{"components":{"schemas":{"AddSubdomainPlan":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"apexAlias":{"type":"object","properties":{"dnsName":{"type":"string","minLength":1},"evaluateTargetHealth":{"type":"boolean"},"hostedZoneId":{"type":"string","minLength":1}},"required":["dnsName","evaluateTargetHealth","hostedZoneId"],"additionalProperties":false},"executionId":{"type":"string","minLength":1},"hostedZoneId":{"type":"string","minLength":1},"items":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"object","properties":{"current":{"type":"object","properties":{"aliasTarget":{"type":"object","properties":{"dnsName":{"type":"string","minLength":1},"evaluateTargetHealth":{"type":"boolean"},"hostedZoneId":{"type":"string","minLength":1}},"required":["dnsName","evaluateTargetHealth","hostedZoneId"],"additionalProperties":false},"name":{"type":"string","minLength":1},"ttl":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"type":{"type":"string","enum":["A","CNAME"]},"values":{"default":[],"type":"array","items":{"type":"string","minLength":1}}},"required":["name","type","values"],"additionalProperties":false},"disposition":{"type":"string","enum":["already-correct","create","replace"]},"hostname":{"type":"string","minLength":1}},"required":["disposition","hostname"],"additionalProperties":false}},"planHash":{"type":"string","pattern":"^[a-f0-9]{64}$"},"replacementRequired":{"type":"boolean"},"rootDomain":{}},"required":["apexAlias","executionId","hostedZoneId","items","planHash","replacementRequired","rootDomain"],"additionalProperties":false},"AddSubdomainPlanApprovalRequest":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"planHash":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"required":["planHash"],"additionalProperties":false},"ApiKeyMetadata":{"additionalProperties":false,"properties":{"apiKeyId":{"type":"string"},"createdAt":{"type":"string"},"expiresAt":{"type":"string"},"lastUsedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"pepperVersion":{"type":"integer"},"prefix":{"type":"string"},"principalId":{"type":"string"},"revokedAt":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["apiKeyId","createdAt","expiresAt","lastUsedAt","pepperVersion","prefix","principalId","revokedAt"],"type":"object"},"ArchiveEventVersionRequest":{"additionalProperties":true,"properties":{"confirm":{"const":true,"type":"boolean"}},"type":"object"},"AuditLog":{"additionalProperties":false,"properties":{"action":{"type":"string"},"at":{"type":"string"},"executionId":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"type":"string"},"ip":{"anyOf":[{"type":"string"},{"type":"null"}]},"method":{"type":"string"},"principalId":{"type":"string"},"resource":{"type":"string"},"result":{"enum":["allowed","denied"],"type":"string"},"route":{"type":"string"},"userAgent":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["action","at","executionId","id","ip","method","principalId","resource","result","route","userAgent"],"type":"object"},"CreateSubscriptionRequest":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"active":{"default":true,"type":"boolean"},"events":{"minItems":1,"type":"array","items":{"type":"string","minLength":1}},"secret":{"type":"string","minLength":1},"url":{"type":"string","format":"uri"}},"required":["events","secret","url"]},"DomainOnboardingOutcome":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"assistance":{"type":"object","properties":{"reasons":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string","minLength":1},"audience":{"type":"string","enum":["platform","requester"]},"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"resources":{"type":"array","items":{"type":"string","minLength":1}}},"required":["action","audience","code","message"],"additionalProperties":false}},"required":{"type":"boolean"}},"required":["reasons","required"],"additionalProperties":false},"certificate":{"type":"object","properties":{"arn":{"type":"string","minLength":1},"id":{"type":"string","minLength":1},"primaryDomain":{"type":"string","minLength":1},"state":{"type":"string","enum":["created","adopted","not-created","unknown"]}},"required":["primaryDomain","state"],"additionalProperties":false},"cleanup":{"type":"object","properties":{"action":{"type":"string","minLength":1},"certificateArn":{"type":"string","minLength":1},"remainingAttachments":{"type":"array","items":{"type":"string","minLength":1}},"state":{"type":"string","enum":["completed","already-clean","not-required","manual-required","not-reached","unknown"]}},"required":["state"],"additionalProperties":false},"distributions":{"type":"object","properties":{"kirby":{"type":"object","properties":{"id":{"type":"string","minLength":1},"state":{"type":"string","enum":["created","updated","adopted","not-created","unknown"]}},"required":["state"],"additionalProperties":false},"nginx":{"type":"object","properties":{"id":{"type":"string","minLength":1},"state":{"type":"string","enum":["created","updated","adopted","not-created","unknown"]}},"required":["state"],"additionalProperties":false}},"required":["kirby","nginx"],"additionalProperties":false},"domain":{"type":"object","properties":{"name":{"type":"string","minLength":1},"state":{"type":"string","enum":["registered","already-registered","not-registered","unknown"]}},"required":["name","state"],"additionalProperties":false},"executionId":{"type":"string","minLength":1},"googleMaps":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"object","properties":{"displayName":{"type":"string","minLength":1},"state":{"type":"string","enum":["updated","already-present","capacity-exhausted","failed"]}},"required":["displayName","state"],"additionalProperties":false}},"outcome":{"type":"string","enum":["updated","already-present","manual-required","not-reached"]},"remainingRootDomains":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["keys","outcome"],"additionalProperties":false},"status":{"type":"string","minLength":1},"workflowRunId":{"type":"string","minLength":1},"zendesk":{"type":"object","properties":{"intendedAction":{"type":"string","minLength":1},"state":{"type":"string","enum":["updated","manual-required","not-requested","not-reached"]},"ticketId":{"type":"string","minLength":1}},"required":["state"],"additionalProperties":false}},"required":["assistance","certificate","cleanup","distributions","domain","executionId","googleMaps","status","zendesk"],"additionalProperties":false},"Error":{"additionalProperties":false,"properties":{"error":{"type":"string"},"issues":{"items":{},"type":"array"},"message":{"type":"string"},"reason":{"type":"string"}},"required":["error"],"type":"object"},"EventCatalog":{"additionalProperties":false,"properties":{"events":{"items":{},"type":"array"}},"required":["events"],"type":"object"},"EventVersionUsage":{"additionalProperties":false,"properties":{"eventType":{"type":"string"},"eventVersion":{"type":"string"},"lifecycle":{},"subscriberCount":{"type":"integer"},"subscribers":{"items":{"additionalProperties":false,"properties":{"active":{"type":"boolean"},"health":{"type":"string"},"ownerPrincipalId":{"type":"string"},"subscriptionId":{"type":"string"}},"required":["active","health","ownerPrincipalId","subscriptionId"],"type":"object"},"type":"array"}},"required":["eventType","eventVersion","lifecycle","subscriberCount","subscribers"],"type":"object"},"Execution":{"additionalProperties":false,"properties":{"cancellationRequestedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"createdAt":{"type":"string"},"currentStage":{"anyOf":[{"type":"string"},{"type":"null"}]},"executionId":{"type":"string"},"finishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"principalId":{"type":"string"},"status":{"enum":["canceled","failed","paused","queued","rolled_back","running","succeeded","waiting"],"type":"string"},"workflow":{"type":"string"},"inputJson":{},"outcome":{"$ref":"#/components/schemas/DomainOnboardingOutcome"},"stages":{"items":{"$ref":"#/components/schemas/ExecutionStage"},"type":"array"}},"required":["createdAt","currentStage","executionId","finishedAt","principalId","status","workflow","inputJson","stages"],"type":"object"},"ExecutionStage":{"additionalProperties":false,"properties":{"errorJson":{},"executionId":{"type":"string"},"finishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"type":"string"},"outputJson":{},"stageName":{"type":"string"},"startedAt":{"type":"string"},"status":{"enum":["failed","running","succeeded","waiting"],"type":"string"}},"required":["executionId","id","stageName","startedAt","status"],"type":"object"},"ExecutionSummary":{"additionalProperties":false,"properties":{"cancellationRequestedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"createdAt":{"type":"string"},"currentStage":{"anyOf":[{"type":"string"},{"type":"null"}]},"executionId":{"type":"string"},"finishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"principalId":{"type":"string"},"status":{"enum":["canceled","failed","paused","queued","rolled_back","running","succeeded","waiting"],"type":"string"},"workflow":{"type":"string"}},"required":["createdAt","currentStage","executionId","finishedAt","principalId","status","workflow"],"type":"object"},"MintedApiKey":{"additionalProperties":false,"properties":{"apiKeyId":{"type":"string"},"expiresAt":{"type":"string"},"pepperVersion":{"type":"integer"},"plaintextToken":{"type":"string"},"prefix":{"type":"string"},"principalId":{"type":"string"}},"required":["apiKeyId","expiresAt","pepperVersion","plaintextToken","prefix","principalId"],"type":"object"},"OutboxEvent":{"additionalProperties":false,"properties":{"dispatchedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"eventId":{"type":"string"},"eventType":{"type":"string"},"eventVersion":{"type":"string"},"executionId":{"type":"string"},"occurredAt":{"type":"string"},"payloadJson":{},"principalId":{"type":"string"},"routedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"streamPublishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"traceparent":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["eventId","eventType","eventVersion","executionId","occurredAt","payloadJson","principalId"],"type":"object"},"RotateSubscriptionSecretRequest":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"secret":{"type":"string","minLength":1}},"required":["secret"]},"Subscription":{"additionalProperties":false,"properties":{"active":{"type":"boolean"},"createdAt":{"type":"string"},"events":{"items":{"type":"string"},"type":"array"},"health":{"type":"string"},"id":{"type":"string"},"kmsKeyId":{"type":"string"},"ownerPrincipalId":{"type":"string"},"url":{"type":"string"}},"required":["active","createdAt","events","health","id","kmsKeyId","ownerPrincipalId","url"],"type":"object"},"SubscriptionDelivery":{"additionalProperties":false,"properties":{"attempt":{"type":"integer"},"dispatchedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"eventId":{"type":"string"},"id":{"type":"string"},"lastError":{"anyOf":[{"type":"string"},{"type":"null"}]},"nextAttemptAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"responseCode":{"anyOf":[{"type":"integer"},{"type":"null"}]},"status":{"type":"string"},"subscriptionId":{"type":"string"}},"required":["attempt","dispatchedAt","eventId","id","lastError","nextAttemptAt","responseCode","status","subscriptionId"],"type":"object"},"SubscriptionError":{"additionalProperties":false,"properties":{"error":{"type":"string"},"issues":{"items":{},"type":"array"},"message":{"type":"string"}},"required":["error"],"type":"object"},"UpdateSubscriptionRequest":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"active":{"type":"boolean"},"events":{"minItems":1,"type":"array","items":{"type":"string","minLength":1}}}},"WorkflowTriggerResponse":{"additionalProperties":false,"properties":{"estimatedDurationSeconds":{"type":"integer"},"executionId":{"type":"string"},"links":{"additionalProperties":false,"properties":{"cancel":{"type":"string"},"events":{"type":"string"},"self":{"type":"string"}},"required":["cancel","events","self"],"type":"object"},"stages":{"items":{"type":"string"},"type":"array"},"status":{"enum":["canceled","failed","paused","queued","rolled_back","running","succeeded","waiting"],"type":"string"},"workflow":{"type":"string"},"workflowRunId":{"type":"string"}},"required":["estimatedDurationSeconds","executionId","links","stages","status","workflow","workflowRunId"],"type":"object"}},"securitySchemes":{"bearerAuth":{"bearerFormat":"Alfred API key","scheme":"bearer","type":"http"},"streamToken":{"description":"Single-use token minted by POST /v1/streams/token.","in":"query","name":"token","type":"apiKey"}}},"info":{"description":"Authenticated client API for supported workflows, executions, events, streams, and outbound webhook subscriptions.","title":"Alfred API","version":"0.1.0"},"jsonSchemaDialect":"https://json-schema.org/draft/2020-12/schema","openapi":"3.1.0","paths":{"/v1/events/catalog":{"get":{"operationId":"eventCatalog","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"items":{},"type":"array"}},"required":["events"],"type":"object"}}},"description":"Versioned domain events and their JSON Schemas."}},"summary":"Event catalog","tags":["Events"],"description":"Public, read-only catalog of Alfred event types, lifecycle metadata, and JSON Schemas; it requires no bearer token and does not depend on workflow state."}},"/v1/executions":{"get":{"operationId":"listExecutions","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"executions":{"items":{"$ref":"#/components/schemas/ExecutionSummary"},"type":"array"}},"required":["executions"],"type":"object"}}},"description":"Successful response"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"An execution filter is invalid."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."}},"summary":"List executions","tags":["Executions"],"description":"Read-only execution search for an authenticated principal. Results are limited to workflows for which the caller has workflows:<name> entitlement, then filtered by workflow, status, requesting principal, and limit; no execution state is changed.","parameters":[{"description":"Maximum records to return. Must be between 1 and 100.","in":"query","name":"limit","required":false,"schema":{"default":50,"maximum":100,"minimum":1,"type":"integer"}},{"description":"Filter by workflow name.","in":"query","name":"workflow","required":false,"schema":{"type":"string"}},{"description":"Filter by execution status.","in":"query","name":"status","required":false,"schema":{"type":"string"}},{"description":"Filter by requesting principal.","in":"query","name":"principalId","required":false,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}":{"get":{"operationId":"getExecution","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Execution"}}},"description":"Successful response"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."}},"summary":"Get execution","tags":["Executions"],"description":"Reads one execution, its ordered stages, and any normalized onboarding outcome. The bearer principal must hold the workflows:<name> entitlement corresponding to that execution; the operation is valid in every execution state and does not mutate it.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/cancel":{"post":{"operationId":"cancelExecution","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"execution":{"$ref":"#/components/schemas/ExecutionSummary"},"status":{"enum":["cancellation_requested"],"type":"string"}},"required":["execution"],"type":"object"}}},"description":"Execution control accepted."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution control is not valid in this state."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution control is not configured."}},"summary":"Cancel non-terminal execution","tags":["Executions"],"description":"Requires the workflows:<name> entitlement for the execution and mutates only cancelable, non-terminal work. Lambda updates record a cancellation request, while other workflows cancel their run and execution; add-subdomain cannot be canceled after Route 53 has accepted its change.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/rollback":{"post":{"operationId":"rollbackExecution","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"execution":{"$ref":"#/components/schemas/ExecutionSummary"}},"required":["execution"],"type":"object"}}},"description":"Execution was rolled back synchronously."},"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"command":{"additionalProperties":false,"properties":{"commandId":{"type":"string"},"operation":{"enum":["rollback"],"type":"string"},"status":{"type":"string"}},"required":["commandId","operation","status"],"type":"object"},"execution":{"$ref":"#/components/schemas/ExecutionSummary"},"workflowRunId":{"type":"string"}},"required":["command","execution","workflowRunId"],"type":"object"}}},"description":"Rollback workflow queued."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution cannot be rolled back in this state."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Rollback orchestration is not configured."}},"summary":"Queue execution rollback","tags":["Executions"],"description":"Requires the workflows:<name> entitlement for the execution. The mutating action queues receipt-backed rollback for a source workflow run, while a failed or canceled execution without a source run is marked rolled back immediately; Lambda restoration additionally requires a terminal execution with durable receipts.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/retry-finalization":{"post":{"operationId":"retryExecutionFinalization","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"command":{"additionalProperties":false,"properties":{"commandId":{"type":"string"},"operation":{"enum":["retry-finalization"],"type":"string"},"status":{"enum":["active","queued"],"type":"string"}},"required":["commandId","operation","status"],"type":"object"},"execution":{"$ref":"#/components/schemas/ExecutionSummary"},"workflowRunId":{"type":"string"}},"required":["command","execution"],"type":"object"}}},"description":"Finalization recovery queued."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution is not eligible for finalization recovery."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Finalization recovery is not configured."}},"summary":"Retry add-certificate finalization","tags":["Executions"],"description":"Requires the workflows:add-certificate or workflows:onboard-domain entitlement matching the execution. This mutating recovery queues finalization only for a failed execution at its finalization stage with a source run and successful persisted prerequisite outputs; duplicate pending recovery is reused.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/retry-maps-whitelist":{"post":{"operationId":"retryGoogleMapsWhitelist","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"command":{"additionalProperties":false,"properties":{"commandId":{"type":"string"},"operation":{"enum":["retry-maps-whitelist"],"type":"string"},"status":{"enum":["active","queued"],"type":"string"}},"required":["commandId","operation","status"],"type":"object"},"execution":{"$ref":"#/components/schemas/ExecutionSummary"},"workflowRunId":{"type":"string"}},"required":["command","execution"],"type":"object"}}},"description":"Google Maps whitelist recovery queued."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution is not eligible for Google Maps whitelist recovery."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Google Maps whitelist recovery is not configured."}},"summary":"Retry Google Maps referrer whitelisting","tags":["Executions"],"description":"Requires workflows:onboard-domain for the execution. This mutating recovery queues only for a succeeded onboarding run whose Google Maps stage records manual-required; an existing pending retry is returned instead of creating another command.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/resume":{"post":{"operationId":"resumeExecution","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"execution":{"$ref":"#/components/schemas/ExecutionSummary"},"status":{"enum":["retry_queued","retry_already_queued"],"type":"string"}},"required":["execution"],"type":"object"}}},"description":"Execution control accepted."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution control is not valid in this state."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution control is not configured."}},"summary":"Resume failed or paused execution","tags":["Executions"],"description":"Requires the workflows:<name> entitlement for the execution. The mutating action resumes a paused run that owns its active command lane, or queues an eligible failed or canceled update-lambda-version retry; other states and unsupported failed or canceled workflows are rejected.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/events":{"get":{"operationId":"executionEvents","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"items":{"$ref":"#/components/schemas/OutboxEvent"},"type":"array"}},"required":["events"],"type":"object"}},"text/event-stream":{"schema":{"type":"string"}}},"description":"Successful response"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."}},"summary":"Read execution events","tags":["Events"],"description":"Reads events for an execution after checking the workflows:<name> entitlement associated with it. Available in every execution state, it returns ordered persisted events as JSON or opens an SSE feed when Accept requests text/event-stream; it does not mutate the execution.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/streams/events":{"get":{"operationId":"streamEvents","responses":{"200":{"content":{"text/event-stream":{"schema":{"type":"string"}}},"description":"Server-sent event stream."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"A query parameter is not a supported stream filter."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The bearer credential or stream token is invalid."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"At least one workflow entitlement is required."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The stream connection capacity is exhausted."}},"summary":"Stream events over SSE","tags":["Streams"],"description":"Opens a read-only SSE stream using a bearer credential or one-time short-lived stream token. At least one workflow entitlement is required, requested workflow filters are narrowed to those entitlements, and the stream does not depend on or mutate execution state.","parameters":[{"description":"Optional event type filter; repeat or comma-separate values.","in":"query","name":"event","required":false,"schema":{"type":"string"}},{"description":"Optional workflow filter.","in":"query","name":"workflow","required":false,"schema":{"type":"string"}},{"description":"Optional execution ID filter.","in":"query","name":"executionId","required":false,"schema":{"type":"string"}},{"description":"Optional event principal filter.","in":"query","name":"principalId","required":false,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]},{"streamToken":[]}]}},"/v1/streams/token":{"post":{"operationId":"createStreamToken","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"expiresIn":{"type":"integer"},"token":{"type":"string"}},"required":["expiresIn","token"],"type":"object"}}},"description":"Successful response"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"At least one workflow entitlement is required."}},"summary":"Create short-lived stream token","tags":["Streams"],"description":"Mints a single-use, five-minute stream token for an authenticated principal with at least one workflow entitlement. This mutates token storage but no execution state; the token can authenticate GET /v1/streams/events without exposing the API key in its URL.","security":[{"bearerAuth":[]}]}},"/v1/subscriptions":{"get":{"operationId":"listSubscriptions","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"subscriptions":{"items":{"$ref":"#/components/schemas/Subscription"},"type":"array"}},"required":["subscriptions"],"type":"object"}}},"description":"Owned webhook subscriptions."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The limit is outside 1-100."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"List webhook subscriptions","tags":["Subscriptions"],"description":"Requires subscriptions:manage and lists only webhook subscriptions owned by the authenticated principal. This read-only operation accepts a limit from 1 to 100.","parameters":[{"description":"Maximum records to return. Must be between 1 and 100.","in":"query","name":"limit","required":false,"schema":{"default":50,"maximum":100,"minimum":1,"type":"integer"}}],"security":[{"bearerAuth":[]}]},"post":{"operationId":"createSubscription","responses":{"201":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"subscription":{"$ref":"#/components/schemas/Subscription"}},"required":["subscription"],"type":"object"}}},"description":"Webhook subscription created; secret material is omitted."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The JSON body, subscription fields, or callback URL is invalid."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Create webhook subscription","tags":["Subscriptions"],"description":"Requires subscriptions:manage. Registers the authenticated principal's public HTTPS callback after URL safety validation, encrypts the shared secret without returning it, and responds with the new subscription.","parameters":[],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"active":true,"events":["CertificateIssued.v2","CertificateFailed.v1"],"secret":"replace-with-a-strong-shared-secret","url":"https://consumer.example.com/webhooks/alfred"}}},"schema":{"$ref":"#/components/schemas/CreateSubscriptionRequest"}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/subscriptions/{id}":{"delete":{"operationId":"deleteSubscription","responses":{"204":{"description":"Webhook subscription disabled."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The subscription does not exist or is owned by another principal."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Disable webhook subscription","tags":["Subscriptions"],"description":"Requires subscriptions:manage and owner access. Disables the webhook subscription instead of deleting its history, then returns an empty response.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]},"get":{"operationId":"getSubscription","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"subscription":{"$ref":"#/components/schemas/Subscription"}},"required":["subscription"],"type":"object"}}},"description":"Owned webhook subscription."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The subscription does not exist or is owned by another principal."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Get webhook subscription","tags":["Subscriptions"],"description":"Requires subscriptions:manage and returns one webhook subscription only when it belongs to the authenticated principal. Secret material is never exposed.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]},"patch":{"operationId":"updateSubscription","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"subscription":{"$ref":"#/components/schemas/Subscription"}},"required":["subscription"],"type":"object"}}},"description":"Webhook subscription updated."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The JSON body is invalid or specifies neither active nor events."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The subscription does not exist or is owned by another principal."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Update webhook subscription","tags":["Subscriptions"],"description":"Requires subscriptions:manage and owner access. Updates the active flag, event filters, or both; callback URLs and signing secrets are changed through other lifecycle operations.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"active":true,"events":["CertificateIssued.v2","CertificateFailed.v1"]}}},"schema":{"$ref":"#/components/schemas/UpdateSubscriptionRequest"}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/subscriptions/{id}/deliveries":{"get":{"operationId":"listSubscriptionDeliveries","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"deliveries":{"items":{"$ref":"#/components/schemas/SubscriptionDelivery"},"type":"array"}},"required":["deliveries"],"type":"object"}}},"description":"Webhook delivery attempts."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The limit is outside 1-100."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"List delivery attempts","tags":["Subscriptions"],"description":"Requires subscriptions:manage and lists recent delivery attempts for a webhook subscription owned by the authenticated principal. This read-only operation accepts a limit from 1 to 100.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Maximum records to return. Must be between 1 and 100.","in":"query","name":"limit","required":false,"schema":{"default":50,"maximum":100,"minimum":1,"type":"integer"}}],"security":[{"bearerAuth":[]}]}},"/v1/subscriptions/{id}/redeliver/{eventId}":{"post":{"operationId":"redeliverSubscriptionEvent","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"delivery":{"$ref":"#/components/schemas/SubscriptionDelivery"}},"required":["delivery"],"type":"object"}}},"description":"Redelivery accepted and queued."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The owned subscription and event delivery pair was not found."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Redeliver event","tags":["Subscriptions"],"description":"Requires subscriptions:manage and owner access. Queues another delivery attempt for the selected subscription event and returns the pending attempt immediately.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Event ID.","in":"path","name":"eventId","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/subscriptions/{id}/secret":{"post":{"operationId":"rotateSubscriptionSecret","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"subscription":{"$ref":"#/components/schemas/Subscription"}},"required":["subscription"],"type":"object"}}},"description":"Signing secret rotated; secret material is omitted."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The JSON body or replacement secret is invalid."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The caller lacks the subscriptions:manage permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"The subscription does not exist or is owned by another principal."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionError"}}},"description":"Webhook subscription storage is unavailable."}},"summary":"Rotate signing secret","tags":["Subscriptions"],"description":"Requires subscriptions:manage and owner access. Encrypts and replaces the webhook signing secret, records an audit decision, and never returns secret material.","parameters":[{"description":"Subscription ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"secret":"replace-with-a-new-strong-shared-secret"}}},"schema":{"$ref":"#/components/schemas/RotateSubscriptionSecretRequest"}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/workflows/onboard-domain":{"post":{"operationId":"triggerOnboardDomain","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Idempotent replay of an existing execution."},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Accepted for asynchronous processing"},"400":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["missing_idempotency_key","invalid_json"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"enum":["invalid_environment","validation_error"],"type":"string"},"issues":{"items":{},"type":"array"}},"required":["error","issues"],"type":"object"}]}}},"description":"Invalid trigger request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"409":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["idempotency_conflict","reservation_replay_pending"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"}]}}},"description":"Idempotency conflict or pending replay."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow SDK orchestration is unavailable."}},"summary":"Trigger onboard-domain","tags":["Workflows"],"description":"Onboards one primary domain through registration, certificate and routing setup, Google Maps whitelisting, and completion. The request schema trims and lowercases domain, applies certificate option defaults, and normalizes ticket IDs. Required permission: workflows:onboard-domain. A new request is accepted for asynchronous Workflow SDK execution; use the returned execution ID with GET /v1/executions/{id} to track it.","parameters":[{"description":"Client-generated key used to make workflow trigger retries safe.","in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"domain":"example.com","isKirby":true,"options":{"dryRun":false,"skipReadinessCheck":false},"ticketId":"12345"}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"isKirby":{"default":true,"type":"boolean"},"ticketId":{"type":"string","minLength":1},"recentCertOverrideDomain":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"options":{"default":{"skipReadinessCheck":false,"dryRun":false},"type":"object","properties":{"skipReadinessCheck":{"default":false,"type":"boolean"},"dryRun":{"default":false,"type":"boolean"}}},"domain":{"type":"string","minLength":1}},"required":["domain"],"additionalProperties":false}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/workflows/add-certificate":{"post":{"operationId":"triggerAddCertificate","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Idempotent replay of an existing execution."},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Accepted for asynchronous processing"},"400":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["missing_idempotency_key","invalid_json"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"enum":["invalid_environment","validation_error"],"type":"string"},"issues":{"items":{},"type":"array"}},"required":["error","issues"],"type":"object"}]}}},"description":"Invalid trigger request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"409":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["idempotency_conflict","reservation_replay_pending"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"}]}}},"description":"Idempotency conflict or pending replay."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow SDK orchestration is unavailable."}},"summary":"Trigger add-certificate","tags":["Workflows"],"description":"Creates or adopts certificate infrastructure for one or more comma-separated domains. The request schema removes spaces, lowercases domains, applies option defaults, and deduplicates ticket IDs. Required permission: workflows:add-certificate. A new request is accepted for asynchronous Workflow SDK execution; use the returned execution ID with GET /v1/executions/{id} to track it.","parameters":[{"description":"Client-generated key used to make workflow trigger retries safe.","in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"domainString":"example.com","isKirby":true,"options":{"dryRun":false,"skipReadinessCheck":false},"ticketId":"12345"}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"isKirby":{"default":true,"type":"boolean"},"ticketId":{"type":"string","minLength":1},"recentCertOverrideDomain":{"anyOf":[{"type":"string","minLength":1},{"type":"null"}]},"options":{"default":{"skipReadinessCheck":false,"dryRun":false},"type":"object","properties":{"skipReadinessCheck":{"default":false,"type":"boolean"},"dryRun":{"default":false,"type":"boolean"}}},"domainString":{"type":"string","minLength":1}},"required":["domainString"]}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/workflows/add-domain":{"post":{"operationId":"triggerAddDomain","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Idempotent replay of an existing execution."},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Accepted for asynchronous processing"},"400":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["missing_idempotency_key","invalid_json"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"enum":["invalid_environment","validation_error"],"type":"string"},"issues":{"items":{},"type":"array"}},"required":["error","issues"],"type":"object"}]}}},"description":"Invalid trigger request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"409":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["idempotency_conflict","reservation_replay_pending"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"}]}}},"description":"Idempotency conflict or pending replay."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow SDK orchestration is unavailable."}},"summary":"Trigger add-domain","tags":["Workflows"],"description":"Registers a root/apex domain by finding or creating its Route 53 hosted zone and, when needed, updating GoDaddy nameservers. Send a bare apex domain such as example.com in domainString, without a protocol, path, wildcard, or leading www; the request schema otherwise passes the string through unchanged. Required permission: workflows:add-domain. A new request is accepted for asynchronous Workflow SDK execution; use the returned execution ID with GET /v1/executions/{id} to track it.","parameters":[{"description":"Client-generated key used to make workflow trigger retries safe.","in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"domainString":"example.com"}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domainString":{"type":"string","minLength":1}},"required":["domainString"]}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/workflows/add-subdomain":{"post":{"operationId":"triggerAddSubdomain","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Idempotent replay of an existing execution."},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Accepted for asynchronous processing"},"400":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["missing_idempotency_key","invalid_json"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"enum":["invalid_environment","validation_error"],"type":"string"},"issues":{"items":{},"type":"array"}},"required":["error","issues"],"type":"object"}]}}},"description":"Invalid trigger request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"409":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["idempotency_conflict","reservation_replay_pending"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"}]}}},"description":"Idempotency conflict or pending replay."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow SDK orchestration is unavailable."}},"summary":"Trigger add-subdomain","tags":["Workflows"],"description":"Plans and applies Route 53 records for labels relative to rootDomain, pausing for approval before replacing existing records. The request schema trims and lowercases DNS names, removes a final dot, and deduplicates labels; values such as blog and offers.eu are relative labels, not full names under the root. Required permission: workflows:add-subdomain. A new request is accepted for asynchronous Workflow SDK execution; use the returned execution ID with GET /v1/executions/{id} to track it.","parameters":[{"description":"Client-generated key used to make workflow trigger retries safe.","in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"rootDomain":"example.com","subdomains":["blog","offers.eu"]}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"rootDomain":{"type":"string"},"subdomains":{"minItems":1,"maxItems":10,"type":"array","items":{"type":"string"}}},"required":["rootDomain","subdomains"],"additionalProperties":false}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/workflows/update-lambda-version":{"post":{"operationId":"triggerUpdateLambdaVersion","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Idempotent replay of an existing execution."},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkflowTriggerResponse"}}},"description":"Accepted for asynchronous processing"},"400":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["missing_idempotency_key","invalid_json"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"enum":["invalid_environment","validation_error"],"type":"string"},"issues":{"items":{},"type":"array"}},"required":["error","issues"],"type":"object"}]}}},"description":"Invalid trigger request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"409":{"content":{"application/json":{"schema":{"oneOf":[{"additionalProperties":false,"properties":{"error":{"enum":["idempotency_conflict","reservation_replay_pending"],"type":"string"},"message":{"type":"string"}},"required":["error","message"],"type":"object"},{"additionalProperties":false,"properties":{"error":{"const":"active_target_conflict","type":"string"},"executionId":{"type":"string"},"links":{"additionalProperties":false,"properties":{"self":{"type":"string"}},"required":["self"],"type":"object"},"message":{"type":"string"}},"required":["error","executionId","links","message"],"type":"object"}]}}},"description":"Idempotency or active target conflict."},"501":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow SDK orchestration is unavailable."}},"summary":"Trigger update-lambda-version","tags":["Workflows"],"x-alfred-asynchronous-failure-codes":["lambda_version_not_found","ambiguous_fleet","mixed_environment_aliases","empty_fleet","plan_stale","provider_failure"],"description":"Plans and updates the selected Lambda@Edge fleet to a positive integer version in the requested environment. The strict request schema applies the dry-run default and rejects unsupported target/environment pairs. Required permission: workflows:update-lambda-version. A new request is accepted for asynchronous Workflow SDK execution; use the returned execution ID with GET /v1/executions/{id} to track it. Fleet and provider work continues durably after this request is accepted; stable asynchronous failures are reported on the execution and its events. Request cancellation at /v1/executions/{id}/cancel, retry unfinished work at /v1/executions/{id}/resume, and restore receipt-backed changes at /v1/executions/{id}/rollback.","parameters":[{"description":"Client-generated key used to make workflow trigger retries safe.","in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"default":{"value":{"environment":"test","options":{"dryRun":false},"target":"microbrands","version":43}}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"environment":{"type":"string","enum":["production","test"]},"options":{"default":{"dryRun":false},"type":"object","properties":{"dryRun":{"default":false,"type":"boolean"}},"additionalProperties":false},"target":{"type":"string","enum":["headout","microbrands","microbrands-booking-flow"]},"version":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"required":["environment","target","version"],"additionalProperties":false}}},"required":true},"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/subdomain-plan":{"get":{"operationId":"getExecutionSubdomainPlan","responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"plan":{"$ref":"#/components/schemas/AddSubdomainPlan"}},"required":["plan"],"type":"object"}}},"description":"The immutable DNS plan awaiting review."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"A subdomain plan is not available."}},"summary":"Get the persisted add-subdomain DNS plan","tags":["Executions"],"description":"Reads the persisted DNS plan after checking the workflows:add-subdomain entitlement for the execution. The operation is read-only and succeeds only for an add-subdomain execution with a valid plan already produced; other workflow or planning states return a conflict.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}]}},"/v1/executions/{id}/subdomain-plan/approve":{"post":{"operationId":"approveExecutionSubdomainPlan","responses":{"202":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"accepted":{"type":"boolean"},"planHash":{"type":"string"},"replayed":{"type":"boolean"}},"required":["accepted","planHash","replayed"],"type":"object"}}},"description":"Approval accepted or safely replayed."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Invalid approval request."},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Missing or invalid bearer token."},"403":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"The caller lacks the required permission."},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Execution not found."},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Plan is stale or not awaiting approval."},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"description":"Workflow approval controls are unavailable."}},"summary":"Approve an add-subdomain replacement plan","tags":["Executions"],"description":"Requires the workflows:add-subdomain entitlement for the execution and mutates a paused workflow by resuming its approval hook. The execution must be waiting for replacement approval of the submitted current plan hash; an already accepted approval is replayed safely.","parameters":[{"description":"Execution ID.","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddSubdomainPlanApprovalRequest"}}},"required":true},"security":[{"bearerAuth":[]}]}}},"tags":[{"name":"Workflows"},{"name":"Executions"},{"name":"Events"},{"name":"Streams"},{"name":"Subscriptions"}],"x-eventCatalog":[{"emittedBy":"update-lambda-version restoration workflow","eventType":"LambdaVersionRestoreCompleted.v1","eventVersion":"v1","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"distributionOutcomes":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"restored"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"already-restored"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"failure":{"type":"object","properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1}},"required":["code","message"],"additionalProperties":false},"status":{"type":"string","const":"failed"}},"required":["aliases","distributionId","failure","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"untouched"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"deploying"}},"required":["aliases","distributionId","status"],"additionalProperties":false}]}},"status":{"type":"string","enum":["in-progress","succeeded","failed"]}},"required":["distributionOutcomes","status"],"additionalProperties":false},"typicalSubscribers":["Audit","Slack"]},{"emittedBy":"update-lambda-version workflow","eventType":"LambdaVersionUpdateCompleted.v1","eventVersion":"v1","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"distributionOutcomes":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"deployed"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"already-current"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"failure":{"type":"object","properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1}},"required":["code","message"],"additionalProperties":false},"status":{"type":"string","const":"failed"}},"required":["aliases","distributionId","failure","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"untouched"}},"required":["aliases","distributionId","status"],"additionalProperties":false},{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"string","minLength":1}},"distributionId":{"type":"string","minLength":1},"status":{"type":"string","const":"deploying"}},"required":["aliases","distributionId","status"],"additionalProperties":false}]}},"environment":{"type":"string","enum":["production","test"]},"functionName":{"type":"string","enum":["uuid-assigner","uuid-assigner-test"]},"newVersionGroups":{"maxItems":1,"type":"array","items":{"type":"object","properties":{"associationCount":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"functionName":{"type":"string","enum":["uuid-assigner","uuid-assigner-test"]},"version":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"required":["associationCount","functionName","version"],"additionalProperties":false}},"oldVersionGroups":{"type":"array","items":{"type":"object","properties":{"associationCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"functionName":{"type":"string","enum":["uuid-assigner","uuid-assigner-test"]},"version":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991}},"required":["associationCount","functionName","version"],"additionalProperties":false}},"protectedBehaviors":{"type":"integer","minimum":0,"maximum":9007199254740991},"receipts":{"type":"array","items":{"type":"object","properties":{"afterArn":{"type":"string","minLength":1},"beforeArn":{"type":"string","minLength":1},"behavior":{"anyOf":[{"type":"string","const":"default"},{"type":"object","properties":{"pathPattern":{"type":"string","minLength":1}},"required":["pathPattern"],"additionalProperties":false}]},"distributionId":{"type":"string","minLength":1},"eventType":{"type":"string","enum":["viewer-request","viewer-response","origin-request","origin-response"]},"includeBody":{"type":"boolean"}},"required":["afterArn","beforeArn","behavior","distributionId","eventType","includeBody"],"additionalProperties":false}},"repairedEnvironmentMismatches":{"type":"integer","minimum":0,"maximum":9007199254740991},"status":{"type":"string","enum":["canceled","dry-run","failed","succeeded"]},"target":{"type":"string","enum":["headout","microbrands","microbrands-booking-flow"]},"version":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"versionedArn":{"type":"string","minLength":1}},"required":["distributionOutcomes","environment","functionName","newVersionGroups","oldVersionGroups","protectedBehaviors","receipts","repairedEnvironmentMismatches","status","target","version","versionedArn"],"additionalProperties":false},"typicalSubscribers":["Audit","Slack"]},{"eventType":"BulkOperationProgress.v1","eventVersion":"v1","emittedBy":"bulk invalidation child worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"completed":{"type":"integer","minimum":0,"maximum":9007199254740991},"distributionId":{"type":"string","minLength":1},"invalidationId":{"type":"string","minLength":1},"stageName":{"type":"string","pattern":"^stage-2-fanout-.*"},"status":{"type":"string","const":"succeeded"},"total":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"workflow":{"type":"string","const":"bulk-invalidate"}},"required":["completed","distributionId","stageName","status","total","workflow"],"additionalProperties":false},"typicalSubscribers":["Live dashboard"]},{"eventType":"BulkOperationCompleted.v1","eventVersion":"v1","emittedBy":"bulk invalidation parent aggregator","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"completed":{"type":"integer","minimum":0,"maximum":9007199254740991},"failed":{"type":"integer","minimum":0,"maximum":9007199254740991},"stageName":{"type":"string","const":"stage-3-completion"},"status":{"type":"string","const":"succeeded"},"total":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"workflow":{"type":"string","enum":["bulk-attach-lambda","bulk-detach-lambda","bulk-invalidate","bulk-update-distribution"]}},"required":["completed","failed","stageName","status","total","workflow"],"additionalProperties":false},"typicalSubscribers":["Slack","future dashboard"]},{"eventType":"DomainRegistered.v1","eventVersion":"v1","emittedBy":"add-domain worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domainId":{"type":"string","minLength":1},"domainString":{"type":"string","minLength":1},"stageName":{"type":"string","minLength":1},"workflow":{"type":"string","const":"onboard-domain"}},"required":["domainString"],"additionalProperties":false},"typicalSubscribers":["Audit","Slack"]},{"eventType":"OnboardingCompleted.v1","eventVersion":"v1","emittedBy":"platform PR worker","lifecycle":{"replacementEventType":"OnboardingCompleted.v2","status":"deprecated","sunsetAt":"2026-11-01T00:00:00.000Z"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"pullRequestUrls":{"type":"array","items":{"type":"string","format":"uri"}},"stageName":{"type":"string","enum":["stage-1-platform-prs","stage-4-create-platform-prs"]},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["create-platform-prs","onboard-domain"]}},"required":["stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Zendesk auto-close"]},{"eventType":"OnboardingCompleted.v2","eventVersion":"v2","emittedBy":"platform PR worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"completedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"},"pullRequestUrls":{"type":"array","items":{"type":"string","format":"uri"}},"stageName":{"type":"string","enum":["stage-1-platform-prs","stage-4-create-platform-prs"]},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["create-platform-prs","onboard-domain"]}},"required":["completedAt","stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Zendesk auto-close"]},{"eventType":"CertificateRequested.v1","eventVersion":"v1","emittedBy":"add-certificate start","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domainString":{"type":"string","minLength":1},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["domainString","workflow"],"additionalProperties":false},"typicalSubscribers":["Slack ticket-thread bot"]},{"eventType":"CertificateStageCompleted.v1","eventVersion":"v1","emittedBy":"certificate stage worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"stageName":{"type":"string","minLength":1},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Internal router","future dashboard"]},{"eventType":"CertificateValidated.v1","eventVersion":"v1","emittedBy":"certificate stage 2","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"stageName":{"type":"string","minLength":1},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]},"certificateArn":{"type":"string","minLength":1}},"required":["stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":[]},{"eventType":"DistributionCreated.v1","eventVersion":"v1","emittedBy":"cloudfront worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"distributionId":{"type":"string","minLength":1},"distributionName":{"type":"string","minLength":1},"operation":{"type":"string","const":"created"},"previousConfig":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},"status":{"type":"string","minLength":1}},"required":["distributionName","operation"],"additionalProperties":false},"typicalSubscribers":["Audit"]},{"eventType":"DistributionUpdated.v1","eventVersion":"v1","emittedBy":"cloudfront worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"distributionId":{"type":"string","minLength":1},"distributionName":{"type":"string","minLength":1},"operation":{"type":"string","const":"updated"},"previousConfig":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},"status":{"type":"string","minLength":1},"stageName":{"type":"string","const":"stage-3-nginx-setup"},"workflow":{"type":"string","const":"onboard-domain"}},"required":["distributionName","operation"],"additionalProperties":false},"typicalSubscribers":["Audit"]},{"eventType":"DistributionDeployed.v1","eventVersion":"v1","emittedBy":"cloudfront deploy poller","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"distributionDomainName":{"type":"string","minLength":1},"distributionId":{"type":"string","minLength":1},"distributionName":{"type":"string","enum":["microbrand","nginx"]},"stageName":{"type":"string","const":"stage-3-cloudfront-setup"},"status":{"type":"string","const":"Deployed"},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["distributionId","distributionName","stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Audit","future dashboard"]},{"eventType":"CertificateIssued.v1","eventVersion":"v1","emittedBy":"certificate finalization","lifecycle":{"replacementEventType":"CertificateIssued.v2","status":"deprecated","sunsetAt":"2026-10-01T00:00:00.000Z"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"stageName":{"type":"string","minLength":1},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["stageName","status","workflow"],"additionalProperties":false},"typicalSubscribers":["nginx-setup trigger","Slack","future dashboard"]},{"eventType":"CertificateIssued.v2","eventVersion":"v2","emittedBy":"certificate finalization","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"stageName":{"type":"string","minLength":1},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]},"issuedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},"required":["stageName","status","workflow","issuedAt"],"additionalProperties":false},"typicalSubscribers":["nginx-setup trigger","Slack","future dashboard"]},{"eventType":"CertificateFailed.v1","eventVersion":"v1","emittedBy":"certificate stage worker","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"errorCode":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"retryable":{"type":"boolean"},"stageName":{"type":"string","minLength":1},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["message","retryable","stageName","workflow"],"additionalProperties":false},"typicalSubscribers":["Slack ops channel","Zendesk auto-reply"]},{"eventType":"CertificateRollbackCompleted.v1","eventVersion":"v1","emittedBy":"add-certificate rollback","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"actionCount":{"type":"integer","minimum":0,"maximum":9007199254740991},"sourceWorkflowRunId":{"type":"string","minLength":1},"status":{"type":"string","const":"succeeded"},"workflow":{"type":"string","const":"add-certificate"}},"required":["actionCount","sourceWorkflowRunId","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Audit","Slack ops channel"]},{"eventType":"CertificateRollbackFailed.v1","eventVersion":"v1","emittedBy":"add-certificate rollback","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"failedOperationKeys":{"minItems":1,"type":"array","items":{"type":"string","minLength":1}},"message":{"type":"string","minLength":1},"sourceWorkflowRunId":{"type":"string","minLength":1},"status":{"type":"string","const":"failed"},"workflow":{"type":"string","const":"add-certificate"}},"required":["failedOperationKeys","message","sourceWorkflowRunId","status","workflow"],"additionalProperties":false},"typicalSubscribers":["Audit","Slack ops channel"]},{"eventType":"CertificateCompensationRequested.v1","eventVersion":"v1","emittedBy":"operator or policy","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"reason":{"type":"string","minLength":1},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["workflow"],"additionalProperties":false},"typicalSubscribers":["Internal router"]},{"eventType":"WorkflowStageTimedOut.v1","eventVersion":"v1","emittedBy":"stage wrapper","lifecycle":{"status":"active"},"payloadJsonSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"stageName":{"type":"string","minLength":1},"timeoutMs":{"type":"integer","exclusiveMinimum":0,"maximum":9007199254740991},"workflow":{"type":"string","enum":["add-certificate","onboard-domain","update-certificate"]}},"required":["stageName","timeoutMs","workflow"],"additionalProperties":false},"typicalSubscribers":["Ops alerting"]}],"servers":[{"url":"https://api-production-da844.up.railway.app"}]}