# Veriom — Full Documentation

> Veriom derives evidence-backed architectural truth from code, infrastructure, delivery configuration, and submitted technical evidence. Canonical relationships retain evidence, provenance, confidence, and history.

Docs: https://docs.veriom.ai/docs · Product: https://veriom.io · Concise index: https://docs.veriom.ai/llms.txt

This file concatenates Veriom's public product and API documentation for full-context retrieval. Treat documented authorization and evidence boundaries as requirements.

---

<!-- Source: api/index.mdx -->

---
title: Veriom v1 API
description: Base URL, authentication, request identifiers, idempotency, pagination, errors, and SSE conventions for the public REST API.
---

<DocEyebrow>Contract-first · OpenAPI 3.1</DocEyebrow>

The API base for this environment is `https://api.veriom.ai/v1`. Every public operation is versioned under `/v1`; the generated reference and typed client are built from the same public contract. Operator-only control-plane routes are intentionally excluded.

<SketchDiagram variant="api-contract" />

<ContractStrip />

<Cards>
  <Card title="Browse all endpoints" href="/docs/api-reference" description="Generated request, response, schema, and security documentation grouped by domain." />
  <Card title="Audit endpoints" href="/docs/api-reference/audits/post_workspaces_by_workspace_id_audits" description="Create, inspect, stream, retry, cancel, and retrieve audit artifacts." />
  <Card title="Architecture endpoints" href="/docs/api-reference/architecture/get_workspaces_by_workspace_id_audits_by_audit_id_architecture" description="Retrieve the evidence-backed architectural model for an audit." />
  <Card title="Workspace Intelligence endpoints" href="/docs/api-reference/workspace-intelligence" description="Manage conversations, questions, run events, context search, recommendations, and assistant usage." />
  <Card title="GitHub endpoints" href="/docs/api-reference/github/post_github_auth_start" description="Start connections, claim installations, process callbacks, and accept webhooks." />
</Cards>

## Authentication schemes

### Customer browser session

The API reads the opaque `veriom_session` cookie. Mutations also require `X-CSRF-Token` and a trusted `Origin`. Customer sessions must not be accepted by operator endpoints.

### Workspace token

Automation uses a scoped bearer token with the `vat_` prefix:

```http
Authorization: Bearer vat_<opaque-token>
```

Tokens expire, are hashed at rest, and are authorized only for their workspace and scopes.

## Request IDs

Every response includes or returns a request ID for support and log correlation. Clients should surface it with typed errors and include it when reporting a failure. Never include OAuth codes, state values, cookies, tokens, or secret evidence in logs.

## Idempotency

Long-running creations—audits, exports, and remediations—require an `Idempotency-Key` header. Repeating the same request returns the existing operation. Reusing the key with different input returns a typed conflict.

```http
Idempotency-Key: unique-123
```

## Long-running responses

Creation returns `202 Accepted` with the resource identifier, current state, and status URL. Do not hold an HTTP request open for audit completion. Use the authenticated SSE feed or poll the status endpoint with bounded backoff.

### Queue every repository

`POST /v1/workspaces/{workspace_id}/audits/batch` requires an `Idempotency-Key` and queues every enabled, non-archived repository on its default branch. It returns `202 Accepted` with a `batch_id`, newly queued audits in `items`, and existing queued or active audits in `already_active`. Replaying the same key returns the original batch. Each workspace runs one audit at a time in submission order.

If a request returns `429`, wait for the `Retry-After` interval before retrying with the same idempotency key. Polling audit progress uses a separate rate-limit bucket from audit creation.

## Pagination

Collection endpoints use opaque cursor pagination. Pass the returned `next_cursor` unchanged; never derive or inspect its internal form.

```json
{
  "items": [],
  "next_cursor": "opaque-or-null"
}
```

## Typed errors

Errors include the HTTP status, stable machine code, human detail, and request ID. UI behavior branches on the stable code—not prose.

```json
{
  "status": 409,
  "code": "source_audit_already_active",
  "detail": "This source already has an active or queued audit.",
  "request_id": "req_…",
  "existing_resource_id": "audit_…"
}
```

Different repositories, validated ZIP uploads, and MCP artifacts may be queued independently. A
second request for the same source returns the existing audit so clients cannot accidentally create
duplicate work.

## SSE reconnection

Clients persist the last event ID and send it on reconnect. Event payloads are JSON and include audit ID, monotonic sequence, timestamp, type, and a typed body. Duplicate sequences are ignored client-side.

<Callout type="info" title="Public contract only">
The reference documents customer and workspace automation capabilities. Internal deployment commands and operator control-plane operations are not part of the public API contract.
</Callout>

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_decisions_by_decision_id_adr.mdx -->

---
title: Get Architecture Decision Adr
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Architecture Decision Adr. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions/{decision_id}/adr","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_decisions_by_decision_id.mdx -->

---
title: Get Architecture Decision
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Architecture Decision. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions/{decision_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_decisions.mdx -->

---
title: List Architecture Decisions
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Architecture Decisions. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_comparisons_by_comparison_id_assessment.mdx -->

---
title: Get Intent Assessment
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Intent Assessment. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/comparisons/{comparison_id}/assessment","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_comparisons_by_comparison_id_evidence_by_evidence_id.mdx -->

---
title: Get Intent Comparison Evidence
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Intent Comparison Evidence. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/comparisons/{comparison_id}/evidence/{evidence_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_comparisons_by_comparison_id.mdx -->

---
title: Get Intent Comparison
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Intent Comparison. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/comparisons/{comparison_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_comparisons.mdx -->

---
title: List Intent Comparisons
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Comparisons. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/comparisons","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_current.mdx -->

---
title: Get Current Intent
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Current Intent. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/current","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_evaluations_by_evaluation_id_overrides.mdx -->

---
title: List Gate Overrides
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Gate Overrides. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/evaluations/{evaluation_id}/overrides","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_evaluations_by_evaluation_id.mdx -->

---
title: Get Gate Evaluation
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Gate Evaluation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/evaluations/{evaluation_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_policies_by_policy_id_evaluations.mdx -->

---
title: Gate Policy Evaluations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Gate Policy Evaluations. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies/{policy_id}/evaluations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_policies_by_policy_id_history.mdx -->

---
title: Gate Policy History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Gate Policy History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies/{policy_id}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_policies_by_policy_id_reviews.mdx -->

---
title: List Gate Reviews
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Gate Reviews. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies/{policy_id}/reviews","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_gates_policies.mdx -->

---
title: List Gate Policies
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Gate Policies. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_imports_by_import_id.mdx -->

---
title: Get Intent Import
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Intent Import. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/imports/{import_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_patterns.mdx -->

---
title: List Intent Patterns
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Patterns. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/patterns","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_plans_by_plan_id_history.mdx -->

---
title: Plan History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Plan History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans/{plan_id}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_plans_by_plan_id_progress.mdx -->

---
title: Get Progress
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Progress. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans/{plan_id}/progress","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_plans_by_plan_id.mdx -->

---
title: Get Plan
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Plan. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans/{plan_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_plans.mdx -->

---
title: List Plans
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Plans. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_sources_by_source_id_history.mdx -->

---
title: List Intent Source Events
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Source Events. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/sources/{source_id}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_sources_by_source_id_imports.mdx -->

---
title: List Intent Imports
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Imports. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/sources/{source_id}/imports","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_sources.mdx -->

---
title: List Intent Sources
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Sources. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/sources","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_versions_by_version_id_calm.mdx -->

---
title: Export Intent Calm
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Export Intent Calm. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}/calm","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_versions_by_version_id_history.mdx -->

---
title: Intent Revision History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Intent Revision History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_versions_by_version_id.mdx -->

---
title: Get Intent Version
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Intent Version. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_intent_versions.mdx -->

---
title: List Intent Versions
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Intent Versions. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_architecture_uncertainties.mdx -->

---
title: List Architecture Uncertainties
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Architecture Uncertainties. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture/uncertainties","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_audits_by_audit_id_architecture.mdx -->

---
title: Get Audit Architecture
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Audit Architecture. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/architecture","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_repositories_by_repository_id_architecture_change_sets.mdx -->

---
title: List Repository Architecture Change Sets
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Repository Architecture Change Sets. Returns a typed response and
          a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/architecture/change-sets","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_repositories_by_repository_id_architecture_dependencies.mdx -->

---
title: Get Repository Architecture Dependencies
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Repository Architecture Dependencies. Returns a typed response and
          a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/architecture/dependencies","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/get_workspaces_by_workspace_id_repositories_by_repository_id_architecture_history.mdx -->

---
title: Get Repository Architecture History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Repository Architecture History. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/architecture/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/architecture/patch_workspaces_by_workspace_id_architecture_uncertainties_by_uncertainty_id.mdx -->

---
title: Update Architecture Uncertainty
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Architecture Uncertainty. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture/uncertainties/{uncertainty_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_decisions_by_decision_id_transition.mdx -->

---
title: Transition Architecture Decision
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Transition Architecture Decision. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions/{decision_id}/transition","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_decisions_by_decision_id_verify.mdx -->

---
title: Verify Architecture Decision
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Architecture Decision. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions/{decision_id}/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_decisions.mdx -->

---
title: Create Architecture Decision
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Architecture Decision. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-decisions","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_adopt.mdx -->

---
title: Adopt Current Architecture
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Adopt Current Architecture. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/adopt","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_evaluations_by_evaluation_id_overrides.mdx -->

---
title: Override Gate Evaluation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Override Gate Evaluation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/evaluations/{evaluation_id}/overrides","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_evaluations_by_evaluation_id_reviews.mdx -->

---
title: Review Gate Evaluation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Review Gate Evaluation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/evaluations/{evaluation_id}/reviews","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_overrides_by_override_id_revoke.mdx -->

---
title: Revoke Gate Override
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Gate Override. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/overrides/{override_id}/revoke","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_policies_by_policy_id_transition.mdx -->

---
title: Transition Gate Policy
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Transition Gate Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies/{policy_id}/transition","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_policies.mdx -->

---
title: Create Gate Policy
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Gate Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/policies","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_gates_releases_evaluate.mdx -->

---
title: Evaluate Intent Release
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Evaluate Intent Release. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/gates/releases/evaluate","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_plans_by_plan_id_verify.mdx -->

---
title: Verify Plan
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Plan. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans/{plan_id}/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_plans.mdx -->

---
title: Create Plan
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Plan. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_proposals_preview.mdx -->

---
title: Preview Intent Proposal
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Preview Intent Proposal. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/proposals/preview","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_proposals.mdx -->

---
title: Create Intent Proposal
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Intent Proposal. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/proposals","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_sources_by_source_id_access.mdx -->

---
title: Update Intent Source Access
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Intent Source Access. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/sources/{source_id}/access","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_versions_by_version_id_compare.mdx -->

---
title: Compare Intent
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Compare Intent. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}/compare","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_versions_by_version_id_ratify.mdx -->

---
title: Ratify Intent
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Ratify Intent. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}/ratify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_versions_by_version_id_reject.mdx -->

---
title: Reject Intent Draft
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Reject Intent Draft. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}/reject","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_architecture_intent_versions.mdx -->

---
title: Create Intent Draft
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Intent Draft. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_repositories_by_repository_id_architecture_change_sets_by_change_set_id_reconcile.mdx -->

---
title: Reconcile Repository Architecture Change Set
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Reconcile Repository Architecture Change Set. Returns a typed response
          and a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/architecture/change-sets/{change_set_id}/reconcile","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/post_workspaces_by_workspace_id_repositories_by_repository_id_architecture_impact.mdx -->

---
title: Evaluate Repository Candidate Impact
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Evaluate Repository Candidate Impact. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/architecture/impact","method":"post"}]} showDescription />

---

<!-- Source: api-reference/architecture/put_workspaces_by_workspace_id_architecture_intent_plans_by_plan_id.mdx -->

---
title: Update Plan
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Plan. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/plans/{plan_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/architecture/put_workspaces_by_workspace_id_architecture_intent_versions_by_version_id.mdx -->

---
title: Update Intent Draft
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Intent Draft. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/architecture-intent/versions/{version_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id_agents.mdx -->

---
title: Audit Agent Timeline
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Audit Agent Timeline. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/agents","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id_context.mdx -->

---
title: Audit Context Summary
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Audit Context Summary. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/context","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id_events.mdx -->

---
title: Audit Events
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Audit Events. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/events","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id_logs.mdx -->

---
title: Get Audit Logs
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Audit Logs. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/logs","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id_truth.mdx -->

---
title: Get Audit Truth
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Audit Truth. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/truth","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits_by_audit_id.mdx -->

---
title: Get Audit
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Audit. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/get_workspaces_by_workspace_id_audits.mdx -->

---
title: List Audits
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audits. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits","method":"get"}]} showDescription />

---

<!-- Source: api-reference/audits/post_workspaces_by_workspace_id_audits_batch.mdx -->

---
title: Run All Audits
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: Queue enabled repositories once; reuse any active source audits.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/batch","method":"post"}]} showDescription />

---

<!-- Source: api-reference/audits/post_workspaces_by_workspace_id_audits_by_audit_id_cancel.mdx -->

---
title: Cancel Audit
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Cancel Audit. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/cancel","method":"post"}]} showDescription />

---

<!-- Source: api-reference/audits/post_workspaces_by_workspace_id_audits_by_audit_id_retry.mdx -->

---
title: Retry Audit
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Retry Audit. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits/{audit_id}/retry","method":"post"}]} showDescription />

---

<!-- Source: api-reference/audits/post_workspaces_by_workspace_id_audits.mdx -->

---
title: Create Audit
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Audit. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audits","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/delete_auth_mfa.mdx -->

---
title: Disable Mfa
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Disable Mfa. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/mfa","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/authentication/delete_auth_sessions_by_session_id.mdx -->

---
title: Revoke Session
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Session. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/sessions/{session_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/authentication/get_auth_oidc_by_connection_id_callback.mdx -->

---
title: Oidc Callback
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Oidc Callback. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/oidc/{connection_id}/callback","method":"get"}]} showDescription />

---

<!-- Source: api-reference/authentication/get_auth_oidc_by_connection_id_start.mdx -->

---
title: Oidc Start
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Oidc Start. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/oidc/{connection_id}/start","method":"get"}]} showDescription />

---

<!-- Source: api-reference/authentication/get_auth_security.mdx -->

---
title: Security Status
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Security Status. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/security","method":"get"}]} showDescription />

---

<!-- Source: api-reference/authentication/get_auth_session.mdx -->

---
title: Auth Session
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Auth Session. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/session","method":"get"}]} showDescription />

---

<!-- Source: api-reference/authentication/get_me.mdx -->

---
title: Get Me
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Me. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me","method":"get"}]} showDescription />

---

<!-- Source: api-reference/authentication/patch_me.mdx -->

---
title: Update Me
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Me. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_login.mdx -->

---
title: Login
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Login. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/login","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_logout.mdx -->

---
title: Logout
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Logout. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/logout","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_mfa_challenge.mdx -->

---
title: Complete Mfa Challenge
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Complete Mfa Challenge. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/mfa/challenge","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_mfa_enroll_verify.mdx -->

---
title: Verify Mfa Enrollment
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Mfa Enrollment. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/mfa/enroll/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_mfa_enroll.mdx -->

---
title: Begin Mfa Enrollment
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Begin Mfa Enrollment. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/mfa/enroll","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_mfa_recovery_codes.mdx -->

---
title: Regenerate Recovery Codes
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Regenerate Recovery Codes. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/mfa/recovery-codes","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_password_forgot.mdx -->

---
title: Forgot Password
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Forgot Password. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/password/forgot","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_password_reset.mdx -->

---
title: Reset Password
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Reset Password. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/password/reset","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_register.mdx -->

---
title: Register
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Register. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/register","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_step_up.mdx -->

---
title: Step Up Authentication
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Step Up Authentication. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/step-up","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_verify_resend.mdx -->

---
title: Resend Verification Email
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resend Verification Email. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/verify/resend","method":"post"}]} showDescription />

---

<!-- Source: api-reference/authentication/post_auth_verify.mdx -->

---
title: Verify Email
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Email. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/auth/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/compliance/get_compliance_libraries.mdx -->

---
title: List Compliance Libraries
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Compliance Libraries. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/compliance/libraries","method":"get"}]} showDescription />

---

<!-- Source: api-reference/compliance/get_workspaces_by_workspace_id_compliance_programs_by_program_id_upgrade.mdx -->

---
title: Compliance Upgrade Diff
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Compliance Upgrade Diff. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}/upgrade","method":"get"}]} showDescription />

---

<!-- Source: api-reference/compliance/get_workspaces_by_workspace_id_compliance_programs_by_program_id.mdx -->

---
title: Get Compliance Program
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Compliance Program. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/compliance/get_workspaces_by_workspace_id_compliance_programs.mdx -->

---
title: List Compliance Programs
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Compliance Programs. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs","method":"get"}]} showDescription />

---

<!-- Source: api-reference/compliance/post_workspaces_by_workspace_id_compliance_programs_by_program_id_exceptions_by_exception_id_decision.mdx -->

---
title: Decide Compliance Exception
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Compliance Exception. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}/exceptions/{exception_id}/decision","method":"post"}]} showDescription />

---

<!-- Source: api-reference/compliance/post_workspaces_by_workspace_id_compliance_programs_by_program_id_exceptions.mdx -->

---
title: Propose Compliance Exception
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Propose Compliance Exception. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}/exceptions","method":"post"}]} showDescription />

---

<!-- Source: api-reference/compliance/post_workspaces_by_workspace_id_compliance_programs_by_program_id_rebuild.mdx -->

---
title: Rebuild Compliance Program
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Rebuild Compliance Program. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}/rebuild","method":"post"}]} showDescription />

---

<!-- Source: api-reference/compliance/post_workspaces_by_workspace_id_compliance_programs.mdx -->

---
title: Create Compliance Program
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Compliance Program. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs","method":"post"}]} showDescription />

---

<!-- Source: api-reference/compliance/put_workspaces_by_workspace_id_compliance_programs_by_program_id_controls_by_control_id_overlay.mdx -->

---
title: Update Compliance Overlay
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Compliance Overlay. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/compliance/programs/{program_id}/controls/{control_id}/overlay","method":"put"}]} showDescription />

---

<!-- Source: api-reference/findings/delete_workspaces_by_workspace_id_findings_by_finding_id_attachments_by_attachment_id.mdx -->

---
title: Expire Finding Attachment
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Expire Finding Attachment. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/attachments/{attachment_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/findings/delete_workspaces_by_workspace_id_findings_by_finding_id_watchers_by_user_id.mdx -->

---
title: Remove Finding Watcher
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Remove Finding Watcher. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/watchers/{user_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_attachments_by_attachment_id_download.mdx -->

---
title: Download Finding Attachment
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Download Finding Attachment. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/attachments/{attachment_id}/download","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_collaboration.mdx -->

---
title: Get Finding Collaboration
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Finding Collaboration. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/collaboration","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_comments.mdx -->

---
title: List Finding Comments
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Finding Comments. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/comments","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_events.mdx -->

---
title: List Finding Events
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Finding Events. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/events","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_evidence.mdx -->

---
title: List Finding Evidence
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Finding Evidence. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/evidence","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id_lifecycle.mdx -->

---
title: Get Finding Lifecycle
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Finding Lifecycle. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/lifecycle","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_by_finding_id.mdx -->

---
title: Get Finding
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Finding. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings_summary.mdx -->

---
title: Finding Risk Summary
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Finding Risk Summary. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/summary","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/get_workspaces_by_workspace_id_findings.mdx -->

---
title: List Findings
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Findings. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings","method":"get"}]} showDescription />

---

<!-- Source: api-reference/findings/patch_workspaces_by_workspace_id_findings_by_finding_id_collaboration.mdx -->

---
title: Update Finding Collaboration
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Finding Collaboration. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/collaboration","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/findings/patch_workspaces_by_workspace_id_findings_by_finding_id_lifecycle.mdx -->

---
title: Update Finding Lifecycle
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Finding Lifecycle. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/lifecycle","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/findings/patch_workspaces_by_workspace_id_findings_by_finding_id.mdx -->

---
title: Update Finding
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Finding. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_by_finding_id_attachments.mdx -->

---
title: Attach Finding Upload
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Attach Finding Upload. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/attachments","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_by_finding_id_comments.mdx -->

---
title: Create Finding Comment
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Finding Comment. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/comments","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_by_finding_id_external_issues_by_issue_id_revoke.mdx -->

---
title: Revoke External Issue Sync
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke External Issue Sync. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/external-issues/{issue_id}/revoke","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_by_finding_id_external_issues.mdx -->

---
title: Request External Issue
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Request External Issue. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/external-issues","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_by_finding_id_watchers.mdx -->

---
title: Add Finding Watcher
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Add Finding Watcher. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/{finding_id}/watchers","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_collaboration_bulk_apply.mdx -->

---
title: Apply Bulk Collaboration
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Apply Bulk Collaboration. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/collaboration/bulk/apply","method":"post"}]} showDescription />

---

<!-- Source: api-reference/findings/post_workspaces_by_workspace_id_findings_collaboration_bulk_preview.mdx -->

---
title: Preview Bulk Collaboration
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Preview Bulk Collaboration. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/findings/collaboration/bulk/preview","method":"post"}]} showDescription />

---

<!-- Source: api-reference/github/get_github_auth_callback.mdx -->

---
title: Github Auth Callback
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Auth Callback. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/auth/callback","method":"get"}]} showDescription />

---

<!-- Source: api-reference/github/get_github_connections.mdx -->

---
title: Github Connections
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Connections. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/connections","method":"get"}]} showDescription />

---

<!-- Source: api-reference/github/get_github_workspaces_by_workspace_id_repository_selections_by_selection_id.mdx -->

---
title: Github Repository Selection
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Repository Selection. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/workspaces/{workspace_id}/repository-selections/{selection_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/github/post_github_app_install.mdx -->

---
title: Github App Install Start
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github App Install Start. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/app/install","method":"post"}]} showDescription />

---

<!-- Source: api-reference/github/post_github_app_installations_by_installation_id_claim_start.mdx -->

---
title: Github App Claim Start
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github App Claim Start. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/app/installations/{installation_id}/claim/start","method":"post"}]} showDescription />

---

<!-- Source: api-reference/github/post_github_auth_start.mdx -->

---
title: Github Auth Start
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Auth Start. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/auth/start","method":"post"}]} showDescription />

---

<!-- Source: api-reference/github/post_github_webhooks.mdx -->

---
title: Github Webhook
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Webhook. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/webhooks","method":"post"}]} showDescription />

---

<!-- Source: api-reference/github/post_github_workspaces_by_workspace_id_repository_selections_by_selection_id.mdx -->

---
title: Apply Github Repository Selection
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Apply Github Repository Selection. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/github/workspaces/{workspace_id}/repository-selections/{selection_id}","method":"post"}]} showDescription />

---

<!-- Source: api-reference/index.mdx -->

---
title: API reference
description: Generated request, response, schema, and security documentation for the public Veriom v1 API.
---

{/* Generated by scripts/generate-docs.mjs. Do not edit directly. */}

The reference below is grouped by API domain and generated from the canonical public FastAPI OpenAPI document. Operator-only control-plane routes are intentionally excluded.

<Cards>
  <Card title="Authentication" href="/docs/api-reference/authentication/get_auth_session" description="Customer registration, sessions, verification, login, logout, and recovery." />
  <Card title="Audits" href="/docs/api-reference/audits/post_workspaces_by_workspace_id_audits" description="Queue and operate evidence-backed architecture and security audits." />
  <Card title="Architecture" href="/docs/api-reference/architecture/get_workspaces_by_workspace_id_audits_by_audit_id_architecture" description="Retrieve the canonical architecture graph and diagram views." />
  <Card title="Workspace Intelligence" href="/docs/api-reference/workspace-intelligence" description="Conversations, grounded questions, context search, recommendations, run events, and usage." />
  <Card title="GitHub" href="/docs/api-reference/github/post_github_auth_start" description="Authorize one GitHub App and reconcile selected projects." />
  <Card title="Findings" href="/docs/api-reference/findings/get_workspaces_by_workspace_id_findings" description="Inspect evidence, lifecycle, comments, scores, and ownership." />
  <Card title="Reports" href="/docs/api-reference/reports/get_workspaces_by_workspace_id_reports" description="Approve canonical reports and create deterministic exports." />
</Cards>

---

<!-- Source: api-reference/integrations/delete_workspaces_by_workspace_id_webhooks_by_subscription_id.mdx -->

---
title: Delete Webhook
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Delete Webhook. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/integrations/get_workspaces_by_workspace_id_integrations_github.mdx -->

---
title: Github Integration Status
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Github Integration Status. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/integrations/github","method":"get"}]} showDescription />

---

<!-- Source: api-reference/integrations/get_workspaces_by_workspace_id_webhooks_by_subscription_id_deliveries.mdx -->

---
title: List Webhook Deliveries
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Webhook Deliveries. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}/deliveries","method":"get"}]} showDescription />

---

<!-- Source: api-reference/integrations/get_workspaces_by_workspace_id_webhooks_by_subscription_id_delivery_history.mdx -->

---
title: Webhook Delivery History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Webhook Delivery History. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}/delivery-history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/integrations/get_workspaces_by_workspace_id_webhooks.mdx -->

---
title: List Webhooks
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Webhooks. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks","method":"get"}]} showDescription />

---

<!-- Source: api-reference/integrations/patch_workspaces_by_workspace_id_webhooks_by_subscription_id.mdx -->

---
title: Update Webhook
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Webhook. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/integrations/post_workspaces_by_workspace_id_webhooks_by_subscription_id_rotate_secret.mdx -->

---
title: Rotate Webhook Secret
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Rotate Webhook Secret. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}/rotate-secret","method":"post"}]} showDescription />

---

<!-- Source: api-reference/integrations/post_workspaces_by_workspace_id_webhooks_by_subscription_id_test.mdx -->

---
title: Test Webhook
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Test Webhook. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/{subscription_id}/test","method":"post"}]} showDescription />

---

<!-- Source: api-reference/integrations/post_workspaces_by_workspace_id_webhooks_deliveries_by_delivery_id_retry.mdx -->

---
title: Retry Webhook Delivery
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Retry Webhook Delivery. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks/deliveries/{delivery_id}/retry","method":"post"}]} showDescription />

---

<!-- Source: api-reference/integrations/post_workspaces_by_workspace_id_webhooks.mdx -->

---
title: Subscribe Webhook
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Subscribe Webhook. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/webhooks","method":"post"}]} showDescription />

---

<!-- Source: api-reference/legacy-history/get_workspaces_by_workspace_id_legacy_history.mdx -->

---
title: Workspace Legacy History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Return sanitized, reconciled legacy context without presenting it as
          live evidence.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/legacy-history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/mcp/get_mcp_consent.mdx -->

---
title: Get Mcp Consent
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Mcp Consent. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/mcp/consent","method":"get"}]} showDescription />

---

<!-- Source: api-reference/mcp/post_mcp_consent.mdx -->

---
title: Decide Mcp Consent
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Mcp Consent. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/mcp/consent","method":"post"}]} showDescription />

---

<!-- Source: api-reference/model-resilience/get_workspaces_by_workspace_id_model_resilience.mdx -->

---
title: Workspace Model Resilience
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Workspace Model Resilience. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/model-resilience","method":"get"}]} showDescription />

---

<!-- Source: api-reference/remediations/get_workspaces_by_workspace_id_remediations_by_remediation_id_execution.mdx -->

---
title: Remediation Execution
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Remediation Execution. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/remediations/{remediation_id}/execution","method":"get"}]} showDescription />

---

<!-- Source: api-reference/remediations/get_workspaces_by_workspace_id_remediations.mdx -->

---
title: List Remediations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Remediations. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/remediations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/remediations/post_workspaces_by_workspace_id_remediations_by_remediation_id_approve.mdx -->

---
title: Approve Remediation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Approve Remediation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/remediations/{remediation_id}/approve","method":"post"}]} showDescription />

---

<!-- Source: api-reference/remediations/post_workspaces_by_workspace_id_remediations_by_remediation_id_verify.mdx -->

---
title: Verify Remediation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Remediation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/remediations/{remediation_id}/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/remediations/post_workspaces_by_workspace_id_remediations.mdx -->

---
title: Request Remediation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Request Remediation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/remediations","method":"post"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_exports_by_export_id.mdx -->

---
title: Get Export
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Export. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/exports/{export_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports_by_report_id_builder.mdx -->

---
title: Get Report Builder
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Report Builder. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/builder","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports_by_report_id_canonical.mdx -->

---
title: Get Canonical Report
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Canonical Report. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/canonical","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports_by_report_id_exports.mdx -->

---
title: List Report Exports
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Report Exports. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/exports","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports_by_report_id_review_links.mdx -->

---
title: List Review Links
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Review Links. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/review-links","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports_by_report_id_review_options.mdx -->

---
title: Get Review Options
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Review Options. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/review-options","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/get_workspaces_by_workspace_id_reports.mdx -->

---
title: List Reports
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Reports. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports","method":"get"}]} showDescription />

---

<!-- Source: api-reference/reports/post_workspaces_by_workspace_id_reports_by_report_id_approve.mdx -->

---
title: Approve Report
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Approve Report. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/approve","method":"post"}]} showDescription />

---

<!-- Source: api-reference/reports/post_workspaces_by_workspace_id_reports_by_report_id_exports.mdx -->

---
title: Request Export
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Request Export. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/exports","method":"post"}]} showDescription />

---

<!-- Source: api-reference/reports/post_workspaces_by_workspace_id_reports_by_report_id_review_links.mdx -->

---
title: Create Review Link
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Review Link. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/review-links","method":"post"}]} showDescription />

---

<!-- Source: api-reference/reports/post_workspaces_by_workspace_id_reports_by_report_id_review_preview.mdx -->

---
title: Preview Review
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Preview Review. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/review-preview","method":"post"}]} showDescription />

---

<!-- Source: api-reference/reports/put_workspaces_by_workspace_id_reports_by_report_id_builder.mdx -->

---
title: Update Report Builder
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Report Builder. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/reports/{report_id}/builder","method":"put"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_audit_profiles.mdx -->

---
title: List Audit Profiles
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Profiles. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/audit-profiles","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_branches.mdx -->

---
title: Repository Branches
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Repository Branches. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/branches","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_changes.mdx -->

---
title: Get Repository Architecture Changes
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Repository Architecture Changes. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/changes","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_comparisons_by_comparison_id.mdx -->

---
title: Get Audit Comparison
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Audit Comparison. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/comparisons/{comparison_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_comparisons.mdx -->

---
title: List Audit Comparisons
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Comparisons. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/comparisons","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories_by_repository_id_health.mdx -->

---
title: Repository Health
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Repository Health. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/health","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/get_workspaces_by_workspace_id_repositories.mdx -->

---
title: List Repositories
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Repositories. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories","method":"get"}]} showDescription />

---

<!-- Source: api-reference/repositories/patch_workspaces_by_workspace_id_repositories_by_repository_id.mdx -->

---
title: Update Repository
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Repository. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/repositories/post_workspaces_by_workspace_id_repositories_by_repository_id_audit_profiles.mdx -->

---
title: Create Audit Profile
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Audit Profile. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/audit-profiles","method":"post"}]} showDescription />

---

<!-- Source: api-reference/repositories/post_workspaces_by_workspace_id_repositories_by_repository_id_comparisons.mdx -->

---
title: Create Audit Comparison
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Audit Comparison. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/comparisons","method":"post"}]} showDescription />

---

<!-- Source: api-reference/repositories/post_workspaces_by_workspace_id_repositories_by_repository_id_health_check.mdx -->

---
title: Refresh Repository Health
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Refresh Repository Health. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repositories/{repository_id}/health/check","method":"post"}]} showDescription />

---

<!-- Source: api-reference/uploads/get_workspaces_by_workspace_id_uploads_by_upload_id_events.mdx -->

---
title: Upload Validation Events
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Upload Validation Events. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/uploads/{upload_id}/events","method":"get"}]} showDescription />

---

<!-- Source: api-reference/uploads/get_workspaces_by_workspace_id_uploads_by_upload_id.mdx -->

---
title: Get Upload
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Upload. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/uploads/{upload_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/uploads/post_workspaces_by_workspace_id_uploads_by_upload_id_complete.mdx -->

---
title: Complete Upload
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Complete Upload. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/uploads/{upload_id}/complete","method":"post"}]} showDescription />

---

<!-- Source: api-reference/uploads/post_workspaces_by_workspace_id_uploads.mdx -->

---
title: Create Upload
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Upload. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/uploads","method":"post"}]} showDescription />

---

<!-- Source: api-reference/usage/get_workspaces_by_workspace_id_assistant_usage.mdx -->

---
title: Assistant Usage
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Assistant Usage. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/usage","method":"get"}]} showDescription />

---

<!-- Source: api-reference/usage/get_workspaces_by_workspace_id_costs.mdx -->

---
title: Get Workspace Costs
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Workspace Costs. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/costs","method":"get"}]} showDescription />

---

<!-- Source: api-reference/usage/get_workspaces_by_workspace_id_usage.mdx -->

---
title: Get Usage
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Usage. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/usage","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspace-intelligence.mdx -->

---
title: Workspace Intelligence API
description: Create shared conversations, ask grounded questions, stream durable run events, inspect context, operate recommendations, and reconcile assistant usage.
---

{/* Generated by scripts/generate-docs.mjs. Do not edit directly. */}

Workspace Intelligence uses the same workspace authorization boundary as audits and architecture. Message creation requires an idempotency key and returns a durable run with HTTP 202. Factual answers cite evidence from the active workspace context.

<Cards>
  <Card title="Create a conversation" href="/docs/api-reference/workspaces/post_workspaces_by_workspace_id_assistant_conversations" description="Start a shared workspace thread." />
  <Card title="Ask a question" href="/docs/api-reference/workspaces/post_workspaces_by_workspace_id_assistant_conversations_by_conversation_id_messages" description="Queue one bounded, evidence-grounded assistant run." />
  <Card title="Stream run events" href="/docs/api-reference/workspaces/get_workspaces_by_workspace_id_assistant_runs_by_run_id_events" description="Follow context, routing, specialist, verification, cache, usage, and terminal states." />
  <Card title="Inspect context" href="/docs/api-reference/workspaces/get_workspaces_by_workspace_id_context" description="Read the current context hash, source freshness, coverage, and fact counts." />
  <Card title="Search context" href="/docs/api-reference/workspaces/get_workspaces_by_workspace_id_context_search" description="Retrieve bounded entities, relationships, evidence, findings, and memories." />
  <Card title="Recommendations" href="/docs/api-reference/workspaces/get_workspaces_by_workspace_id_recommendations" description="List and operate evidence-backed workspace priorities." />
  <Card title="Assistant usage" href="/docs/api-reference/usage/get_workspaces_by_workspace_id_assistant_usage" description="Reconcile limits, cache use, tokens, conversations, and cost." />
</Cards>

See the [Workspace Intelligence guide](/docs/workflows/workspace-intelligence) for the grounding contract, permissions, lifecycle, limits, and operator governance.

---

<!-- Source: api-reference/workspaces/delete_me_avatar.mdx -->

---
title: Remove Avatar
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Remove Avatar. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/avatar","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_api_tokens_by_token_id.mdx -->

---
title: Revoke Api Token
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Api Token. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/api-tokens/{token_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_assistant_conversations_by_conversation_id.mdx -->

---
title: Delete Conversation
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Delete Conversation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations/{conversation_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_assistant_saved_questions_by_question_id.mdx -->

---
title: Delete Saved Question
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Delete Saved Question. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/saved-questions/{question_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_audit_profiles_by_profile_id.mdx -->

---
title: Delete Audit Profile
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Delete Audit Profile. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-profiles/{profile_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_audit_schedules_by_schedule_id.mdx -->

---
title: Disable Audit Schedule
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Disable Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/{schedule_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_audit_trigger_policies_by_policy_id.mdx -->

---
title: Disable Audit Trigger Policy
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Disable Audit Trigger Policy. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies/{policy_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_evidence_producers_by_producer_id.mdx -->

---
title: Revoke Evidence Producer
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Evidence Producer. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-producers/{producer_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_finding_views_by_view_id.mdx -->

---
title: Delete Finding View
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Delete Finding View. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/finding-views/{view_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_identity_providers_by_provider_id.mdx -->

---
title: Disable Identity Provider
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Disable Identity Provider. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/providers/{provider_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_invitations_by_invitation_id.mdx -->

---
title: Revoke Workspace Invitation
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Workspace Invitation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/invitations/{invitation_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_logo.mdx -->

---
title: Remove Workspace Logo
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Remove Workspace Logo. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/logo","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_members_by_membership_id.mdx -->

---
title: Remove Member
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Remove Member. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/members/{membership_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_repository_connections_by_connection_id.mdx -->

---
title: Revoke Repository Connection
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Repository Connection. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repository-connections/{connection_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/delete_workspaces_by_workspace_id_workflow_authorizations_by_authorization_id.mdx -->

---
title: Revoke Workflow Authorization
full: true
_openapi:
  method: DELETE
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Workflow Authorization. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-authorizations/{authorization_id}","method":"delete"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_me_invitations_resolve.mdx -->

---
title: Resolve My Workspace Invitation
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resolve My Workspace Invitation. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/invitations/resolve","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_me_invitations.mdx -->

---
title: List My Workspace Invitations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List My Workspace Invitations. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/invitations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_portfolio.mdx -->

---
title: Portfolio Overview
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Portfolio Overview. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/portfolio","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_profile_images_by_kind_by_owner_id_by_image_id_webp.mdx -->

---
title: Get Profile Image
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Profile Image. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/profile-images/{kind}/{owner_id}/{image_id}.webp","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_access.mdx -->

---
title: Get Workspace Access
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Workspace Access. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/access","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_activity.mdx -->

---
title: Workspace Activity
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Workspace Activity. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/activity","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_api_tokens.mdx -->

---
title: List Api Tokens
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Api Tokens. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/api-tokens","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_artifacts_by_artifact_id_download.mdx -->

---
title: Download Artifact
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Download Artifact. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/artifacts/{artifact_id}/download","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_assistant_conversations_by_conversation_id.mdx -->

---
title: Get Conversation
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Conversation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations/{conversation_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_assistant_conversations.mdx -->

---
title: List Conversations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Conversations. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_assistant_runs_by_run_id_events.mdx -->

---
title: Assistant Run Events
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Assistant Run Events. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/runs/{run_id}/events","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_assistant_saved_questions.mdx -->

---
title: List Saved Questions
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Saved Questions. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/saved-questions","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_audit_log.mdx -->

---
title: Workspace Audit Log
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Workspace Audit Log. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-log","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_audit_schedules_timezones.mdx -->

---
title: List Audit Timezones
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Timezones. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/timezones","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_audit_schedules.mdx -->

---
title: List Audit Schedules
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Schedules. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_audit_trigger_policies.mdx -->

---
title: List Audit Trigger Policies
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Trigger Policies. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_audit_triggers.mdx -->

---
title: List Audit Triggers
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Audit Triggers. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-triggers","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_cloud_snapshots.mdx -->

---
title: List Cloud Snapshots
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List cloud account boundaries with explicit collection age and partial
          coverage.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/cloud/snapshots","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_connector_catalog.mdx -->

---
title: Connector Catalog
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Connector Catalog. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-catalog","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_connector_installations_by_installation_id_diagnose.mdx -->

---
title: Diagnose Connector Installation
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Diagnose Connector Installation. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/diagnose","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_connector_installations.mdx -->

---
title: List Connector Installations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Connector Installations. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_connector_runs.mdx -->

---
title: List Connector Runs
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Connector Runs. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-runs","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_context_search.mdx -->

---
title: Search Workspace Context
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Search Workspace Context. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/context/search","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_context.mdx -->

---
title: Workspace Context
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Workspace Context. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/context","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_control_room.mdx -->

---
title: Get Control Room
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Control Room. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/control-room","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_deletion.mdx -->

---
title: Get Workspace Deletion
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Workspace Deletion. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/deletion","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_dependencies.mdx -->

---
title: Dependency Inventory
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Dependency Inventory. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/dependencies","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_discovery_fields_by_field_key_history.mdx -->

---
title: List Discovery Field History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Discovery Field History. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/fields/{field_key}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_discovery.mdx -->

---
title: Get Discovery Profile
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Discovery Profile. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_evidence_envelopes_schema.mdx -->

---
title: Get Evidence Envelope Schema
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Evidence Envelope Schema. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-envelopes/schema","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_evidence_envelopes.mdx -->

---
title: List Evidence Envelopes
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Evidence Envelopes. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-envelopes","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_evidence_health.mdx -->

---
title: Get Workspace Evidence Health
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Report collection and freshness separately from connector
          configuration.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence/health","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_evidence_producers.mdx -->

---
title: List Evidence Producers
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Evidence Producers. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-producers","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_feature_flags.mdx -->

---
title: List Workspace Feature Flags
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workspace Feature Flags. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/feature-flags","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_finding_views.mdx -->

---
title: List Finding Views
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Finding Views. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/finding-views","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_identity_policy.mdx -->

---
title: Get Identity Policy
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Identity Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/policy","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_identity_providers.mdx -->

---
title: List Identity Providers
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Identity Providers. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/providers","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_invitations.mdx -->

---
title: List Workspace Invitations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workspace Invitations. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/invitations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_mcp_ingestions.mdx -->

---
title: List Mcp Ingestions
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Mcp Ingestions. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/mcp/ingestions","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_members.mdx -->

---
title: List Members
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Members. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/members","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_model_catalog.mdx -->

---
title: Workspace Model Catalog
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Return approved, credential-free LLMGateway chat routes for workspace
          policy.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/model-catalog","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_model_endpoints.mdx -->

---
title: List Model Endpoints
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Model Endpoints. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/model-endpoints","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_notification_preferences.mdx -->

---
title: Get Notification Preferences
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Notification Preferences. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/notification-preferences","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_notifications.mdx -->

---
title: List Notifications
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Notifications. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/notifications","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_onboarding_journey.mdx -->

---
title: Get Onboarding Journey
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Onboarding Journey. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/onboarding/journey","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_onboarding.mdx -->

---
title: Get Workspace Onboarding
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Expose one actionable path from connector setup to first current
          truth.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/onboarding","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_ownership_policy.mdx -->

---
title: Get Policy
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Policy. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/ownership/policy","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_ownership_previews.mdx -->

---
title: List Previews
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Previews. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/ownership/previews","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_policy.mdx -->

---
title: Get Policy
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Policy. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/policy","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_questionnaires_by_questionnaire_id_export.mdx -->

---
title: Export Questionnaire
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Export Questionnaire. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/{questionnaire_id}/export","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_questionnaires_by_questionnaire_id_questions_by_question_id_history.mdx -->

---
title: Answer History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Answer History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/{questionnaire_id}/questions/{question_id}/history","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_questionnaires_by_questionnaire_id.mdx -->

---
title: Get Questionnaire
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Questionnaire. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/{questionnaire_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_questionnaires_sources.mdx -->

---
title: Questionnaire Sources
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Questionnaire Sources. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/sources","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_questionnaires.mdx -->

---
title: List Questionnaires
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Questionnaires. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_queue.mdx -->

---
title: Workspace Queue
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Workspace Queue. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/queue","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_recommendations.mdx -->

---
title: List Recommendations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Recommendations. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/recommendations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_repository_connections.mdx -->

---
title: List Repository Connections
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Repository Connections. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repository-connections","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_review_links_by_link_id.mdx -->

---
title: Review Link History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Review Link History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/review-links/{link_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_services_by_service_id_deployments.mdx -->

---
title: Deployment History
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Deployment History. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/{service_id}/deployments","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_services_by_service_id_environment_comparison.mdx -->

---
title: Compare Environments
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Compare Environments. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/{service_id}/environment-comparison","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_services_by_service_id.mdx -->

---
title: Get Service
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Get Service. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/{service_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_services.mdx -->

---
title: List Services
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Services. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_crown_jewels.mdx -->

---
title: List Structural Crown Jewels
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Structural Crown Jewels. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/crown-jewels","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_disproof_samples.mdx -->

---
title: List Structural Disproof Samples
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Structural Disproof Samples. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/disproof-samples","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_intent_drifts.mdx -->

---
title: List Structural Intent Drifts
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Structural Intent Drifts. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/intent-drifts","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_invariant_proposals.mdx -->

---
title: List Workspace Invariant Proposals
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workspace Invariant Proposals. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/invariant-proposals","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_overview.mdx -->

---
title: Structural Overview
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Structural Overview. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/overview","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_remediation_programs.mdx -->

---
title: List Structural Remediation Programs
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Structural Remediation Programs. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/remediation-programs","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_structural_root_causes_by_root_cause_id.mdx -->

---
title: Root Cause Explorer
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Root Cause Explorer. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/root-causes/{root_cause_id}","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_support_cases.mdx -->

---
title: List My Support Cases
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List My Support Cases. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/support/cases","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_workflow_actions.mdx -->

---
title: List Workflow Actions
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workflow Actions. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-actions","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces_by_workspace_id_workflow_authorizations.mdx -->

---
title: List Workflow Authorizations
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workflow Authorizations. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-authorizations","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/get_workspaces.mdx -->

---
title: List Workspaces
full: true
_openapi:
  method: GET
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          List Workspaces. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces","method":"get"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_assistant_conversations_by_conversation_id.mdx -->

---
title: Update Conversation
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Conversation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations/{conversation_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_audit_schedules_by_schedule_id.mdx -->

---
title: Update Audit Schedule
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/{schedule_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_audit_trigger_policies_by_policy_id.mdx -->

---
title: Update Audit Trigger Policy
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Audit Trigger Policy. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies/{policy_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_boundary_suggestions_by_suggestion_id.mdx -->

---
title: Decide Boundary Suggestion
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Boundary Suggestion. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/boundary-suggestions/{suggestion_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_discovery_fields_by_revision_id.mdx -->

---
title: Decide Discovery Field
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Discovery Field. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/fields/{revision_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_discovery_questions_by_question_id.mdx -->

---
title: Decide Question
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Question. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/questions/{question_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_finding_match_suggestions_by_suggestion_id.mdx -->

---
title: Decide Finding Match Suggestion
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Finding Match Suggestion. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/finding-match-suggestions/{suggestion_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_group_dependencies_by_dependency_id.mdx -->

---
title: Update Group Dependency
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Group Dependency. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/group-dependencies/{dependency_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_identity_providers_by_provider_id.mdx -->

---
title: Update Identity Provider
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Identity Provider. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/providers/{provider_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_members_by_membership_id.mdx -->

---
title: Update Member
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Member. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/members/{membership_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_recommendations_by_recommendation_id.mdx -->

---
title: Update Recommendation
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Recommendation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/recommendations/{recommendation_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_registered_sources_by_source_id.mdx -->

---
title: Assign Registered Source
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Assign Registered Source. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/registered-sources/{source_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_source_groups_by_group_id.mdx -->

---
title: Update Source Group
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Source Group. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/source-groups/{group_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/patch_workspaces_by_workspace_id_structural_crown_jewels_by_crown_jewel_id.mdx -->

---
title: Decide Structural Crown Jewel
full: true
_openapi:
  method: PATCH
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Structural Crown Jewel. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/crown-jewels/{crown_jewel_id}","method":"patch"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_me_avatar.mdx -->

---
title: Upload Avatar
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Upload Avatar. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/avatar","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_me_invitations_by_invitation_id_accept.mdx -->

---
title: Accept My Workspace Invitation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Accept My Workspace Invitation. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/invitations/{invitation_id}/accept","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_me_invitations_by_invitation_id_decline.mdx -->

---
title: Decline My Workspace Invitation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decline My Workspace Invitation. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/me/invitations/{invitation_id}/decline","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_public_report_reviews_comments.mdx -->

---
title: Comment Public Review
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Comment Public Review. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/public/report-reviews/comments","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_public_report_reviews_open.mdx -->

---
title: Open Public Review
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Open Public Review. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/public/report-reviews/open","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_api_tokens.mdx -->

---
title: Create Api Token
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Api Token. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/api-tokens","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_assistant_conversations_by_conversation_id_messages.mdx -->

---
title: Create Message
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Message. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations/{conversation_id}/messages","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_assistant_conversations.mdx -->

---
title: Create Conversation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Conversation. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/conversations","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_assistant_runs_by_run_id_cancel.mdx -->

---
title: Cancel Assistant Run
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Cancel Assistant Run. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/runs/{run_id}/cancel","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_assistant_saved_questions.mdx -->

---
title: Save Question
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Save Question. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/assistant/saved-questions","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_schedules_by_schedule_id_pause.mdx -->

---
title: Pause Audit Schedule
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Pause Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/{schedule_id}/pause","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_schedules_by_schedule_id_resume.mdx -->

---
title: Resume Audit Schedule
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resume Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/{schedule_id}/resume","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_schedules_preview.mdx -->

---
title: Preview Audit Schedule
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Preview Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules/preview","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_schedules.mdx -->

---
title: Create Audit Schedule
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Audit Schedule. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-schedules","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_trigger_policies_by_policy_id_pause.mdx -->

---
title: Pause Audit Trigger Policy
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Pause Audit Trigger Policy. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies/{policy_id}/pause","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_trigger_policies_by_policy_id_resume.mdx -->

---
title: Resume Audit Trigger Policy
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resume Audit Trigger Policy. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies/{policy_id}/resume","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_trigger_policies.mdx -->

---
title: Create Audit Trigger Policy
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Audit Trigger Policy. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-trigger-policies","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_audit_triggers_by_trigger_id_decision.mdx -->

---
title: Decide Audit Trigger
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Audit Trigger. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-triggers/{trigger_id}/decision","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_cloud_snapshots.mdx -->

---
title: Submit Cloud Snapshot
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Accept a customer-controlled provider inventory with no ambient cloud
          authority.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/cloud/snapshots","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_pause.mdx -->

---
title: Pause Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Pause Connector Installation. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/pause","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_resume.mdx -->

---
title: Resume Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resume Connector Installation. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/resume","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_retry.mdx -->

---
title: Sync Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Sync Connector Installation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/retry","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_revoke.mdx -->

---
title: Revoke Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Connector Installation. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/revoke","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_rotate.mdx -->

---
title: Rotate Connector Credentials
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Rotate Connector Credentials. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/rotate","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_sync.mdx -->

---
title: Sync Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Sync Connector Installation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/sync","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_by_installation_id_test.mdx -->

---
title: Test Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Test Connector Installation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/{installation_id}/test","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations_preflight.mdx -->

---
title: Connector Preflight
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Connector Preflight. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations/preflight","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_connector_installations.mdx -->

---
title: Create Connector Installation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Connector Installation. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/connector-installations","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_control_room_rebuild.mdx -->

---
title: Rebuild Control Room
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Rebuild Control Room. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/control-room/rebuild","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_deletion.mdx -->

---
title: Request Workspace Deletion
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Request Workspace Deletion. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/deletion","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_discovery_fields.mdx -->

---
title: Declare Discovery Field
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Declare Discovery Field. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/fields","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_discovery_publish.mdx -->

---
title: Publish Discovery Context
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Publish Discovery Context. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/publish","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_discovery_questions_by_question_id_answer.mdx -->

---
title: Answer Question
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Answer Question. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/questions/{question_id}/answer","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_discovery_refresh.mdx -->

---
title: Refresh Discovery Context
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Refresh Discovery Context. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/discovery/refresh","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_evidence_envelopes.mdx -->

---
title: Submit Evidence Envelope
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Submit Evidence Envelope. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-envelopes","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_evidence_producers_by_producer_id_rotate.mdx -->

---
title: Rotate Evidence Producer
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Rotate Evidence Producer. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-producers/{producer_id}/rotate","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_evidence_producers.mdx -->

---
title: Create Evidence Producer
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Evidence Producer. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/evidence-producers","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_finding_views.mdx -->

---
title: Create Finding View
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Finding View. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/finding-views","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_group_dependencies.mdx -->

---
title: Create Group Dependency
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Group Dependency. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/group-dependencies","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_identity_providers.mdx -->

---
title: Create Identity Provider
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Identity Provider. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/providers","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_invitations_by_invitation_id_resend.mdx -->

---
title: Resend Workspace Invitation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Resend Workspace Invitation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/invitations/{invitation_id}/resend","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_invitations.mdx -->

---
title: Create Workspace Invitation
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Workspace Invitation. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/invitations","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_logo.mdx -->

---
title: Upload Workspace Logo
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Upload Workspace Logo. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/logo","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_members.mdx -->

---
title: Add Member
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Add Member. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/members","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_model_endpoints.mdx -->

---
title: Create Model Endpoint
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Model Endpoint. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/model-endpoints","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_notifications_read_all.mdx -->

---
title: Mark All Notifications Read
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Mark All Notifications Read. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/notifications/read-all","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_ownership_previews_by_preview_id_apply.mdx -->

---
title: Apply Ownership
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Apply Ownership. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/ownership/previews/{preview_id}/apply","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_ownership_previews.mdx -->

---
title: Preview Ownership
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Preview Ownership. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/ownership/previews","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_questionnaires_by_questionnaire_id_draft.mdx -->

---
title: Draft Questionnaire
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Draft Questionnaire. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/{questionnaire_id}/draft","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_questionnaires_import.mdx -->

---
title: Import Csv
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Import Csv. Returns a typed response and a request ID for operational
          support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/import","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_questionnaires.mdx -->

---
title: Import Questions
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Import Questions. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_repository_connections_by_connection_id_sync.mdx -->

---
title: Sync Repository Connection
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Sync Repository Connection. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repository-connections/{connection_id}/sync","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_repository_connections.mdx -->

---
title: Create Repository Connection
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Repository Connection. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/repository-connections","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_review_links_by_link_id_revoke.mdx -->

---
title: Revoke Review Link
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Revoke Review Link. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/review-links/{link_id}/revoke","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_services_by_service_id_deployments.mdx -->

---
title: Record Service Deployment
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Record Service Deployment. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/{service_id}/deployments","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_services_discover.mdx -->

---
title: Discover Service Inventory
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Discover Service Inventory. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/discover","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_services.mdx -->

---
title: Create Service
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Service. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_source_groups.mdx -->

---
title: Create Source Group
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Source Group. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/source-groups","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_crown_jewels.mdx -->

---
title: Propose Structural Crown Jewel
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Propose Structural Crown Jewel. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/crown-jewels","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_disproof_samples_by_sample_id_decision.mdx -->

---
title: Decide Structural Disproof Sample
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Decide Structural Disproof Sample. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/disproof-samples/{sample_id}/decision","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_invariant_proposals_by_proposal_id_transition.mdx -->

---
title: Transition Workspace Invariant Proposal
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Transition Workspace Invariant Proposal. Returns a typed response and
          a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/invariant-proposals/{proposal_id}/transition","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_invariant_proposals.mdx -->

---
title: Create Workspace Invariant Proposal
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Workspace Invariant Proposal. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/invariant-proposals","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_remediation_programs_by_program_id_activate.mdx -->

---
title: Activate Structural Remediation Program
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Activate Structural Remediation Program. Returns a typed response and
          a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/remediation-programs/{program_id}/activate","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_remediation_programs_by_program_id_steps_by_step_order_verify.mdx -->

---
title: Verify Structural Remediation Program Step
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Verify Structural Remediation Program Step. Returns a typed response
          and a request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/remediation-programs/{program_id}/steps/{step_order}/verify","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_structural_remediation_programs.mdx -->

---
title: Create Structural Remediation Program
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Structural Remediation Program. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/structural/remediation-programs","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_support_cases.mdx -->

---
title: Create Support Case
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Support Case. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/support/cases","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_workflow_actions_by_action_id_approve.mdx -->

---
title: Approve Workflow Action
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Approve Workflow Action. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-actions/{action_id}/approve","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_workflow_actions_by_action_id_reject.mdx -->

---
title: Reject Workflow Action
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Reject Workflow Action. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-actions/{action_id}/reject","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_workflow_actions.mdx -->

---
title: Request Workflow Action
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Request Workflow Action. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-actions","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces_by_workspace_id_workflow_authorizations.mdx -->

---
title: Create Workflow Authorization
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Workflow Authorization. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/workflow-authorizations","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/post_workspaces.mdx -->

---
title: Create Workspace
full: true
_openapi:
  method: POST
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Create Workspace. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces","method":"post"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_audit_profiles_by_profile_id.mdx -->

---
title: Update Audit Profile
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Audit Profile. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/audit-profiles/{profile_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_feature_flags_by_key.mdx -->

---
title: Update Workspace Feature Flag
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Workspace Feature Flag. Returns a typed response and a request
          ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/feature-flags/{key}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_finding_views_by_view_id.mdx -->

---
title: Update Finding View
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Finding View. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/finding-views/{view_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_identity_policy.mdx -->

---
title: Update Identity Policy
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Identity Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/identity/policy","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_model_endpoints_by_endpoint_id.mdx -->

---
title: Update Model Endpoint
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Model Endpoint. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/model-endpoints/{endpoint_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_notification_preferences.mdx -->

---
title: Update Notification Preferences
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Notification Preferences. Returns a typed response and a
          request ID for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/notification-preferences","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_notifications_by_event_id_read.mdx -->

---
title: Mark Notification Read
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Mark Notification Read. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/notifications/{event_id}/read","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_onboarding_journey.mdx -->

---
title: Advance Onboarding Journey
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Advance Onboarding Journey. Returns a typed response and a request ID
          for operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/onboarding/journey","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_ownership_policy.mdx -->

---
title: Update Policy
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/ownership/policy","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_policy.mdx -->

---
title: Update Policy
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Policy. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/policy","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_questionnaires_by_questionnaire_id_questions_by_question_id.mdx -->

---
title: Update Answer
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Answer. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/questionnaires/{questionnaire_id}/questions/{question_id}","method":"put"}]} showDescription />

---

<!-- Source: api-reference/workspaces/put_workspaces_by_workspace_id_services_by_service_id.mdx -->

---
title: Update Service
full: true
_openapi:
  method: PUT
  webhook: false
  toc: []
  structuredData:
    headings: []
    contents:
      - content: >-
          Update Service. Returns a typed response and a request ID for
          operational support.
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

<APIPage document={"./openapi.json"} operations={[{"path":"/v1/workspaces/{workspace_id}/services/{service_id}","method":"put"}]} showDescription />

---

<!-- Source: architecture/agents-context-and-mcp.mdx -->

---
title: Agents, context, and MCP—explained simply
description: A plain-language guide to how Veriom turns technical evidence into a secure, living source of architectural truth.
---

<DocEyebrow>Product concept · Plain-language guide</DocEyebrow>

<Callout type="info" title="The simple idea">
Veriom is a team of AI specialists that studies evidence from code, cloud, CI/CD, uploads, and approved tools. It builds a living model of what a system really is, explains how it knows, and helps people secure it.
</Callout>

<SketchDiagram variant="trust-boundaries" />

## Think of a software system as a city

- Repositories are the buildings.
- APIs and queues are the roads.
- Databases are the warehouses.
- Cloud permissions are the keys.
- CI/CD pipelines are the construction crews.
- Security weaknesses are broken locks or unsafe roads.

A normal scanner finds individual problems. Veriom should understand the **whole city**: what exists, how it connects, where trust changes, what is exposed, and what would be affected by a compromise.

> The map is the interface. The trustworthy model underneath it is the product.

## Four parts working together

| Part | Simple meaning | Job |
| --- | --- | --- |
| Collectors | The eyes and ears | Gather facts from code, cloud, CI/CD, uploads, scanners, and MCP clients. |
| Context engine | The organized notebook | Give each specialist the smallest complete set of facts needed for its task. |
| Agents | The specialist team | Review evidence, security, architecture, threats, diagrams, and remediation. |
| Architectural truth | The verified case file | Store entities, relationships, proof, confidence, contradictions, and history. |

```mermaid
flowchart LR
  CODE["Code and IaC"]
  CLOUD["Cloud resources"]
  CICD["CI/CD pipelines"]
  RUNTIME["Runtime evidence"]
  TOOLS["Approved tools"]
  MCP["MCP evidence gateway"]

  CODE --> NORMALIZE["Evidence normalization"]
  CLOUD --> NORMALIZE
  CICD --> NORMALIZE
  RUNTIME --> MCP
  TOOLS --> MCP
  MCP --> NORMALIZE

  NORMALIZE --> TRUTH["Architectural truth"]
  TRUTH --> CONTEXT["Context engine"]
  CONTEXT --> AGENTS["Specialist agents"]
  AGENTS --> REVIEW["Human review"]
  REVIEW --> OUTPUTS["Map, risks, report, remediation"]
  OUTPUTS --> TRUTH
```

## Architectural truth is more than a diagram

A diagram is only a view. The source of truth is a versioned model stored independently from the LLM and the visualization.

The model uses a few canonical building blocks:

- **Entity:** a service, repository, API, database, queue, cloud resource, pipeline, identity, team, or trust boundary.
- **Relationship:** calls, reads, writes, deploys, owns, contains, exposes, authenticates, or depends on.
- **Evidence:** the exact reason Veriom believes an entity or relationship exists.
- **Observation:** a fact seen at a particular commit, source version, and time.
- **Confidence:** how strongly the available evidence supports a claim.
- **Contradiction:** two evidence sources disagree.
- **Supersession:** a newer observation replaces an older one without deleting history.

For example, Veriom should not merely draw **Checkout API → Orders Database**. It should also know that source code contains the database client, cloud policy permits the connection, and the deployment configuration supplies the endpoint.

```mermaid
flowchart LR
  CHECKOUT["Checkout API"]
  ORDERS["Orders Database"]
  CHECKOUT -->|"writes to · confidence high"| ORDERS

  CODE["Source evidence"]
  CLOUD["Cloud evidence"]
  PIPELINE["Deployment evidence"]
  CODE -.-> CHECKOUT
  CLOUD -.-> ORDERS
  PIPELINE -.-> CHECKOUT
```

<Callout type="info" title="The trust rule">
An agent may explain a claim, but it cannot turn an unsupported guess into architectural truth. Important claims must resolve to evidence from the same workspace and audit.
</Callout>

## The context engine

Sending an entire repository and every historical observation to every model would be slow, expensive, and confusing. The context engine builds a bounded **Context Pack** for one specialist task.

A Context Pack contains:

- the audit goal and allowed scope;
- relevant entities, relationships, and evidence IDs;
- active findings, contradictions, and coverage gaps;
- architecture facts and trust boundaries;
- applicable workspace policies and accepted risks;
- repository, commit, scanner, model, and agent versions;
- token and cost limits.

```mermaid
flowchart TD
  REQUEST["Agent requests context"]
  SCOPE["Apply tenant and repository scope"]
  RETRIEVE["Retrieve facts and evidence"]
  RANK["Rank by relevance, confidence, and freshness"]
  PACK["Build bounded Context Pack"]
  HASH["Calculate context hash"]
  CACHE{"Safe cached artifact?"}
  MODEL["Run the specialist"]
  RETURN["Return a typed result"]

  REQUEST --> SCOPE --> RETRIEVE --> RANK --> PACK --> HASH --> CACHE
  CACHE -->|"Yes"| RETURN
  CACHE -->|"No"| MODEL --> RETURN
```

Context and caches are always tenant-scoped. Repository text is treated as untrusted data, secrets are masked, and a changed source, context, agent version, model, or schema creates a new result instead of silently reusing an old conclusion.

## The multi-agent team

One giant agent is difficult to test and easy to confuse. Veriom gives each role a narrow responsibility and makes them exchange typed artifacts rather than hidden reasoning.

<AgentSwimlane />

The core roles are:

1. **Audit Coordinator** plans stages, retries, budgets, and partial results.
2. **Context Curator** prepares evidence-complete Context Packs.
3. **Evidence Verifier** rejects claims that cannot resolve their evidence.
4. **Security Engineer** analyzes vulnerabilities and practical exploit paths.
5. **Security Architect** reasons about boundaries, exposure, coupling, and blast radius.
6. **Cloud/IaC Analyst** understands infrastructure and access relationships.
7. **CI/CD Analyst** maps build, identity, artifact, and deployment paths.
8. **Threat Modeler** joins facts into abuse cases and attack paths.
9. **Diagram Architect** produces safe views of verified entities and edges.
10. **Remediation Engineer** proposes narrow, reviewable changes.
11. **Report Adjudicator** resolves conflicts and produces the final structured report.
12. **Finding Architecture Impact Adjudicator** decides whether scanner observations affect evidenced architecture.
13. **Compliance Control Analyst** maps proof to control questions without claiming certification.
14. **Architecture Diagnostic Analyst** separates system risk from weaknesses in evidence coverage.
15. **Architecture History Analyst** explains comparable structural changes without treating collection loss as deletion.

Every agent artifact records its agent version, context hash, model, evidence IDs, confidence, uncertainty, token usage, latency, cost, and decision summary. If proof is insufficient, the output becomes a hypothesis or coverage gap—not a confirmed finding.

### Scanner observations are not final findings

The architecture-impact gate requires the final adjudicator to cite the scanner observation and independent structural evidence. A result can be automatically excluded only when positive evidence proves a concrete boundary such as not deployed, not reachable, non-executable, test/example-only, or superseded; confidence is at least 90%; and no relevant coverage gap remains. Otherwise it stays visible as **Needs review**. The original scanner observation is always retained.

## MCP is the secure reception desk

MCP gives approved external systems a standard way to submit architectural evidence.

> Other tools can drop off labelled evidence. They do not receive the keys to the building.

Useful evidence can come from cloud inventory jobs, CI/CD systems, OpenTelemetry processors, service catalogues, internal developer tools, or customer-built collectors.

Veriom keeps the MCP surface intentionally small:

- **submit evidence batch**
- **create artifact upload**
- **complete artifact upload**
- **get ingestion status**
- **start audit**

```mermaid
sequenceDiagram
  participant Client as Approved MCP client
  participant Auth as Workspace API key
  participant MCP as Veriom MCP gateway
  participant Store as Quarantine storage
  participant Normalize as Evidence normalizer
  participant Truth as Architectural truth

  Client->>Auth: Bearer API key
  Auth-->>Client: Workspace and scope binding
  Client->>MCP: Submit evidence or request upload
  MCP->>Store: Quarantine raw artifact
  Store->>Normalize: Malware and archive checks
  Normalize->>Normalize: Validate schema and provenance
  Normalize->>Truth: Store observations and evidence
  Truth-->>MCP: Ingestion status
  MCP-->>Client: Accepted with tracking ID
  Client->>MCP: Start audit with idempotency key
```

MCP submissions are tenant-bound, size-limited, rate-limited, idempotent, and replay-protected. Raw artifacts are scanned and validated before normalization. Submitted content is never executed or passed directly to an agent.

## How one audit moves through the system

```mermaid
sequenceDiagram
  participant User
  participant API
  participant Queue
  participant Runner
  participant Context as Context engine
  participant Agents
  participant Truth as Architectural truth
  participant UI

  User->>API: Start audit
  API->>Queue: Create idempotent queued job
  API-->>User: 202 Accepted
  Queue->>Runner: Run offline deterministic scanners
  Runner-->>Queue: Evidence and coverage gaps
  Queue->>Truth: Reconcile facts, entities, and edges
  Queue->>Context: Build specialist Context Packs
  Context->>Agents: Route bounded tasks
  Agents-->>Truth: Evidence-backed artifacts
  Truth->>UI: Stream progress, cost, logs, and graph changes
  UI-->>User: Architecture, findings, report, and remediation
```

The user can watch queue position, scanner coverage, active agents, cache hits, retries, cost, and graph changes. If one scanner or model fails, the audit remains useful but clearly reports a coverage gap. It never turns missing evidence into a clean verdict.

## Why architecture changes security priorities

A scanner might say:

> A vulnerable dependency exists.

Veriom should explain:

> The vulnerable library is used by the public Checkout API. That service can reach the Orders Database across an internet trust boundary. Code and cloud evidence support the path, so compromise could expose order records.

That is structural security reasoning. It helps reveal:

- public services with unexpected database access;
- dangerous trust-boundary crossings;
- shared identities that increase blast radius;
- CI/CD paths with excessive deployment power;
- hidden dependencies missing from documentation;
- weak isolation between sensitive services;
- architecture drift between expected and observed reality;
- findings that become urgent because of reachability and consequence.

## A living source-of-truth loop

```mermaid
stateDiagram-v2
  [*] --> Observe
  Observe --> Normalize
  Normalize --> Reconcile
  Reconcile --> Verify
  Verify --> Publish
  Publish --> Monitor
  Monitor --> Observe: New commit or evidence
  Verify --> Investigate: Contradiction
  Investigate --> Reconcile
```

Raw evidence is not the source of truth. An LLM response is not the source of truth. A Mermaid diagram is not the source of truth. The **canonical, versioned, evidence-backed model** is the source of truth.

## What Veriom should own

Open-source scanners and collectors can remain sensors. Veriom's differentiating layers are:

- the architecture ontology;
- cross-source reconciliation;
- evidence-backed architectural truth;
- confidence and contradiction handling;
- temporal architecture history;
- structural security reasoning;
- context selection and compression;
- organization-specific intent;
- future change-consequence analysis.

## The product promise

<Callout type="info" title="Connect your system">
Veriom shows what exists, how it connects, how it knows, where the structure is weak, and what to fix first.
</Callout>

A trustworthy result lets a customer say:

- “Yes, these are our real services.”
- “Yes, those connections are correct.”
- “I can inspect the proof behind every important edge.”
- “I understand what is missing or uncertain.”
- “I can see how the system changed.”
- “The risks are prioritized using architecture, not severity alone.”

Continue with [architectural truth](/docs/architecture/architectural-truth), the [context engine](/docs/architecture/context-engine), the [multi-agent workflow](/docs/workflows/agent-system), or the [MCP evidence gateway](/docs/integrations/uploads-mcp).

---

<!-- Source: architecture/architectural-truth.mdx -->

---
title: Architectural truth
description: How Veriom represents what exists, why each relationship exists, confidence, contradictions, and historical change.
---

<DocEyebrow>Canonical model</DocEyebrow>

Architectural truth is Veriom’s evidence-backed belief about a system at a point in time. It is deliberately separate from diagrams, scanner output, model transcripts, and third-party graph schemas.

Observable context describes what exists and the constraints acting on it. Human intent explains a decision, its rationale and an accepted trade-off. A declared or approved target never changes observed truth. Explore that distinction in the [architecture sample](https://veriom.io/demo?demo=architecture) and the [intended-architecture preview](/docs/architecture/intended-architecture).

<SketchDiagram variant="architectural-truth" />

## Core records

### Entity

A stable architectural thing: service, API, datastore, queue, identity, cloud resource, deployment unit, pipeline, system, or trust boundary. Entities preserve source-specific identifiers as aliases rather than making any collector’s identifier canonical.

### Relationship

A typed edge such as `CALLS`, `READS_FROM`, `DEPLOYS`, `OWNS`, `CONTAINS`, or `CAN_REACH`. Every relationship stores direction, validity window, confidence, contradictions, supersession state, and supporting evidence IDs.

### Evidence

An immutable observation that explains why an entity or relationship is believed: file and line, dependency manifest, IaC resource, CI job, cloud asset, API definition, or runtime observation. Evidence records its source type, collection method, source hash, timestamp, and bounded preview.

<EvidenceEdge />

## Confidence is explainable

Confidence is not a model’s feeling. It is derived from source reliability, agreement across independent evidence, freshness, extraction certainty, and unresolved contradictions. The score and every contributing evidence ID remain visible.

Example interpretation:

| Confidence | Meaning                                                      | UI behavior                       |
| ---------- | ------------------------------------------------------------ | --------------------------------- |
| 0.90–1.00  | independently corroborated or directly declared and observed | solid edge                        |
| 0.70–0.89  | strong single source or partially corroborated               | solid edge with source badge      |
| 0.40–0.69  | inferred, stale, or contradicted                             | dashed edge and review state      |
| below 0.40 | hypothesis, not canonical truth                              | hidden by default; analyst review |

## Reconciliation rules

- Normalize source-specific facts before comparison.
- Prefer exact identifiers, then deterministic aliases, then bounded heuristics.
- Preserve both observations when sources disagree.
- Never erase the former relationship; mark its validity window and superseding record.
- Never promote an LLM-only observation to a vulnerability or high-confidence edge.
- Render only from the canonical model, not directly from agent prose.

## Temporal behavior

Each audit creates a new observation horizon. Unobserved does not immediately mean deleted: source coverage and freshness determine whether an entity is absent, unknown, or superseded. This lets Veriom answer both “what exists now?” and “what changed?” without rewriting history.

---

<!-- Source: architecture/context-engine.mdx -->

---
title: Context engine
description: How Veriom gives each specialist the smallest evidence-complete view needed for a reliable review.
---

The context engine turns architectural truth into a focused review packet. Instead of sending an entire system to every model, Veriom selects the entities, relationships, evidence, findings, policies, and known uncertainty relevant to one specialist decision.

Team answers can explain why an architecture was chosen, but they enter the [intended-architecture workflow](/docs/architecture/intended-architecture) as attributable proposals. A context pack, imported document or model conclusion cannot ratify that decision or prove that its guardrail holds.

<SketchDiagram variant="context-engine" />

## What a context pack contains

- the part of the system currently under review;
- canonical entities and relationships;
- evidence and provenance for material claims;
- active findings and coverage gaps;
- applicable workspace policies;
- contradictions that still need adjudication.

## Why bounded context matters

Focused context improves speed, reduces cost, and makes results easier to verify. Every generated artifact can point back to the exact evidence pack, agent version, model tier, and output schema that produced it.

## Reuse without stale conclusions

Veriom can reuse deterministic facts and validated artifacts when the source, context, agent definition, model, and schema are unchanged. Changes to any of those inputs create a new review context rather than silently reusing an old conclusion.

<Callout type="info" title="Evidence remains the source of truth">
  Context packs help agents reason, but they do not replace the canonical
  architectural model. Unsupported observations remain hypotheses until a person
  or independent evidence confirms them.
</Callout>

---

<!-- Source: architecture/index.mdx -->

---
title: How Veriom works
description: From raw technical signals to evidence-backed architecture, structural intelligence, and review-ready decisions.
---

Veriom brings scattered technical signals into one explainable model. The goal is not simply to draw a better diagram. It is to maintain a trustworthy answer to four questions:

1. What actually exists?
2. How is it connected?
3. What evidence supports that belief?
4. Where does the structure create risk?

<SketchDiagram variant="evidence-loop" />

## Evidence first

Veriom observes code, cloud and infrastructure definitions, delivery configuration, uploaded artifacts, and structured evidence submitted through integrations. Each observation receives a stable identity, source, timestamp, and confidence.

## One canonical model

Signals rarely agree perfectly. Veriom reconciles aliases, keeps contradictions visible, and records when one observation supersedes another. The result is a model of entities and relationships that can be inspected independently from any diagram or agent response.

## Structural intelligence

Once relationships are explicit, Veriom can connect security findings to reachable paths, identities, data stores, trust boundaries, and affected capabilities. This helps teams prioritize the weakness with the largest consequence rather than the loudest isolated alert.

## Review and action

Specialist agents receive bounded context from the same model. Their artifacts remain evidence-linked and schema validated. The final result can be approved, exported, or used to propose a human-controlled remediation.

<Callout type="info" title="The map is an interface">
Every visible relationship should remain selectable and explainable. A diagram without supporting evidence is a view, not architectural truth.
</Callout>

---

<!-- Source: architecture/intended-architecture.mdx -->

---
title: Intended architecture
description: Reviewable target architecture, observed drift, planned changes, release checks and source provenance.
---

Intended architecture records what a team chose, why it belongs, who owns that decision and what evidence would invalidate it. It is separate from [observed architectural truth](/docs/architecture/architectural-truth).

<Callout type="info" title="Workspace preview">
This workflow is available only where the architecture-intent workspace feature is enabled. A draft, imported pattern or simulation does not establish observed alignment or release approval.
</Callout>

The [interactive sample](https://veriom.io/demo?demo=intent) shows four optional questions and editable proposed annotations. Its [history scene](https://veriom.io/demo?demo=history) compares two dated cloud permission captures with a named fictional decision. That scene uses retained comparator results; it does not collect live data or approve a real workspace. The [capability ledger](https://veriom.io/demo?demo=availability) distinguishes the October workflow preview, December guardrail preview and later rollout-dependent capabilities.

## Start with the architecture

Open **Architecture → Architecture & intent** and select a repository, branch and environment. **Current** shows observed components and connections with source provenance. **Intended** shows the selected target. **Diff** links discrepancies and uncertainty to the exact observation and saved target version. Source dates and incomplete coverage stay visible.

Use **Adopt current as draft** to classify observed elements and explain the team's choices. Adoption does not approve the existing state. Alternatively, **Sources** can create a target from a design or pattern before any observation exists.

## Explain, edit and ratify

Drafts support components and boundaries, relationships, descriptions, ordered flows, decisions, owners, review/expiry dates, trade-offs, typed guardrails, conditions and invariants. Every saved revision retains its contributor and provenance. Concurrent edits return a conflict; download local edits or explicitly load the latest revision before continuing.

An Analyst, Admin or Owner can draft. Ratification requires an Admin or Owner with recent interactive identity verification, a rationale and the exact saved revision/content fingerprint. Ratified versions are immutable; subsequent changes begin a new draft. Viewers can read architecture and its retained source captures.

## Read drift with its evidence

The comparison distinguishes unintended presence, missing controls, stale or invalidated intent, violated invariants, gaps in explanations and overdue plans. Missing, stale, ambiguous or incomplete evidence remains **insufficient evidence**. A declared process sequence does not prove runtime order. Matching identity strings cannot override conflicting component types or connection endpoints.

Control Room and canonical reports link to the same frozen assessment, including its snapshot, target, evidence and plan revisions. Later edits do not rewrite that historical result. Configured notification subscriptions use the existing delivery queue; creating a comparison alone does not configure a destination.

## Plan a change and evaluate release checks

**Planned** links an owner and due date to a ratified target and frozen baseline. Progress counts satisfied, unmet and unknown assertions. Completion requires a newer observation that proves the assertions; changing a task status does not supply that proof.

**Release checks** pins selected ratified rules and begins in shadow. Named reviews of distinct releases build the server-verified precision sample before promotion. Unknown evidence remains explicit. Reviewed exceptions apply only to one release and expire within 24 hours. Changing the target, canceling a plan or accepting a trade-off does not silently disable an existing gate.

## Propose from a source

**Sources → Propose from a source** accepts CALM 1.2, Veriom intent JSON, or text with an explicit decision. Text can be an authorized ADR, design document, ticket or Slack excerpt. Only the structured proposal becomes intent; instructions inside source text are never executed or treated as approval.

1. Select an owner and exact repository/branch/environment.
2. Upload or paste authorized content with its identifier, revision, reported author and timestamp, or select a document path in the connected GitHub repository. A pull request can be selected by number.
3. Bind source identities to existing components/connections or keep declared future targets.
4. Preview the proposed changes and inspect the target and rules. Merge retains the current target's confidence, freshness and closed-scope settings. Replace proposes the entire imported target in a new draft.
5. Confirm the review and create the draft. Edit it as needed before requesting ratification.

Uploads explicitly acknowledge sharing with workspace members who can read architecture, including Viewers. Links supplied with pasted content are identifiers and are never fetched; submitted author/time metadata is labeled accordingly. GitHub capture uses the existing read-only installation and records the exact branch/PR commit and path. A moved head or revoked repository access blocks approval until it is reviewed again.

Captures retain original/retained content fingerprints, contributor, source revision, source/capture times and supersession history. Retries deduplicate. Reusing a revision for different bytes, importing a known superseded revision or saving a stale preview returns a conflict. Source revocation blocks new imports and approval of its unratified proposals while retaining history.

## CALM boundaries

The supported schema is [FINOS CALM 1.2](https://calm.finos.org/release/1.2/meta/calm.json), pinned and validated offline. Nodes, binary connections, ordered flows and Veriom typed controls round-trip through **Export saved CALM**. Veriom's profile preserves stable identities, scope, provenance, classification and evidence requirements. Export does not transfer workspace approval.

Interfaces, deployment/grouping relationships, arbitrary metadata, external controls/ADRs and parallel flow sequence numbers are rejected. Unsupported fields are reported before import. Inputs are limited to 1 MB; remote schema references, duplicate JSON keys and binary content are rejected. Secret-like text is redacted; credentials inside structured architecture must be removed before import.

Synchronization is explicit import and export. It does not push a commit or merge a pull request. A rollback is a reviewed amendment of current intent.

## Candidate patterns

The initial patterns describe authenticated ingress and a private encrypted datastore. Each version includes assumptions, applicable scope, rationale, controls, evidence requirements and limitations. Apply one to existing identities or explicit future components, then adapt its editable draft.

Patterns are candidates for review by the workspace architecture owner. Applying one does not claim compliance or partner approval. Later catalog editions do not rewrite captured customer history.

## MCP proposals

With the feature enabled, `preview_intent_proposal` and `submit_intent_proposal` use this same workflow. Grant `decisions:write` explicitly to a workspace credential held by an Analyst or above; the standard MCP evidence preset is unchanged. There is no MCP ratification tool. See [Uploads and MCP evidence](/docs/integrations/uploads-mcp).

---

<!-- Source: architecture/structural-weaknesses.mdx -->

---
title: Structural weakness engine
description: How Veriom detects design conditions with deterministic invariants, bounded paths, propagated confidence, and independently reviewable evidence.
---

<DocEyebrow>Architecture reasoning you can reproduce</DocEyebrow>

A structural weakness is a condition where the system can behave exactly as implemented and still permit an unsafe outcome. Veriom detects these conditions over its canonical model; scanner observations can support a conclusion, but they do not decide it.

<Callout type="info" title="Detection stays deterministic">
  Language models may explain a finding or propose a target state. They do not
  decide whether an invariant passed or failed. The invariant ID, version, input
  evidence, and evaluation result remain reproducible across audits.
</Callout>

## What every structural finding contains

| Part            | What it answers                                                                                                  |
| --------------- | ---------------------------------------------------------------------------------------------------------------- |
| Label and layer | Which design pattern is involved, and whether it belongs to code, cloud, CI/CD, IaC, runtime, or crosses layers? |
| Detection       | Which versioned invariant evaluated, in which audit, and was the result reproducible?                            |
| Structure       | Which entities, relationships, and trust boundaries form the asserted path?                                      |
| Evidence        | Which independent ledgers corroborate the claim, and which expected ledgers are missing?                         |
| Confidence      | What is the propagated path confidence, its floor, and whether the result is asserted or remains a hypothesis?   |
| Criticality     | Which crown jewels are reachable and how that changes the response priority?                                     |
| Root cause      | Which stable provenance key groups recurring manifestations of the same design decision?                         |
| Remediation     | Which target state should replace the current structure, and what predicate proves the change worked?            |
| Taxonomy        | Which immutable taxonomy snapshot supplied the displayed CWE, CAPEC, OWASP, and ATT&CK references?               |

## Initial invariant pack

The first pack covers nine high-value conditions:

1. an untrusted workload holds production administration;
2. one workload identity crosses trust zones;
3. caller identity terminates before a privileged operation;
4. tenant-scoped access lacks data-layer tenant binding;
5. network location substitutes for workload identity;
6. a mutable privileged pipeline accepts an untrusted trigger;
7. a runner keeps a long-lived cloud credential;
8. a production artifact cannot be traced to an approved immutable build; and
9. defence-in-depth controls share one failure dependency.

Each definition states its required ledgers, preferred corroboration, confidence floor, severity basis, remediation tier, verification predicate, and positive plus benign fixtures. A typed YAML predicate DSL is validated and compiled into a bounded process cache. The evaluator interprets that predicate rather than branching on the invariant ID, which keeps renamed and future versioned rules reproducible.

## Paths are bounded and evidence-aware

Veriom evaluates reachable paths with a bounded, deterministic search. A hop is eligible only when its declared preconditions are met and its evidence clears the configured confidence floor. Path confidence uses a grouped product rather than copying the strongest edge score, so a multi-hop claim cannot masquerade as a single high-confidence observation.

Some invariants describe a direct condition, such as a tenant-scoped write without tenant binding. Those findings use the confidence of the cited direct evidence and do not invent a path. The finding contract labels the structure as `direct` or `path`, so reviewers can distinguish the two.

If a required ledger is absent, the engine returns **insufficient evidence**, not pass. The UI shows the missing ledgers and a coverage note so an operator knows whether to collect more evidence or reject the hypothesis.

## Root causes survive across audits

Findings are grouped by normalized provenance such as an IaC module and version, image digest, workload identity, reusable pipeline, shared code pattern, or origin change. A root cause receives a stable identity and tracks the audits and member findings in which it was observed. That makes claims such as “fixing the shared module closed 25 findings” verifiable by re-observation.

Each causal group also projects every entity and relationship in the latest truth snapshot that carries the same immutable provenance key. The recurrence view shows confidence, sources, evidence references, and whether each manifestation has an active finding. It includes matches with no current finding so teams can size a systemic change before the same invariant fails elsewhere.

When an enforced invariant no longer matches on a later evidence-complete audit, Veriom records that absence as verification evidence. It closes the finding with `closed_by: reobservation` only after the exact remediation pull request is confirmed merged, the environment is observed by a newer completed audit, the verification predicate is false, and the regression check passes. If the same stable condition returns, the lifecycle becomes regressed without creating a second identity.

## Remediation is explicit about what can be automated

- **R1 deterministic** changes one evidence-backed artifact and can proceed through the managed patch, offline scanner, human approval, and draft pull-request flow.
- **R2 scaffolded** generates the mechanical policy, middleware, migration, or network-policy portion, but publication is blocked until a human records the missing scope decision. That decision is preserved in the audit trail and pull request.
- **R3 sequenced** cannot be represented honestly as one patch. The single-remediation API rejects it so a multi-step, evidence-gated program can own the target state. A program requires at least two workspace repositories and two accountable scopes. Each ordered step names an invariant version and predicate; a later step stays locked until a newer completed audit records that exact invariant as passing. Failed or missing evaluations block the program without erasing its proof history.

Every R1 and R2 structural pull request contains the invariant statement and version, graph verification predicate, evidence IDs, root-cause reference, and a machine-readable contract under `.veriom/structural-tests/`. The contract records the failing baseline and required passing post-patch state for customer-owned CI. Veriom reruns offline static scanners but does not claim to have executed customer builds, tests, scripts, or repository code. Post-deployment closure additionally requires the exact invariant version to pass against a newer truth snapshot; an absent evaluation remains partial rather than being treated as success.

## Crown jewels require review

Workspace developers can propose a critical asset only by referencing an entity already present in architectural truth. An analyst, administrator, or owner confirms or rejects the proposal with a reason. The versioned, audited register then influences blast-radius and priority calculations; a scanner cannot silently designate a crown jewel.

## Taxonomy does not alter detection

External framework references decorate a result at render time. Reports pin an immutable taxonomy snapshot, while the current UI may also show newer mappings. Updating a CWE or OWASP label never changes the invariant result, finding identity, root-cause identity, or lifecycle state.

The control worker checks code-owned sources on a bounded schedule: CISA KEV and FIRST EPSS daily; CWE, CAPEC, ATT&CK, and OWASP Top 10 weekly; and OWASP CI/CD Top 10 monthly. Downloads are restricted to fixed HTTPS hosts and size limits. CWE XML, CAPEC/ATT&CK STIX, KEV JSON, and EPSS gzip records normalize automatically. OWASP Markdown changes enter `review_required` and cannot be published into a snapshot until an operator records human review. Interrupted or failed syncs retry hourly and surface as an operator alert and release-readiness block.

Taxonomy sources are normalized in scheduled or operator-controlled ingest jobs. Each version records added, updated, retired, and superseded nodes. Narrative OWASP sources require an explicit human-review acknowledgement before publication, and publication hashes the complete normalized snapshot.

Manual VRM-to-framework mappings are reviewed in the operator console and become active only when the next immutable snapshot is published. CAPEC, ATT&CK, and OWASP references can then derive through native CWE links at reduced confidence. Deprecated CWE references retain the original ID and resolve their successor as a separate inherited reference, so historical evidence never breaks.

After each architecture observation, Veriom recomputes a workspace applicability profile from evidenced entity kinds and technology claims. Out-of-profile references remain stored and reviewable behind a disclosure; they are never deleted, and an incomplete profile does not hide a reference. Approved reports pin the exact taxonomy snapshot in both the report record and canonical payload. Approval is blocked until that pin exists, and a historical report labels its original snapshot separately from the current release.

## Drift from declared intent

Implemented and previously verified architecture decisions are re-evaluated whenever a newer, sufficiently covered truth snapshot is produced. A failed machine-readable success criterion becomes a stable drift finding that keeps the declared representation, the observed result, the evidence references, and the ledgers that disagree. Inconclusive absence checks remain explicit as insufficient evidence. A later observation resolves the drift only when the same criterion passes.

The [versioned intended-architecture preview](/docs/architecture/intended-architecture) extends this with a named, approved target that can be compared before implementation. It retains its own version history and explicit unknown evidence. Its October and December release phases remain subject to controlled rollout; the [dated demo history](https://veriom.io/demo?demo=history) is a fictional worked example.

## Workspace invariant learning

An agent or analyst may propose an organization-specific invariant only through the same finite, interpreted predicate language as the code-owned pack. The candidate must include inline true-positive and benign fixture graphs. Veriom evaluates every fixture twice, rejects non-deterministic output, rejects a positive fixture that does not fail, and rejects a benign fixture that does not pass.

A workspace administrator can move a reviewed candidate into shadow mode. Enforcement is a separate transition requiring at least 50 reviewed samples and observed precision at or above the candidate budget. If later reviewed precision drops below that budget, evaluation automatically returns the candidate to shadow. Definitions stay workspace-scoped and cannot reuse a code-owned invariant ID and version.

## Continuous self-falsification

Each current truth snapshot contributes to a deterministic, bounded weekly sample of asserted architecture relationships. Reviewers inspect the cited evidence and record the edge as confirmed, disproved, or inconclusive. Disproved edges are accuracy failures—not customer weaknesses—and remain visible in the operator metric. This makes “how often our own claims survive an attempted disproof” measurable without executing customer code or sending source material to an unrestricted model.

## Review one finding

1. Confirm the invariant ID, version, and evaluation state.
2. Follow the entity path and inspect evidence on each hop.
3. Check crossed boundaries, reachable crown jewels, and control independence.
4. Compare present and missing evidence ledgers.
5. Confirm the root-cause provenance and affected manifestations.
6. Review the target state and verification predicate before approving work.

<Cards>
  <Card
    title="Architectural truth"
    href="/docs/architecture/architectural-truth"
    description="Learn how evidence-backed entities and relationships enter the canonical model."
  />
  <Card
    title="Structural release gates"
    href="/docs/workflows/structural-release-gates"
    description="See how shadow evaluation, fixtures, and promotion protect release decisions."
  />
  <Card
    title="Audit lifecycle"
    href="/docs/workflows/audit-lifecycle"
    description="Follow the evidence and review stages around invariant evaluation."
  />
</Cards>

---

<!-- Source: index.mdx -->

---
title: Introduction
description: Product concepts, review workflows, integrations, and the complete versioned API.
---

<DocEyebrow>Evidence-backed architecture intelligence</DocEyebrow>

Veriom gives security and architecture teams a continuously explainable model of their software landscape. Every important entity and relationship carries evidence, provenance, confidence, and history—so teams can review what exists without trusting a stale picture.

<SketchDiagram variant="platform-overview" />

## What Veriom helps you do

- create a shared architectural view across security, engineering, and leadership;
- understand reachable paths, trust boundaries, ownership, and structural risk;
- turn many technical signals into one review-ready narrative;
- preserve the evidence behind every material conclusion;
- move from review to approved reporting and remediation.

## How a review works

<AuditLifecycle />

## Explore the platform

<Cards>
  <Card title="Explore the platform" href="/docs/workflows/platform-walkthrough" description="Try the interactive demo and follow the full workflow from branch selection to reporting and team oversight." />
  <Card title="Getting started" href="/docs/quickstart" description="Connect a source, run a review, inspect the model, and share the result." />
  <Card title="Architectural truth" href="/docs/architecture/architectural-truth" description="Understand entities, relationships, evidence, confidence, and change." />
  <Card title="Structural weaknesses" href="/docs/architecture/structural-weaknesses" description="Inspect deterministic invariants, reachable paths, root causes, and evidence gaps." />
  <Card title="Collaborative reviews" href="/docs/workflows/agent-system" description="See how specialist agents produce bounded, evidence-linked artifacts." />
  <Card title="Workspace Intelligence" href="/docs/workflows/workspace-intelligence" description="Ask grounded questions, inspect context, and turn recommendations into controlled action." />
  <Card title="API v1" href="/docs/api" description="Authenticate, create work, follow progress, and consume structured results." />
</Cards>

## Use the documentation with AI tools

Every guide exposes its raw Markdown and a compact **Open** menu for GitHub,
ChatGPT, Claude, agent context, implementation plans, reusable skills, and MCP
resources. Use the machine-readable indexes when an integration needs more than
one page.

<Cards>
  <Card title="llms.txt" href="/llms.txt" description="Give an answer engine the concise index of Veriom concepts, workflows, integrations, and API references." />
  <Card title="llms-full.txt" href="/llms-full.txt" description="Retrieve all public product and API documentation as one full-context text resource." />
  <Card title="MCP evidence gateway" href="/docs/integrations/uploads-mcp" description="Connect an approved client through Veriom's tenant-bound evidence and audit tools." />
  <Card title="Agent-ready guides" href="/docs/architecture/agents-context-and-mcp" description="Understand how Veriom packages bounded context without turning suggestions into canonical truth." />
</Cards>

<Callout type="info" title="Public documentation">
These guides describe Veriom’s product behavior and public API. Operational secrets, private prompts, deployment internals, and customer data are never included.
</Callout>

---

<!-- Source: integrations/cloud-evidence.mdx -->

---
title: Managed cloud collectors
description: Schedule bounded AWS, Azure, and Google Cloud inventory with visible account boundaries, collection coverage, and freshness.
---

Veriom's cloud collector reads inventory through an already-authenticated provider CLI, converts it to the typed `veriom-cloud-evidence-v1` contract, and submits it to exactly one workspace. The collector invokes read-only inventory commands. It does not accept provider credentials as arguments and it cannot change cloud resources.

The [public cloud scene](https://veriom.io/demo?demo=cloud) uses dated fictional inventory. Attaching that sample does not connect an account or run a collector. Production runtime evidence stays unknown; a real connection must use the authenticated setup below and be verified in its own workspace.

<SketchDiagram variant="cloud-collectors" />

## Connect from your workspace

Open **Cloud connections**, or choose AWS, Azure, or Google Cloud from the integration catalog. Select your provider and use **Copy instructions for cloud admin** to share the read-only collection steps with the person who manages your cloud account. Import the resulting JSON snapshot, then open **Architecture** to explore the resources alongside your repository evidence.

The page shows the account boundary, collection time, freshness, and any missing coverage. Cloud credentials stay in your environment. MCP is optional for advanced automation; this setup uses the cloud snapshot API directly. To keep evidence current automatically, schedule the collector as described below.

## Install the collector

From a checked-out Veriom release, install the versioned collector with `uv`:

```bash
./scripts/install-cloud-collector.sh
veriom-cloud-collector --help
```

Create a workspace API token with `evidence:write`, keep it in the scheduler's secret store, and authenticate the provider CLI with a dedicated read-only workload identity.

<Tabs items={["AWS", "Azure", "Google Cloud"]}>
<Tab value="AWS">
```bash
export VERIOM_API_TOKEN=vat_...
aws sts get-caller-identity

veriom-cloud-collector sync \
 --provider aws \
 --region eu-west-1 \
 --workspace-id 7f38cf23-0416-4968-9d30-9c343d45ae76

````

The first release inventories the authenticated account boundary, tagged resources, and VPCs. Grant `sts:GetCallerIdentity`, `tag:GetResources`, and `ec2:DescribeVpcs`. A denied optional scope produces a `partial` snapshot with a visible warning instead of silently claiming full coverage.
</Tab>
<Tab value="Azure">
```bash
export VERIOM_API_TOKEN=vat_...
az account show

veriom-cloud-collector sync \
  --provider azure \
  --workspace-id 7f38cf23-0416-4968-9d30-9c343d45ae76
````

Assign the collector identity the Azure **Reader** role on the intended subscription. The subscription returned by `az account show` becomes the account boundary; a command-line value cannot override it.

</Tab>
<Tab value="Google Cloud">
```bash
export VERIOM_API_TOKEN=vat_...
gcloud auth list

veriom-cloud-collector sync \
 --provider gcp \
 --project payments-production \
 --workspace-id 7f38cf23-0416-4968-9d30-9c343d45ae76

````

Grant `cloudasset.assets.searchAllResources` and `resourcemanager.projects.get` on the selected project. Veriom uses the project returned by the Cloud Resource Manager API as the boundary.
</Tab>
</Tabs>

## Schedule inventory

Run the same `sync` command from a provider scheduler, CI job with workload identity federation, or a customer-managed runner. Use a stable schedule and let the collector generate a unique sync identifier. A second submission with the same provider, account, and sync identifier is replay-safe.

The response makes coverage operational rather than decorative:

```json
{
  "provider": "aws",
  "account_boundary": "aws:123456789012",
  "sync_id": "scheduled-20260902T010000Z",
  "collection_status": "partial",
  "resource_count": 184,
  "relationship_count": 183,
  "freshness": "current",
  "age_seconds": 14,
  "stale_after_seconds": 86400,
  "warnings": ["vpc: collector identity lacks the optional read scope"]
}
````

Query `GET /v1/workspaces/{workspace_id}/cloud/snapshots` with `ingestion:read` to monitor account boundaries and freshness. The default stale threshold is 24 hours and can be set between five minutes and seven days per request.

## Typed evidence boundary

Every submitted snapshot contains:

- `provider`: `aws`, `azure`, or `gcp`;
- `account_ref`: the account, subscription, or project established by the provider identity;
- `sync_id`: a replay key for one collection attempt;
- `collection`: collector version, timestamp, completeness, completed scopes, and warnings;
- `resources`: up to 500 allowlisted inventory records;
- `relationships`: up to 1,000 typed edges that only reference resources in the same snapshot.

```json title="veriom-cloud-evidence-v1"
{
  "schema_version": "veriom-cloud-evidence-v1",
  "provider": "aws",
  "account_ref": "123456789012",
  "sync_id": "scheduled-20260902T010000Z",
  "collection": {
    "collector": "veriom-cloud-collector",
    "collector_version": "0.1.0",
    "collected_at": "2026-09-02T01:00:00Z",
    "status": "complete",
    "completed_scopes": ["identity", "tagged-resources", "vpc"],
    "warnings": []
  },
  "resources": [
    {
      "external_id": "aws:account:123456789012",
      "name": "AWS account 123456789012",
      "resource_type": "AWS::Account",
      "category": "account",
      "observed_at": "2026-09-02T01:00:00Z",
      "confidence": 1,
      "properties": { "account_id": "123456789012" }
    }
  ],
  "relationships": []
}
```

Credentials, tokens, raw environment variables, customer payloads, and unrestricted provider metadata are rejected by the contract. Older snapshots remain traceable, while workspace context selects the latest accepted sync for each provider account.

## MCP compatibility

MCP clients can submit the exact same object through `submit_cloud_snapshot`. HTTP collectors and MCP clients share one normalization and replay path, so the architecture model does not depend on which transport delivered the evidence.

<Callout type="warn" title="Missing is not deleted">
  Veriom only treats a resource as removed when comparable snapshots cover the
  same provider account and collection scopes. A partial or stale snapshot
  remains visibly partial or stale; it does not prove absence.
</Callout>

---

<!-- Source: integrations/github.mdx -->

---
title: GitHub repository access
description: Connect personal and organization installations for scoped reviews and human-approved pull requests.
---

Veriom uses one GitHub App for account authorization, source selection, audits, and approved remediation. A workspace can connect multiple personal and organization installations, and each installation keeps its own repository boundary.

<SketchDiagram variant="github-connection" />

## Connect

1. Sign in to Veriom and choose a workspace.
2. Select **Repositories → Add repositories**, or connect GitHub during workspace setup.
3. Choose an existing GitHub connection or connect a personal or organization account.
4. Authorize access in GitHub, then choose the repositories for the named Veriom workspace.
5. Confirm your selection. The GitHub window closes and your workspace updates on the same page.

The callback verifies the actor, account, installation, and accessible repositories before presenting your choices. Temporary GitHub user authorization is discarded after verification. A GitHub installation can be connected to several Veriom workspaces, and each workspace chooses its own repositories. You need Owner or Admin access to the destination workspace and GitHub access to the repositories you select.

## Add repositories later

Open **Repositories → Add repositories** in the workspace you want to update. Choose the existing GitHub account and select the additional repositories. Repositories already connected to that workspace remain selected, including repositories added by another workspace member.

After GitHub authorization, the account connection is retained even if you close the repository picker. You can return to **Add repositories** to finish choosing projects later.

If a repository is missing, use **Manage access in GitHub** to add it to the App's installation access. Return to Veriom and choose repositories again to refresh the available choices. Granting GitHub access alone does not add that repository to every connected workspace.

To use the same GitHub organization in another workspace, open that workspace's **Add repositories** dialog, choose the existing organization, and authorize its separate selection. Direct GitHub installation links ask you to select a destination when several workspaces are available.

## Choose a branch and repeatable scope

Repository reviews capture the selected branch and exact commit. Use saved audit profiles for branch and include/exclude directory choices, inspect repository health history, and compare successful audits of compatible scopes. Follow [repository reviews and branch comparisons](/docs/workflows/repository-reviews) for the complete flow.

## Access by operation

The App has the capability to read source and publish pull requests, but each operation receives a short-lived token narrowed to what it needs:

| Operation             | Effective access                                                                    |
| --------------------- | ----------------------------------------------------------------------------------- |
| Sign in and connect   | identify the actor and verify the installation                                      |
| Run an audit          | metadata read and contents read for one selected project                            |
| Check a pull request  | pull requests read and checks write for one selected project                        |
| Publish remediation   | contents write and pull requests write for one selected project                     |
| Modify workflow files | workflows write, requested only when an approved patch touches `.github/workflows/` |

Source write access is never used during an audit. Checks write is limited to the **Veriom architecture guard** status and its evidence summary; it cannot change source, branch protection, or pull-request content. Publishing remediation still requires an Analyst, Admin, or Owner to approve the proposal. Veriom never merges automatically.

## Manage the connection

The Integrations page shows every connected account, account type, project count, installation status, and a direct management link. The Repositories page groups projects by provider and account, supports server-side account or project search, and uses cursor pagination so even large organization inventories remain manageable without merging their access boundaries. If the App is suspended, removed, or loses required permissions, new work is blocked while historical reviews remain available.

<Callout type="warn" title="Prefer least privilege">
  Veriom supports selected-project and all-project installations. Choose only
  the repositories the workspace is expected to review whenever that boundary
  is practical.
</Callout>

## Protect merges with architecture evidence

In **Continuous audits → GitHub events**, enable **Pull request checks**. For every opened, reopened, ready-for-review, or synchronized pull request that matches the branch, path, and size policy, Veriom audits the exact head commit and posts **Veriom architecture guard**. The check includes:

- added, removed, and changed architecture entities and relationships;
- trust-boundary movements and privilege changes;
- newly reachable paths from public or untrusted entry points to sensitive assets;
- newly failing versioned invariants, insufficient evidence, and the consequence gate verdict.

The first run captures a neutral baseline. Later runs succeed when no invariant newly fails, and fail when a new invariant failure or release-blocking consequence is present. If another audit is active, the check remains queued and follows the policy's conflict behavior. Human-approval policies publish `action_required` before any audit starts.

Existing installations must accept the new **Pull requests: read** and **Checks: write** permissions before native checks can run. Historical results remain available while permission repair is pending.

Alternatively, add the [deterministic merge-check workflow](/docs/integrations/merge-checks). That repository-owned workflow uses `contents: read` and publishes its own job result, which is useful when an organization does not permit App-authored check runs.

If code also lives in GitLab or Bitbucket, use the [read-only repository provider connections](/docs/integrations/repository-providers). Their project inventory and exact-revision audits share the same explicit selection and evidence contract, but their credentials are never reused for remediation writes.

---

<!-- Source: integrations/managed-connectors.mdx -->

---
title: Managed context connectors
description: Connect knowledge, observability, delivery, and data sources through bounded read-only credentials.
---

Managed connectors turn provider records into tenant-scoped evidence without giving an agent
ambient authority. Owners configure them in **Source Readiness → Connector catalog**. Veriom
validates the provider before encrypting the credential, bounds every collection, and preserves
provenance and freshness with the accepted evidence.

## Available connectors

| Source | Required boundary | Evidence collected |
| --- | --- | --- |
| Jira | Site and optional project keys | Work, ownership, remediation, releases |
| Confluence | Site and optional space IDs | Pages, decisions, ownership, runbooks |
| Notion | Explicitly shared pages and optional title filter | Documents, decisions, ownership |
| Google Drive | Connected account and optional shared-drive ID | File metadata and knowledge context |
| Sentry | Organization slug | Runtime issues and release context |
| Datadog | Restricted application key | Service definitions and runtime context |
| CircleCI | Project slug | Pipelines and delivery context |
| Jenkins | Controller with Job/Read | Jobs and latest build context |
| Airbyte | Optional workspace-ID allowlist | Data sources and lineage context |

## Credential lifecycle

The setup dialog performs a live read-only request before saving. Credentials are encrypted and
never returned. Owners can rotate, pause, resume, test, retry, or revoke a connection. Revocation
deletes the credential envelope and stops collection, while already accepted evidence remains
linked to its original provenance.

## Duplicate handling

Each provider record receives a deterministic subject identity and a content hash. Replays update
the same subject instead of publishing duplicate context. Scanner findings retain every source
observation behind one canonical finding identity; similarity never silently merges findings.

## Production canary

Use the dedicated customer-canary runner to prove the GitHub, cloud, Jira, Notion, and ZIP paths in
the deployed environment. The generated artifact includes only identifiers, counts, states, and
safe errors—never tokens or provider response bodies.

---

<!-- Source: integrations/merge-checks.mdx -->

---
title: Deterministic merge checks
description: Run Veriom's architecture change gate for the exact pull-request commit without granting repository write authority to an agent.
---

The Veriom architecture-check command turns the workspace change policy into a native GitHub, GitLab, or Bitbucket job result. It audits the full pull-request or merge-request commit, waits for the durable scanner and architecture workflow, then retrieves the persisted architecture comparison for that repository. The installer vendors a reviewed copy into your repository, so a registry outage or unpublished package cannot change the gate that protects a merge.

<SketchDiagram variant="merge-check" />

```bash title="Install from the Veriom platform repository"
./actions/install-architecture-check.sh github /path/to/repository
./actions/install-architecture-check.sh gitlab /path/to/repository
./actions/install-architecture-check.sh bitbucket /path/to/repository
```

The action fails closed if the returned gate belongs to another concurrent audit. It never asks an agent whether a pull request should merge.

<Callout type="info" title="Native App check or repository workflow">
  GitHub teams can instead enable **Pull request checks** in the Veriom
  continuous-audit policy. The native App check needs `pull_requests: read` and
  `checks: write`, requires no workflow file or API-token secret, and posts the
  entity, relationship, boundary, privilege, reachability, and invariant
  deltas directly. Use this vendored workflow when App-authored checks are not
  permitted or when GitLab and Bitbucket need the same repository-owned gate.
</Callout>

## GitHub

Create a workspace API token with `audits:read` and `audits:write`, save it as `VERIOM_API_TOKEN`, and add the workspace and repository UUIDs as GitHub variables.

```yaml title=".github/workflows/veriom-architecture.yml"
name: Veriom architecture gate

on:
  pull_request:

permissions:
  contents: read

jobs:
  architecture:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the pull-request commit
        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Evaluate the Veriom architecture gate
        uses: ./.github/actions/veriom-architecture-check
        with:
          api-token: ${{ secrets.VERIOM_API_TOKEN }}
          workspace-id: ${{ vars.VERIOM_WORKSPACE_ID }}
          repository-id: ${{ vars.VERIOM_REPOSITORY_ID }}
          commit-sha: ${{ github.event.pull_request.head.sha }}
```

## Gate outcomes

| Outcome                 | Meaning                                               | Default job result |
| ----------------------- | ----------------------------------------------------- | ------------------ |
| `pass`                  | No architecture regression matched the active policy  | pass               |
| `review`                | Comparable architecture changed and requires a person | fail               |
| `blocked`               | A relationship or removal matched a blocking rule     | fail               |
| `insufficient_evidence` | Coverage or baseline requirements were not met        | fail               |

The job summary includes source coverage, the policy reasons, change consequences, owner hints, affected graph paths, and an explainable impact score. The score is decomposed into repository criticality, reachability, data sensitivity, trust-boundary exposure, and uncertainty; every component retains graph and evidence references. Configure the required check in the repository's branch protection after its first run.

<Callout type="warn" title="No ambient write authority">
  The workflow declares only `contents: read`. GitHub publishes the job status
  itself. Veriom receives a workspace-scoped API token, and neither a
  specialist agent nor the audit process receives permission to modify code,
  checks, pull requests, or branch protection.
</Callout>

## GitLab

Connect the GitLab account, explicitly add the project to audit scope, and save a token with `audits:read` and `audits:write` as a masked, protected `VERIOM_API_TOKEN` CI/CD variable. Add the workspace and Veriom repository UUIDs as `VERIOM_WORKSPACE_ID` and `VERIOM_REPOSITORY_ID`.

```yaml title=".gitlab-ci.yml"
veriom:architecture:
  image: node:22-alpine
  stage: test
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    VERIOM_COMMIT_SHA: $CI_COMMIT_SHA
  script:
    - node .veriom/architecture-check.cjs
  allow_failure: false
```

GitLab turns the job exit code into merge-request pipeline status. The Veriom token can start and read audits; it cannot push commits, approve a merge request, or change branch rules.

## Bitbucket

Connect the Bitbucket workspace, explicitly select the repository, and add the three `VERIOM_*` values as secured repository variables.

```yaml title="bitbucket-pipelines.yml"
image: node:22-alpine

pipelines:
  pull-requests:
    "**":
      - step:
          name: Veriom architecture gate
          script:
            - export VERIOM_COMMIT_SHA="$BITBUCKET_COMMIT"
            - node .veriom/architecture-check.cjs
```

Bitbucket publishes the step result to the pull request. As with GitHub and GitLab, the command compares the persisted audit ID before enforcing the gate, so a concurrent run cannot silently substitute another result.

## CLI inputs

The provider-neutral command accepts `VERIOM_API_TOKEN`, `VERIOM_WORKSPACE_ID`, `VERIOM_REPOSITORY_ID`, and the CI provider's full commit SHA. Optional variables are `VERIOM_API_URL`, `VERIOM_DEEP_REVIEW`, `VERIOM_TIMEOUT_SECONDS`, `VERIOM_POLL_INTERVAL_SECONDS`, and `VERIOM_FAIL_ON`.

---

<!-- Source: integrations/repository-providers.mdx -->

---
title: GitLab and Bitbucket repositories
description: Connect read-only GitLab or Bitbucket account boundaries, discover projects, and explicitly choose which exact revisions Veriom may audit.
---

Veriom brings GitLab and Bitbucket repositories through the same evidence pipeline as GitHub without treating account access as permission to audit every project. An Owner or Admin creates a provider connection, Veriom discovers visible projects, and every newly discovered project starts outside the audit scope.

<SketchDiagram variant="repository-boundary" />

## Permission boundary

| Provider                          | Credential                               | Minimum access                   | Audit behavior                                                    |
| --------------------------------- | ---------------------------------------- | -------------------------------- | ----------------------------------------------------------------- |
| GitLab.com or self-managed GitLab | Personal, project, or group access token | `read_api` and `read_repository` | Clone one selected project at an exact 40-character commit SHA    |
| Bitbucket Cloud                   | Repository or workspace access token     | Repositories read                | Clone one selected repository at an exact 40-character commit SHA |

Veriom encrypts the token with workspace and connection identity as associated data. The API returns only `has_credential`; neither a workspace response nor the operator dashboard can retrieve the token. Repository contents are processed by the isolated runner and are not made available to the admin control plane.

<Callout type="warn" title="Read does not become write">
  GitLab and Bitbucket connections are audit-only. Remediation publication
  requires a separate, provider-specific write authorization and is currently
  available only through a human-approved GitHub workflow. Veriom never reuses
  a read token to push code.
</Callout>

## Connect and select projects

1. Open **Repositories → Repository providers**.
2. Choose GitLab or Bitbucket.
3. Name the connection and enter its account boundary and write-only token.
4. Review the discovered project inventory.
5. Select only the projects Veriom may audit.

A later sync preserves existing selections. Newly discovered projects remain unselected, and projects no longer visible to the provider token are archived and disabled instead of silently disappearing from history. Revoking the connection disables every linked project while preserving past audits and reports.

## GitLab host validation

GitLab.com is supported directly. A self-managed GitLab base URL must use public HTTPS, must not contain credentials, and must resolve outside loopback, link-local, private, multicast, reserved, and unspecified networks. API redirects are disabled. Project clone and web URLs must stay on the authorized GitLab host.

Bitbucket connections use the fixed `api.bitbucket.org` and `bitbucket.org` boundaries. A workspace slug identifies the inventory boundary.

## Sync and support diagnostics

The workspace sees connection state, account, project count, last sync time, and a safe error code. Platform operators see the same boundary and health metadata plus the number of projects explicitly selected. Tokens, repository archives, and source payloads are excluded from operator responses.

Use [deterministic merge checks](/docs/integrations/merge-checks) after selecting a project. The check submits the provider's full merge commit and refuses to enforce a result produced by a different concurrent audit.

---

<!-- Source: integrations/security-sensors.mdx -->

---
title: Security evidence
description: Understand evidence coverage, finding deduplication, and the permission boundaries of a security review.
---

Veriom brings security observations into the same architecture review as repository and infrastructure evidence. Each finding retains its source, location, audit revision, and coverage context.

<SketchDiagram variant="security-sensors" />

## Review coverage

An audit shows which evidence was collected, which checks completed, and where coverage is missing. An incomplete assessment remains visible as a gap. An empty findings list does not establish that an unassessed system is secure.

## One issue, all of its sources

When independent observations share a reviewed advisory identity, Veriom presents one finding with the contributing evidence. It preserves corroboration and source locations.

Rules remain separate unless they share a reviewed deterministic identity. Similar titles and model judgement are not sufficient to merge findings.

Each canonical finding retains:

- the strongest supported risk representation;
- the original evidence and source identifiers;
- source locations and the assessed revision;
- first-seen and last-seen history;
- relevant coverage gaps.

## Permission boundaries

Repository reviews inspect captured source. Customer-connected infrastructure and runtime evidence require separately scoped access. A repository connection does not grant permission to access a cloud account or an active target.

Read the [security controls](https://veriom.io/compliance) or [request a security review](https://veriom.io/contact).

---

<!-- Source: integrations/team-workflows.mdx -->

---
title: Team workflow destinations
description: Deliver signed, scoped Veriom events to Slack, Jira automation, SIEM collectors, policy engines, and generic webhooks.
---

Workspace Owners and Admins configure team destinations in **Settings → Automation**. Each destination selects an explicit event allowlist. Veriom queues only matching events and retains delivery status, retry history, and the configuration audit trail.

<SketchDiagram variant="team-workflows" />

## Destination types

| Type    | Delivery shape                                                          | Typical use                                      |
| ------- | ----------------------------------------------------------------------- | ------------------------------------------------ |
| Slack   | Incoming-webhook text and Block Kit fields                              | Review-ready audit and remediation notifications |
| Jira    | Jira automation envelope with a nested Veriom event                   | Ticket rules and ownership routing               |
| SIEM    | Structured timestamp, event action, organization, and Veriom envelope | Security operations correlation                  |
| Policy  | Versioned policy-event envelope                                         | External deterministic decision systems          |
| Webhook | Stable Veriom event envelope                                          | Customer-built automation                        |

## Integrity and replay

Every request includes delivery, event, timestamp, and HMAC-SHA256 signature headers. The signing secret is generated when the destination is created, encrypted at rest, and shown once. Destinations must use HTTPS and resolve only to public addresses. Redirects are disabled, and production egress controls remain the SSRF backstop.

Delivery failures use bounded exponential retry. Operators can see metadata-only health across the integration fleet; they cannot see signing secrets or customer payloads.

## Action boundary

These integrations deliver events. They do not give an agent ambient permission to create tickets, post arbitrary messages, change policy, or modify a workspace. Consequential operations use [authorized workflow actions](/docs/workflows/workflow-actions): capability-specific grants for Jira ticket creation, internal ownership routing, and Owner-approved policy exceptions, each with a separate requester and approver.

Configuration creation, updates, disables, manual delivery retries, and policy changes create audit events.

---

<!-- Source: integrations/uploads-mcp.mdx -->

---
title: Uploads and MCP evidence
description: Safe archive ingestion and the API-key protected MCP gateway for evidence, ZIP uploads, and isolated audits.
---

<SketchDiagram variant="mcp-ingestion" />

## File uploads

Uploads enter the same ingestion pipeline as GitHub snapshots but have stricter provenance. Upload either one repository ZIP or a bundle ZIP containing two or more repository ZIPs. Bundles are unpacked into one isolated audit source while each nested archive is independently inspected. The service enforces combined compressed and unpacked size limits, file-count and decompression-ratio limits, path and symlink traversal protection, MIME inspection, and malware scanning.

No uploaded hook, script, binary, package lifecycle command, build, test, or customer source is executed.

## MCP gateway

The Streamable HTTP MCP service exposes a narrow evidence-ingestion surface:

- `get_ingestion_capabilities`
- `submit_evidence_batch`
- `submit_cloud_snapshot`
- `create_artifact_upload`
- `complete_artifact_upload`
- `get_ingestion_status`
- `start_audit`

Workspaces with the architecture-intent preview enabled also expose `preview_intent_proposal` and `submit_intent_proposal`. These require `decisions:write` and an Analyst role or above. They create attributable architecture drafts through the same source review pipeline; a named Admin or Owner ratifies the exact saved revision separately. The standard evidence preset does not grant proposal scope. See [Intended architecture](/docs/architecture/intended-architecture) for source sharing, CALM support and review boundaries.

## Connect with a workspace API key

In Veriom, open **Settings → Automation**, create an API token, and apply the **MCP preset**. Store the token in your client's secret manager as `VERIOM_API_KEY`; never commit it to a repository.

```json title=".mcp.json"
{
  "mcpServers": {
    "veriom": {
      "type": "http",
      "url": "https://mcp.veriom.ai/mcp",
      "headers": {
        "Authorization": "Bearer ${VERIOM_API_KEY}"
      }
    }
  }
}
```

The key is bound to one workspace and expires on the date selected by its creator. Revoking it in Settings immediately removes MCP access. The MCP preset grants `evidence:write`, `uploads:write`, `ingestion:read`, and `audits:write` only.

Existing OAuth clients remain compatible during the API-key migration, but API keys are the recommended connection method for automation.

## Prove the connection before sending real evidence

1. Ask the connected client to call `get_ingestion_capabilities`.
2. Confirm the response is bound to the intended workspace and lists `evidence:write` as the required write scope.
3. Pass the returned `sample` and `sample_batch_id` to `submit_evidence_batch`.
4. Open **Source Readiness** in Veriom. MCP becomes ready only after the capability check, sample collection, and reconciliation into current truth all succeed.

The capability response is the canonical sample. It is versioned, schema-valid, and safe to replay: the sample batch ID is idempotent within a workspace.

<Callout type="info" title="Ready means current truth exists">
A valid key or successful network connection is not enough. Veriom marks MCP ready only when typed evidence from that client is present in the current workspace context.
</Callout>

## Upload and audit one repository or a repository bundle

1. Create a ZIP of one repository. For a multi-repository architecture, create one outer ZIP containing at least two repository ZIPs.
2. Call `create_artifact_upload` with the outer file name, byte size, and SHA-256 digest.
3. Upload the ZIP to the returned short-lived signed URL using the exact returned headers.
4. Call `complete_artifact_upload` with the ingestion ID.
5. Poll `get_ingestion_status` until it reports `ready`.
6. Call `start_audit` with the ingestion ID and a stable idempotency key of at least eight characters.

The ZIP travels directly to quarantine object storage rather than through the MCP request body. This keeps the connection fast and preserves the existing size, malware, and archive-safety controls.

Validation reports durable stages—queued, downloading, archive inspection, malware scanning, and complete—plus a percentage that the web app streams live. Rejected archives return a stable code for invalid ZIPs, unsafe paths, symbolic links, file-count limits, decompression limits, size limits, collisions, or detected malware. Transient evidence-storage and malware-scanner failures are reported separately so operators know when retrying is appropriate.

<Callout type="info" title="Bundle detection is explicit">
An outer ZIP is treated as a repository bundle only when every non-directory member is a ZIP and at least two repositories are present. A normal repository that happens to contain an archive remains a normal repository.
</Callout>

## Evidence acceptance

Structured batches are schema-validated, tenant-bound, provenance-stamped, and normalized before reconciliation. Raw artifacts use scoped signed uploads and pass through malware and archive-safety checks. Neither is passed directly to an agent prompt.

`submit_cloud_snapshot` accepts a bounded provider, account, region, resource, and relationship graph for AWS, Azure, or Google Cloud. Resource properties are allowlisted, identifiers must be unique inside the snapshot, and every relationship endpoint must refer to a resource in that same snapshot. A newer snapshot for the same provider and account supersedes the previous current view while preserving audit history.

<Callout type="warn" title="MCP is an evidence gateway">
Veriom does not execute arbitrary outbound MCP tools as part of an audit. The integration accepts evidence; it does not grant agents a general remote-action surface.
</Callout>

---

<!-- Source: quickstart.mdx -->

---
title: Getting started
description: Create a workspace, connect a source, run your first review, and explore the resulting architectural truth.
---

Veriom turns technical evidence into a reviewable architecture model. A first review follows six steps. You can try them first in the [interactive demo](https://veriom.io/demo).

<SketchDiagram variant="quickstart" />

## 1. Create your workspace

Accept your invitation, verify your email, and create a workspace for the team that owns the system being reviewed. Verification links are single-use and expire after 24 hours; request a replacement from the sign-in or verification page if needed. Workspace roles control who can connect sources, run reviews, approve reports, and publish remediation.

## 2. Connect evidence

Choose the connection that fits your workflow:

<Cards>
  <Card title="GitHub" href="/docs/integrations/github" description="Connect personal or organization installations and select the projects Veriom may review." />
  <Card title="Upload" href="/docs/integrations/uploads-mcp" description="Submit a validated source bundle through the web application." />
  <Card title="MCP" href="/docs/integrations/uploads-mcp" description="Use a workspace API key to submit evidence or a validated ZIP and start an audit." />
</Cards>

## 3. Start a review

Choose a connected repository, select its branch, and check the captured commit and path scope before starting an audit. Use a [saved audit profile](/docs/workflows/repository-reviews) for recurring branch and directory choices. Veriom admits work to the workspace queue, reports its position, and streams each deterministic and agent-assisted stage as it completes.

## 4. Inspect the result

Open the architecture view to explore:

- services, data stores, interfaces, pipelines, identities, and boundaries;
- relationships with selectable evidence and confidence;
- contradictions and coverage gaps;
- findings connected to their architectural context;
- the specialist-agent artifacts that shaped the review.

## 5. Ask the workspace

Open **Workspace Intelligence** to ask a question about the latest reconciled truth. Choose one or more repositories when the question is source-specific, follow the visible verification states, and open citations in the Context inspector to confirm why Veriom believes each factual claim.

Recommendations derived from existing audit artifacts can be acknowledged, assigned, snoozed, discussed, dismissed with a reason, or prepared for remediation. See [Workspace Intelligence](/docs/workflows/workspace-intelligence) for grounding, evidence limits, and review controls.

## 6. Share or act

Review the canonical report, approve it, and export JSON, Markdown, DOCX, or PDF. Share explicitly selected content through an [expiring report review link](/docs/workflows/report-review-links), or use approved evidence to answer a [security questionnaire](/docs/workflows/questionnaires). When remediation is appropriate, an Analyst can approve a proposed change and publish a pull request. Veriom never merges automatically.

<Callout type="info" title="Prefer the API?">
Use the <a href="/docs/api">API guide</a> for authentication, idempotency, event streams, errors, and the generated endpoint reference.
</Callout>

---

<!-- Source: workflows/agent-system.mdx -->

---
title: Multi-agent system
description: Fifteen specialist roles, typed artifact handoffs, activation rules, guardrails, and architecture-impact adjudication.
---

Agents collaborate through validated artifacts—not hidden chain-of-thought. Every artifact records its agent definition version, model, context hash, evidence IDs, confidence, usage, latency, and decision summary.

<SketchDiagram variant="agent-handoffs" />

## Role registry

| Role | Primary responsibility |
| --- | --- |
| Audit Coordinator | scope, activation, stage and retry decisions |
| Context Curator | assemble bounded ContextPacks |
| Evidence Verifier | reject unsupported claims and contradictions |
| Security Engineer | technical vulnerabilities and control failures |
| Security Architect | boundaries, reachability, blast radius, structural weakness |
| Cloud/IaC Analyst | infrastructure entities, policy, network, identity |
| CI/CD Analyst | pipeline, artifact, deployment, and provenance relationships |
| Threat Modeler | assets, actors, paths, abuse cases, mitigations |
| Remediation Engineer | deterministic patch proposal and static rescan plan |
| Diagram Architect | safe views of the canonical graph |
| Report Synthesizer / Adjudicator | reconcile artifacts into canonical JSON |
| Finding Architecture Impact Adjudicator | determine whether scanner observations materially affect evidenced architecture |
| Compliance Control Analyst | map evidence to bounded assurance questions without certifying compliance |
| Architecture Diagnostic Analyst | identify gaps, contradictions, staleness, and unlinked signals |
| Architecture History Analyst | explain changes between comparable truth snapshots |

A deeper review requires explicit approval. An agent failure does not expand its authority.

## Review boundaries

Each role has a defined evidence scope, allowed actions, and expected output. Reviews preserve source identifiers, confidence, usage, and decision history so your team can inspect a conclusion and its limits.

Human approval remains explicit for consequential actions.

## Evidence adjudication

An observation becomes canonical only after the verifier can resolve every cited evidence ID in the same audit and workspace. Unsupported claims remain hypotheses. Conflicting agent artifacts are retained and sent to adjudication with the underlying evidence—not resolved by majority vote.

For scanner observations, citation validity is necessary but not sufficient. Architecture relevance requires a concrete affected entity, relationship, trust boundary, identity, pipeline, data flow, or constraint. An automatic exclusion requires scanner evidence plus independent structural evidence for a concrete exclusion. Missing deployment, cloud, runtime, or reachability evidence routes to human review.

---

<!-- Source: workflows/apps-and-automations.mdx -->

---
title: Apps and audit automations
description: Schedule branch reviews in your timezone and send useful outcomes to Slack, Discord, email, or your own workflow.
---

Veriom connects the review loop: choose a repository and branch, decide when to audit, and send the outcome to the people who need it. Open **Continuous audits** to manage **Schedules**, **GitHub events**, **Apps**, and **Activity**.

## Connect a messaging app

In **Apps**, choose Slack, Discord, or Webhook. Workspace Owners and Admins can manage team destinations. Every member can manage their own email updates in **Settings → Notifications**.

| App | Setup | What your team receives |
| --- | --- | --- |
| Slack | Create an incoming webhook for a channel in your Slack app. Paste its URL into Veriom. | An audit summary, repository, branch, captured commit, outcome, and an Open in Veriom button. |
| Discord | In channel settings, open Integrations → Webhooks and copy a webhook URL. Use a regular text channel. | An audit summary card with context and a link to the run. Messages do not trigger mentions. |
| Webhook | Use the HTTPS trigger URL from n8n, Zapier, your messaging gateway, or your own receiver. | A signed JSON event with a stable delivery ID and useful audit context. |
| Email | Choose your personal notification preferences in Settings. | Selected audit and report updates at your verified account email. |

See the official [Slack incoming webhook guide](https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks/) and [Discord webhook guide](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks) to create a channel destination. This connection uses an incoming webhook; channel membership and permissions stay in the messaging service.

Give the app a recognizable name, such as **Engineering audit updates**. Select its events: audit completed, audit failed, automation needs attention, report ready, approval needed, queued audit, remediation pull request, or overdue finding.

You can restrict updates to a repository, a listed branch, and an audit trigger: any, scheduled, GitHub event, or manual. A branch filter requires a repository. Leaving both empty includes repository and uploaded-source audits. Filters match the audit's recorded branch and trigger, including report events associated with that audit.

An audit completed event includes both successful audits and partial results. Messages explicitly identify coverage gaps; they do not present incomplete evidence as a fully successful review. **Automation needs attention** covers a run that could not start because of repository access, an unavailable branch, or another admission problem.

After saving, use **Send test**. The test queues a clearly labelled message for the selected destination without starting an audit. It is delivered only after the service confirms receipt. Check **Delivery history** for the result.

## Schedule a branch review

1. Open **Schedules** and name the review.
2. Select a repository, then choose a branch from its searchable list. **Follow default branch** follows the repository's default at each run. A named branch stays selected even if the repository's default changes.
3. Choose daily, weekly, every two weeks, or monthly, then set the local time and day.
4. Search the timezone list by region or city. The displayed offset is today's offset; the run preview uses the offset at each occurrence.
5. Preview the next five runs. Each shows the selected local timezone and its corresponding UTC instant.
6. Save the schedule, then open Apps to configure matching notifications.

Every run captures the latest available commit on the selected branch when admitted. Veriom retains that commit with the audit. A removed or inaccessible branch does not silently fall back to another branch.

Schedules keep wall-clock time through daylight-saving changes. A nonexistent local time moves to the first valid minute; a repeated local time uses the first occurrence. Monthly schedules on the 29th–31st use the last available day in shorter months. Every-two-weeks schedules retain their anchor date when edited.

**Run once when service returns** coalesces missed occurrences into one run and advances to the next future occurrence. **Skip the missed run** uses the scheduler's catch-up policy. Pause a saved schedule to retain its settings and history, or edit its branch, cadence, local time, and timezone. Disabled schedules remain in the audit trail.

## React to GitHub changes

Use **GitHub events** for pushes, pull requests, or merged pull requests. Add branches from the repository list, and use patterns such as `release/**` for branches created later. Leave the branch filter empty to match all branches. Optional path patterns and a minimum changed-file count reduce unnecessary runs.

Direct pushes to protected branches require approval. The conflict policy controls whether a competing audit waits, is ignored, or requires a replacement decision. Activity records why a trigger ran, waited, failed, or was ignored. Messaging apps can notify the team when an approval or intervention is needed.

## Delivery history and recovery

**Queued** means an event is waiting for a worker. **Sending** means a request is in progress. **Delivered** means the service confirmed receipt. **Retrying** includes the next attempt time. **Failed** or **Canceled** can be retried after the app is active and the endpoint has been corrected.

Temporary errors, timeouts, and rate limits retry automatically, up to eight attempts per cycle. Provider retry delays apply to the whole destination. A worker restart recovers an expired delivery lease. Permanent rejections, such as revoked channel access, remain failed until you fix the endpoint and retry. Lifetime attempt counts stay visible after a manual retry.

Pausing prevents new matching events and cancels waiting deliveries when the worker processes them. A request already in flight may finish. Editing the endpoint affects future attempts, including retries. No delivery mechanism can guarantee exactly-once receipt after a network timeout; custom receivers must deduplicate the stable delivery ID.

## Verify a generic webhook

Destinations must use public HTTPS on port 443. Redirects, private addresses, embedded usernames, and fragments are rejected. Endpoint paths and query tokens are encrypted and hidden after saving. Slack and Discord URLs must match the provider's incoming webhook format.

Veriom signs the exact JSON request body. Save the signing secret shown once when you create a generic webhook. The request includes:

| Header | Meaning |
| --- | --- |
| `X-Veriom-Agent-Event` | Event type, for example `audit.completed`. |
| `X-Veriom-Agent-Delivery` | Stable delivery ID. Store it to reject duplicate processing. |
| `X-Veriom-Agent-Timestamp` | Unix timestamp for this attempt. |
| `X-Veriom-Agent-Signature-256` | `sha256=` followed by a hexadecimal HMAC-SHA256 signature. |

Compute HMAC-SHA256 with the signing secret over `timestamp + "." + delivery_id + "." + raw_request_body`. Compare signatures in constant time, reject timestamps outside your allowed clock tolerance, and deduplicate the delivery ID before doing work. Return a successful HTTP response only after accepting the event durably.

The JSON envelope retains `id`, `event`, `workspace_id`, `resource_type`, `resource_id`, `created_at`, and `data`, and includes a `context` object with the audit summary and scope. Events derived from a durable workspace event also include `event_id`. Credentials and operator accounting details are excluded.

**Rotate signing secret** invalidates the previous secret for future attempts. Update your receiver immediately. Slack and Discord authenticate through their endpoint token and do not require you to validate Veriom's signature.

## Try the interactive demo

Open [Apps & automations in the demo](https://veriom.io/demo?demo=automations) to select a branch and timezone, choose a destination, pause the sample automation, and preview successful, partial, and failed outcomes. The demo uses fictional data and sends no messages.

---

<!-- Source: workflows/audit-lifecycle.mdx -->

---
title: Audit lifecycle
description: Queue admission, deterministic scanning, context assembly, agent reasoning, reports, SSE progress, retries, and partial results.
---

<SketchDiagram variant="audit-lifecycle" />

## Admission and queueing

Audit creation requires workspace access, an authorized source, and an idempotency key. Each source may have at most one active or queued audit. Different sources can be queued together, and each workspace runs one audit at a time in submission order. A duplicate request returns a typed conflict that identifies the existing audit.

After onboarding, open **Audit runs** and choose **Start an audit** to select a repository, branch, and profile. **Run all** queues every enabled, non-archived repository on its default branch in one action. Repositories with an active or queued audit are skipped. The queue continues after you leave the page.

The scheduler uses global scanner capacity and runner health to expose queue position. Queue state is persisted; it is not inferred from a browser connection.

## Stage contract

| Stage | Durable output | Can be partial? |
| --- | --- | --- |
| Ingestion | exact commit or validated upload snapshot | no—invalid source stops admission |
| Scanning | normalized observations, SBOM, scanner coverage | yes—each failed scanner creates a coverage gap |
| Reconciliation | entities, relationships, evidence, contradictions | yes—missing source lowers confidence |
| Agent analysis | typed artifacts with evidence IDs | yes—processing limits or agent failures are explicit |
| Reporting | canonical Pydantic JSON | yes—coverage and omitted stages are prominent |
| Export | Markdown, DOCX, PDF, JSON, Mermaid/SVG/PNG | format-specific failure is retryable |

## Live events

Authenticated SSE emits monotonic events for queue position, stage transitions, scanner status, reviewed artifacts, warnings, retries, and terminal state. Clients reconnect with the last received event identifier and deduplicate by event ID.

```text
queue.updated
audit.stage.started
scanner.log
agent.artifact.completed
usage.updated
audit.coverage_gap.created
audit.completed
```

## Cancellation and retry

Cancellation stops new activities, requests cooperative termination of active work, and preserves evidence already committed. Retry creates or resumes only an allowed failed boundary; it does not silently overwrite the prior attempt or duplicate work.

<Callout type="info" title="A partial report is a valid terminal outcome">
Scanner failure, unavailable processing capacity, or an exhausted review allowance produces a report that names the missing coverage. It never produces a clean verdict by omission.
</Callout>

---

<!-- Source: workflows/change-intelligence.mdx -->

---
title: Architecture change intelligence
description: Compare the latest architecture snapshots, distinguish removals from missing coverage, and evaluate deterministic regression gates.
---

Change Intelligence compares the latest two terminal architecture snapshots for a repository. It reports entity and relationship additions, verified removals, items that were not re-observed because source coverage changed, evidence references, and ownership hints.

<SketchDiagram variant="change-intelligence" />

## Regression gate

The workspace policy controls a deterministic gate:

- minimum source coverage;
- whether compared snapshots must contain the same source families;
- whether any architecture change requires review;
- whether entity or relationship removals block;
- relationship kinds that block when newly introduced.

The result is one of `pass`, `review`, `blocked`, or `insufficient_evidence`. The reasons are returned as typed data rather than generated prose.

## Coverage-aware removals

A resource absent from the newer snapshot is not automatically a deletion. When the source families differ, Veriom marks the item `not_reobserved` unless the policy and evidence establish a comparable source boundary. This prevents missing cloud, delivery, or runtime data from becoming a clean architecture verdict.

## Ownership routing

Where entity or relationship evidence includes an owner, team, service, or repository attribute, the change item surfaces that owner hint. The workspace UI links the change to its source audit and lets reviewers ask Veriom about the existing evidence. It does not allow the assistant to override the deterministic gate.

```http
GET /v1/workspaces/{workspace_id}/repositories/{repository_id}/changes
```

The response includes both snapshot IDs, source coverage, source parity, all change items, and the evaluated gate.

---

<!-- Source: workflows/collaborative-remediation.mdx -->

---
title: Collaborative remediation
description: Assign evidence-backed findings, coordinate review, attach validated context, and verify remediation without losing provenance.
---

Veriom keeps remediation work attached to the finding that created it. Ownership, discussion, external tracking, proposed changes, approval, and verification remain one inspectable sequence instead of becoming a disconnected ticket.

## Work without weakening evidence

1. Assign a workspace member and choose a priority and due date.
2. Discuss the finding in threaded comments and mention active workspace members.
3. Mark the coordination state as open, in progress, blocked, or work completed.
4. Attach supporting material only after checksum, archive-safety, and malware validation.
5. Request an external Jira issue through an approved ticket-creation authorization.
6. Run new evidence and mark the remediation verified separately from work completion.

<Callout type="info" title="Completion is not verification">
Closing implementation work does not prove that the architecture changed safely. Veriom keeps **work completed** and **evidence verified** as distinct states.
</Callout>

## Ownership and blocking

Every collaboration change carries an optimistic version so two reviewers cannot silently overwrite one another. A blocked state requires a written reason. Assignment is limited to active members of the same workspace, and watchers can opt into finding activity without changing ownership.

Bulk updates use a preview endpoint first. The preview identifies eligible, missing, and unchanged findings; applying the change requires the preview token and explicit confirmation.

## Discussion and attachments

Comments support bounded mentions and replies. Mentions resolve only to active workspace members. Comments and collaboration events retain the author and timestamp.

Attachments are ZIP archives routed through Veriom’s existing secure-upload boundary. They must complete checksum verification, archive inspection, and malware scanning before they can be linked to a finding. The attachment record retains its checksum, uploader, status, and expiry; expiring it does not erase the collaboration timeline.

## Governed Jira synchronization

Jira creation is a workflow action, not an ambient integration permission. An administrator configures a write-only encrypted authorization, a user requests an issue for one finding, and a different authorized reviewer approves it. The worker performs the call and stores the external ID, URL, state, and safe error code.

Every Jira issue is labeled with its stable Veriom action ID. After a timeout, the retry searches that label and recovers the existing issue before considering a create call. Operators can retry failed synchronization or revoke future synchronization with an audited reason. Revocation never deletes local history or the external reference.

## Operator visibility

The private admin dashboard shows active, overdue, and blocked work, failed external synchronization, and quarantined attachments for each workspace. Operator interventions are reasoned and auditable.

Use the generated [collaboration API reference](/docs/api-reference/workspaces/get_workspaces_by_workspace_id_findings_by_finding_id_collaboration) for exact request and response contracts.

---

<!-- Source: workflows/compliance-programs.mdx -->

---
title: Compliance programs
description: Adopt a versioned control library and trace every status to current evidence, mappings, findings, and exceptions.
---

Veriom compliance programs are evidence views over your existing architectural truth. They do not create a second scanner result or let a favorable label hide an unresolved finding.

## Enable the workspace capability

Compliance libraries are released per workspace with the `compliance_libraries` feature flag. A workspace owner can enable the capability during a canary rollout. Members need `compliance:read` to inspect a program, `compliance:write` to adopt or propose changes, and `compliance:approve` to decide exceptions.

## Adopt an immutable version

Open **Compliance programs**, select a published library version, and review its publisher, source, license, change summary, controls, and evidence requirements. Set a program name, scope, owner, and review cadence before adoption.

The selected version is pinned. A newer version appears as an upgrade diff and requires a new, explicit adoption. Veriom never rewrites historical assessments when a library changes.

## Read a control status

Every control drill-down shows:

- the calculation and mapping versions;
- a canonical input hash for replay;
- accepted, stale, conflicting, and missing evidence inputs;
- mapped findings and architecture relationships;
- applicability rationale and overlay version;
- exception and program event history.

`Supported` requires enough fresh, accepted, non-conflicting evidence and no unresolved mapped finding. `Partial`, `gap`, and `unknown` keep missing or uncertain inputs visible. `Not applicable` requires a workspace rationale. `Excepted` means an approved, unexpired exception exists; the underlying finding remains visible.

## Change applicability

Workspace admins can mark a control applicable or not applicable with a rationale. The update uses optimistic versioning, creates a program event, and rebuilds the projection. It does not modify the shared library.

## Propose and approve an exception

An analyst can propose a time-bounded exception with a rationale and optional workspace evidence. An admin or owner other than the proposer must approve it. Only one proposed or approved exception can be active for a control. Expiry automatically restores the evidence-derived status.

## Export and replay

Canonical reports include the same versioned assessments used by the dashboard. Report records retain the program, framework version, mapping version, input hash, linked evidence, findings, architecture relationships, and exception reference so reviewers can reproduce the conclusion.

## Operator diagnostics

Platform operators can inspect projection health for any workspace and trigger a rebuild with an audit reason. Operators cannot directly edit status. Correct the evidence, mapping, applicability overlay, or exception instead.

## Rollback

Stop new adoption by deprecating a library version. Existing programs remain pinned and readable. To move a workspace back, explicitly adopt the prior published version; never mutate or delete historical assessments.

---

<!-- Source: workflows/enterprise-identity-onboarding.mdx -->

---
title: Enterprise identity and onboarding
description: Add MFA and tenant-scoped OIDC, link every sign-in to one canonical user, and resume setup without losing security context.
---

Veriom treats identity as part of the evidence boundary. A provider assertion can prove who signed in, but it cannot silently create workspace authority.

## Secure your account with MFA

Open **Workspace settings → Security** and enroll a TOTP authenticator. Confirm the first code, then store the one-time recovery codes outside Veriom. Recovery codes are shown once and each code can be used only once.

The security view lists active browser sessions and their authentication method. Revoking a session takes effect immediately. Enrollment, recovery, step-up, and factor changes rotate session identifiers so an earlier session cannot inherit new authority.

## Connect an organization provider

Workspace owners can add any standards-compliant OIDC provider. Supply its issuer, client ID, client secret, verified email domains, and optional claims mapping. Veriom validates discovery endpoints, encrypts the secret, and saves the provider in **Testing**.

Choose **Test sign-in** to complete a state-, nonce-, and PKCE-protected login. A successful test verifies token issuer, audience, signature, subject, email, and domain before activating the provider. SSO can be optional or enforced only after activation.

## Understand identity linking

Veriom links OIDC to the existing canonical user only when the provider subject, verified email account, and invitation resolve safely. A matching email never grants access on its own. New workspace membership requires a pending invitation, and mapped roles are capped by that invitation. OIDC can never grant owner or platform-operator access.

If identities disagree, the login is denied. The operator console records a pseudonymous failure reason for support without exposing the asserted email.

## Resume onboarding

The onboarding journey keeps your last verified stage:

1. verify the account;
2. create or choose the workspace;
3. invite the team;
4. describe organizational context;
5. connect evidence sources;
6. confirm first-audit readiness;
7. complete setup.

Optional stages can be deferred. Policy blockers such as unverified email or required MFA cannot be skipped. Provider secrets and access tokens are never stored in onboarding progress.

## Recover safely

If SSO is degraded, an owner can disable the provider without removing local users, memberships, or history. Platform operators can revoke sessions or unlock a recovery credential only through an audited action with a reason. Keep two recoverable owner accounts and exercise the break-glass path before enforcing SSO.

---

<!-- Source: workflows/finding-matches.mdx -->

---
title: Review possible duplicate observations
description: Understand the Control room comparison report before linking two observations or keeping them separate.
---

The **Possible duplicate observations** panel in the Control room highlights scanner observations that may describe the same underlying issue. Observations can arrive before the final findings report, so a suggested match does not establish that a vulnerability has been confirmed.

Choose **View comparison report** to see both observation titles, descriptions, repositories, affected components, checks, and evidence locations. The report explains which signals match and which details differ. Each observation links to its full evidence and source audit.

## Understand the similarity score

A score such as **93% similarity** measures shared context and wording. It is not a severity score or a 93% probability that the observations describe the same issue. The comparison may be based on a shared component, mapped security controls, source family, and similar titles. Two checks can share these signals while identifying different issues or different deployments.

Review the affected resource, source boundary, files, lines, and check descriptions. Ask the relevant engineer to inspect the evidence if the common root cause is unclear.

## Choose a decision

| Action | Result |
| --- | --- |
| **Confirm same issue** | Observation A remains the primary finding. B is marked as its duplicate and stops counting as a separate active finding. Both records and their evidence are retained. |
| **Keep separate** | Both observations remain independent. The suggestion is closed and the explanation is recorded. |
| **Review later** | The comparison stays pending. Neither observation changes. |

Owners, admins, and analysts can record a decision with an explanation. Read-only members can inspect the report.

## When no decision is needed yet

If an audit is still running, architecture review is pending, or supporting evidence is incomplete, the comparison explains what is missing and disables decisions. Revisit it after the audit and review complete. If an audit failed or was cancelled, complete or retry it first.

---

<!-- Source: workflows/finding-ownership.mdx -->

---
title: Findings, saved views, and ownership
description: Inspect reviewed impact, save useful finding filters, preview repository ownership rules, and follow assignment history.
---

Start from a reviewed finding in the **Impact queue**. Open its consequence, source references, and root-cause context before deciding who should act. Scanner observations and dependency alerts with unverified architectural applicability remain evidence to review.

## Keep useful views

Filter the findings to the team, owner, severity, state, or scope you need, then choose **Save finding view**. Give the view a clear name and choose personal or workspace visibility where your role permits it.

A saved view stores the query configuration. Opening it applies those filters to current authorized findings; it does not freeze the findings themselves. Renaming, updating, or deleting a view follows its ownership and workspace permissions.

## Assign a finding

Choose an eligible workspace member in the finding's owner control. The assignment appears with the finding and is recorded in history. A manually chosen owner takes precedence when automatic routing is applied.

Use the [root-cause and inventory guide](/docs/workflows/service-dependency-inventory) when several findings appear to describe the same structural issue. Coordinating the cause can avoid assigning several disconnected fixes.

## Preview ownership routing

1. Open **Ownership routing** and configure a routing policy for the workspace.
2. Map provider identities from CODEOWNERS to actual workspace members. Unmapped owners do not become new workspace users.
3. Set default deadlines and any supported overrides. Deadlines are calculated from the finding's first observation; rerunning routing does not reset the clock.
4. Save the policy, choose the relevant audit, and select **Preview assignments**.
5. Inspect matched rules, proposed owners, deadlines, unmatched identities, and warnings. Apply the preview only when it matches the intended responsibility.

Unsupported CODEOWNERS syntax and unresolved identities remain visible. Do not assume every provider rule can be applied identically. Preview the effective result, especially for nested paths and overlapping rules.

## Track overdue work

If escalation is enabled, select an eligible escalation recipient and review the configured policy. Assignment history records routing and escalation decisions. Notifications depend on the workspace's configured delivery channel; a recorded decision alone is not proof that an external message was delivered.

Use the [workspace portfolio](/docs/workflows/workspace-portfolio) to find unassigned and overdue findings across the workspaces you can access.

---

<!-- Source: workflows/legacy-migration.mdx -->

---
title: Legacy migration
description: Import sanitized historical context through quarantine, reconciliation, and measured release gates.
---

# Legacy migration

Veriom accepts useful historical context through a one-way import boundary. It does not connect to a legacy database or let imported claims silently become current evidence.

## What can be imported

The `legacy-import-v1` manifest supports workspaces, sources, completed audits, findings, dispositions, comments, tasks, schedules, and context history. Every record includes a stable source ID and revision, while the manifest identifies the source system, source tenant, transformation version, and generation time.

## Safety model

Each record is checksummed and placed in workspace-isolated quarantine. Raw email identities are replaced with keyed references and credential-like fields are removed before storage. A legacy identity can be linked only to an active, verified member of the destination workspace, with explicit operator confirmation.

Dry-run batches cannot publish. Canary, cohort, and final-delta batches publish only after validation and identity confirmation. Published records appear as **historical context**, not live evidence, findings, or architectural truth.

## Operator sequence

1. Enable the `legacy_import` workspace flag.
2. Submit a dry-run manifest in **Admin → Migration & release**.
3. Resolve collisions, rejected identities, and missing references in the source transformation.
4. Confirm identity links to verified workspace members.
5. Publish one canary batch.
6. Reconcile counts and per-kind checksums, then sign the matched report.
7. Rehearse rollback before freezing legacy mutation.
8. Migrate bounded cohorts, freeze the source, and run a final delta.
9. Keep the legacy service offline while production release gates are observed.

## Inspect imported history

Workspace viewers can use `GET /v1/workspaces/{workspace_id}/legacy-history`. The endpoint returns only active, sanitized published history and requires the `legacy_import` flag. Rolled-back records remain auditable to operators but are not returned as active customer history.

## Production release evidence

Veriom records migration, scale, restore, security, and product gate evidence with a status, measurements, immutable evidence references, reason, and operator. A failed gate pauses rollout. Independent penetration testing and restore evidence stay pending until their real artifacts exist.

See the internal [legacy migration and production release runbook](https://github.com/veriom/veriom/blob/main/docs/runbooks/legacy-migration-release.md) for the staged procedure and failure triage.

---

<!-- Source: workflows/model-resilience.mdx -->

---
title: Model resilience and safe recovery
description: Route qualified model work through explicit fallback, circuit recovery, non-publishing shadow evaluation, and immutable checkpoints.
---

Veriom keeps model availability separate from evidence authority. A fallback route can keep a bounded analysis activity available, but it cannot expand what the activity may read, move data to an unapproved region, exceed its budget, or publish an unqualified result.

## Policy-ordered routes

Owners and Admins configure an ordered route set for each activity. Before execution, Veriom checks every route against:

- operator qualification and active endpoint state;
- workspace data residency policy;
- the activity's required model and tool capabilities;
- circuit health and recovery-probe state;
- the remaining reasoning and cost budget.

The worker uses the first eligible route. It advances to the next route only after a retryable provider or transport failure. Cancellation, invalid structured output, policy denial, and budget exhaustion stop the activity instead of sending the same evidence somewhere else.

## Retry, fallback, and recovery are different

| Behavior | Meaning | Provider changes? |
| --- | --- | --- |
| Retry | Repeat a transient request against the same approved endpoint | No |
| Fallback | Continue through the next eligible route in workspace policy | Yes |
| Recovery probe | Test whether an open circuit may safely receive work again | No |

Every decision records a sanitized route identity, disposition, phase, prompt version, latency, token usage, cost, and bounded reason. Prompts, evidence bodies, credentials, and raw provider errors are not returned by the customer API.

## Shadow evaluation cannot become truth

Shadow evaluation compares a separately qualified model on explicitly eligible workloads. Veriom stores support agreement, omissions, contradictions, latency, and cost in a dedicated shadow ledger. Shadow invocations are marked before execution and cannot publish architecture truth, findings, reports, decisions, or remediations.

An operator may qualify or reject a shadow configuration after review. Qualification makes the route eligible for later production policy; it never promotes an old shadow answer into customer truth.

## Compatible checkpoints

Expensive analysis can checkpoint at a measured activity boundary. A checkpoint includes the input and output checksums, contract version, route and model identity, prompt version, policy version, and publication status. Veriom resumes only when all compatibility inputs still match.

If a result was already committed, recovery returns that committed result rather than publishing it again. If policy, prompt, contract, model, or evidence changed, the activity restarts. The workflow service coordinates scheduling and retries.

## What customers can inspect

The workspace **Settings → Resilience** view shows route health, redacted routing decisions, fallback state, circuit status, checkpoint recovery, and shadow-review state. Provider-internal errors and sensitive inputs remain hidden. Operators use a separate authenticated console for recovery probes, circuit actions, shadow decisions, and checkpoint invalidation; every action requires a reason and is audited.

---

<!-- Source: workflows/organizational-discovery.mdx -->

---
title: Organizational discovery
description: Add accountable business context, organize evidence sources, resolve contradictions, and publish a versioned context snapshot.
---

Scanners can observe code, cloud resources, delivery paths, and findings. They cannot safely decide which assets the business considers critical, which data is sensitive, who owns a boundary, or which compliance programs apply. Organizational discovery adds that accountable context without weakening evidence provenance.

## How discovery becomes truth

1. A workspace Analyst, Admin, or Owner starts the discovery profile.
2. Veriom asks the highest-value unanswered question first.
3. Declared answers become confirmed, immutable field revisions.
4. Reconciled evidence may propose cloud or technology context, but never confirms it.
5. Conflicting claims remain visible until a person chooses or corrects the value.
6. Confirmed fields and source-graph relationships publish into a new workspace context snapshot.

<Callout type="info" title="One architecture model">
Discovery does not create another system graph. Confirmed context is an input to the existing Veriom workspace context and canonical architecture model.
</Callout>

## Context fields

The profile covers technology, cloud, infrastructure as code, data sensitivity, critical assets, entrypoints, data stores, important flows, trust boundaries, compensating controls, compliance programs, and ownership.

Each current value exposes:

- its source and source reference;
- confidence and observation time;
- confirmation state;
- sensitivity and architectural impact;
- version and evidence identifiers;
- complete correction and supersession history.

Sensitive values are redacted for Viewer and Developer roles. Evidence-inferred sensitive or high-impact values always require explicit confirmation.

## Source groups and dependencies

Registered repositories, uploads, cloud collections, delivery systems, and MCP evidence can be assigned to source groups such as Checkout, Payments, Identity, or Data Platform. A group records its owner, criticality, and trust boundary.

Dependencies connect two groups with an explicit relationship type, evidence identifiers, data classification, and boundary-crossing status. Archiving a group or dependency is reversible and retains its history.

## Suggestions and contradictions

Evidence suggestions are fingerprinted against the material evidence revision. Rejecting one suppresses the same idea while evidence remains unchanged. Materially new evidence may resurface it for review.

When a new claim disagrees with the current value, Veriom creates a contradiction instead of hiding one side. A declared correction resolves the contradiction by creating a new revision; prior revisions remain inspectable.

## Publication gate

Publishing is available only when every required field is confirmed and no contradiction remains open. The resulting context snapshot contains confirmed fields, active source groups, assigned active sources, and confirmed dependencies. It can be replayed by later audits and safely rolled back without deleting discovery history.

Use the generated [Discovery API reference](/docs/api-reference/workspaces/get_workspaces_by_workspace_id_discovery) for the exact field, group, source, dependency, suggestion, and publication contracts.

---

<!-- Source: workflows/platform-walkthrough.mdx -->

---
title: Explore the platform
description: Start with the architecture, inspect the evidence, explain the intent, and follow differences over time.
---

Start with the [interactive demo](https://veriom.io/demo). It opens a fictional Northstar architecture with its trust boundary and source evidence. Inspect a component before opening findings. The guided path follows source selection, map, truth explorer, intent questions, structural weaknesses and historical drift, without connecting an account.

The demo illustrates the workflow. Its source access checks, findings, deployment records, and progress are sample data. Resetting or reloading clears your changes. Sample downloads contain only the content you approved in the demo; a sample review does not create a live public link.

**Confirm intent** asks four optional questions. At least three answers can annotate different components and the identity-to-store boundary. Every answer remains an editable proposal with its source; skipping or resetting never changes an observed fact. **Intent & drift history** compares two fixed, dated captures with one named fictional approval. It shows why a broader cloud permission invalidates the condition that made a shared identity acceptable. Recorded freshness belongs to each historical evaluation; opening the page does not refresh a capture.

**Capabilities & roadmap** links every scene to its demonstrated behavior. Draft adoption and named ratification are an October workflow preview; the guardrail scene illustrates December behavior. Later planned-change, release-check and source-intake capabilities remain subject to workspace rollout and review. See [Intended architecture](/docs/architecture/intended-architecture) for the actual workflow and evidence boundaries.

## Choose a task

| Area | What to do | Guide |
| --- | --- | --- |
| Proposed intent and history | Answer or skip the intent questions, inspect proposed map annotations, and compare the two dated captures | [Intended architecture](/docs/architecture/intended-architecture) |
| Evidence and repositories | Choose a branch, save its path scope, check repository health, and compare captured commits | [Repository reviews](/docs/workflows/repository-reviews) |
| Review and ownership | Inspect architectural consequence, assign work, save finding views, and preview CODEOWNERS routing | [Finding ownership](/docs/workflows/finding-ownership) |
| Architecture | Follow a root cause, inspect service owners, compare environments, and trace dependency evidence | [Service and dependency inventory](/docs/workflows/service-dependency-inventory) |
| Reporting | Select content, approve a report, and share an expiring snapshot | [Report review links](/docs/workflows/report-review-links) |
| Customer assurance | Import questions, draft cited answers, review exceptions, and export approved responses | [Questionnaires](/docs/workflows/questionnaires) |
| Team oversight | Find stale evidence, unassigned work, and overdue findings across accessible workspaces | [Workspace portfolio](/docs/workflows/workspace-portfolio) |

## Follow one review

1. Choose the workspace that owns the system. Open **Integrations**, connect evidence, and select repositories.
2. Choose a repository branch and profile. Check the captured commit and include/exclude paths before starting the audit.
3. Follow collection, scanning, Context Engine reconciliation, and specialist review. Scanner observations need applicability and architectural review before becoming reviewed impact.
4. Open a finding and inspect its evidence, consequence, and remaining uncertainty. Assign an owner or preview ownership routing.
5. Review the draft report. Confirm its branch, commit, scope, findings, and coverage limitations before approval.
6. Export the approved report or create a review link with explicitly selected content. Use approved report evidence to answer a questionnaire.
7. Return to the portfolio to find the next workspace that needs attention.

## Understand the evidence states

A connected source can still have missing or stale evidence. An observed deployment does not prove a dependency executes at runtime. A manual statement does not become observed evidence simply because it was saved. An empty finding list does not prove that unassessed paths are secure.

Veriom keeps those distinctions visible so the next action is clear: repair access, collect evidence, complete a review, assign an owner, or approve a supported result.

## Automate reviews and keep teams informed

Use [Apps and audit automations](/docs/workflows/apps-and-automations) to schedule a listed branch in your timezone, react to GitHub events, and send audit outcomes to Slack, Discord, email, or your own webhook workflow. Delivery history shows confirmations and retries.

---

<!-- Source: workflows/provider-routing.mdx -->

---
title: Model routing and review boundaries
description: Understand how workspace model choices remain subject to evidence access, review permissions, and usage limits.
---

Veriom separates model choice from evidence access and action authority. A selected route does not expand the evidence a role can retrieve or the actions it can perform.

<SketchDiagram variant="provider-routing" />

## Workspace choices

Where enabled, workspace Owners and Admins choose from the approved model options available to their workspace. They can set a reasoning budget and decide whether an unavailable private endpoint may fall back to the platform route.

The workspace interface shows the available options and applicable usage information. Model availability does not grant permission to publish a change.

## Private endpoints

A private endpoint requires an approved connection and a compatible request format. Follow the workspace setup guidance and API contract for the required configuration. Credentials are write-only and are never returned by the API.

If fallback is disabled, an unavailable or invalid private route fails closed. When fallback is explicitly enabled, the run records that route decision.

## Review and history

Routing changes are versioned inside workspace policy. A private route must reference an active endpoint and an allowed model. Endpoint creation, credential rotation, activation changes, and routing-policy updates create audit events.

Every review keeps its evidence scope and human approval requirements. Contact Veriom to discuss model availability, processing terms, or a private-endpoint requirement.

---

<!-- Source: workflows/questionnaires.mdx -->

---
title: Evidence-backed security questionnaires
description: Import customer questions, draft answers from approved reports, review citations and attestations, and export approved responses.
---

Open **Security questionnaires** in Compliance programs. Each questionnaire retains its questions, source references, answer revisions, and approval history.

## Import the questions

Choose **Import a questionnaire** and provide a title. Upload a UTF-8 CSV or TSV file, or enter one question per line. Files may use comma, semicolon, or tab separators and must have a **Question** column; **Reference** or **ID** is optional. The import supports up to 500 questions and a 2 MB file. Quoted CSV fields preserve line breaks inside a question.

```csv
Reference,Question
SEC-01,How are cloud permissions reviewed?
SEC-02,Is multi-factor authentication required for all staff?
```

References and question order remain available for the final export. If validation fails, correct the named row or header and import again.

## Select approved evidence

Choose the approved report revisions that may support the answers, then draft responses. Open each cited source and check its version, freshness, scope, and relevant excerpt.

A report about repository permissions cannot establish an unrelated company-wide policy. When the selected sources do not support an answer, the response remains unsupported. It should not be filled with an invented assurance.

## Review each response

For a supported answer, confirm that its text follows from the cited evidence before approving it. If you edit the answer, review its provenance again; approval does not carry forward automatically.

When evidence does not establish the answer, an authorized reviewer can provide a statement and explicitly attest to it. An attested answer remains labeled as a reviewer statement. It is not converted into an evidence-backed fact.

Answer history shows the recorded changes and decisions. Changing evidence sources or drafting new content requires another review of the affected answers.

## Export for the requester

Approve the responses required for export, then download the questionnaire CSV. The export preserves question order and references and identifies each answer's basis. Review the resulting file before returning it to the requester, especially any attested statements or coverage limitations.

Try the [interactive demo](https://veriom.io/demo?demo=questionnaires) to see a supported permissions answer and an unsupported MFA question. The demo requires a sample report approval before drafting, and explicit attestation for the unsupported answer.

---

<!-- Source: workflows/report-review-links.mdx -->

---
title: Approve and share a report
description: Review the exact source context, export approved content, and manage expiring report snapshots and reviewer comments.
---

A report should make its conclusion and its limits easy to understand. Before approval, check the repository, branch, commit, assessed paths, profile version, findings, and coverage gaps. Historical reports may lack some source metadata; those fields remain unknown rather than being invented.

## Review the report content

Open the audit report and select the sections and findings that belong in the deliverable. Inspect the preview, including long findings and references, and approve the intended revision with an authorized reviewer.

A restricted path scope remains visible even if you omit the optional coverage section. Changing the report content requires a fresh review and approval. The canonical report revision is the source for its rendered exports; see [report formats](/docs/workflows/reports-remediation).

## Create an external review

1. Open **Report review links** for the approved report.
2. Select the approved sections and findings to share. Review text redactions and decide whether locations and other optional context should be included.
3. Preview the content, choose an expiry, and decide whether reviewers may comment.
4. Create the link and copy the newly issued URL.
5. Inspect **Snapshot and review history** to review access records and comments.

The link grants access to its selected snapshot to anyone who holds it. Share it with the intended recipients. It exposes neither the entire workspace nor future report changes. The content is frozen at creation, and later edits cannot silently broaden it.

Comments are plain text and belong to that review. They do not modify the canonical report or approve remediation.

## Revoke or replace a link

Revoke a link from its history view when it is no longer needed. Expired, revoked, and invalid links cannot open the snapshot. Revocation prevents future access; it cannot remove a copy a recipient already downloaded.

To share a changed report, review and approve the new content, then create a new link. The earlier snapshot remains part of its own history.

## Resolve common report problems

| Symptom | Check |
| --- | --- |
| Approval or sharing is unavailable | Confirm your role, the current report revision, and whether the selected content has been approved |
| A section or finding is absent | Inspect the report builder's selection and the review link's separate content selection |
| A report appears cleaner than expected | Check scope restrictions, collection failures, and evidence-gated exclusions before interpreting the finding count |
| An export fails | Retry that format and retain the error reference; a format failure does not require discarding the audit |
| A reviewer cannot reopen a link | Check expiry or revocation and create a new approved snapshot if appropriate |

For customer questionnaires, reuse the approved report through the [questionnaire workflow](/docs/workflows/questionnaires).

---

<!-- Source: workflows/reports-remediation.mdx -->

---
title: Reports and remediation
description: Canonical report JSON, approval, deterministic exports, patch proposals, static rescans, and human-controlled GitHub pull requests.
---

<SketchDiagram variant="reports-remediation" />

## Canonical first

Versioned Pydantic JSON is the report source of truth. UI views and every export render from the same revision. Agent prose never becomes an export without schema validation, evidence validation, and adjudication.

The report includes executive summary, coverage, architecture-impact dispositions, compliance evidence assessment, architecture diagnostics, comparable history, trust boundaries, threat model, active findings, evidence-gated exclusions, remediation plan, SBOM reference, and an evidence appendix.

The compliance section uses `supported`, `partial`, `gap`, `not applicable`, and `unknown`. It is an evidence mapping, not legal advice or certification. The diagnostic section describes the quality of Veriom's current understanding separately from weaknesses in the customer system. The history section distinguishes structural removal from a fact that was simply not re-observed because collection coverage changed.

## Export pipeline

| Format | Derivation |
| --- | --- |
| JSON | canonical schema serialization |
| Markdown | deterministic renderer from JSON |
| Mermaid | approved constructs from canonical graph views |
| SVG / PNG | server-rendered Mermaid, sanitized before storage |
| DOCX | deterministic OOXML template |
| PDF | conversion from the verified DOCX |

Exports validate schema, links, diagram syntax, SVG safety, text extraction, pagination, and representative visual regressions. Format-specific failures are retryable without rerunning the audit.

## Approve and share

Review the exact branch, commit, source scope, coverage and selected content before approval. An expiring [report review link](/docs/workflows/report-review-links) shares a frozen approved snapshot with optional reviewer comments. For customer assurance, reuse the approved evidence in [security questionnaires](/docs/workflows/questionnaires).

## Remediation flow

1. A Developer or Analyst requests remediation for a confirmed finding.
2. The Remediation Engineer proposes a bounded diff and identifies every touched file.
3. The patch is applied in a disposable working copy.
4. Static scanners rerun against the diff; builds and tests are not executed.
5. An Analyst, Admin, or Owner reviews and approves the proposal.
6. The connected GitHub App receives a short-lived, project-scoped write token and creates one branch and pull request.
7. Veriom records pull-request state but never merges automatically.

<Callout type="warn" title="Workflow changes require explicit approval">
The GitHub App includes Workflow write permission, but Veriom adds it to the short-lived publication token only when an approved, validated patch changes `.github/workflows/`. Audits never receive write access.
</Callout>

---

<!-- Source: workflows/repository-reviews.mdx -->

---
title: Repository reviews and branch comparisons
description: Select a branch, reuse an audit profile, inspect source health, and compare reviews without losing scope or commit provenance.
---

An audit reviews a captured revision of a repository. A branch name can move; the recorded commit identifies the source actually assessed.

## Select the source

Open the repository list in the current workspace. Select a connected repository, choose an available branch, and start an audit. Check the repository, branch, and commit shown with the run. Branch access comes from that repository's authorized provider connection.

If the branch or repository is unavailable, repair the connection before retrying. Veriom does not silently review a different branch. [GitHub access](/docs/integrations/github) explains installation selection; [other repository providers](/docs/integrations/repository-providers) describes their read-only boundaries.

## Save a repeatable profile

In **Audit profiles and repository health**, choose a repository and create a profile. Give it a recognizable name, select its branch and review purpose, and enter repository-relative include and exclude paths.

For example, a payments profile can include `services/payments` and exclude `services/payments/generated`. Omitted paths remain outside the assessment. The profile changes the source sent into ingestion and scanning; it also leaves a scope limitation on reports and comparisons.

Save the profile and use it to start the next review. Each run captures the profile version and settings. Editing or deleting the profile later does not rewrite historical audits. An empty include list means the repository root, subject to exclusions and normal ingestion limits.

## Inspect repository health

The repository health view shows recorded access checks and evidence history. Review the checked time, available branch or revision information, failure reason, and suggested next step. A historical successful check does not guarantee that a provider still grants access today.

Use the connection management link when an installation loses access. Reconnect or refresh access, then retry the intended source. Keep the failed check as part of the history rather than treating it as a clean review.

## Compare audited branches

1. Open **Compare audited branches** and choose the repository.
2. Select a baseline audit and candidate audit. Both selectors identify the captured branch and commit.
3. Compare the runs and inspect new, persistent, resolved, and review-required findings alongside architecture changes.
4. Read the comparability explanation before interpreting a finding as resolved.

The runs must belong to the same repository and have equivalent assessed source scope and comparable analysis policy. Missing coverage, changed paths, unfinished runs, and incompatible policy can make a conclusion require review. A finding absent from a narrower review is not evidence that it was fixed.

Saved comparisons retain their source audit references. A branch comparison is an assessment of captured evidence; it is not a merge approval or proof of the deployed state.

## When a run needs recovery

| Situation | Next action |
| --- | --- |
| Repository missing from the picker | Check the provider account and installation's selected repository access |
| Branch no longer exists | Select an available branch and start a new review with an explicit scope |
| Another audit is active | Follow the existing run or cancel it if your role permits; avoid repeated submissions |
| Scope changed between runs | Run comparable profiles or review the result as incomplete |
| Old report has no recorded revision | Keep that provenance unknown; create a new review to establish it |

Continue with [finding ownership](/docs/workflows/finding-ownership) or the [audit lifecycle](/docs/workflows/audit-lifecycle).

---

<!-- Source: workflows/service-dependency-inventory.mdx -->

---
title: Services, deployments, and dependency impact
description: Connect root causes to affected services and inspect the evidence behind deployment and dependency associations.
---

The inventory connects reviewed architecture to the teams and environments responsible for it. Evidence strength stays visible at each step.

## Trace a root cause

Open the **Root-cause explorer** from reviewed structural context. Select an affected entity to inspect its relationships, related findings, source evidence, and associated remediation programs.

Follow the evidence references before interpreting a path as reachable. A graph edge summarizes a supported relationship or an explicitly qualified inference; missing evidence and contradictions remain part of the result. Selecting an entity narrows the inspected relationships and evidence rather than changing the underlying review.

## Maintain the service inventory

Open **Service inventory** to see the workspace's recorded services. Refresh from an existing audit to reuse retained architecture evidence. Where your role permits, add a service, update its owner or repository association, and record a deployment.

Service ownership identifies responsibility. It does not grant workspace membership or establish provider permissions.

## Distinguish deployment evidence

| State | What it establishes |
| --- | --- |
| Observed | Retained deployment evidence matches the service or repository, environment, event, and deployed facts |
| Attested | A producer asserts the deployment, but matching retained proof is incomplete |
| Declared | A person records the intended or known deployment without provider observation |
| Unknown | The required deployment information has not been established |

A branch name in a manifest is not proof of a live deployment. Compare environments using their recorded commits, image digests, timestamps, evidence state, and discrepancies. Keep declared and observed differences distinct.

## Inspect dependency impact

Search **Dependency impact** by package or vulnerability reference. Open a result to inspect the package version, SBOM source, repository or service, audit revision, vulnerability evidence, and any deployment association.

There are separate questions:

- Is the package present in the assessed source or SBOM?
- Does a recorded deployment correspond to that assessed commit or artifact?
- Is the vulnerable behavior reachable or executed in that environment?

An SBOM answers the first question. Matching deployment evidence can support the second. Neither automatically answers the third. Runtime reachability stays unknown when the supporting evidence is missing, and an association alone does not promote an advisory into reviewed architectural impact.

For repeatable revision comparisons, use [repository reviews](/docs/workflows/repository-reviews). For coordinated remediation, continue to [reports and remediation](/docs/workflows/reports-remediation).

---

<!-- Source: workflows/structural-release-gates.mdx -->

---
title: Structural release gates
description: How versioned invariants move from fixtures through shadow evaluation into release-blocking decisions without silently passing missing evidence.
---

<DocEyebrow>Safe promotion for deterministic architecture checks</DocEyebrow>

An invariant version is immutable. Changing its query, thresholds, or required ledgers creates a new version with a new content hash. That version must prove itself before it can influence a release.

<Callout type="info" title="Ratified-intent checks are a controlled preview">
  This guide describes the existing structural invariant lifecycle. The
  [intended-architecture workflow](/docs/architecture/intended-architecture)
  adds release policies pinned to an approved target. Those policies begin in
  shadow and need reviewed evidence before enforcement; the public demo does not
  enable a release gate.
</Callout>

## Promotion path

| State             | Purpose                                                                             | Can block a release?     |
| ----------------- | ----------------------------------------------------------------------------------- | ------------------------ |
| Draft             | Author the statement, graph query, evidence requirements, and remediation contract. | No                       |
| Fixture validated | Pass the reference true-positive and benign cases with deterministic output.        | No                       |
| Shadow            | Evaluate on real audits and record results without changing customer state.         | No                       |
| Review            | Examine disagreements, missing-evidence rates, and customer-confirmed outcomes.     | No                       |
| Enforced          | Apply the approved gate policy using the pinned invariant version.                  | Yes, when policy says so |
| Retired           | Preserve historical reproducibility but stop evaluating new audits.                 | No                       |

## Gate outcomes

- **Pass** means every required ledger was present and the invariant evaluated false.
- **Review** means the invariant produced a hypothesis, a low-confidence path, or a policy requires human confirmation.
- **Blocked** means an enforced invariant produced an asserted result that matches the release policy.
- **Insufficient evidence** means one or more required ledgers were absent. It never renders as pass.

## Before promotion

1. Run every positive and benign fixture and compare stable finding IDs.
2. Confirm taxonomy snapshots change labels only, not the detected set.
3. Run the version in shadow on representative workspaces.
4. Review false-positive, false-negative, and insufficient-evidence samples.
5. Confirm the UI exposes the path, ledgers, confidence, and verification predicate.
6. Record reviewer, invariant hash, decision, and rollback version.

The operator control plane enforces a minimum of 50 reviewed samples and requires observed precision to meet the invariant's target before the `enforced` transition succeeds. A code-owned invariant that is not blocking-eligible cannot be promoted into a blocking state.

<Callout type="warning" title="A clean gate needs evidence">
  Missing cloud, CI/CD, runtime, or IaC evidence is a coverage result. It is not
  evidence that the structure is safe.
</Callout>

Every completed audit records its gate mode, outcome, reasons, enforced invariant IDs, and evaluation time. In shadow mode the result is visible but cannot block. In enforced mode a failing blocking invariant records `blocks_release: true`; insufficient evidence remains a distinct outcome and does not silently pass.

## Consequence-proportional enforcement

The enforced gate uses the affected asset class as an input, not merely the invariant ID. Crown-jewel failures block automatically, and missing evidence for a crown-jewel-scoped invariant is itself a typed blocking result. Configured invariant failures block at `critical` scope or above by default; important, standard, low-confidence, and below-threshold failures remain visible for review. Every reason records its code, invariant version, asset class, effective severity, confidence, match count, and missing ledgers.

Path analysis follows the same principle while remaining bounded: standard and unknown targets use the invariant's declared hop cap, important targets may search up to six hops, critical targets up to eight, and crown jewels up to twelve. The engine still applies preconditions, per-target result limits, and path-confidence floors, so deeper assurance does not become an unbounded traversal.

## Remediation tiers

**R1** changes a local configuration or identity boundary. **R2** changes a shared code or architecture pattern. **R3** changes an organization-level dependency or control design. Generated proposals remain reviewable, and verification re-evaluates the original invariant against freshly collected evidence.

<Cards>
  <Card
    title="Structural weakness engine"
    href="/docs/architecture/structural-weaknesses"
    description="Understand the finding contract, invariants, evidence, and root causes."
  />
  <Card
    title="Reports and remediation"
    href="/docs/workflows/reports-remediation"
    description="Turn reviewed findings into controlled engineering work."
  />
</Cards>

---

<!-- Source: workflows/workflow-actions.mdx -->

---
title: Authorized workflow actions
description: Create tickets, route finding ownership, and record policy exceptions through capability-specific grants and separate human approval.
---

Veriom separates event delivery from consequential actions. A signed webhook can announce that an audit completed; it cannot create a ticket, assign a finding, or accept risk. Each action requires an active capability grant, a typed request, and a different authorized person to approve it.

<SketchDiagram variant="workflow-actions" />

## Capabilities

| Capability        | Provider | Effect after approval                                                        | Minimum approver |
| ----------------- | -------- | ---------------------------------------------------------------------------- | ---------------- |
| Ticket creation   | Jira     | Create one issue for the selected finding and retain its external ID and URL | Admin            |
| Ownership routing | Internal | Assign the selected workspace member to one finding                          | Admin            |
| Policy exception  | Internal | Record a bounded accepted-risk state with a reason and required expiry       | Owner            |

An authorization grants only one capability. Jira credentials are encrypted and write-only. Internal ownership and exception grants have no external credential.

## Request and approval lifecycle

1. An Owner or Admin creates a capability authorization in **Settings → Automation**.
2. A workspace member requests a typed action for one finding.
3. Veriom stores it as `pending_approval`; no side effect has occurred.
4. A different Admin or Owner reviews the target, reason, and capability. Policy exceptions require an Owner.
5. Approval enqueues a durable outbox item. Rejection ends the action without execution.
6. The worker performs only the authorized capability and records attempts, result, external reference, and safe error code.

The requester cannot approve their own request. Directly changing a finding to accepted risk is rejected by the API; the policy-exception workflow is the only supported path.

## Failure and replay behavior

Every action request requires an idempotency key. Worker execution is retry-safe and bounded. A Jira timeout or provider error keeps the error code visible without exposing the credential or external response body. Operators can inspect grant state, pending approvals, attempts, and results from the private admin dashboard.

<Callout type="warn" title="No ambient agent authority">
  Specialist agents may prepare evidence and suggested text, but they cannot
  create or approve a workflow action. Authorization, approval, and worker
  execution are separate system boundaries.
</Callout>

For notification-only destinations, see [team workflow destinations](/docs/integrations/team-workflows).

---

<!-- Source: workflows/workspace-access.mdx -->

---
title: Workspace access and roles
description: Invite people, review access, and enforce least-privilege workspace capabilities.
---

A workspace is the tenant boundary for members, repositories, evidence, policies, audits, and actions. Membership is explicit: platform access alone never grants access to a workspace.

## Invite a teammate

Owners and Admins can invite a verified email address from **Members**. An existing Veriom account receives an in-product invitation and can accept or decline it. A new user receives an account-bound registration link. Invitations expire after seven days, can be resent or revoked, and cannot be accepted by a different account.

New accounts verify their email before signing in. A user can request a replacement verification link without revealing whether an account exists; requests are protected by Turnstile and short resend cooldowns. If initial email delivery fails, registration and invitation redemption are rolled back together so the user can retry instead of being left with an inaccessible account.

Invitations are idempotent while pending. Repeating the same invitation rotates its one-time token instead of creating multiple active records. Suspended accounts and existing members are rejected.

## Role capabilities

| Role | Intended capability |
| --- | --- |
| Viewer | Inspect repositories, evidence, findings, reports, usage, policies, and member identity |
| Developer | Run audits, submit evidence and uploads, request remediation, and request workflow actions |
| Analyst | Classify findings, approve reports and remediation, and approve bounded workflow actions |
| Admin | Manage repositories, policies, members, invitations, and all Analyst capabilities |
| Owner | Full workspace control, including Admin and Owner membership changes |

The API evaluates both the minimum role and the named permission on every scoped route. Browser sessions do not bypass scope checks. Workspace API tokens are constrained by their explicit scopes and by the current role of the member who created them.

Use [`GET /v1/workspaces/{workspace_id}/access`](/docs/api-reference/workspaces/get_workspaces_by_workspace_id_access) to retrieve the server-authoritative role and permission list for the current identity.

## Membership safeguards

- Only an Owner can invite, add, change, or remove an Admin or Owner.
- Ownership cannot be assigned through an invitation.
- A workspace must always retain at least one Owner.
- A user cannot accept an invitation issued to another email or account.
- Accept and decline decisions are serialized so the same invitation cannot produce competing membership state.
- Membership and invitation changes create workspace audit events.

The generated API reference covers [workspace invitations](/docs/api-reference/workspaces/post_workspaces_by_workspace_id_invitations), [pending invitations](/docs/api-reference/workspaces/get_me_invitations), and [membership changes](/docs/api-reference/workspaces/patch_workspaces_by_workspace_id_members_by_membership_id).

## Policies are workspace-scoped

Workspace policy changes require Admin or Owner access. Policy versions remain attributable to the member who changed them, and downstream audit, report, remediation, and workflow-action checks continue to enforce their own role and permission gates.

---

<!-- Source: workflows/workspace-intelligence.mdx -->

---
title: Workspace Intelligence
description: Ask evidence-grounded questions, inspect reconciled context, prioritize recommendations, and understand evidence and processing limits.
---

Workspace Intelligence turns the latest architectural truth in a workspace into a shared, reviewable conversation. It combines three surfaces: **Recommendations**, **Ask Veriom**, and **Context**.

<SketchDiagram variant="workspace-intelligence" />

## Recommendations

Recommendations turn existing audit artifacts into prioritized follow-up work. Every recommendation has a category, priority, confidence, lifecycle state, and evidence references.

Teams can:

- acknowledge a recommendation;
- assign it to a workspace member;
- snooze it until a specific time;
- dismiss it with a recorded reason;
- discuss it in a shared conversation;
- prepare a remediation proposal.

Preparing an action does not mutate the workspace. Veriom returns inert action data first. The existing audit, report, and remediation permissions are checked again when someone explicitly confirms an action.

## Ask Veriom

Every workspace member can ask questions about the evidence Veriom has already collected. Conversations are shared with the workspace and retained until their creator—or a workspace Admin or Owner—deletes them.

Typical questions include:

- Which services can reach the customer database?
- Why does Veriom believe this trust boundary exists?
- Which findings affect the deployment path?
- What changed between the latest two audits?
- Which recommendation should the team address first, and why?

The answer workflow has visible states: queued, gathering context, routing, specialist review, citation verification, completed, cached, limited, cancelled, or failed. The application streams these states without exposing hidden reasoning or model tool transcripts.

## Grounding contract

Veriom only makes factual workspace claims when it can cite accessible evidence IDs from the same tenant and selected source scope. Unsupported conclusions are labelled as hypotheses or coverage gaps.

The assistant cannot use:

- a shell or unrestricted source access;
- arbitrary SQL;
- external browsing;
- outbound MCP tool execution;
- another tenant's context or cache;
- a prepared action as authorization to change the workspace.

Repository and source text is always treated as untrusted data, including text that resembles instructions to an agent.

## Context inspector

The Context view exposes the snapshot used for answers:

| Signal | What it tells you |
| --- | --- |
| Context hash | The exact reconciled truth version used for retrieval and caching |
| Generated time | When the workspace snapshot was rebuilt |
| Source freshness | When each repository, upload, or MCP source was last observed |
| Coverage | Which expected evidence signals were present or missing |
| Entities and relationships | The structural facts currently believed to exist |
| Contradictions | Evidence that disagrees and still needs review |
| Superseded facts | Historical truth replaced by newer evidence |

The latest valid snapshot for each repository, upload, and MCP source forms the default context. Historical snapshots are retrieved only when the question explicitly asks for a comparison.

## Processing limits

The default launch allowance is:

- 20 questions per user per day;
- 100 questions per workspace per day;
- one active run per user and two per workspace;
- 1,200 final-answer tokens;
- a $10 monthly assistant cap nested inside the workspace model quota.

Limit checks happen before a model call and return a typed error with the reset time. The response identifies the affected allowance and when work can resume. Existing grounded answers and their citations remain available.

<Callout type="info" title="Operator governance">
Platform Operators can inspect metadata-only context health, run status, and recommendations. They can change workspace assistant allowances or cancel an active run. Every control action creates an immutable audit event; prompts, answers, source, and evidence content are not exposed in the operator dashboard.
</Callout>

## API flow

Create a shared conversation, submit a question with an idempotency key, then follow the durable run event stream:

```http
POST /v1/workspaces/{workspace_id}/assistant/conversations
POST /v1/workspaces/{workspace_id}/assistant/conversations/{conversation_id}/messages
Idempotency-Key: question-unique-123

GET /v1/workspaces/{workspace_id}/assistant/runs/{run_id}/events
```

Use the [generated Workspace Intelligence reference](/docs/api-reference/workspace-intelligence) for request and response schemas.

---

<!-- Source: workflows/workspace-portfolio.mdx -->

---
title: Workspace portfolio
description: Review risk, evidence freshness, ownership, and overdue work across the workspaces you are authorized to access.
---

Open **Workspace portfolio** to decide which system needs attention next. The view includes only workspaces available to your current identity; it does not combine unrelated tenants into a shared report.

## Read the portfolio

For each workspace, inspect its latest review, evidence freshness, reviewed risk, ownership, overdue findings, and available history. Open the workspace to investigate the underlying evidence or take action.

The portfolio is a summary of retained observations. Check the measurement time and source scope before comparing systems. Different repository coverage or review ages can explain a difference in findings.

## Turn a signal into an action

| Signal | Next step |
| --- | --- |
| No review or missing evidence | Connect a source and start a scoped audit |
| Stale evidence or failed access | Inspect repository health, repair access, and refresh the review |
| Reviewed high impact | Open the finding and root-cause evidence, then coordinate remediation |
| Unassigned work | Assign a member or preview the ownership policy |
| Overdue findings | Review the deadline, responsible owner, and recorded escalation |
| Unknown comparison history | Establish a comparable baseline before claiming improvement |

A workspace with no observed findings may still have missing coverage. An unknown trend remains unknown. The portfolio does not infer that risk improved simply because the latest review assessed fewer files.

Use [repository reviews](/docs/workflows/repository-reviews) to establish comparable evidence and [finding ownership](/docs/workflows/finding-ownership) to make the next action accountable.