{"openapi":"3.1.0","info":{"title":"SASEGuard Gateway","description":"SASE-inspired Zero Trust policy enforcement point. Verifies RS256 bearer tokens, consults a separate policy decision service for every request, applies text-only DLP to uploads, records a redacted audit decision before forwarding, and forwards only to fixed private URLs.\n\nThis is a local lab built from synthetic data. It is not affiliated with any vendor, implements no SD-WAN or other network-layer SASE function, and is not production-ready.","version":"1.0.0"},"paths":{"/healthz":{"get":{"tags":["ops"],"summary":"Healthz","operationId":"healthz_healthz_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","title":"Response Healthz Healthz Get"}}}}}}},"/meta/dlp-rules":{"get":{"tags":["ops"],"summary":"Dlp Rules","description":"Published so a blocked user can see exactly what matched them.","operationId":"dlp_rules_meta_dlp_rules_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","title":"Response Dlp Rules Meta Dlp Rules Get"}}}}}}},"/auth/login":{"post":{"tags":["auth"],"summary":"Login","description":"Proxy login to the private identity issuer.\n\nThe gateway does not verify the password itself and never sees the\nprivate signing key. It records the outcome, never the credential.","operationId":"login_auth_login_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/auth/logout":{"post":{"tags":["auth"],"summary":"Logout","description":"Persistently revoke the caller's own verified token ID.\n\nNo policy call: logout only ever reduces privilege, so it must succeed\neven for a user whose device has just gone non-compliant. Requiring a\nhealthy posture to log out would be a trap, not a control.","operationId":"logout_auth_logout_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/apps/{app_id}":{"get":{"tags":["apps"],"summary":"Read App","description":"Authorize, audit, then fetch one fixed private application.","operationId":"read_app_apps__app_id__get","parameters":[{"name":"app_id","in":"path","required":true,"schema":{"type":"string","title":"App Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/web/{destination}":{"get":{"tags":["web"],"summary":"Visit Web","description":"Category enforcement over a fixed set of local fixture IDs.\n\nThere is no URL parameter anywhere in this route. ``destination`` is\nan ID checked against a compiled-in tuple, which is why this endpoint\ncannot be turned into an open proxy or an SSRF primitive.","operationId":"visit_web_web__destination__get","parameters":[{"name":"destination","in":"path","required":true,"schema":{"type":"string","title":"Destination"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/saas/upload":{"post":{"tags":["dlp"],"summary":"Upload","description":"Authorize the role, scan the text, audit, then forward if clean.\n\nThe scan happens before the synthetic storage service is contacted.\nThat ordering is what the test suite verifies via the upstream\naccepted-upload counter: a blocked payload never arrives at all.","operationId":"upload_saas_upload_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/admin/devices":{"get":{"tags":["admin"],"summary":"Admin Devices","description":"Device registry, for verified healthy administrators only.\n\nThe UI hides these controls for non-admins, but the check that\nmatters is this one, on the server.","operationId":"admin_devices_admin_devices_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/admin/devices/{device_id}":{"put":{"tags":["admin"],"summary":"Admin Update Device","description":"Change a device's posture. Administrator only, enforced server-side.","operationId":"admin_update_device_admin_devices__device_id__put","parameters":[{"name":"device_id","in":"path","required":true,"schema":{"type":"string","title":"Device Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/admin/events":{"get":{"tags":["admin"],"summary":"Admin Events","description":"Redacted audit decisions, newest first. Administrator only.","operationId":"admin_events_admin_events_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"result","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Result"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}}},"components":{"schemas":{"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"}}}}