{
  "openapi": "3.1.0",
  "info": {
    "title": "TechVizier Marketplace Management API",
    "version": "ops-v1",
    "description": "Authenticated /api/ops/v1 management API for backend wiki, campaigns, monitoring, notifications, catalog discovery, seller operations, admin reporting, operations metrics, settings, and sanitized audit logs."
  },
  "servers": [
    {
      "url": "/"
    }
  ],
  "components": {
    "securitySchemes": {
      "managementBearer": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "role-scoped-management-token",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Store only SHA-256 credential hashes plus non-secret metadata such as subject id, scopes, expiry, revocation, and rotation references."
      }
    },
    "parameters": {
      "idempotencyKey": {
        "name": "Idempotency-Key",
        "in": "header",
        "required": true,
        "schema": {
          "type": "string",
          "minLength": 8
        }
      }
    }
  },
  "paths": {
    "/healthz": {
      "get": {
        "summary": "Read redacted application health",
        "description": "Health and provider-smoke readiness summary Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Health and provider-smoke readiness summary"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/supervisor/status.json": {
      "get": {
        "summary": "Read public demo supervisor proof",
        "description": "Supervisor status without secrets or board tokens Mode availability: demo+stripe. Auth: public demo proof. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public demo proof",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Supervisor status without secrets or board tokens"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/catalog": {
      "get": {
        "summary": "List public catalog products",
        "description": "Public product catalog Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Public product catalog"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/catalog/{id}": {
      "get": {
        "summary": "Read public catalog product detail",
        "description": "Public product detail Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Public product detail"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/policies": {
      "get": {
        "summary": "List current public policy versions",
        "description": "Versioned policy metadata with pending-review status Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Versioned policy metadata with pending-review status"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/policies/{slug}": {
      "get": {
        "summary": "Read one current policy document",
        "description": "Policy metadata and draft body Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Policy metadata and draft body"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/policies/{slug}": {
      "get": {
        "summary": "Render a public policy page",
        "description": "Human-readable policy page Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Human-readable policy page"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/purchases": {
      "post": {
        "summary": "Issue a demo purchase/license",
        "description": "Demo purchase/license result Mode availability: demo. Auth: public demo email. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo",
        "x-auth": "public demo email",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "201": {
            "description": "Demo purchase/license result"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      },
      "get": {
        "summary": "List buyer purchases",
        "description": "Entitlement-scoped purchase list Mode availability: demo email query, production buyer token. Auth: public demo email or production buyer token. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo email query, production buyer token",
        "x-auth": "public demo email or production buyer token",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Entitlement-scoped purchase list"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/checkout-sessions": {
      "post": {
        "summary": "Create hosted Stripe Checkout session",
        "description": "Pending order and hosted checkout session Mode availability: stripe. Auth: public checkout request. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "stripe",
        "x-auth": "public checkout request",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "201": {
            "description": "Pending order and hosted checkout session"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/orders/{id}": {
      "get": {
        "summary": "Poll trusted order state",
        "description": "Buyer-scoped order state Mode availability: stripe. Auth: buyer token. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "stripe",
        "x-auth": "buyer token",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Buyer-scoped order state"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/downloads/{id}": {
      "get": {
        "summary": "Resolve entitlement-scoped download",
        "description": "Download file or private signed redirect Mode availability: demo+stripe. Auth: download token or buyer token. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "download token or buyer token",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Download file or private signed redirect"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/events": {
      "post": {
        "summary": "Capture sanitized analytics event",
        "description": "Normalized analytics event Mode availability: demo+stripe. Auth: public sanitized event capture. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public sanitized event capture",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "201": {
            "description": "Normalized analytics event"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/analytics/event": {
      "post": {
        "summary": "Capture legacy demo analytics event",
        "description": "Legacy analytics event acknowledgement Mode availability: demo legacy. Auth: public sanitized event capture. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo legacy",
        "x-auth": "public sanitized event capture",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Legacy analytics event acknowledgement"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/analytics": {
      "get": {
        "summary": "Read demo analytics summary",
        "description": "Demo analytics summary, not production ledger truth Mode availability: demo. Auth: public demo summary. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo",
        "x-auth": "public demo summary",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Demo analytics summary, not production ledger truth"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/waitlist": {
      "post": {
        "summary": "Capture waitlist or creator lead",
        "description": "Waitlist acknowledgement Mode availability: demo+stripe. Auth: public. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "demo+stripe",
        "x-auth": "public",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Waitlist acknowledgement"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/webhooks/stripe": {
      "post": {
        "summary": "Process Stripe checkout/payment/refund webhook",
        "description": "Webhook acknowledgement Mode availability: stripe. Auth: Stripe-Signature. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "stripe",
        "x-auth": "Stripe-Signature",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Webhook acknowledgement"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/webhooks/stripe-connect": {
      "post": {
        "summary": "Process Stripe Connect account, transfer, and payout webhook",
        "description": "Connect webhook acknowledgement Mode availability: stripe. Auth: Stripe-Signature. Responses must not include secrets, provider payloads, signed URL values in examples, board tokens, raw webhook signatures, or customer data exports.",
        "x-mode-availability": "stripe",
        "x-auth": "Stripe-Signature",
        "x-rate-limit-scope": "client_ip+route",
        "responses": {
          "200": {
            "description": "Connect webhook acknowledgement"
          },
          "400": {
            "description": "Invalid request"
          },
          "401": {
            "description": "Buyer or bearer token required where applicable"
          },
          "403": {
            "description": "Forbidden or entitlement denied"
          },
          "404": {
            "description": "Resource not found"
          },
          "429": {
            "description": "Rate limited"
          },
          "501": {
            "description": "Unavailable in current commerce mode"
          }
        }
      }
    },
    "/api/v1/operator/wiki/pages": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List backend wiki pages (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Wiki page list"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/production-map": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read redacted production gap map aggregate (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Production operation map and gap rows"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/wiki/pages/{slug}": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read a wiki page (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Wiki page"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "put": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create or update a wiki page revision (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "wiki:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Updated wiki page"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/wiki/pages/{slug}/revisions": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List wiki page revisions (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Revision history"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/metrics/summary": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read operating analytics summary (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: analytics:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "analytics:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Analytics summary"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/campaigns": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List campaign config (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "campaigns:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Campaigns"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create campaign config (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "campaigns:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Campaign created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/campaigns/{id}": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read campaign config (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "campaigns:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Campaign"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "put": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update campaign config (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "campaigns:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Campaign updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/monitoring/checks": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List monitoring checks (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "monitoring:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Checks"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create monitoring check (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Check created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/monitoring/incidents": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List incidents (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "monitoring:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Incidents"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create incident (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Incident created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/monitoring/incidents/{id}": {
      "patch": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update incident (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Incident updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/notifications/health": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read transactional notification health (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "notifications:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Notification health"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/notifications/events": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List redacted notification events (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "notifications:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Notification events"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/notifications/send": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Send transactional notification with idempotency (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "notifications:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Notification event"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/notifications/events/{id}/retry": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Retry failed transactional notification (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "notifications:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Notification retry"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/discovery/config": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read catalog discovery configuration (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: discovery:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "discovery:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Discovery config"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/sellers": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List seller operation states (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Sellers"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/products": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List product operation states (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Products"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/orders": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List order operation states (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Orders"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/compliance/queues": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List compliance policy queues and evidence fields (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Compliance queue states"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/accounting/export": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read redacted accounting export rows (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Accounting export"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/settings": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read platform settings (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: settings:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "settings:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Settings"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "patch": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update operational settings (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: settings:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "settings:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Settings updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/v1/operator/audit-logs": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read remote API audit logs (legacy operator path)",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: audit:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "audit:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Audit logs"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/wiki/pages": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List backend wiki pages",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Wiki page list"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/production-map": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read redacted backend wiki and production gap map aggregate",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Production operation map and gap rows"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/wiki/pages/{slug}": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read a wiki page",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Wiki page"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "put": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create or update a wiki page revision",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "wiki:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Updated wiki page"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/wiki/pages/{slug}/revisions": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List wiki page revisions",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: wiki:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "wiki:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Revision history"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/metrics/summary": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read operating analytics summary",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: analytics:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "analytics:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Analytics summary"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/campaigns": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List campaign config",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "campaigns:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Campaigns"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create campaign config",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "campaigns:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Campaign created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/campaigns/{id}": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read campaign config",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "campaigns:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Campaign"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "put": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update campaign config",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: campaigns:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "campaigns:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Campaign updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/monitoring/checks": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List monitoring checks",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "monitoring:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Checks"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create monitoring check",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Check created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/monitoring/incidents": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List incidents",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "monitoring:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Incidents"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create incident",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Incident created"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/monitoring/incidents/{id}": {
      "patch": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update incident",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: monitoring:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "monitoring:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Incident updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/notifications/health": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read transactional notification health",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "notifications:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Notification health"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/notifications/events": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List redacted notification events",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "notifications:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Notification events"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/notifications/send": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Send transactional notification with idempotency",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "notifications:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Notification event"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/notifications/events/{id}/retry": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Retry failed transactional notification",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: notifications:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "notifications:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Notification retry"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/discovery/config": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read catalog discovery configuration",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: discovery:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "discovery:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Discovery config"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/sellers": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List seller operation states",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Sellers"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/products": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List product operation states",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Products"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/orders": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List order operation states",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Orders"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/compliance/queues": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List compliance policy queues and evidence fields",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Compliance queue states"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/accounting/export": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read redacted accounting export rows",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Accounting export"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/settings": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read platform settings",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: settings:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "settings:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Settings"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      },
      "patch": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update operational settings",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: settings:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "settings:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Settings updated"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/ops/v1/audit-logs": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read remote API audit logs",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: audit:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "audit:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Audit logs"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create or upsert a seller profile",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Seller profile"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}": {
      "put": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Update a seller profile",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Seller profile"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/dashboard": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read seller dashboard",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "seller:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Seller dashboard"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/fee-acceptance": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Record seller 5% fee acceptance",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Fee acceptance"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/policy-acceptances": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Record seller policy acceptances",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Policy acceptances"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/analytics": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read seller analytics",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:analytics:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "seller:analytics:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Seller analytics"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/connect/onboarding-link": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create seller Connect onboarding link",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:connect:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:connect:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Connect onboarding link"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/connect/refresh": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Refresh seller Connect account readiness",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:connect:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:connect:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Connect account state"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/products": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create or update seller product and optional price",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:product:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:product:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Seller product"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/sellers/{sellerId}/products/{productId}/publish": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Run product publish gate and publish when eligible",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:product:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:product:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "200": {
            "description": "Publish result"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/seller/upload-sessions": {
      "post": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Create private object-storage upload session",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: seller:upload:write. Mutating management requests require Idempotency-Key; replays return the original response with idempotentReplay=true and conflicting reuse returns 409. Successful mutations write sanitized audit records with actor, role, target, idempotency reference, and request hash.",
        "x-required-capability": "seller:upload:write",
        "x-idempotency-required": true,
        "x-rate-limit-scope": "credential+ip",
        "parameters": [
          {
            "$ref": "#/components/parameters/idempotencyKey"
          }
        ],
        "responses": {
          "201": {
            "description": "Upload session"
          },
          "400": {
            "description": "Invalid body or missing Idempotency-Key"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "409": {
            "description": "Idempotency conflict or domain conflict"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/reports/reconciliation": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read reconciliation report",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Reconciliation report"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/reports/accounting-export": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read redacted accounting export rows",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Accounting export"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/payment-events": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List payment webhook events",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Payment events"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/audit-events": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List sanitized audit events",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: admin:report. Requests are rate limited per credential and client IP.",
        "x-required-capability": "admin:report",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Audit events"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/operations/metrics": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "Read operations metrics and failure states",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Operations metrics"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/admin/operations/events": {
      "get": {
        "security": [
          {
            "managementBearer": []
          }
        ],
        "summary": "List sanitized operations events",
        "description": "Role-scoped bearer token backed by hashed credential records. `owner`/`admin` can use every endpoint; `support`, `catalog`, `compliance`, `market`, and `readonly` are scoped by role and optional token scopes. Revoked or expired credentials are rejected. Required capability: operations:read. Requests are rate limited per credential and client IP.",
        "x-required-capability": "operations:read",
        "x-rate-limit-scope": "credential+ip",
        "responses": {
          "200": {
            "description": "Operations events"
          },
          "401": {
            "description": "Bearer token missing"
          },
          "403": {
            "description": "Credential revoked or role lacks the required capability"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    }
  }
}