openapi: 3.0.1
info:
  contact:
    name: GlueOps
  description: API for managing K3s clusters across cloud providers
  title: AutoGlue API
  version: "1.0"
servers:
- url: http://localhost:8080/api/v1
- url: https://localhost:8080/api/v1
paths:
  /.well-known/jwks.json:
    get:
      description: Returns the JSON Web Key Set for token verification
      operationId: getJWKS
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.JWKS"
          description: OK
      summary: Get JWKS
      tags:
      - Auth
  /auth/logout:
    post:
      operationId: Logout
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.LogoutRequest"
        description: Refresh token
        required: true
      responses:
        "204":
          content: {}
          description: No Content
      summary: Revoke refresh token family (logout everywhere)
      tags:
      - Auth
      x-codegen-request-body-name: body
  /auth/refresh:
    post:
      operationId: Refresh
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.RefreshRequest"
        description: Refresh token
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.TokenPair"
          description: OK
      summary: Rotate refresh token
      tags:
      - Auth
      x-codegen-request-body-name: body
  /auth/{provider}/callback:
    get:
      operationId: AuthCallback
      parameters:
      - description: google|github
        in: path
        name: provider
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.TokenPair"
          description: OK
      summary: Handle social login callback
      tags:
      - Auth
  /auth/{provider}/start:
    post:
      description: Returns provider authorization URL for the frontend to redirect
      operationId: AuthStart
      parameters:
      - description: google|github
        in: path
        name: provider
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.AuthStartResponse"
          description: OK
      summary: Begin social login
      tags:
      - Auth
  /labels:
    get:
      description: "Returns node labels for the organization in X-Org-ID. Filters:\
        \ `key`, `value`, and `q` (key contains). Add `include=node_pools` to include\
        \ linked node groups."
      operationId: ListLabels
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Exact key
        in: query
        name: key
        schema:
          type: string
      - description: Exact value
        in: query
        name: value
        schema:
          type: string
      - description: Key contains (case-insensitive)
        in: query
        name: q
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/dto.LabelResponse"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: failed to list node taints
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: List node labels (org scoped)
      tags:
      - Labels
    post:
      description: Creates a label.
      operationId: CreateLabel
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.CreateLabelRequest"
        description: Label payload
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.LabelResponse"
          description: Created
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid json / missing fields / invalid node_pool_ids
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: create failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Create label (org scoped)
      tags:
      - Labels
      x-codegen-request-body-name: body
  /labels/{id}:
    delete:
      description: Permanently deletes the label.
      operationId: DeleteLabel
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Label ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content:
            application/json:
              schema:
                type: string
          description: No Content
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: delete failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Delete label (org scoped)
      tags:
      - Labels
    get:
      description: Returns one label.
      operationId: GetLabel
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Label ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.LabelResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: fetch failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Get label by ID (org scoped)
      tags:
      - Labels
    patch:
      description: Partially update label fields.
      operationId: UpdateLabel
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Label ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.UpdateLabelRequest"
        description: Fields to update
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.LabelResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id / invalid json
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: update failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Update label (org scoped)
      tags:
      - Labels
      x-codegen-request-body-name: body
  /me:
    get:
      operationId: GetMe
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.meResponse"
          description: OK
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      summary: Get current user profile
      tags:
      - Me
    patch:
      operationId: UpdateMe
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.updateMeRequest"
        description: Patch profile
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/models.User"
          description: OK
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      summary: Update current user profile
      tags:
      - Me
      x-codegen-request-body-name: body
  /me/api-keys:
    get:
      operationId: ListUserAPIKeys
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.userAPIKeyOut"
                type: array
          description: OK
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      summary: List my API keys
      tags:
      - Me / API Keys
    post:
      description: Returns the plaintext key once. Store it securely on the client
        side.
      operationId: CreateUserAPIKey
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.createUserKeyRequest"
        description: Key options
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.userAPIKeyOut"
          description: Created
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      summary: Create a new user API key
      tags:
      - Me / API Keys
      x-codegen-request-body-name: body
  /me/api-keys/{id}:
    delete:
      operationId: DeleteUserAPIKey
      parameters:
      - description: Key ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content: {}
          description: No Content
      security:
      - BearerAuth: []
      summary: Delete a user API key
      tags:
      - Me / API Keys
  /orgs:
    get:
      operationId: listMyOrgs
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/models.Organization"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: List organizations I belong to
      tags:
      - Orgs
    post:
      operationId: createOrg
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.orgCreateReq"
        description: Org payload
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/models.Organization"
          description: Created
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Bad Request
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Conflict
      security:
      - BearerAuth: []
      summary: Create organization
      tags:
      - Orgs
      x-codegen-request-body-name: body
  /orgs/{id}:
    delete:
      operationId: deleteOrg
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content: {}
          description: Deleted
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
        "404":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Not Found
      security:
      - BearerAuth: []
      summary: Delete organization (owner)
      tags:
      - Orgs
    get:
      operationId: getOrg
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/models.Organization"
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
        "404":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Not Found
      security:
      - BearerAuth: []
      summary: Get organization
      tags:
      - Orgs
    patch:
      operationId: updateOrg
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.orgUpdateReq"
        description: Update payload
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/models.Organization"
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
        "404":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Not Found
      security:
      - BearerAuth: []
      summary: Update organization (owner/admin)
      tags:
      - Orgs
      x-codegen-request-body-name: body
  /orgs/{id}/api-keys:
    get:
      operationId: listOrgKeys
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/models.APIKey"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: List org-scoped API keys (no secrets)
      tags:
      - Orgs
    post:
      operationId: createOrgKey
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.orgKeyCreateReq"
        description: Key name + optional expiry
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.orgKeyCreateResp"
          description: Created
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: Create org key/secret pair (owner/admin)
      tags:
      - Orgs
      x-codegen-request-body-name: body
  /orgs/{id}/api-keys/{key_id}:
    delete:
      operationId: deleteOrgKey
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Key ID (UUID)
        in: path
        name: key_id
        required: true
        schema:
          type: string
      responses:
        "204":
          content: {}
          description: Deleted
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: Delete org key (owner/admin)
      tags:
      - Orgs
  /orgs/{id}/members:
    get:
      operationId: listMembers
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/handlers.memberOut"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: List members in org
      tags:
      - Orgs
    post:
      operationId: addOrUpdateMember
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/handlers.memberUpsertReq"
        description: User & role
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/handlers.memberOut"
          description: OK
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: Add or update a member (owner/admin)
      tags:
      - Orgs
      x-codegen-request-body-name: body
  /orgs/{id}/members/{user_id}:
    delete:
      operationId: removeMember
      parameters:
      - description: Org ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: User ID (UUID)
        in: path
        name: user_id
        required: true
        schema:
          type: string
      responses:
        "204":
          content: {}
          description: Removed
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/utils.ErrorResponse"
          description: Unauthorized
      security:
      - BearerAuth: []
      summary: Remove a member (owner/admin)
      tags:
      - Orgs
  /servers:
    get:
      description: "Returns servers for the organization in X-Org-ID. Optional filters:\
        \ status, role."
      operationId: ListServers
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Filter by status (pending|provisioning|ready|failed)
        in: query
        name: status
        schema:
          type: string
      - description: Filter by role
        in: query
        name: role
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/dto.ServerResponse"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: failed to list servers
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: List servers (org scoped)
      tags:
      - Servers
    post:
      description: Creates a server bound to the org in X-Org-ID. Validates that ssh_key_id
        belongs to the org.
      operationId: CreateServer
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.CreateServerRequest"
        description: Server payload
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.ServerResponse"
          description: Created
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid json / missing fields / invalid status / invalid ssh_key_id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: create failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Create server (org scoped)
      tags:
      - Servers
      x-codegen-request-body-name: body
  /servers/{id}:
    delete:
      description: Permanently deletes the server.
      operationId: DeleteServer
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Server ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content:
            application/json:
              schema:
                type: string
          description: No Content
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: delete failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Delete server (org scoped)
      tags:
      - Servers
    get:
      description: Returns one server in the given organization.
      operationId: GetServer
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Server ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.ServerResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: fetch failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Get server by ID (org scoped)
      tags:
      - Servers
    patch:
      description: Partially update fields; changing ssh_key_id validates ownership.
      operationId: UpdateServer
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Server ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.UpdateServerRequest"
        description: Fields to update
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.ServerResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id / invalid json / invalid status / invalid ssh_key_id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: update failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Update server (org scoped)
      tags:
      - Servers
      x-codegen-request-body-name: body
  /ssh:
    get:
      description: Returns ssh keys for the organization in X-Org-ID.
      operationId: ListPublicSshKeys
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/dto.SshResponse"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: failed to list keys
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: List ssh keys (org scoped)
      tags:
      - Ssh
    post:
      description: "Generates an RSA or ED25519 keypair, saves it, and returns metadata.\
        \ For RSA you may set bits (2048/3072/4096). Default is 4096. ED25519 ignores\
        \ bits."
      operationId: CreateSSHKey
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.CreateSSHRequest"
        description: Key generation options
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.SshResponse"
          description: Created
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid json / invalid bits
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: generation/create failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Create ssh keypair (org scoped)
      tags:
      - Ssh
      x-codegen-request-body-name: body
  /ssh/{id}:
    delete:
      description: Permanently deletes a keypair.
      operationId: DeleteSSHKey
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: SSH Key ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content:
            application/json:
              schema:
                type: string
          description: No Content
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: delete failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Delete ssh keypair (org scoped)
      tags:
      - Ssh
    get:
      description: Returns public key fields. Append `?reveal=true` to include the
        private key PEM.
      operationId: GetSSHKey
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: SSH Key ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Reveal private key PEM
        in: query
        name: reveal
        schema:
          type: boolean
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.SshRevealResponse"
          description: When reveal=true
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: fetch failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Get ssh key by ID (org scoped)
      tags:
      - Ssh
  /ssh/{id}/download:
    get:
      description: Download `part=public|private|both` of the keypair. `both` returns
        a zip file.
      operationId: DownloadSSHKey
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        required: true
        schema:
          type: string
      - description: SSH Key ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Which part to download
        in: query
        name: part
        required: true
        schema:
          enum:
          - public
          - private
          - both
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: string
          description: file content
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id / invalid part
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: download failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Download ssh key files by ID (org scoped)
      tags:
      - Ssh
  /taints:
    get:
      description: "Returns node taints for the organization in X-Org-ID. Filters:\
        \ `key`, `value`, and `q` (key contains). Add `include=node_pools` to include\
        \ linked node pools."
      operationId: ListTaints
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Exact key
        in: query
        name: key
        schema:
          type: string
      - description: Exact value
        in: query
        name: value
        schema:
          type: string
      - description: key contains (case-insensitive)
        in: query
        name: q
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/dto.TaintResponse"
                type: array
          description: OK
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: failed to list node taints
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: List node pool taints (org scoped)
      tags:
      - Taints
    post:
      description: Creates a taint.
      operationId: CreateTaint
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.CreateTaintRequest"
        description: Taint payload
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.TaintResponse"
          description: Created
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid json / missing fields / invalid node_pool_ids
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: create failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Create node taint (org scoped)
      tags:
      - Taints
      x-codegen-request-body-name: body
  /taints/{id}:
    delete:
      description: Permanently deletes the taint.
      operationId: DeleteTaint
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Node Taint ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "204":
          content:
            application/json:
              schema:
                type: string
          description: No Content
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "500":
          content:
            application/json:
              schema:
                type: string
          description: delete failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Delete taint (org scoped)
      tags:
      - Taints
    get:
      operationId: GetTaint
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Node Taint ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.TaintResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: fetch failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Get node taint by ID (org scoped)
      tags:
      - Taints
    patch:
      description: Partially update taint fields.
      operationId: UpdateTaint
      parameters:
      - description: Organization UUID
        in: header
        name: X-Org-ID
        schema:
          type: string
      - description: Node Taint ID (UUID)
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/dto.UpdateTaintRequest"
        description: Fields to update
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/dto.TaintResponse"
          description: OK
        "400":
          content:
            application/json:
              schema:
                type: string
          description: invalid id / invalid json
        "401":
          content:
            application/json:
              schema:
                type: string
          description: Unauthorized
        "403":
          content:
            application/json:
              schema:
                type: string
          description: organization required
        "404":
          content:
            application/json:
              schema:
                type: string
          description: not found
        "500":
          content:
            application/json:
              schema:
                type: string
          description: update failed
      security:
      - BearerAuth: []
      - OrgKeyAuth: []
      - OrgSecretAuth: []
      summary: Update node taint (org scoped)
      tags:
      - Taints
      x-codegen-request-body-name: body
components:
  schemas:
    dto.AuthStartResponse:
      example:
        auth_url: https://accounts.google.com/o/oauth2/v2/auth?client_id=...
      properties:
        auth_url:
          example: https://accounts.google.com/o/oauth2/v2/auth?client_id=...
          type: string
      type: object
    dto.CreateLabelRequest:
      properties:
        key:
          type: string
        value:
          type: string
      type: object
    dto.CreateSSHRequest:
      properties:
        bits:
          description: Only for RSA
          type: integer
        comment:
          example: deploy@autoglue
          type: string
        name:
          type: string
        type:
          description: '"rsa" (default) or "ed25519"'
          type: string
      type: object
    dto.CreateServerRequest:
      properties:
        hostname:
          type: string
        private_ip_address:
          type: string
        public_ip_address:
          type: string
        role:
          example: master|worker|bastion
          type: string
        ssh_key_id:
          type: string
        ssh_user:
          type: string
        status:
          example: pending|provisioning|ready|failed
          type: string
      type: object
    dto.CreateTaintRequest:
      properties:
        effect:
          type: string
        key:
          type: string
        value:
          type: string
      type: object
    dto.JWK:
      example:
        kty: RSA
        e: AQAB
        use: sig
        kid: 7c6f1d0a-7a98-4e6a-9dbf-6b1af4b9f345
        x: x
        alg: RS256
        "n": "n"
      properties:
        alg:
          example: RS256
          type: string
        e:
          example: AQAB
          type: string
        kid:
          example: 7c6f1d0a-7a98-4e6a-9dbf-6b1af4b9f345
          type: string
        kty:
          example: RSA
          type: string
        "n":
          type: string
        use:
          example: sig
          type: string
        x:
          type: string
      type: object
    dto.JWKS:
      example:
        keys:
        - kty: RSA
          e: AQAB
          use: sig
          kid: 7c6f1d0a-7a98-4e6a-9dbf-6b1af4b9f345
          x: x
          alg: RS256
          "n": "n"
        - kty: RSA
          e: AQAB
          use: sig
          kid: 7c6f1d0a-7a98-4e6a-9dbf-6b1af4b9f345
          x: x
          alg: RS256
          "n": "n"
      properties:
        keys:
          items:
            $ref: "#/components/schemas/dto.JWK"
          type: array
      type: object
    dto.LabelResponse:
      example:
        id: id
        value: value
        key: key
      properties:
        id:
          type: string
        key:
          type: string
        value:
          type: string
      type: object
    dto.LogoutRequest:
      properties:
        refresh_token:
          example: m0l9o8rT3t0V8d3eFf...
          type: string
      type: object
    dto.RefreshRequest:
      properties:
        refresh_token:
          example: m0l9o8rT3t0V8d3eFf...
          type: string
      type: object
    dto.ServerResponse:
      example:
        hostname: hostname
        public_ip_address: public_ip_address
        role: role
        updated_at: updated_at
        ssh_key_id: ssh_key_id
        organization_id: organization_id
        created_at: created_at
        private_ip_address: private_ip_address
        id: id
        ssh_user: ssh_user
        status: status
      properties:
        created_at:
          type: string
        hostname:
          type: string
        id:
          type: string
        organization_id:
          type: string
        private_ip_address:
          type: string
        public_ip_address:
          type: string
        role:
          type: string
        ssh_key_id:
          type: string
        ssh_user:
          type: string
        status:
          type: string
        updated_at:
          type: string
      type: object
    dto.SshResponse:
      example:
        public_key: public_key
        updated_at: updated_at
        organization_id: organization_id
        fingerprint: fingerprint
        name: name
        created_at: created_at
        id: id
      properties:
        created_at:
          type: string
        fingerprint:
          type: string
        id:
          type: string
        name:
          type: string
        organization_id:
          type: string
        public_key:
          type: string
        updated_at:
          type: string
      type: object
    dto.SshRevealResponse:
      example:
        public_key: public_key
        updated_at: updated_at
        organization_id: organization_id
        fingerprint: fingerprint
        name: name
        created_at: created_at
        private_key: private_key
        id: id
      properties:
        created_at:
          type: string
        fingerprint:
          type: string
        id:
          type: string
        name:
          type: string
        organization_id:
          type: string
        private_key:
          type: string
        public_key:
          type: string
        updated_at:
          type: string
      type: object
    dto.TaintResponse:
      example:
        updated_at: updated_at
        effect: effect
        organization_id: organization_id
        created_at: created_at
        id: id
        value: value
        key: key
      properties:
        created_at:
          type: string
        effect:
          type: string
        id:
          type: string
        key:
          type: string
        organization_id:
          type: string
        updated_at:
          type: string
        value:
          type: string
      type: object
    dto.TokenPair:
      example:
        access_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ij...
        refresh_token: m0l9o8rT3t0V8d3eFf....
        token_type: Bearer
        expires_in: 3600
      properties:
        access_token:
          example: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ij...
          type: string
        expires_in:
          example: 3600
          type: integer
        refresh_token:
          example: m0l9o8rT3t0V8d3eFf....
          type: string
        token_type:
          example: Bearer
          type: string
      type: object
    dto.UpdateLabelRequest:
      properties:
        key:
          type: string
        value:
          type: string
      type: object
    dto.UpdateServerRequest:
      properties:
        hostname:
          type: string
        private_ip_address:
          type: string
        public_ip_address:
          type: string
        role:
          example: master|worker|bastion
          type: string
        ssh_key_id:
          type: string
        ssh_user:
          type: string
        status:
          example: pending|provisioning|ready|failed
          type: string
      type: object
    dto.UpdateTaintRequest:
      properties:
        effect:
          type: string
        key:
          type: string
        value:
          type: string
      type: object
    handlers.createUserKeyRequest:
      properties:
        expires_in_hours:
          description: optional TTL
          type: integer
        name:
          type: string
      type: object
    handlers.meResponse:
      example:
        emails:
        - is_primary: true
          updated_at: 2000-01-23T04:56:07.000+00:00
          user_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          created_at: 2000-01-23T04:56:07.000+00:00
          id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          is_verified: true
          user:
            avatar_url: avatar_url
            updated_at: 2000-01-23T04:56:07.000+00:00
            is_disabled: true
            created_at: 2000-01-23T04:56:07.000+00:00
            primary_email: primary_email
            id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            display_name: display_name
          email: email
        - is_primary: true
          updated_at: 2000-01-23T04:56:07.000+00:00
          user_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          created_at: 2000-01-23T04:56:07.000+00:00
          id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          is_verified: true
          user:
            avatar_url: avatar_url
            updated_at: 2000-01-23T04:56:07.000+00:00
            is_disabled: true
            created_at: 2000-01-23T04:56:07.000+00:00
            primary_email: primary_email
            id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
            display_name: display_name
          email: email
        avatar_url: avatar_url
        updated_at: 2000-01-23T04:56:07.000+00:00
        is_disabled: true
        organizations:
        - updated_at: 2000-01-23T04:56:07.000+00:00
          domain: domain
          name: name
          created_at: 2000-01-23T04:56:07.000+00:00
          id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        - updated_at: 2000-01-23T04:56:07.000+00:00
          domain: domain
          name: name
          created_at: 2000-01-23T04:56:07.000+00:00
          id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        created_at: 2000-01-23T04:56:07.000+00:00
        primary_email: primary_email
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        display_name: display_name
      properties:
        avatar_url:
          type: string
        created_at:
          format: date-time
          type: string
        display_name:
          type: string
        emails:
          items:
            $ref: "#/components/schemas/models.UserEmail"
          type: array
        id:
          description: "example: 3fa85f64-5717-4562-b3fc-2c963f66afa6"
          format: uuid
          type: string
        is_disabled:
          type: boolean
        organizations:
          items:
            $ref: "#/components/schemas/models.Organization"
          type: array
        primary_email:
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    handlers.memberOut:
      example:
        role: role
        user_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        email: email
      properties:
        email:
          type: string
        role:
          description: owner/admin/member
          type: string
        user_id:
          format: uuid
          type: string
      type: object
    handlers.memberUpsertReq:
      properties:
        role:
          example: member
          type: string
        user_id:
          format: uuid
          type: string
      type: object
    handlers.orgCreateReq:
      properties:
        domain:
          example: acme.com
          type: string
        name:
          example: Acme Corp
          type: string
      type: object
    handlers.orgKeyCreateReq:
      properties:
        expires_in_hours:
          example: 720
          type: integer
        name:
          example: automation-bot
          type: string
      type: object
    handlers.orgKeyCreateResp:
      example:
        org_key: org_key
        expires_at: expires_at
        scope: scope
        name: name
        created_at: created_at
        id: id
        org_secret: org_secret
      properties:
        created_at:
          type: string
        expires_at:
          type: string
        id:
          type: string
        name:
          type: string
        org_key:
          description: "shown once:"
          type: string
        org_secret:
          description: "shown once:"
          type: string
        scope:
          description: '"org"'
          type: string
      type: object
    handlers.orgUpdateReq:
      properties:
        domain:
          type: string
        name:
          type: string
      type: object
    handlers.updateMeRequest:
      properties:
        display_name:
          type: string
      type: object
    handlers.userAPIKeyOut:
      example:
        last_used_at: last_used_at
        expires_at: expires_at
        plain: plain
        scope: scope
        name: name
        created_at: created_at
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        created_at:
          type: string
        expires_at:
          type: string
        id:
          format: uuid
          type: string
        last_used_at:
          type: string
        name:
          type: string
        plain:
          description: "Shown only on create:"
          type: string
        scope:
          description: '"user"'
          type: string
      type: object
    models.APIKey:
      example:
        last_used_at: 2000-01-23T04:56:07.000+00:00
        expires_at: 2000-01-23T04:56:07.000+00:00
        updated_at: 2000-01-23T04:56:07.000+00:00
        user_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        org_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        prefix: prefix
        scope: scope
        name: name
        created_at: 2000-01-23T04:56:07.000+00:00
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        revoked: true
      properties:
        created_at:
          format: date-time
          type: string
        expires_at:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        last_used_at:
          format: date-time
          type: string
        name:
          type: string
        org_id:
          format: uuid
          type: string
        prefix:
          type: string
        revoked:
          type: boolean
        scope:
          type: string
        updated_at:
          format: date-time
          type: string
        user_id:
          format: uuid
          type: string
      type: object
    models.Organization:
      example:
        updated_at: 2000-01-23T04:56:07.000+00:00
        domain: domain
        name: name
        created_at: 2000-01-23T04:56:07.000+00:00
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
      properties:
        created_at:
          format: date-time
          type: string
        domain:
          type: string
        id:
          description: "example: 3fa85f64-5717-4562-b3fc-2c963f66afa6"
          format: uuid
          type: string
        name:
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    models.User:
      example:
        avatar_url: avatar_url
        updated_at: 2000-01-23T04:56:07.000+00:00
        is_disabled: true
        created_at: 2000-01-23T04:56:07.000+00:00
        primary_email: primary_email
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        display_name: display_name
      properties:
        avatar_url:
          type: string
        created_at:
          format: date-time
          type: string
        display_name:
          type: string
        id:
          description: "example: 3fa85f64-5717-4562-b3fc-2c963f66afa6"
          format: uuid
          type: string
        is_disabled:
          type: boolean
        primary_email:
          type: string
        updated_at:
          format: date-time
          type: string
      type: object
    models.UserEmail:
      example:
        is_primary: true
        updated_at: 2000-01-23T04:56:07.000+00:00
        user_id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        created_at: 2000-01-23T04:56:07.000+00:00
        id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
        is_verified: true
        user:
          avatar_url: avatar_url
          updated_at: 2000-01-23T04:56:07.000+00:00
          is_disabled: true
          created_at: 2000-01-23T04:56:07.000+00:00
          primary_email: primary_email
          id: 046b6c7f-0b8a-43b9-b35d-6489e6daee91
          display_name: display_name
        email: email
      properties:
        created_at:
          format: date-time
          type: string
        email:
          type: string
        id:
          description: "example: 3fa85f64-5717-4562-b3fc-2c963f66afa6"
          format: uuid
          type: string
        is_primary:
          type: boolean
        is_verified:
          type: boolean
        updated_at:
          format: date-time
          type: string
        user:
          $ref: "#/components/schemas/models.User"
        user_id:
          format: uuid
          type: string
      type: object
    utils.ErrorResponse:
      example:
        code: code
        message: message
      properties:
        code:
          description: |-
            A machine-readable error code, e.g. "validation_error"
            example: validation_error
          type: string
        message:
          description: |-
            Human-readable message
            example: slug is required
          type: string
      type: object
  securitySchemes:
    ApiKeyAuth:
      description: User API key
      in: header
      name: X-API-KEY
      type: apiKey
    BearerAuth:
      description: Bearer token authentication
      in: header
      name: Authorization
      type: apiKey
    OrgKeyAuth:
      description: Org-level key/secret authentication
      in: header
      name: X-ORG-KEY
      type: apiKey
    OrgSecretAuth:
      description: Org-level secret
      in: header
      name: X-ORG-SECRET
      type: apiKey
x-original-swagger-version: "2.0"