{
  "openapi": "3.1.0",
  "info": {
    "title": "OceanWay Core identity slice",
    "version": "0.1.0-draft"
  },
  "x-source-commit": "385d2dfd10d821b25c8a6766bd16eea248cb1652",
  "x-status": "local_identity_configured",
  "x-limits": [
    "No public registration, MFA, OAuth, PAT, password reset or cross-site code exchange in this slice.",
    "Self projection omits upstream billing/provider/settings/permissions fields.",
    "Runtime auth requires explicit configuration and fresh OceanWay migrations."
  ],
  "paths": {
    "/api/user/login": {
      "post": {
        "operationId": "Login",
        "security": [],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginSuccess"
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "400": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "415": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "username": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 64
                  },
                  "password": {
                    "type": "string",
                    "description": "Not normalized; 512-byte input cap. New account password policy 8–128 Unicode characters."
                  }
                },
                "required": [
                  "username",
                  "password"
                ],
                "additionalProperties": false
              }
            }
          }
        },
        "x-origin": "Explicit allowed Origin or Referer is required, including local HTTP mode."
      }
    },
    "/api/user/auth/refresh": {
      "post": {
        "operationId": "RefreshAuth",
        "security": [
          {
            "RefreshCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginSuccess"
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "409": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "X-Auth-Session",
            "in": "header",
            "schema": {
              "type": "string"
            },
            "description": "Optional expected SID. Mismatch rejected without overwriting browser cookies."
          }
        ],
        "x-origin": "Explicit allowed Origin or Referer is required, including local HTTP mode."
      }
    },
    "/api/user/auth/logout": {
      "post": {
        "operationId": "AuthLogout",
        "security": [
          {
            "Access": []
          },
          {
            "RefreshCookie": []
          },
          {}
        ],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/LogoutSuccess"
                    },
                    {
                      "$ref": "#/components/schemas/NoDataSuccess"
                    }
                  ]
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "409": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "X-Auth-Session",
            "in": "header",
            "schema": {
              "type": "string"
            },
            "description": "Optional expected SID. Mismatch rejected without overwriting browser cookies."
          }
        ],
        "x-origin": "Explicit allowed Origin or Referer is required, including local HTTP mode."
      }
    },
    "/api/user/self": {
      "get": {
        "operationId": "GetSelf",
        "security": [
          {
            "Access": []
          }
        ],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SelfSuccess"
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/api/user/sessions": {
      "get": {
        "operationId": "GetLoginSessions",
        "security": [
          {
            "Access": []
          }
        ],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SessionsSuccess"
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/api/user/sessions/{sid}": {
      "delete": {
        "operationId": "DeleteLoginSession",
        "security": [
          {
            "Access": []
          }
        ],
        "responses": {
          "200": {
            "description": "Success; Cache-Control: no-store.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokeSuccess"
                }
              }
            }
          },
          "401": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Structured AUTH_* error; no credentials or SQL diagnostics.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "sid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "x-origin": "Explicit allowed Origin or Referer is required, including local HTTP mode."
      }
    }
  },
  "components": {
    "schemas": {
      "User": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "username": {
            "type": "string"
          },
          "display_name": {
            "type": "string"
          },
          "email": {
            "type": "string"
          },
          "role": {
            "type": "integer"
          },
          "status": {
            "type": "integer"
          },
          "group": {
            "type": "string"
          },
          "has_password": {
            "type": "boolean"
          }
        },
        "required": [
          "id",
          "username",
          "display_name",
          "email",
          "role",
          "status",
          "group",
          "has_password"
        ],
        "additionalProperties": false
      },
      "Session": {
        "type": "object",
        "properties": {
          "sid": {
            "type": "string"
          },
          "current": {
            "type": "boolean"
          },
          "login_method": {
            "type": "string"
          },
          "ip": {
            "type": "string"
          },
          "user_agent": {
            "type": "string"
          },
          "created_at": {
            "type": "integer"
          },
          "last_active_at": {
            "type": "integer"
          },
          "expires_at": {
            "type": "integer"
          }
        },
        "required": [
          "sid",
          "current",
          "login_method",
          "ip",
          "user_agent",
          "created_at",
          "last_active_at",
          "expires_at"
        ],
        "additionalProperties": false
      },
      "Bundle": {
        "type": "object",
        "properties": {
          "access_token": {
            "type": "string"
          },
          "token_type": {
            "const": "Bearer"
          },
          "access_expires_at": {
            "type": "integer"
          },
          "user": {
            "$ref": "#/components/schemas/User"
          },
          "session": {
            "$ref": "#/components/schemas/Session"
          }
        },
        "required": [
          "access_token",
          "token_type",
          "access_expires_at",
          "user",
          "session"
        ],
        "additionalProperties": false
      },
      "Error": {
        "type": "object",
        "properties": {
          "success": {
            "const": false
          },
          "code": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "success",
          "code",
          "message"
        ],
        "additionalProperties": false
      },
      "NoDataSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          }
        },
        "required": [
          "success",
          "message"
        ],
        "additionalProperties": false
      },
      "LoginSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          },
          "data": {
            "$ref": "#/components/schemas/Bundle"
          }
        },
        "required": [
          "success",
          "message",
          "data"
        ],
        "additionalProperties": false
      },
      "SelfSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          },
          "data": {
            "$ref": "#/components/schemas/User"
          }
        },
        "required": [
          "success",
          "message",
          "data"
        ],
        "additionalProperties": false
      },
      "SessionsSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          },
          "data": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Session"
            }
          }
        },
        "required": [
          "success",
          "message",
          "data"
        ],
        "additionalProperties": false
      },
      "RevokeSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          },
          "data": {
            "type": "object",
            "properties": {
              "revoked_sid": {
                "type": "string"
              },
              "current": {
                "type": "boolean"
              }
            },
            "required": [
              "revoked_sid",
              "current"
            ],
            "additionalProperties": false
          }
        },
        "required": [
          "success",
          "message",
          "data"
        ],
        "additionalProperties": false
      },
      "LogoutSuccess": {
        "type": "object",
        "properties": {
          "success": {
            "const": true
          },
          "message": {
            "const": ""
          },
          "data": {
            "type": "object",
            "properties": {
              "revoked_sid": {
                "type": "string"
              },
              "cookie_cleared": {
                "type": "boolean"
              }
            },
            "required": [
              "revoked_sid",
              "cookie_cleared"
            ],
            "additionalProperties": false
          }
        },
        "required": [
          "success",
          "message",
          "data"
        ],
        "additionalProperties": false
      }
    },
    "securitySchemes": {
      "Access": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      },
      "RefreshCookie": {
        "type": "apiKey",
        "in": "cookie",
        "name": "new_api_refresh"
      }
    }
  }
}