{
  "openapi": "3.1.0",
  "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
  "info": {
    "title": "Sectigo Axiom action contract",
    "version": "2026-11-14",
    "summary": "Submit, status and resume - the three base operations - plus cancel, receipt, delegation and the provider interface.",
    "description": "Machine-readable contract for agents that cannot install the Axiom Gateway agent skill (see SKILL.md).\n\nRules that the schema cannot express:\n- An action ID alone never proves permission; status and resume require the original agent's DPoP-bound token.\n- Reuse the same `operation_key` for every retry of one intent. A changed material field under the same key is `idempotency_conflict`.\n- After dispatch (`executing`, `outcome_unknown`) only read status. Never resubmit or resume again.\n- A wake event (webhook) is a hint to read status, never authority."
  },
  "servers": [{ "url": "https://api.sectigoaxiom.com" }, { "url": "http://localhost:8787", "description": "local development" }],
  "tags": [
    { "name": "Agent", "description": "Called by the agent with a DPoP-bound access token" },
    { "name": "Provider", "description": "Called by the receiving application with a project API key (embedded SDK)" },
    { "name": "Provider-implemented", "description": "Implemented by the receiving application; called by Axiom" },
    { "name": "Discovery" }
  ],
  "paths": {
    "/v1/capabilities": {
      "get": {
        "tags": ["Discovery"],
        "operationId": "getCapabilities",
        "summary": "Supported wait modes, warm-wait bound, retry interval and endpoints",
        "responses": {
          "200": {
            "description": "Capabilities",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Capabilities" } } }
          }
        }
      }
    },
    "/.well-known/jwks.json": {
      "get": {
        "tags": ["Discovery"],
        "operationId": "getJwks",
        "summary": "Every Axiom signing key ever used, annotated with axiom:role and axiom:status",
        "responses": { "200": { "description": "JWK set" } }
      }
    },
    "/oauth/token": {
      "post": {
        "tags": ["Agent"],
        "operationId": "getToken",
        "summary": "client_credentials with private_key_jwt (RFC 7523) and a DPoP proof (RFC 9449)",
        "parameters": [
          {
            "name": "DPoP",
            "in": "header",
            "required": true,
            "schema": { "type": "string" },
            "description": "Proof with htm=POST, htu=token endpoint"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": ["grant_type", "client_id", "client_assertion_type", "client_assertion"],
                "properties": {
                  "grant_type": { "const": "client_credentials" },
                  "client_id": { "type": "string", "description": "Stable agent ID" },
                  "client_assertion_type": { "const": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" },
                  "client_assertion": {
                    "type": "string",
                    "description": "JWT signed by the enrolled key: iss=sub=agent ID, aud=token endpoint, jti, exp <= 10 min"
                  },
                  "scope": { "type": "string", "default": "actions:submit actions:read" },
                  "resource": { "type": "string" }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "DPoP-bound access token (5 minutes)",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TokenResponse" } } }
          },
          "400": { "description": "OAuth error (RFC 6749 §5.2)" },
          "401": { "description": "invalid_client or invalid_dpop_proof" }
        }
      }
    },
    "/v1/actions": {
      "post": {
        "tags": ["Agent"],
        "operationId": "submitAction",
        "summary": "Submit an action; returns its durable ID and state",
        "security": [{ "dpop": [] }],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitActionRequest" } } }
        },
        "responses": {
          "200": {
            "description": "Replay of an existing action with the same operation key and request",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "201": {
            "description": "Created and completed (or closed) synchronously",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "202": {
            "description": "pending_approval or approved: persist the ID and wait",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "403": {
            "description": "Denied before an action was created (e.g. tenant_mismatch)",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          },
          "409": {
            "description": "idempotency_conflict: same operation key, different material request; see changed_fields",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          },
          "422": {
            "description": "validation_failed",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/actions/{action_id}": {
      "get": {
        "tags": ["Agent"],
        "operationId": "getActionStatus",
        "summary": "Authenticated status read (the only source of truth)",
        "security": [{ "dpop": [] }],
        "parameters": [
          { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^act_[0-9a-z]{26}$" } }
        ],
        "responses": {
          "200": {
            "description": "Current status",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "404": {
            "description": "Not found, or not visible to this caller",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/actions/{action_id}/resume": {
      "post": {
        "tags": ["Agent"],
        "operationId": "resumeAction",
        "summary": "Resume an approved action as the original agent with the approved params",
        "security": [{ "dpop": [] }],
        "parameters": [
          { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^act_[0-9a-z]{26}$" } }
        ],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResumeActionRequest" } } }
        },
        "responses": {
          "200": {
            "description": "Final or closed state",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "202": {
            "description": "executing: track by status reads only",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "403": {
            "description": "wrong_resume_actor or a policy recheck failed",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          },
          "409": {
            "description": "invalid_state (not yet approved; honour retry_after_seconds) or conflict (params differ from the approval)",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/actions/{action_id}/cancel": {
      "post": {
        "tags": ["Agent"],
        "operationId": "cancelAction",
        "security": [{ "dpop": [] }],
        "parameters": [
          { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^act_[0-9a-z]{26}$" } }
        ],
        "responses": {
          "200": {
            "description": "Cancelled (or already closed)",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          }
        }
      }
    },
    "/v1/actions/{action_id}/receipt": {
      "get": {
        "tags": ["Agent"],
        "operationId": "getReceipt",
        "summary": "Signed receipt bundle; verify offline with the embedded key snapshot",
        "security": [{ "dpop": [] }],
        "parameters": [
          { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^act_[0-9a-z]{26}$" } },
          {
            "name": "reveal",
            "in": "query",
            "required": false,
            "schema": { "type": "string" },
            "description": "Comma-separated fields to disclose"
          }
        ],
        "responses": {
          "200": {
            "description": "Receipt bundle",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReceiptBundle" } } }
          },
          "404": {
            "description": "Not found",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/grants/{grant_id}/delegate": {
      "post": {
        "tags": ["Agent"],
        "operationId": "delegate",
        "summary": "Explicit delegation: a narrower child grant for another agent, bound to one root action",
        "security": [{ "dpop": [] }],
        "parameters": [{ "name": "grant_id", "in": "path", "required": true, "schema": { "type": "string" } }],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DelegateRequest" } } }
        },
        "responses": {
          "201": {
            "description": "Child grant",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DelegationResult" } } }
          },
          "403": {
            "description": "Delegation not permitted",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/authorize": {
      "post": {
        "tags": ["Provider"],
        "operationId": "authorize",
        "summary": "Embedded SDK: forward the agent's DPoP token and proof plus authoritative action fields",
        "security": [{ "projectApiKey": [] }],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthorizeRequest" } } }
        },
        "responses": {
          "200": {
            "description": "Decision",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthorizeResponse" } } }
          }
        }
      }
    },
    "/v1/actions/{action_id}/outcome": {
      "post": {
        "tags": ["Provider"],
        "operationId": "reportOutcome",
        "summary": "Embedded SDK: report the provider-signed axiom.outcome.v1 attestation",
        "security": [{ "projectApiKey": [] }],
        "parameters": [
          { "name": "action_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^act_[0-9a-z]{26}$" } }
        ],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OutcomeRequest" } } }
        },
        "responses": {
          "200": {
            "description": "Closed with the attested outcome",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionStatus" } } }
          },
          "403": {
            "description": "Attestation rejected",
            "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }
          }
        }
      }
    },
    "/v1/projects/{project_id}/simulate": {
      "post": {
        "tags": ["Provider"],
        "operationId": "simulatePolicy",
        "summary": "Policy simulator: expected allow / deny / approval with the rule trace; creates nothing",
        "security": [{ "projectApiKey": [] }],
        "parameters": [{ "name": "project_id", "in": "path", "required": true, "schema": { "type": "string" } }],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimulateRequest" } } }
        },
        "responses": { "200": { "description": "Decision and trace" } }
      }
    },
    "/.well-known/axiom/operations/{operation_key}": {
      "get": {
        "tags": ["Provider-implemented"],
        "operationId": "lookupOperation",
        "summary": "Reconciliation lookup Axiom calls on the provider after an unknown outcome",
        "servers": [{ "url": "https://{provider}", "variables": { "provider": { "default": "sample.sectigoaxiom.com" } } }],
        "parameters": [
          { "name": "operation_key", "in": "path", "required": true, "schema": { "type": "string" } },
          {
            "name": "Axiom-Authorization",
            "in": "header",
            "required": true,
            "schema": { "type": "string" },
            "description": "axiom.dispatch.v1 JWS for the same operation key"
          }
        ],
        "responses": {
          "200": {
            "description": "Committed result",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": ["state", "attestation"],
                  "properties": {
                    "state": { "enum": ["succeeded", "failed"] },
                    "attestation": { "type": "string" },
                    "target_ref": { "type": "string" }
                  }
                }
              }
            }
          },
          "404": { "description": "The operation key never committed" }
        }
      }
    }
  },
  "webhooks": {
    "wakeEvent": {
      "post": {
        "summary": "Signed, data-minimised wake event. Verify with the issuer JWKS (role event), drop seq <= last processed, then read status.",
        "parameters": [{ "name": "Axiom-Event-Id", "in": "header", "schema": { "type": "string" } }],
        "requestBody": {
          "required": true,
          "content": {
            "application/jose": { "schema": { "type": "string", "description": "Compact JWS, typ axiom-event+jws; payload is WakeEvent" } }
          }
        },
        "responses": { "2XX": { "description": "Accepted" } }
      }
    }
  },
  "components": {
    "schemas": {
      "SubmitActionRequest": {
        "$id": "#/components/schemas/SubmitActionRequest",
        "type": "object",
        "properties": {
          "operation_key": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Client-provided idempotency key, stable across retries"
          },
          "operation": { "type": "string", "minLength": 1, "maxLength": 128 },
          "service": { "type": "string", "minLength": 1 },
          "tenant": { "type": "string", "minLength": 1 },
          "resource": {
            "type": "object",
            "properties": {
              "type": { "type": "string", "minLength": 1, "maxLength": 64 },
              "id": { "type": "string", "minLength": 1, "maxLength": 256 }
            },
            "required": ["type", "id"]
          },
          "params": {
            "type": "object",
            "propertyNames": { "type": "string" },
            "additionalProperties": { "$ref": "#/components/schemas/Json" }
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
          },
          "parent_action_id": { "type": "string" },
          "intent": { "type": "string", "maxLength": 500 },
          "payload": {
            "type": "object",
            "propertyNames": { "type": "string" },
            "additionalProperties": { "$ref": "#/components/schemas/Json" }
          },
          "execute": { "default": true, "type": "boolean" }
        },
        "required": ["operation_key", "operation", "service", "tenant", "resource", "params"],
        "description": "Submit an action"
      },
      "ResumeActionRequest": {
        "$id": "#/components/schemas/ResumeActionRequest",
        "type": "object",
        "properties": {
          "operation_key": { "type": "string", "minLength": 8, "maxLength": 200 },
          "resource": {
            "type": "object",
            "properties": {
              "type": { "type": "string", "minLength": 1, "maxLength": 64 },
              "id": { "type": "string", "minLength": 1, "maxLength": 256 }
            },
            "required": ["type", "id"]
          },
          "params": {
            "type": "object",
            "propertyNames": { "type": "string" },
            "additionalProperties": { "$ref": "#/components/schemas/Json" }
          },
          "payload": {
            "type": "object",
            "propertyNames": { "type": "string" },
            "additionalProperties": { "$ref": "#/components/schemas/Json" }
          }
        },
        "required": ["operation_key", "resource", "params"],
        "description": "Resume an approved action as the original agent"
      },
      "DelegateRequest": {
        "$id": "#/components/schemas/DelegateRequest",
        "type": "object",
        "properties": {
          "child_agent": { "type": "string" },
          "root_action_id": { "type": "string" },
          "operations": { "minItems": 1, "type": "array", "items": { "type": "string" } },
          "resources": {
            "minItems": 1,
            "type": "array",
            "items": {
              "type": "object",
              "properties": { "type": { "type": "string" }, "id": { "type": "string" } },
              "required": ["type", "id"]
            }
          },
          "expires_at": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
          }
        },
        "required": ["child_agent", "root_action_id", "operations", "resources", "expires_at"]
      },
      "AuthorizeRequest": {
        "$id": "#/components/schemas/AuthorizeRequest",
        "type": "object",
        "properties": {
          "agent": {
            "type": "object",
            "properties": {
              "authorization": { "type": "string", "description": "The agent's Authorization header, e.g. `DPoP axa_…`" },
              "dpop": { "type": "string", "description": "The agent's DPoP proof header" },
              "htm": { "type": "string", "description": "HTTP method the provider received" },
              "htu": { "type": "string", "format": "uri", "description": "Full URL the provider received" }
            },
            "required": ["authorization", "dpop", "htm", "htu"]
          },
          "action": {
            "type": "object",
            "properties": {
              "operation_key": {
                "type": "string",
                "minLength": 8,
                "maxLength": 200,
                "description": "Client-provided idempotency key, stable across retries"
              },
              "operation": { "type": "string", "minLength": 1, "maxLength": 128 },
              "service": { "type": "string", "minLength": 1 },
              "tenant": { "type": "string", "minLength": 1 },
              "resource": {
                "type": "object",
                "properties": {
                  "type": { "type": "string", "minLength": 1, "maxLength": 64 },
                  "id": { "type": "string", "minLength": 1, "maxLength": 256 }
                },
                "required": ["type", "id"]
              },
              "params": {
                "type": "object",
                "propertyNames": { "type": "string" },
                "additionalProperties": { "$ref": "#/components/schemas/Json" }
              },
              "not_after": {
                "type": "string",
                "format": "date-time",
                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
              },
              "parent_action_id": { "type": "string" },
              "intent": { "type": "string", "maxLength": 500 }
            },
            "required": ["operation_key", "operation", "service", "tenant", "resource", "params"]
          }
        },
        "required": ["agent", "action"]
      },
      "OutcomeRequest": {
        "$id": "#/components/schemas/OutcomeRequest",
        "type": "object",
        "properties": {
          "attestation": {
            "type": "string",
            "description": "Compact JWS of an axiom.outcome.v1 document signed by a registered provider key"
          }
        },
        "required": ["attestation"]
      },
      "SimulateRequest": {
        "$id": "#/components/schemas/SimulateRequest",
        "type": "object",
        "properties": {
          "service_id": { "type": "string" },
          "operation": { "type": "string" },
          "tenant_id": { "type": "string" },
          "agent_id": { "type": "string" },
          "grant_id": { "type": "string" },
          "resource": {
            "type": "object",
            "properties": { "type": { "type": "string" }, "id": { "type": "string" } },
            "required": ["type", "id"]
          },
          "params": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} },
          "environment": { "type": "string" },
          "candidate": {
            "type": "object",
            "properties": {
              "policy_id": { "type": "string" },
              "rules": {
                "maxItems": 200,
                "type": "array",
                "items": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }
              }
            },
            "required": ["rules"]
          }
        },
        "required": ["service_id", "operation", "tenant_id", "resource", "params"]
      },
      "ActionStatus": {
        "$id": "#/components/schemas/ActionStatus",
        "type": "object",
        "properties": {
          "action_id": { "type": "string" },
          "root_action_id": { "type": "string" },
          "parent_action_id": { "type": "string" },
          "state": { "$ref": "#/components/schemas/ActionState" },
          "reason_code": { "$ref": "#/components/schemas/ReasonCode" },
          "progress": {
            "type": "string",
            "enum": ["delivery_pending", "waiting_on_person", "decision_readback_unavailable", "awaiting_agent_resume", "reconciling"]
          },
          "operation": { "type": "string" },
          "operation_key": { "type": "string" },
          "tenant": { "type": "string" },
          "service": { "type": "string" },
          "grant_id": { "type": "string" },
          "request_digest": { "type": "string", "description": "sha-256 digest of the canonical action the approver saw" },
          "summary": { "type": "string" },
          "status_url": { "type": "string" },
          "resume_url": { "type": "string" },
          "receipt_url": { "type": "string" },
          "decision_deadline": { "description": "Deadline to receive a verified decision", "type": "string" },
          "resume_deadline": { "description": "Last time to resume an approved action", "type": "string" },
          "expires_at": { "type": "string", "description": "RFC 3339 timestamp" },
          "retry_after_seconds": {
            "description": "Poll no sooner than this",
            "type": "integer",
            "minimum": 0,
            "maximum": 9007199254740991
          },
          "supported_modes": { "type": "array", "items": { "type": "string", "enum": ["poll", "webhook", "mcp_task", "sse"] } },
          "resume_actor": { "type": "string", "const": "original_agent" },
          "approvals": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "required": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
                "received": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
                "role": { "type": "string" },
                "system": { "type": "string" },
                "next_party": { "type": "string" }
              },
              "required": ["required", "received", "role", "system"]
            }
          },
          "outcome": {
            "type": "object",
            "properties": {
              "state": { "type": "string", "enum": ["succeeded", "failed", "outcome_unknown"] },
              "target_ref": { "type": "string" },
              "recorded_at": { "type": "string", "description": "RFC 3339 timestamp" },
              "result": { "$ref": "#/components/schemas/Json" }
            },
            "required": ["state", "recorded_at"]
          },
          "created_at": { "type": "string", "description": "RFC 3339 timestamp" },
          "updated_at": { "type": "string", "description": "RFC 3339 timestamp" }
        },
        "required": [
          "action_id",
          "root_action_id",
          "state",
          "reason_code",
          "operation",
          "operation_key",
          "tenant",
          "service",
          "request_digest",
          "summary",
          "status_url",
          "resume_url",
          "supported_modes",
          "resume_actor",
          "created_at",
          "updated_at"
        ],
        "description": "Authoritative action status"
      },
      "ActionState": {
        "$id": "#/components/schemas/ActionState",
        "type": "string",
        "enum": [
          "pending_approval",
          "approved",
          "executing",
          "succeeded",
          "failed",
          "outcome_unknown",
          "denied",
          "expired",
          "revoked",
          "cancelled"
        ],
        "description": "Action lifecycle state (brief §5 state table)"
      },
      "ReasonCode": {
        "$id": "#/components/schemas/ReasonCode",
        "type": "string",
        "enum": [
          "allowed_by_grant",
          "approval_required",
          "finance_approval_required",
          "second_approver_required",
          "awaiting_delivery",
          "awaiting_decision",
          "decision_readback_unavailable",
          "awaiting_agent_resume",
          "no_grant",
          "grant_expired",
          "grant_revoked",
          "grant_scope_mismatch",
          "tenant_mismatch",
          "audience_mismatch",
          "resource_not_permitted",
          "operation_not_permitted",
          "agent_suspended",
          "agent_retired",
          "credential_revoked",
          "issuer_not_trusted",
          "ceiling_exceeded",
          "policy_deny",
          "emergency_deny",
          "delegation_not_permitted",
          "delegation_expands_scope",
          "delegation_depth_exceeded",
          "wrong_resume_actor",
          "material_change",
          "approval_denied",
          "approval_expired",
          "approver_ineligible",
          "separation_of_duties",
          "policy_stale",
          "status_stale",
          "quota_exceeded",
          "invalid_request",
          "dispatched",
          "target_confirmed",
          "target_failed",
          "target_timeout",
          "gateway_observed_success",
          "gateway_observed_failure",
          "resume_expired",
          "reconciled",
          "cancelled_by_requester"
        ],
        "description": "Why the action is in its state"
      },
      "Problem": {
        "$id": "#/components/schemas/Problem",
        "type": "object",
        "properties": {
          "type": { "type": "string" },
          "title": { "type": "string" },
          "status": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
          "code": {
            "type": "string",
            "enum": [
              "unauthenticated",
              "invalid_token",
              "invalid_dpop_proof",
              "forbidden",
              "not_found",
              "conflict",
              "idempotency_conflict",
              "invalid_state",
              "precondition_failed",
              "invalid_request",
              "validation_failed",
              "rate_limited",
              "quota_exceeded",
              "upstream_error",
              "upstream_timeout",
              "internal"
            ]
          },
          "detail": { "type": "string" },
          "reason_code": { "$ref": "#/components/schemas/ReasonCode" },
          "changed_fields": {
            "description": "Material fields that differ (idempotency conflicts)",
            "type": "array",
            "items": { "type": "string" }
          },
          "action_id": { "type": "string" },
          "issues": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": { "field": { "type": "string" }, "message": { "type": "string" } },
              "required": ["field", "message"]
            }
          },
          "retry_after_seconds": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }
        },
        "required": ["type", "title", "status", "code"],
        "description": "RFC 9457 problem details"
      },
      "Capabilities": {
        "$id": "#/components/schemas/Capabilities",
        "type": "object",
        "properties": {
          "api_version": { "type": "string", "const": "2026-11-14" },
          "issuer": { "type": "string" },
          "supported_modes": { "type": "array", "items": { "type": "string", "enum": ["poll", "webhook", "mcp_task", "sse"] } },
          "mcp": {
            "type": "object",
            "properties": {
              "protocol_versions": { "type": "array", "items": { "type": "string" } },
              "tasks_extension": { "type": "boolean" },
              "structured_pending_result": { "type": "boolean" }
            },
            "required": ["protocol_versions", "tasks_extension", "structured_pending_result"]
          },
          "max_warm_wait_seconds": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
          "default_retry_after_seconds": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
          "resume_actor": { "type": "string", "const": "original_agent" },
          "jwks_uri": { "type": "string" },
          "token_endpoint": { "type": "string" },
          "receipt_format": { "type": "string", "const": "axiom.receipt.v1" },
          "canonical_format": { "type": "string", "const": "axiom.action.v1" },
          "delegation": {
            "type": "object",
            "properties": { "max_depth": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } },
            "required": ["max_depth"]
          }
        },
        "required": [
          "api_version",
          "issuer",
          "supported_modes",
          "mcp",
          "max_warm_wait_seconds",
          "default_retry_after_seconds",
          "resume_actor",
          "jwks_uri",
          "token_endpoint",
          "receipt_format",
          "canonical_format",
          "delegation"
        ],
        "description": "Capability discovery: read before choosing how to wait"
      },
      "WakeEvent": {
        "$id": "#/components/schemas/WakeEvent",
        "type": "object",
        "properties": {
          "v": { "type": "string", "const": "axiom.event.v1" },
          "event_id": { "type": "string" },
          "type": { "type": "string", "enum": ["action.changed", "agent.suspended", "grant.revoked", "policy.updated"] },
          "action_id": { "type": "string" },
          "tenant": { "type": "string" },
          "occurred_at": { "type": "string", "description": "RFC 3339 timestamp" },
          "seq": {
            "type": "integer",
            "minimum": -9007199254740991,
            "maximum": 9007199254740991,
            "description": "Monotonic per action; drop events with seq <= the last processed"
          }
        },
        "required": ["v", "event_id", "type", "tenant", "occurred_at", "seq"],
        "description": "Payload of a signed wake event (compact JWS, typ axiom-event+jws). Never authority: read status after it."
      },
      "ReceiptBundle": {
        "$id": "#/components/schemas/ReceiptBundle",
        "type": "object",
        "properties": {
          "type": { "type": "string", "const": "axiom.receipt.bundle.v1" },
          "receipt": {
            "type": "object",
            "properties": {
              "payload": { "type": "string" },
              "signatures": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "protected": { "type": "string" },
                    "signature": { "type": "string" },
                    "header": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }
                  },
                  "required": ["protected", "signature"]
                }
              }
            },
            "required": ["payload", "signatures"]
          },
          "disclosures": {
            "type": "object",
            "propertyNames": { "type": "string" },
            "additionalProperties": {
              "type": "object",
              "properties": { "salt": { "type": "string" }, "value": { "$ref": "#/components/schemas/Json" } },
              "required": ["salt", "value"]
            }
          },
          "keys": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "kty": { "type": "string", "enum": ["EC", "OKP"] },
                "crv": { "type": "string", "enum": ["P-256", "Ed25519"] },
                "x": { "type": "string" },
                "y": { "type": "string" },
                "kid": { "type": "string" },
                "alg": { "type": "string", "enum": ["ES256", "EdDSA"] },
                "use": { "type": "string", "const": "sig" }
              },
              "required": ["kty", "crv", "x"]
            }
          },
          "status": {
            "type": "object",
            "properties": {
              "checked_at": { "type": "string", "description": "RFC 3339 timestamp" },
              "keys": {
                "type": "object",
                "propertyNames": { "type": "string" },
                "additionalProperties": { "type": "string", "enum": ["active", "retired", "revoked"] }
              },
              "source": { "type": "string" }
            },
            "required": ["checked_at", "keys", "source"]
          }
        },
        "required": ["type", "receipt", "disclosures", "keys"],
        "description": "Signed receipt bundle (JWS general serialization + salted disclosures + key snapshot)"
      },
      "TokenResponse": {
        "$id": "#/components/schemas/TokenResponse",
        "type": "object",
        "properties": {
          "access_token": { "type": "string" },
          "token_type": { "type": "string", "const": "DPoP" },
          "expires_in": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 },
          "scope": { "type": "string" }
        },
        "required": ["access_token", "token_type", "expires_in", "scope"],
        "description": "OAuth token response for agents (client_credentials + private_key_jwt + DPoP)"
      },
      "DelegationResult": {
        "$id": "#/components/schemas/DelegationResult",
        "type": "object",
        "properties": {
          "grant_id": { "type": "string" },
          "parent_grant_id": { "type": "string" },
          "root_action_id": { "type": "string" },
          "agent": { "type": "string" },
          "operations": { "type": "array", "items": { "type": "string" } },
          "resources": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": { "type": { "type": "string" }, "id": { "type": "string" } },
              "required": ["type", "id"]
            }
          },
          "expires_at": { "type": "string" },
          "depth": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }
        },
        "required": ["grant_id", "parent_grant_id", "root_action_id", "agent", "operations", "resources", "expires_at", "depth"]
      },
      "AuthorizeResponse": {
        "$id": "#/components/schemas/AuthorizeResponse",
        "type": "object",
        "properties": {
          "decision": { "type": "string", "enum": ["execute", "completed", "pending", "in_progress", "stop"] },
          "status": { "$ref": "#/components/schemas/ActionStatus" },
          "claim": {
            "type": "object",
            "properties": { "claim_id": { "type": "string" }, "authorization": { "type": "string" } },
            "required": ["claim_id", "authorization"]
          }
        },
        "required": ["decision", "status"],
        "description": "Embedded-SDK authorize result; execute only when decision is execute"
      },
      "Json": {
        "$id": "#/components/schemas/Json",
        "anyOf": [
          { "type": "string" },
          { "type": "number" },
          { "type": "boolean" },
          { "type": "null" },
          { "type": "array", "items": { "$ref": "#/components/schemas/Json" } },
          { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "$ref": "#/components/schemas/Json" } }
        ]
      }
    },
    "securitySchemes": {
      "dpop": {
        "type": "http",
        "scheme": "DPoP",
        "description": "Authorization: DPoP <token> plus a DPoP header proof bound to method, URL and token hash (ath) on every request"
      },
      "projectApiKey": { "type": "http", "scheme": "bearer", "description": "Project API key (axk_…) with provider:authorize" }
    }
  },
  "x-axiom-headers": {
    "Idempotency-Key": "Operation key, forwarded to upstreams on dispatch",
    "Axiom-Action-Id": "Action ID, forwarded to upstreams",
    "Axiom-Root-Action-Id": "Root action ID for delegated child operations",
    "Axiom-Authorization": "Compact JWS (typ axiom-dispatch+jws, grant key) stating exactly what was authorised",
    "axiom-outcome": "Provider response header: compact JWS (typ axiom-outcome+jws) of axiom.outcome.v1"
  }
}