{"openapi":"3.1.0","info":{"title":"Zephyr RADIUS API","version":"1.0.0","description":"Staff sessions with MFA or named scoped bearer keys. 60 authenticated key calls per minute, 25 results per page. Customer-bound keys filter before pagination. No live customer tenant writes. Login ingestion is pending."},"servers":[{"url":"/api/v1"}],"security":[{"bearerKey":[]},{"staffSession":[]}],"components":{"securitySchemes":{"bearerKey":{"type":"http","scheme":"bearer"},"staffSession":{"type":"apiKey","in":"cookie","name":"Supabase staff session"}}},"paths":{"/consent/callback":{"get":{"operationId":"consent_callback","summary":"Complete administrator consent using signed one-time state, with key revocation rechecked","security":[],"parameters":[{"name":"state","in":"query","required":true,"schema":{"type":"string"}},{"name":"tenant","in":"query","required":true,"schema":{"type":"string"}},{"name":"admin_consent","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Consent accepted, fresh sync still required"},"403":{"description":"consent_callback_refused"}}}},"/customers":{"get":{"operationId":"customers_read_GET_customers","summary":"customers.read","x-required-scope":"customers:read","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"post":{"operationId":"customer_create_POST_customers","summary":"customer_create","x-required-scope":"customers:write","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}":{"get":{"operationId":"customers_read_GET_customers__customer_","summary":"customers.read","x-required-scope":"customers:read","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"patch":{"operationId":"customer_update_PATCH_customers__customer_","summary":"customer_update","x-required-scope":"customers:write","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/archive":{"post":{"operationId":"customer_archive_POST_customers__customer__archive","summary":"customer_archive","x-required-scope":"customers:write","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/restore":{"post":{"operationId":"customer_restore_POST_customers__customer__restore","summary":"customer_restore","x-required-scope":"customers:write","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/cas":{"get":{"operationId":"cas_read_GET_customers__customer__cas","summary":"cas.read","x-required-scope":"cas:read","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/sync":{"get":{"operationId":"sync_read_GET_customers__customer__sync","summary":"sync.read","x-required-scope":"cas:read","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/consent":{"post":{"operationId":"consent_start_POST_customers__customer__consent","summary":"consent.start","x-required-scope":"consent:write","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/customers/{customer}/sites":{"get":{"operationId":"sites_read_GET_customers__customer__sites","summary":"sites.read","x-required-scope":"sites:read","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"post":{"operationId":"site_create_POST_customers__customer__sites","summary":"site_create","x-required-scope":"sites:write","parameters":[{"name":"customer","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}":{"get":{"operationId":"sites_read_GET_sites__site_","summary":"sites.read","x-required-scope":"sites:read","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"patch":{"operationId":"site_update_PATCH_sites__site_","summary":"site_update","x-required-scope":"sites:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/archive":{"post":{"operationId":"site_archive_POST_sites__site__archive","summary":"site_archive","x-required-scope":"sites:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/live":{"post":{"operationId":"site_live_POST_sites__site__live","summary":"site_live","x-required-scope":"sites:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/disable":{"post":{"operationId":"site_disable_POST_sites__site__disable","summary":"site_disable","x-required-scope":"sites:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/networks":{"get":{"operationId":"networks_read_GET_sites__site__networks","summary":"networks.read","x-required-scope":"networks:read","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"post":{"operationId":"network_add_POST_sites__site__networks","summary":"network_add","x-required-scope":"networks:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/networks/{network}":{"delete":{"operationId":"network_remove_DELETE_sites__site__networks__network_","summary":"network_remove","x-required-scope":"networks:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"network","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/secret/reveal":{"post":{"operationId":"secret_reveal_POST_sites__site__secret_reveal","summary":"secret_reveal","x-required-scope":"secrets:read","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/sites/{site}/secret/rotate":{"post":{"operationId":"secret_rotate_POST_sites__site__secret_rotate","summary":"secret_rotate","x-required-scope":"secrets:write","parameters":[{"name":"site","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"Customer: tenant/name. Site: name/transport/vlan/ca. Network: network CIDR. Server supplies path IDs; secret rotation never accepts a caller secret."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/deployments":{"post":{"operationId":"deployment_create_POST_deployments","summary":"deployment.create","x-required-scope":"deployment:write","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"tenant, rootCA, issuingCA, prefix, Windows SCEP fields; createCA/wifi/wired must be false. See deployment help."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/logins":{"get":{"operationId":"logins_read_GET_logins","summary":"logins.read","x-required-scope":"logins:read","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/audit":{"get":{"operationId":"audit_read_GET_audit","summary":"audit.read","x-required-scope":"audit:read","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/keys":{"get":{"operationId":"keys_list_GET_keys","summary":"keys.list","x-required-scope":"keys:admin","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}},"post":{"operationId":"keys_create_POST_keys","summary":"keys.create","x-required-scope":"keys:admin","parameters":[{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","description":"name, scopes (explicit array), optional customer UUID and expires_at ISO date. Returns key once."}}}},"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}},"/keys/{key}":{"delete":{"operationId":"keys_revoke_DELETE_keys__key_","summary":"keys.revoke","x-required-scope":"keys:admin","parameters":[{"name":"key","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"page","in":"query","schema":{"type":"integer","minimum":0,"maximum":100000}},{"name":"customer","in":"query","schema":{"type":"string","format":"uuid"}},{"name":"archived","in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"JSON data; all responses no-store; keys returned once on creation only"},"400":{"description":"invalid_request"},"401":{"description":"credential_refused"},"403":{"description":"operation_refused"},"429":{"description":"rate_limited; Retry-After: 60"}}}}}}