{
  "components": {
    "schemas": {
      "AdminIssueBody": {
        "additionalProperties": false,
        "properties": {
          "kind": {
            "default": "standard",
            "pattern": "^(standard|dev_global)$",
            "title": "Kind",
            "type": "string"
          },
          "label": {
            "anyOf": [
              {
                "maxLength": 256,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Label"
          },
          "project_config_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Config Ref"
          },
          "project_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Id"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          },
          "tenant_slug": {
            "maxLength": 256,
            "minLength": 1,
            "title": "Tenant Slug",
            "type": "string"
          }
        },
        "required": [
          "tenant_slug"
        ],
        "title": "AdminIssueBody",
        "type": "object"
      },
      "AdminIssueResponse": {
        "properties": {
          "api_key": {
            "title": "Api Key",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "key_prefix": {
            "title": "Key Prefix",
            "type": "string"
          }
        },
        "required": [
          "key_prefix",
          "api_key",
          "id"
        ],
        "title": "AdminIssueResponse",
        "type": "object"
      },
      "HTTPValidationError": {
        "properties": {
          "detail": {
            "items": {
              "$ref": "#/components/schemas/ValidationError"
            },
            "title": "Detail",
            "type": "array"
          }
        },
        "title": "HTTPValidationError",
        "type": "object"
      },
      "RevokeResponse": {
        "properties": {
          "jtis_invalidated": {
            "title": "Jtis Invalidated",
            "type": "integer"
          },
          "revoked": {
            "title": "Revoked",
            "type": "boolean"
          }
        },
        "required": [
          "revoked",
          "jtis_invalidated"
        ],
        "title": "RevokeResponse",
        "type": "object"
      },
      "TokenRequest": {
        "additionalProperties": false,
        "properties": {
          "api_key": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Key"
          },
          "audience": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Audience"
          },
          "grant_type": {
            "pattern": "^(api_key|bff_session)$",
            "title": "Grant Type",
            "type": "string"
          },
          "project_config_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Config Ref"
          },
          "project_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Id"
          },
          "requested_scopes": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Requested Scopes"
          },
          "subject": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Subject"
          },
          "tenant_slug": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Tenant Slug"
          }
        },
        "required": [
          "grant_type"
        ],
        "title": "TokenRequest",
        "type": "object"
      },
      "TokenResponse": {
        "properties": {
          "access_token": {
            "title": "Access Token",
            "type": "string"
          },
          "expires_in": {
            "title": "Expires In",
            "type": "integer"
          },
          "litellm_proxy_api_key": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Litellm Proxy Api Key"
          },
          "token_type": {
            "default": "Bearer",
            "title": "Token Type",
            "type": "string"
          }
        },
        "required": [
          "access_token",
          "expires_in"
        ],
        "title": "TokenResponse",
        "type": "object"
      },
      "ValidationError": {
        "properties": {
          "ctx": {
            "title": "Context",
            "type": "object"
          },
          "input": {
            "title": "Input"
          },
          "loc": {
            "items": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "integer"
                }
              ]
            },
            "title": "Location",
            "type": "array"
          },
          "msg": {
            "title": "Message",
            "type": "string"
          },
          "type": {
            "title": "Error Type",
            "type": "string"
          }
        },
        "required": [
          "loc",
          "msg",
          "type"
        ],
        "title": "ValidationError",
        "type": "object"
      }
    }
  },
  "info": {
    "description": "JWT + scoped API-key auth plane for digithings. Issues short-lived RS256 JWTs, publishes JWKS, and administers opaque API keys. Interactive docs: `/docs` (Swagger) and `/redoc`.",
    "title": "digikey",
    "version": "0.1.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/.well-known/jwks.json": {
      "get": {
        "description": "Return the RS256 public JWK set used to verify digikey-issued JWTs.",
        "operationId": "jwks__well_known_jwks_json_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Jwks  Well Known Jwks Json Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "JWKS public keys",
        "tags": [
          "jwks"
        ]
      }
    },
    "/health": {
      "get": {
        "description": "Legacy health check (kept for back-compat).",
        "operationId": "health_health_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Health Health Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Legacy health check",
        "tags": [
          "health"
        ]
      }
    },
    "/healthz": {
      "get": {
        "description": "Minimal liveness probe. Auth-exempt, rate-limit-exempt, secret-free.\n\nReturns HTTP 200 with ``{\"ok\": true}``. Intended for load-balancer and\nk8s liveness checks. For richer cross-service diagnostics, call digismith's\n``/v1/status``.",
        "operationId": "healthz_healthz_get",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "boolean"
                  },
                  "title": "Response Healthz Healthz Get",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "summary": "Liveness probe",
        "tags": [
          "health"
        ]
      }
    },
    "/v1/admin/keys": {
      "post": {
        "operationId": "admin_issue_key_v1_admin_keys_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AdminIssueBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AdminIssueResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Issue API key",
        "tags": [
          "admin"
        ]
      }
    },
    "/v1/admin/keys/{key_id}/revoke": {
      "post": {
        "description": "Revoke a key and blocklist all live JWTs issued from it (ADR-0007).",
        "operationId": "admin_revoke_key_v1_admin_keys__key_id__revoke_post",
        "parameters": [
          {
            "in": "path",
            "name": "key_id",
            "required": true,
            "schema": {
              "title": "Key Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RevokeResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Revoke API key",
        "tags": [
          "admin"
        ]
      }
    },
    "/v1/oauth/token": {
      "post": {
        "operationId": "oauth_token_v1_oauth_token_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "422": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            },
            "description": "Validation Error"
          }
        },
        "summary": "Exchange API key or BFF session for JWT",
        "tags": [
          "oauth"
        ]
      }
    }
  },
  "tags": [
    {
      "description": "Liveness probes (auth-exempt).",
      "name": "health"
    },
    {
      "description": "Public signing keys for JWT verification.",
      "name": "jwks"
    },
    {
      "description": "Token exchange (API key → JWT).",
      "name": "oauth"
    },
    {
      "description": "Key issue/revoke (requires DIGIKEY_ADMIN_TOKEN).",
      "name": "admin"
    }
  ]
}