"type":"string","format":"date-time","description":"When the first source was published; absent when not available."},"status":{"$ref":"#/components/schemas/SecurityEventVrmStatus"}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Detailed view of one security event, keyed by (org_domain, event_id)."},"children":[]}]}]}],"required":["eventId","title","summary","nature","subtype","affectedOrganizations","threatActors","infoLeaked","timeline","sources"]}},"components/schemas/SecurityEventActivityEntry":{"id":"components/schemas/SecurityEventActivityEntry","kind":"json-schema","title":"SecurityEventActivityEntry","data":{"type":"object","properties":{"activityType":{"$ref":"#/components/schemas/SecurityEventActivityType"},"occurredAt":{"type":"string","format":"date-time","description":"When this entry occurred."},"actorEmail":{"type":"string","description":"Email of the user who performed the action; absent for system-driven or\nsynthetic (first-seen) entries."},"actorOrganization":{"$ref":"#/components/schemas/security_event.v1.Organization"},"message":{"type":"string","description":"Free-form message or comment supplied with the action, when applicable."}},"description":"One entry in a vendor's security-event communication log (VRM/vendor/system\nworkflow transitions plus the synthetic first-seen marker). See\nSecurityEventActivityType for why Exchange Hub vendor replies never appear here.","required":["activityType","occurredAt"]}},"components/schemas/SecurityEventActivityType":{"id":"components/schemas/SecurityEventActivityType","kind":"json-schema","title":"SecurityEventActivityType","data":{"type":"string","enum":["SECURITY_EVENT_ACTIVITY_TYPE_UNSPECIFIED","SECURITY_EVENT_ACTIVITY_TYPE_FIRST_SEEN","SECURITY_EVENT_ACTIVITY_TYPE_FLAG","SECURITY_EVENT_ACTIVITY_TYPE_UNFLAG","SECURITY_EVENT_ACTIVITY_TYPE_CLOSE","SECURITY_EVENT_ACTIVITY_TYPE_REOPEN","SECURITY_EVENT_ACTIVITY_TYPE_INITIAL_REQUEST_RESPONSE","SECURITY_EVENT_ACTIVITY_TYPE_FOLLOW_UP_REQUEST_RESPONSE","SECURITY_EVENT_ACTIVITY_TYPE_VENDOR_RESPONSE"],"default":"SECURITY_EVENT_ACTIVITY_TYPE_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Classifies a communication-log entry on a vendor's security event detail."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Exchange Hub vendor replies (internal "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"SecurityEventExchangeHubReply"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":", which is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"CONFIDENTIAL-classified — subject line, conversation id, message id, and raw MIME"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"body fragments) are intentionally NOT represented here or anywhere in this public"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"contract. Only VRM/vendor/system workflow transitions and the synthetic"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"first-seen marker are surfaced; free-text reply content never crosses the public"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"boundary."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_FIRST_SEEN: Synthetic marker: earliest observation seen for this vendor on the event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_FLAG: VRM flagged the event for follow-up."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_UNFLAG: VRM cleared a previously set flag."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_CLOSE: VRM closed the event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_REOPEN: VRM reopened a previously closed event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_INITIAL_REQUEST_RESPONSE: VRM sent the initial response request to the vendor."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_FOLLOW_UP_REQUEST_RESPONSE: VRM sent a follow-up response request to the vendor."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_ACTIVITY_TYPE_VENDOR_RESPONSE: Vendor submitted a triage response to the VRM organization(s)."},"children":[]}]}]}]}]}},"components/schemas/SecurityEventImpactReasoning":{"id":"components/schemas/SecurityEventImpactReasoning","kind":"json-schema","title":"SecurityEventImpactReasoning","data":{"type":"string","enum":["SECURITY_EVENT_IMPACT_REASONING_UNSPECIFIED","SECURITY_EVENT_IMPACT_REASONING_VICTIM_ENTITY","SECURITY_EVENT_IMPACT_REASONING_NAMED_VICTIM","SECURITY_EVENT_IMPACT_REASONING_CONNECTION_DETECTED"],"default":"SECURITY_EVENT_IMPACT_REASONING_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"How an impacted company is tied to a security event."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_IMPACT_REASONING_VICTIM_ENTITY: The company is the primary victim named on the event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_IMPACT_REASONING_NAMED_VICTIM: The company is a named victim on the event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_IMPACT_REASONING_CONNECTION_DETECTED: A connection was detected between the company and the event's primary victim."},"children":[]}]}]}]}]}},"components/schemas/SecurityEventImpactStatus":{"id":"components/schemas/SecurityEventImpactStatus","kind":"json-schema","title":"SecurityEventImpactStatus","data":{"type":"string","enum":["SECURITY_EVENT_IMPACT_STATUS_UNSPECIFIED","SECURITY_EVENT_IMPACT_STATUS_IMPACTED","SECURITY_EVENT_IMPACT_STATUS_NOT_IMPACTED"],"default":"SECURITY_EVENT_IMPACT_STATUS_UNSPECIFIED","description":"Assessed impact state for an impacted company on a security event."}},"components/schemas/SecurityEventImpactedCompany":{"id":"components/schemas/SecurityEventImpactedCompany","kind":"json-schema","title":"SecurityEventImpactedCompany","data":{"type":"object","properties":{"organization":{"$ref":"#/components/schemas/security_event.v1.Organization"},"impactReasoning":{"$ref":"#/components/schemas/SecurityEventImpactReasoning"},"impactStatus":{"$ref":"#/components/schemas/SecurityEventImpactStatus"},"isFlagged":{"type":"boolean","description":"True when this company has been flagged for follow-up on this event."},"lastActivityDate":{"type":"string","format":"date-time","description":"Most recent activity on this company for the event; absent when no activity\nhas been recorded yet."}},"description":"One impacted company row in a security event's vendor overview\n(GetImpactedCompanies) or vendor detail (GetVendorSecurityEventDetail).","required":["organization","impactReasoning","impactStatus"]}},"components/schemas/SecurityEventNature":{"id":"components/schemas/SecurityEventNature","kind":"json-schema","title":"SecurityEventNature","data":{"type":"string","enum":["SECURITY_EVENT_NATURE_UNSPECIFIED","SECURITY_EVENT_NATURE_COMPROMISE","SECURITY_EVENT_NATURE_THREAT"],"default":"SECURITY_EVENT_NATURE_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Broad classification of a security event: a confirmed compromise vs an unverified threat signal."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Curated copy of factor_protos.io.factor.observation.v1.SecurityEventNature."},"children":[]}]}]}]}},"components/schemas/SecurityEventSeverity":{"id":"components/schemas/SecurityEventSeverity","kind":"json-schema","title":"SecurityEventSeverity","data":{"type":"string","enum":["SECURITY_EVENT_SEVERITY_UNSPECIFIED","SECURITY_EVENT_SEVERITY_INFO","SECURITY_EVENT_SEVERITY_LOW","SECURITY_EVENT_SEVERITY_MEDIUM","SECURITY_EVENT_SEVERITY_HIGH","SECURITY_EVENT_SEVERITY_CRITICAL"],"default":"SECURITY_EVENT_SEVERITY_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Severity rank for a security event, derived server-side from nature (low numeric"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"value = low severity, high numeric value = high severity)."},"children":[]}]}]}]}},"components/schemas/SecurityEventSourceItem":{"id":"components/schemas/SecurityEventSourceItem","kind":"json-schema","title":"SecurityEventSourceItem","data":{"type":"object","properties":{"itemId":{"type":"string","description":"Stable identifier of the source item within its event cluster."},"title":{"type":"string","description":"Title of the article or OSINT record."},"link":{"type":"string","description":"External URL to the source article."},"sourceType":{"type":"string","description":"Source category (e.g. blog, news, dark-web, social)."},"publishedDate":{"type":"string","format":"date-time","description":"When the source was published."},"originatingParty":{"type":"string","description":"Originating party named in this source item, when present."},"affectedParties":{"type":"array","items":{"type":"string"},"description":"Companies named as affected in this source item."},"sourceReliability":{"type":"number","format":"float","description":"Reliability score of the source, on a 0.0-1.0 scale; absent when not computed."}},"description":"A supporting OSINT or article record tying an organization to a security event.","required":["itemId","title","link","sourceType","publishedDate","affectedParties"]}},"components/schemas/SecurityEventSubtype":{"id":"components/schemas/SecurityEventSubtype","kind":"json-schema","title":"SecurityEventSubtype","data":{"type":"string","enum":["SECURITY_EVENT_SUBTYPE_UNSPECIFIED","SECURITY_EVENT_SUBTYPE_BREACH","SECURITY_EVENT_SUBTYPE_ALLEGED_BREACH","SECURITY_EVENT_SUBTYPE_HACKER_CHATTER"],"default":"SECURITY_EVENT_SUBTYPE_UNSPECIFIED","description":"Fine-grained subclassification within a SecurityEventNature."}},"components/schemas/SecurityEventSummary":{"id":"components/schemas/SecurityEventSummary","kind":"json-schema","title":"SecurityEventSummary","data":{"type":"object","properties":{"eventId":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Stable identifier for this event row. Pass through to GetSecurityEvent's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"or GetImpactedCompanies' event_id for detail lookups."},"children":[]}]}]}]},"organizationDomain":{"type":"string","description":"Originating-party domain for this event row."},"nature":{"$ref":"#/components/schemas/SecurityEventNature"},"subtype":{"$ref":"#/components/schemas/SecurityEventSubtype"},"title":{"type":"string","description":"Human-readable headline shown in the feed."},"sourceCount":{"type":"integer","format":"int32","description":"Number of distinct sources contributing evidence for this event."},"firstDetectedDate":{"type":"string","format":"date-time","description":"When the event was first detected (UTC)."},"eventDate":{"type":"string","format":"date-time","description":"Primary event instant for display; absent when not available."},"status":{"$ref":"#/components/schemas/SecurityEventVrmStatus"},"lastUpdatedDate":{"type":"string","format":"date-time","description":"When cluster evidence last changed (UTC)."},"impactedCompanies":{"type":"array","items":{"$ref":"#/components/schemas/security_event.v1.Organization"},"description":"Sample of impacted companies with identity and logo."},"impactedCount":{"type":"integer","format":"int32","description":"Number of monitored vendors assessed as impacted for this event in the caller's context."},"notImpactedCount":{"type":"integer","format":"int32","description":"Number of monitored vendors assessed as not impacted for this event."},"impactedUnknownCount":{"type":"integer","format":"int32","description":"Number of monitored vendors whose impacted status is unknown or not yet determined."},"severity":{"$ref":"#/components/schemas/SecurityEventSeverity"},"publishedDate":{"type":"string","format":"date-time","description":"When the first source was published; absent when not available."},"archivedDate":{"type":"string","format":"date-time","description":"When the event was archived for the caller's organization; absent while not archived."}},"description":"Summary row for the org-scoped security events feed (GetSecurityEventsFeed).","required":["eventId","organizationDomain","nature","subtype","title","sourceCount","firstDetectedDate","status","lastUpdatedDate","impactedCompanies","impactedCount","notImpactedCount","impactedUnknownCount"]}},"components/schemas/SecurityEventTimelineEntry":{"id":"components/schemas/SecurityEventTimelineEntry","kind":"json-schema","title":"SecurityEventTimelineEntry","data":{"type":"object","properties":{"kind":{"$ref":"#/components/schemas/SecurityEventTimelineEntryKind"},"occurredAt":{"type":"string","format":"date-time","description":"When this entry happened (event creation time, or source ingestion time)."},"actor":{"type":"string","description":"Originating party for SOURCE entries (e.g. \"BleepingComputer\"); absent for EVENT entries."},"description":{"type":"string","description":"Source title for SOURCE entries; cluster title for EVENT entries."},"nature":{"$ref":"#/components/schemas/SecurityEventNature"},"subtype":{"$ref":"#/components/schemas/SecurityEventSubtype"}},"description":"One row on the security event timeline rail.","required":["kind","occurredAt","description"]}},"components/schemas/SecurityEventTimelineEntryKind":{"id":"components/schemas/SecurityEventTimelineEntryKind","kind":"json-schema","title":"SecurityEventTimelineEntryKind","data":{"type":"string","enum":["SECURITY_EVENT_TIMELINE_ENTRY_KIND_UNSPECIFIED","SECURITY_EVENT_TIMELINE_ENTRY_KIND_EVENT","SECURITY_EVENT_TIMELINE_ENTRY_KIND_SOURCE"],"default":"SECURITY_EVENT_TIMELINE_ENTRY_KIND_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Kind of entry on the security event timeline rail."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_TIMELINE_ENTRY_KIND_EVENT: Aggregate event marker (event creation in platform)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_TIMELINE_ENTRY_KIND_SOURCE: Per-source ingestion entry."},"children":[]}]}]}]}]}},"components/schemas/SecurityEventVendorDetail":{"id":"components/schemas/SecurityEventVendorDetail","kind":"json-schema","title":"SecurityEventVendorDetail","data":{"type":"object","properties":{"impactReasoning":{"$ref":"#/components/schemas/SecurityEventImpactReasoning"},"vrmRequests":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventVrmRequest"},"description":"VRM response requests sent to this vendor, in chronological order."},"vendorStatus":{"$ref":"#/components/schemas/SecurityEventVendorStatus"},"communicationLog":{"type":"array","items":{"$ref":"#/components/schemas/SecurityEventActivityEntry"},"description":"Chronological workflow activity log for this vendor on the event. See\nSecurityEventActivityType for what is (and is not) represented here."}},"description":"Vendor-perspective detail payload for a single vendor on a security event\n(GetVendorSecurityEventDetail).","required":["impactReasoning","vrmRequests","vendorStatus","communicationLog"]}},"components/schemas/SecurityEventVendorStatus":{"id":"components/schemas/SecurityEventVendorStatus","kind":"json-schema","title":"SecurityEventVendorStatus","data":{"type":"string","enum":["SECURITY_EVENT_VENDOR_STATUS_UNSPECIFIED","SECURITY_EVENT_VENDOR_STATUS_ACTIVE","SECURITY_EVENT_VENDOR_STATUS_TRIAGED","SECURITY_EVENT_VENDOR_STATUS_RESPONSE_NEEDED","SECURITY_EVENT_VENDOR_STATUS_REOPENED","SECURITY_EVENT_VENDOR_STATUS_ARCHIVED","SECURITY_EVENT_VENDOR_STATUS_RETRACTED"],"default":"SECURITY_EVENT_VENDOR_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Vendor-side workflow status for a security event, from the perspective of the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"vendor named in GetVendorSecurityEventDetail."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_ACTIVE: Vendor has been notified; event is awaiting initial triage."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_TRIAGED: Vendor has acknowledged and triaged the event."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_RESPONSE_NEEDED: A response has been requested from the vendor and is pending."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_REOPENED: Event was previously closed but has been reopened for the vendor."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_ARCHIVED: Event has been archived for the vendor; no further action expected."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VENDOR_STATUS_RETRACTED: Upstream evidence source withdrew the underlying observation for the vendor."},"children":[]}]}]}]}]}},"components/schemas/SecurityEventView":{"id":"components/schemas/SecurityEventView","kind":"json-schema","title":"SecurityEventView","data":{"type":"string","enum":["SECURITY_EVENT_VIEW_UNSPECIFIED","SECURITY_EVENT_VIEW_VRM","SECURITY_EVENT_VIEW_VENDOR"],"default":"SECURITY_EVENT_VIEW_UNSPECIFIED","description":"Caller perspective for reading a security event: the VRM (customer) view or the\nvendor-facing view."}},"components/schemas/SecurityEventVrmRequest":{"id":"components/schemas/SecurityEventVrmRequest","kind":"json-schema","title":"SecurityEventVrmRequest","data":{"type":"object","properties":{"organization":{"$ref":"#/components/schemas/security_event.v1.Organization"},"sentAt":{"type":"string","format":"date-time","description":"When the request was sent."},"isInitialRequest":{"type":"boolean","description":"True for the initial request; false for follow-up requests."},"customMessage":{"type":"string","description":"Optional custom message included in the request template."}},"description":"One VRM response request sent to a vendor for a security event.","required":["organization","sentAt","isInitialRequest"]}},"components/schemas/SecurityEventVrmStatus":{"id":"components/schemas/SecurityEventVrmStatus","kind":"json-schema","title":"SecurityEventVrmStatus","data":{"type":"string","enum":["SECURITY_EVENT_VRM_STATUS_UNSPECIFIED","SECURITY_EVENT_VRM_STATUS_ACTIVE","SECURITY_EVENT_VRM_STATUS_INVESTIGATING","SECURITY_EVENT_VRM_STATUS_CLOSED","SECURITY_EVENT_VRM_STATUS_REOPENED","SECURITY_EVENT_VRM_STATUS_ARCHIVED","SECURITY_EVENT_VRM_STATUS_RETRACTED"],"default":"SECURITY_EVENT_VRM_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VRM (caller-organization) lifecycle status of a security event."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"SECURITY_EVENT_VRM_STATUS_RETRACTED: Upstream evidence source withdrew the underlying observation; the event was"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"not user-resolved, the evidence itself was retracted."},"children":[]}]}]}]}]}},"components/schemas/SendQuestionnaireBody":{"id":"components/schemas/SendQuestionnaireBody","kind":"json-schema","title":"SendQuestionnaireBody","data":{"type":"object","description":"Request to dispatch an already-created questionnaire to its vendor."}},"components/schemas/SendQuestionnaireResponse":{"id":"components/schemas/SendQuestionnaireResponse","kind":"json-schema","title":"SendQuestionnaireResponse","data":{"type":"object","properties":{"questionnaire":{"$ref":"#/components/schemas/Questionnaire"}},"description":"Response containing the questionnaire after dispatch.","required":["questionnaire"]}},"components/schemas/SortOrder":{"id":"components/schemas/SortOrder","kind":"json-schema","title":"SortOrder","data":{"type":"string","enum":["SORT_ORDER_UNSPECIFIED","SORT_ORDER_ASC","SORT_ORDER_DESC"],"default":"SORT_ORDER_UNSPECIFIED","description":"Sort direction for list and search APIs: ascending, descending, or unspecified."}},"components/schemas/Status":{"id":"components/schemas/Status","kind":"json-schema","title":"Status","data":{"type":"object","properties":{"code":{"type":"integer","format":"int32"},"message":{"type":"string"},"details":{"type":"array","items":{"$ref":"#/components/schemas/Any"}}},"required":["code","message","details"]}},"components/schemas/StringList":{"id":"components/schemas/StringList","kind":"json-schema","title":"StringList","data":{"type":"object","properties":{"values":{"type":"array","items":{"type":"string"}}},"description":"Ordered list of string tokens, typically for IN-style or multi-select filter matches.","required":["values"]}},"components/schemas/SubmitVendorResponseRequest":{"id":"components/schemas/SubmitVendorResponseRequest","kind":"json-schema","title":"SubmitVendorResponseRequest","data":{"type":"object","properties":{"orgDomain":{"type":"string","description":"Domain of the organization the security event belongs to."},"eventId":{"type":"string","description":"Unique identifier of the security event."},"impactStatus":{"$ref":"#/components/schemas/SecurityEventImpactStatus"},"impactStatement":{"type":"string","description":"Free-form description of the organizational impact."},"comment":{"type":"string","description":"Optional comment from the vendor."}},"description":"Input for submitting a vendor response to a security event. The responding\nvendor's domain is derived from the caller's own organization domain claim.","required":["orgDomain","eventId","impactStatus","impactStatement"]}},"components/schemas/SubmitVendorResponseResponse":{"id":"components/schemas/SubmitVendorResponseResponse","kind":"json-schema","title":"SubmitVendorResponseResponse","data":{"type":"object","properties":{"activity":{"$ref":"#/components/schemas/SecurityEventActivityEntry"}},"description":"Outcome of submitting a vendor response: the persisted activity entry.","required":["activity"]}},"components/schemas/UpdateVendorBody":{"id":"components/schemas/UpdateVendorBody","kind":"json-schema","title":"UpdateVendorBody","data":{"type":"object","properties":{"companyName":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Display name of the vendor company. Applied only if \"company_name\" is in update_mask."},"children":[]}]}]}]},"vendorId":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Customer-defined free-text identifier for the vendor. Applied only if"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"\"vendor_id\" is in update_mask."},"children":[]}]}]}]},"isMonitored":{"type":"boolean","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Whether the vendor should be actively monitored. Applied only if"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"\"is_monitored\" is in update_mask."},"children":[]}]}]}]},"riskLevel":{"$ref":"#/components/schemas/RiskLevel"},"businessImpact":{"$ref":"#/components/schemas/BusinessImpact"},"dataTypesShared":{"type":"array","items":{"$ref":"#/components/schemas/DataTypeShared"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Categories of data shared with the vendor. Replaces the existing set; applied"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only if \"data_types_shared\" is in update_mask."},"children":[]}]}]}]},"accessTypes":{"type":"array","items":{"$ref":"#/components/schemas/AccessType"},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Types of access granted to the vendor. Replaces the existing set; applied"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"only if \"access_types\" is in update_mask."},"children":[]}]}]}]},"contractValue":{"type":"string","format":"int64","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Monetary value of the contract, in the minor units of the customer account's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"currency — same representation as Vendor.contract_value. Applied only if"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"\"contract_value\" is in update_mask."},"children":[]}]}]}]},"contractEndDate":{"type":"string","format":"date-time","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Date the vendor contract expires. Applied only if \"contract_end_date\" is in"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"update_mask; unset clears it."},"children":[]}]}]}]},"dataRegion":{"$ref":"#/components/schemas/DataRegion"},"updateMask":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Field paths (from the fields above, by their public JSON/proto name) to apply"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"from this request. Required and must be non-empty: a field not listed here is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ignored even if set on the request. Naming an unknown or non-updatable path"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(e.g. \"domain_name\", \"lifecycle_status\") is rejected with INVALID_ARGUMENT."},"children":[]}]}]}]}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Writable, curated subset for partially updating a vendor in the caller's"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"directory, plus the field mask that scopes the merge."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Deliberately narrow, mirroring CreateVendorRequest: it has NO"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"customer_organization_id — the organization is derived server-side from the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"caller's access token — and no internal ids, audit actors, or contact PII."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"domain_name and lifecycle_status are intentionally absent: domain_name is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"immutable, and lifecycle transitions go through OffboardVendor instead."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Only the field paths named in update_mask are applied; a value left unset on a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"masked field clears it (where the underlying field is optional/nullable)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Fields not named in update_mask are ignored even if set on the request."},"children":[]}]}]}],"required":["dataTypesShared","accessTypes","contractEndDate","updateMask"]}},"components/schemas/UpdateVendorResponse":{"id":"components/schemas/UpdateVendorResponse","kind":"json-schema","title":"UpdateVendorResponse","data":{"type":"object","properties":{"vendor":{"$ref":"#/components/schemas/vendor.v1.Vendor"}},"description":"Response containing the updated vendor.","required":["vendor"]}},"components/schemas/VendorConnectionDetails":{"id":"components/schemas/VendorConnectionDetails","kind":"json-schema","title":"VendorConnectionDetails","data":{"type":"object","properties":{"description":{"type":"string"},"evidence":{"type":"array","items":{"type":"string"}}},"description":"Human-readable summary plus the raw evidence fragments that justify a single vendor\nconnection. The producer derives the description from the underlying detection (e.g.\n\"HTTP Request: fonts.googleapis.com\", \"Detected library: Bootstrap 3.3.7 via\ngetbootstrap.com\"); each evidence string is a raw fragment (request host, DNS target, SAN,\ncookie domain, ...) captured verbatim for UI display or downstream re-parsing.","required":["description","evidence"]}},"components/schemas/VendorConnectionRelationship":{"id":"components/schemas/VendorConnectionRelationship","kind":"json-schema","title":"VendorConnectionRelationship","data":{"type":"string","enum":["VENDOR_CONNECTION_RELATIONSHIP_UNSPECIFIED","VENDOR_CONNECTION_RELATIONSHIP_THIRD_PARTY","VENDOR_CONNECTION_RELATIONSHIP_FOURTH_PARTY"],"default":"VENDOR_CONNECTION_RELATIONSHIP_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Degree of separation between the customer and the detected vendor. Producers may leave this"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"UNSPECIFIED while THIRD_PARTY is the only relationship currently emitted; FOURTH_PARTY is"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"reserved for the upcoming nested-vendor classification work."},"children":[]}]}]}]}},"components/schemas/VendorConnectionType":{"id":"components/schemas/VendorConnectionType","kind":"json-schema","title":"VendorConnectionType","data":{"type":"string","enum":["VENDOR_CONNECTION_TYPE_UNSPECIFIED","VENDOR_CONNECTION_TYPE_HTTP_REQUEST","VENDOR_CONNECTION_TYPE_DETECTED_LIBRARY","VENDOR_CONNECTION_TYPE_DNS","VENDOR_CONNECTION_TYPE_BREACH","VENDOR_CONNECTION_TYPE_PRODUCTS_DETECTED","VENDOR_CONNECTION_TYPE_TLS","VENDOR_CONNECTION_TYPE_X509"],"default":"VENDOR_CONNECTION_TYPE_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Channel on which a customer <-> vendor connection was detected (HTTP request, DNS, TLS,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"X509, ...). Mapping from the producer's per-channel evidence (e.g. bluepipe's detection"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"channels) into this consumer-facing grouping happens in the producer."},"children":[]}]}]}]}},"components/schemas/VendorGroup":{"id":"components/schemas/VendorGroup","kind":"json-schema","title":"VendorGroup","data":{"type":"object","properties":{"id":{"type":"string","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Server-generated unique identifier of the group (the internal vendor_group_id,"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"renamed for the public surface exactly as Vendor.id curates the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"vendor_relationship_id). Pass this back when addressing a specific group."},"children":[]}]}]}]},"name":{"type":"string","description":"Human-readable display name of the group; unique within the caller's organization."},"description":{"type":"string","description":"Free-text description of the group. Absent when never set, which is\ndistinguishable from an explicitly empty description."},"memberCount":{"type":"string","format":"int64","description":"Number of vendors currently in this group. Maintained by the service and\nread-only on this surface. Typed int64 to match the internal counterpart, so the\ncurating builder copies the value across rather than narrowing it."},"createdAt":{"type":"string","format":"date-time","description":"Time the group was created."},"updatedAt":{"type":"string","format":"date-time","description":"Time the group's metadata was last updated."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A vendor group in the caller's vendor directory, curated for public API consumers."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A vendor group is the customer's own named collection over the third parties they"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"track (e.g. by business unit or risk tier)."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A deliberately narrow, stable subset of the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor_protos.vendor_relationship.v1.VendorGroup. Message field numbers are scoped"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"to this message and renumbered densely on the public side, independent of the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"internal contract. Intentionally excluded:"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"customer_organization_id – necessarily the caller's own org (the query is scoped"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"to it server-side), so echoing it back adds nothing"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"and leaks an internal id shape."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"organizational_unit_id   – an internal scoping mechanism, not a customer-facing"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"concept."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"created_by / updated_by  – internal audit subject identifiers; the same exclusion"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the curated public Vendor makes."},"children":[]}]}]}],"required":["id","name","memberCount","createdAt","updatedAt"]}},"components/schemas/VendorLifecycleStatus":{"id":"components/schemas/VendorLifecycleStatus","kind":"json-schema","title":"VendorLifecycleStatus","data":{"type":"string","enum":["VENDOR_LIFECYCLE_STATUS_UNSPECIFIED","VENDOR_LIFECYCLE_STATUS_NEW","VENDOR_LIFECYCLE_STATUS_ONBOARDED","VENDOR_LIFECYCLE_STATUS_OFFBOARDED","VENDOR_LIFECYCLE_STATUS_UNVETTED"],"default":"VENDOR_LIFECYCLE_STATUS_UNSPECIFIED","description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Lifecycle state of a vendor as exposed on the public API. Curated public copy of"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"the internal factor_protos.vendor_relationship.v1.VendorLifecycleStatus."},"children":[]}]}]},{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Ordinals are deliberately kept IDENTICAL to the internal enum (including a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"reserved"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" slot for the internal-only DELETED). Rationale: unlike message field"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"numbers — which are scoped to a single message and are renumbered freely on the"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"public side — enum values can cross the public/internal boundary by their numeric"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"value (e.g. a value cast or copied through a shared downstream service / read"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"model). If the numbers diverged, a public value could silently decode as a"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"different internal one (e.g. public UNVETTED=4 landing on internal DELETED=4)."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Value "},"children":[]},{"$$mdtype":"Node","type":"em","inline":true,"attributes":{"marker":"*"},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"names"},"children":[]}]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" may differ (public uses the prefixed form); only the NUMBERS must"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"stay aligned. When the internal enum gains a value, mirror it here at the same"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"ordinal — or "},"children":[]},{"$$mdtype":"Node","type":"code","inline":true,"attributes":{"content":"reserved"},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":" that ordinal if it stays internal-only."},"children":[]}]}]},{"$$mdtype":"Node","type":"list","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDOR_LIFECYCLE_STATUS_UNSPECIFIED: Default zero value; lifecycle status was not set."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDOR_LIFECYCLE_STATUS_NEW: Newly added vendor, not yet onboarded."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDOR_LIFECYCLE_STATUS_ONBOARDED: Vendor is active and monitored."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDOR_LIFECYCLE_STATUS_OFFBOARDED: Vendor has been offboarded (archived)."},"children":[]}]}]},{"$$mdtype":"Node","type":"item","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"VENDOR_LIFECYCLE_STATUS_UNVETTED: Tracked but not monitored: holds metadata only, consumes no monitoring slot."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Kept at 5 to match the internal ordinal."},"children":[]}]}]}]}]}},"components/schemas/VendorPortfolio":{"id":"components/schemas/VendorPortfolio","kind":"json-schema","title":"VendorPortfolio","data":{"type":"object","properties":{"portfolioId":{"type":"string","description":"Unique identifier of the portfolio."},"portfolioName":{"type":"string","description":"Human-readable display name of the portfolio."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A single portfolio a vendor belongs to. Curated public copy of the internal"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"factor_protos.vendor_relationship.v1.VendorRelationshipPortfolio."},"children":[]}]}]}],"required":["portfolioId","portfolioName"]}},"components/schemas/VendorScoreResult":{"id":"components/schemas/VendorScoreResult","kind":"json-schema","title":"VendorScoreResult","data":{"type":"object","properties":{"domain":{"type":"string","description":"The vendor domain these scores belong to."},"topLevelScore":{"$ref":"#/components/schemas/PublicVendorScore"},"breachLikelihoodScore":{"$ref":"#/components/schemas/PublicVendorScore"},"ransomwareScore":{"$ref":"#/components/schemas/PublicVendorScore"}},"description":"Overall, breach-likelihood, and ransomware scores for a single vendor domain. Any score not\navailable for the domain is left unset rather than defaulting to a zero/UNSPECIFIED value.","required":["domain"]}},"components/schemas/VulnerabilityDetail":{"id":"components/schemas/VulnerabilityDetail","kind":"json-schema","title":"/ VulnerabilityDetail class","data":{"type":"object","properties":{"cveId":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"source":{"type":"string","title":"\"<https://www.cvedetails.com/cve-assigners-cnas/1.html>\""},"cvssScores":{"type":"array","items":{"$ref":"#/components/schemas/CvssScore"},"title":"\"a set of different CVSS structs, unique by version\""},"cwes":{"type":"array","items":{"$ref":"#/components/schemas/CweData"}},"cpes":{"type":"array","items":{"type":"string"}},"epss":{"type":"number","format":"float","title":"\"scaled from 0 to 1 <https://www.cvedetails.com/epss/faq.html>\""},"epssHistory":{"type":"array","items":{"$ref":"#/components/schemas/EpssHistory"}},"published":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"},"isInCisaKev":{"type":"boolean"}},"title":"/ VulnerabilityDetail class","required":["cveId","title","description","source","cvssScores","cwes","cpes","epss","epssHistory","published","updated","isInCisaKev"]}},"components/schemas/observation.v1.Organization":{"id":"components/schemas/observation.v1.Organization","kind":"json-schema","title":"/ Organization class","data":{"type":"object","properties":{"orn":{"type":"string","title":"\"ORN to the organization\""},"scorecardOrn":{"type":"string","title":"\"ORN to the scorecard\""},"displayName":{"type":"string","title":"\"friendly name for rendering\""},"logoIcon":{"type":"string","title":"\"url to the logo icon\""},"domain":{"type":"string","title":"top-level domain"}},"title":"/ Organization class","required":["orn","scorecardOrn","displayName","logoIcon","domain"]}},"components/schemas/observation.v1.Vendor":{"id":"components/schemas/observation.v1.Vendor","kind":"json-schema","title":"/ Vendor class","data":{"type":"object","properties":{"organization":{"$ref":"#/components/schemas/observation.v1.Organization"}},"title":"/ Vendor class","required":["organization"]}},"components/schemas/security_event.v1.Organization":{"id":"components/schemas/security_event.v1.Organization","kind":"json-schema","title":"security_event.v1.Organization","data":{"type":"object","properties":{"domain":{"type":"string","description":"Top-level domain identifying the organization."},"displayName":{"type":"string","description":"Friendly display name for rendering; absent when not yet resolved."},"logoIcon":{"type":"string","description":"URL to the organization's logo icon; absent when not available."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"Minimal organization identity used throughout the security-events public API"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"(impacted companies, VRM requesters, activity actors). Self-contained curated"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"copy — does not reference the public/observation domain's Organization message."},"children":[]}]}]}],"required":["domain"]}},"components/schemas/v1.Contact":{"id":"components/schemas/v1.Contact","kind":"json-schema","title":"v1.Contact","data":{"type":"object","properties":{"email":{"type":"string","description":"Email address to receive the remediation-request email."}},"description":"A single contact to receive a remediation-request email.","required":["email"]}},"components/schemas/vendor.v1.Vendor":{"id":"components/schemas/vendor.v1.Vendor","kind":"json-schema","title":"vendor.v1.Vendor","data":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the vendor."},"domainName":{"type":"string","description":"Primary domain name of the vendor."},"companyName":{"type":"string","description":"Display name of the vendor company."},"companyIndustryCategory":{"type":"string","description":"Industry category of the vendor company."},"companyLogoUrl":{"type":"string","description":"URL of the vendor company logo."},"lifecycleStatus":{"$ref":"#/components/schemas/VendorLifecycleStatus"},"isMonitored":{"type":"boolean","description":"Whether the vendor is actively monitored."},"dataRegion":{"$ref":"#/components/schemas/DataRegion"},"riskLevel":{"$ref":"#/components/schemas/RiskLevel"},"dataTypesShared":{"type":"array","items":{"$ref":"#/components/schemas/DataTypeShared"},"description":"Categories of data shared with the vendor."},"businessImpact":{"$ref":"#/components/schemas/BusinessImpact"},"vendorId":{"type":"string","description":"Customer-defined free-text identifier for the vendor (not the internal entity ID)."},"accessTypes":{"type":"array","items":{"$ref":"#/components/schemas/AccessType"},"description":"Types of access granted to the vendor."},"contractValue":{"type":"string","format":"int64","description":"Monetary value of the contract, in the minor units of the customer account's\ncurrency (e.g. cents for a USD account). Currency is the caller's account\ncurrency; there is no per-vendor currency override."},"contractEndDate":{"type":"string","format":"date-time","description":"Date the vendor contract expires; absent when not set."},"lastAssessedDate":{"type":"string","format":"date-time","description":"Date the vendor was last assessed/reviewed; absent when never assessed."},"createdAt":{"type":"string","format":"date-time","description":"When the vendor was created."},"updatedAt":{"type":"string","format":"date-time","description":"When the vendor was last updated."}},"description":[{"$$mdtype":"Node","type":"paragraph","attributes":{},"children":[{"$$mdtype":"Node","type":"inline","attributes":{},"children":[{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A vendor in the caller's vendor directory, curated for public API consumers."},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"A deliberately narrow, stable subset of the internal vendor-relationship model —"},"children":[]},{"$$mdtype":"Node","type":"softbreak","inline":true,"attributes":{},"children":[]},{"$$mdtype":"Node","type":"text","inline":true,"attributes":{"content":"internal ids, audit actors, and contact PII are intentionally excluded."},"children":[]}]}]}],"required":["id","domainName","lifecycleStatus","isMonitored","dataTypesShared","accessTypes","contractEndDate","lastAssessedDate","createdAt","updatedAt"]}},"schema_1":{"kind":"json-schema","data":{},"id":"schema_1"}},"exampleStore":{},"securitySchemeStore":{},"servers":[{"url":"/_mock/openapi.public","isMockServer":true,"description":"Mock server"}]},"options":{"hideSidebar":true,"mockServer":{"url":"/_mock/openapi.public","position":"first","description":"Mock server"},"disableRouter":true,"downloadUrls":[{"url":"/_bundle/openapi.public.json?download"},{"url":"/_bundle/openapi.public.yaml?download"}],"excludeFromSearch":false,"specType":"openapi","markdocOptions":{"tags":{},"nodes":{},"components":{}},"metadata":{"title":"Titan Public API","description":"Programmatic access to the Titan platform's public surface. Endpoints\nlive under the `/public/<major>/` path prefix and use OAuth 2.0\nclient-credentials authentication (see the Getting Started guide in\nthe sidebar). Lifecycle state —\nstability, deprecation, sunset — is surfaced on each operation via\nthe lifecycle overlays under `openapi/overlays/lifecycle/`.\n"}},"baseSlug":"/openapi.public","routesMapping":{}}