openapi.yaml

openapi: 3.0.1
info:
  contact:
    email: info@openremote.io
  description: "This is the documentation for the OpenRemote Manager HTTP API. The\
    \ `realm` server variable selects the request realm. Operations that show the\
    \ `openid` security requirement need an OAuth 2 access token; operations without\
    \ that requirement support anonymous access, although the returned data can still\
    \ be limited to public resources. Unless an operation documents another schema,\
    \ error responses use a plain-text body. Please see the [documentation](https://docs.openremote.io)\
    \ for more info."
  license:
    name: AGPL 3.0
    url: https://www.gnu.org/licenses/agpl-3.0.en.html
  title: OpenRemote Manager HTTP API
  version: 3.0.0
servers:
- url: "https://demo.openremote.io/api/{realm}/"
  variables:
    realm:
      default: master
tags:
- description: "Create, query, maintain, and associate alarms with assets"
  name: Alarm
- description: Discover installed Manager applications and load their public client
    configuration
  name: UI Apps
- description: "Discover asset, attribute-value, and metadata types supported by this\
    \ Manager or a gateway"
  name: Asset Model
- description: "Query and manage assets, attributes, hierarchy, and user-to-asset\
    \ links"
  name: Asset
- description: Discover protocol instances and import or discover assets through Agent
    assets
  name: Agent
- description: Register mobile and browser consoles as Console assets
  name: Console
- description: Query public or accessible dashboards and manage dashboards for the
    Insights UI
  name: Dashboard
- description: Query and export historical values stored for asset attributes
  name: Asset Datapoint
- description: Read and replace predicted future values for asset attributes
  name: Asset Predicted Datapoint
- description: Configure this Manager's connections to central OpenRemote gateway
    services
  name: Gateway
- description: Read public Manager UI configuration and administer its configuration
    and images
  name: Configuration
- description: "Configure the Manager map and serve map styles, vector tiles, and\
    \ custom MBTiles data"
  name: Map
- description: "Send notifications and query, delete, deliver, or acknowledge their\
    \ delivery records"
  name: Notification
- description: Super-administrator operations for device provisioning configurations
  name: Provisioning
- description: "Inspect rule engines and query or manage global, realm, and asset\
    \ rulesets"
  name: Rule
- description: Discover the node definitions available to the visual flow-rules editor
  name: Flow
- description: Discover accessible realms and administer identity-provider realms
  name: Realm
- description: "Query and manage identity-provider users, roles, credentials, locale,\
    \ and live sessions"
  name: User
- description: "Register, discover, renew, and deregister leased external-service\
    \ instances"
  name: Services
- description: Query and clear stored Manager logs and maintain syslog storage settings
  name: Syslog
- description: Read Manager health and build information
  name: Status
paths:
  /agent/assetDiscovery/{agentId}:
    get:
      description: "Runs the agent protocol's asset discovery, waits up to ten seconds\
        \ for results, returns the discovered tree, and asynchronously persists discovered\
        \ assets below the agent."
      operationId: doProtocolAssetDiscovery
      parameters:
      - description: Agent asset that performs discovery.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: agentId
        required: true
        schema:
          type: string
      - description: OpenRemote realm name. Non-super users are always restricted
          to their authenticated realm.
        example: building
        in: query
        name: realm
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetTreeNode"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Discover assets through an agent
      tags:
      - Agent
  /agent/assetImport/{agentId}:
    post:
      description: "Decodes the supplied FileInfo, asks the agent protocol to import\
        \ it, persists the returned asset tree below the agent, and returns that tree."
      operationId: doProtocolAssetImport
      parameters:
      - description: Agent asset that performs the import.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: agentId
        required: true
        schema:
          type: string
      - description: OpenRemote realm name. Non-super users are always restricted
          to their authenticated realm.
        example: building
        in: query
        name: realm
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/FileInfo"
        description: File metadata and Base64 or text contents in the format understood
          by the selected agent protocol.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetTreeNode"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The selected agent protocol does not support asset import
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Import assets through an agent
      tags:
      - Agent
  /agent/instanceDiscovery/{agentType}:
    get:
      description: Runs instance discovery for an agent type and returns candidate
        Agent assets. parentId selects local versus edge-gateway discovery; non-super
        users are always constrained to their authenticated realm.
      operationId: doProtocolInstanceDiscovery
      parameters:
      - description: Optional parent asset used to choose local or edge-gateway discovery.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      - description: Registered agent asset type whose protocol supports instance
          discovery.
        example: HTTPAgent
        in: path
        name: agentType
        required: true
        schema:
          type: string
      - description: OpenRemote realm name. Non-super users are always restricted
          to their authenticated realm.
        example: building
        in: query
        name: realm
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AgentObjectObjectObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "415":
          description: The selected agent protocol does not support instance discovery
      security:
      - openid: []
      summary: Discover protocol instances
      tags:
      - Agent
  /alarm:
    delete:
      description: Permanently removes all alarms identified by the request body after
        verifying access to every alarm's realm.
      operationId: removeAlarms
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: integer
                format: int64
        description: Numeric IDs of the alarms to remove.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Remove alarms
      tags:
      - Alarm
    get:
      description: "Returns alarms in the requested accessible realm, optionally filtered\
        \ by status, linked asset, or assignee. When realm is omitted, the authenticated\
        \ realm is used."
      operationId: getAlarms
      parameters:
      - description: OpenRemote realm name. Defaults to the authenticated realm.
        example: building
        in: query
        name: realm
        schema:
          type: string
      - description: Alarm lifecycle status to match.
        example: OPEN
        in: query
        name: status
        schema:
          type: string
          enum:
          - OPEN
          - ACKNOWLEDGED
          - IN_PROGRESS
          - RESOLVED
          - CLOSED
      - description: Return alarms linked to this asset.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        schema:
          type: string
      - description: Return alarms assigned to this identity-provider user.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: assigneeId
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SentAlarm"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve all alarms or a subset using filter criteria
      tags:
      - Alarm
    post:
      description: Creates a manual alarm in an accessible realm and optionally links
        it to the supplied asset IDs. The authenticated user or client becomes the
        alarm source.
      operationId: createAlarm
      parameters:
      - description: Asset IDs to link to the new alarm. Repeat the query parameter
          for multiple assets.
        example: 7A6p4AnLTkKxJUCQAAABAA
        explode: true
        in: query
        name: assetIds
        schema:
          type: array
          items:
            type: string
        style: form
      requestBody:
        content:
          application/json:
            examples:
              High temperature alarm:
                description: High temperature alarm
                summary: Create an open high-severity alarm
                value:
                  title: Temperature threshold exceeded
                  content: Boiler room temperature reached 42 °C.
                  severity: HIGH
                  status: OPEN
                  realm: building
            schema:
              $ref: "#/components/schemas/Alarm"
        description: Alarm to create. The source and sourceId are assigned from the
          authenticated caller.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SentAlarm"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Create an alarm
      tags:
      - Alarm
  /alarm/assets:
    put:
      description: |
        Adds links between assets and one existing alarm.

        The request body is a list for backward compatibility, but this operation now has single-alarm semantics:
        every item must contain the same `id.realm` and the same `id.alarmId`. The alarm must exist in that realm,
        every asset must exist in the same realm, and the authenticated user must have access to that realm. Requests
        containing mixed alarm IDs or realms are rejected as bad requests.

        Existing links are left unchanged; duplicate links in the request or links that already exist are ignored.
        This operation does not remove existing links from the alarm.
      operationId: setAssetLinks
      requestBody:
        content:
          application/json:
            examples:
              Invalid multiple alarms:
                description: Invalid multiple alarms
                summary: Rejected because the request targets more than one alarm
                value:
                - id:
                    realm: building
                    alarmId: 1234
                    assetId: 7A6p4AnLTkKxJUCQAAABAA
                - id:
                    realm: building
                    alarmId: 5678
                    assetId: 2Qjr4AnLTkKxJUCQAAACAA
              Multiple asset links:
                description: Multiple asset links
                summary: Link multiple assets to the same alarm
                value:
                - id:
                    realm: building
                    alarmId: 1234
                    assetId: 7A6p4AnLTkKxJUCQAAABAA
                - id:
                    realm: building
                    alarmId: 1234
                    assetId: 2Qjr4AnLTkKxJUCQAAACAA
              Single asset link:
                description: Single asset link
                summary: Link one asset to one alarm
                value:
                - id:
                    realm: building
                    alarmId: 1234
                    assetId: 7A6p4AnLTkKxJUCQAAABAA
            schema:
              type: array
              items:
                $ref: "#/components/schemas/AlarmAssetLink"
        description: Alarm asset links to add. All items must use the same `id.realm`
          and `id.alarmId`.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Add asset links to a single alarm
      tags:
      - Alarm
  /alarm/{alarmId}:
    delete:
      description: Permanently removes one alarm after verifying access to its realm.
      operationId: removeAlarm
      parameters:
      - description: Numeric alarm identifier.
        example: 1234
        in: path
        name: alarmId
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Remove an alarm
      tags:
      - Alarm
    get:
      description: Returns one alarm when its realm is active and accessible to the
        authenticated user.
      operationId: getAlarm
      parameters:
      - description: Numeric alarm identifier.
        example: 1234
        in: path
        name: alarmId
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SentAlarm"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve an alarm
      tags:
      - Alarm
    put:
      description: Updates the mutable state of an existing alarm after verifying
        access to its current realm.
      operationId: updateAlarm
      parameters:
      - description: Numeric alarm identifier.
        example: 1234
        in: path
        name: alarmId
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SentAlarm"
        description: Complete updated alarm state.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update an alarm
      tags:
      - Alarm
  /alarm/{alarmId}/assets:
    get:
      description: Returns links from the alarm to assets in the explicitly supplied
        accessible realm.
      operationId: getAssetLinks
      parameters:
      - description: Numeric alarm identifier.
        example: 1234
        in: path
        name: alarmId
        required: true
        schema:
          type: integer
          format: int64
      - description: OpenRemote realm name.
        example: building
        in: query
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AlarmAssetLink"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve the asset links of an alarm
      tags:
      - Alarm
  /apps:
    get:
      description: Returns the identifiers of applications installed in the Manager
        web root.
      operationId: getApps
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
          description: The request completed successfully
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve a list of the available applications
      tags:
      - UI Apps
  /apps/consoleConfig:
    get:
      description: Loads the public console_config.json document used to configure
        console clients before sign-in.
      operationId: getConsoleConfig
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
          description: The request completed successfully
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve the console configuration
      tags:
      - UI Apps
  /apps/info:
    get:
      description: Loads each installed application's info.json file and returns the
        documents keyed by application identifier.
      operationId: getAppInfos
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: object
          description: The request completed successfully
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve the info of the available applications
      tags:
      - UI Apps
  /asset:
    delete:
      description: "Permanently deletes every asset identified by repeated assetId\
        \ query parameters, subject to realm and restricted-user access rules."
      operationId: deleteAsset
      parameters:
      - description: Asset IDs to delete. Repeat the query parameter for multiple
          assets.
        example: 7A6p4AnLTkKxJUCQAAABAA
        explode: true
        in: query
        name: assetId
        required: true
        schema:
          type: array
          items:
            type: string
        style: form
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete assets
      tags:
      - Asset
    post:
      description: Creates an asset in an accessible realm and returns the persisted
        representation. The server generates an ID when absent; supplied IDs must
        be globally unique and 22 characters long.
      operationId: createAsset
      requestBody:
        content:
          application/json:
            examples:
              Create a Thing asset:
                description: Create a Thing asset
                summary: Create a sensor with temperature and humidity attributes
                value:
                  type: ThingAsset
                  name: Boiler room sensor
                  realm: building
                  attributes:
                    temperature:
                      name: temperature
                      type: number
                      value: 21.5
                    humidity:
                      name: humidity
                      type: number
                      value: 48
            schema:
              $ref: "#/components/schemas/AssetObject"
        description: Asset to create. Omit id to let the server generate one; realm
          defaults to the authenticated realm.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Create an asset
      tags:
      - Asset
  /asset/attributes:
    put:
      description: Submits a batch of attribute states using current server time and
        returns one result per input item. Authorization and processing failures are
        encoded in each AttributeWriteResult rather than returned as an HTTP error.
      operationId: writeAttributeValues
      requestBody:
        content:
          application/json:
            examples:
              Write two attributes:
                description: Write two attributes
                summary: Update temperature and humidity on one asset
                value:
                - ref:
                    id: 7A6p4AnLTkKxJUCQAAABAA
                    name: temperature
                  value: 21.5
                - ref:
                    id: 7A6p4AnLTkKxJUCQAAABAA
                    name: humidity
                  value: 48
            schema:
              type: array
              items:
                $ref: "#/components/schemas/AttributeState"
        description: Attribute references and values to write using the current server
          time.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AttributeWriteResult"
          description: The request completed successfully
      summary: Write values to multiple asset attributes
      tags:
      - Asset
  /asset/attributes/timestamp:
    put:
      description: Submits a batch of complete attribute events and returns one result
        per input item. Supplied timestamps are preserved; authorization and processing
        failures are encoded per result rather than returned as an HTTP error.
      operationId: writeAttributeEvents
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/AttributeEvent"
        description: "Complete attribute events to write, including their timestamps."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AttributeWriteResult"
          description: The request completed successfully
      summary: Write timestamped values to multiple asset attributes
      tags:
      - Asset
  /asset/count:
    post:
      description: "Returns only the number of assets matching an AssetQuery after\
        \ applying the caller's realm, public, and linked-asset access constraints."
      operationId: queryCount
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AssetQuery"
        description: Optional asset query to count. An omitted or empty query counts
          all assets visible to the caller.
      responses:
        "200":
          content:
            application/json:
              schema:
                type: integer
                format: int32
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
      summary: Count assets using a query
      tags:
      - Asset
  /asset/datapoint/export:
    get:
      description: Streams a ZIP archive containing exported datapoints for one or
        more attribute references over the requested inclusive time range. attributeRefs
        is a JSON-encoded array of objects with id and name fields.
      operationId: getDatapointExport
      parameters:
      - description: JSON-encoded array of objects with id and name fields.
        example:
        - id: 7A6p4AnLTkKxJUCQAAABAA
          name: temperature
        in: query
        name: attributeRefs
        required: true
        schema:
          type: string
      - description: Start of the export range as Unix time in milliseconds.
        example: 1767225600000
        in: query
        name: fromTimestamp
        required: true
        schema:
          type: integer
          format: int64
      - description: End of the export range as Unix time in milliseconds.
        example: 1767312000000
        in: query
        name: toTimestamp
        required: true
        schema:
          type: integer
          format: int64
      - description: Export file format.
        example: CSV
        in: query
        name: format
        schema:
          type: string
          _default: CSV
          enum:
          - CSV
          - CSV_CROSSTAB
          - CSV_CROSSTAB_MINUTE
      responses:
        "200":
          content:
            application/zip:
              schema:
                type: string
                format: binary
          description: A ZIP archive containing the exported data
          headers:
            Content-Disposition:
              description: Attachment filename for the ZIP archive
              schema:
                type: string
                example: attachment; filename="dataexport.zip"
              style: simple
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "413":
          content:
            text/plain:
              schema:
                type: string
          description: The request or generated response exceeds the configured size
            limit
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Export historical datapoints
      tags:
      - Asset Datapoint
  /asset/datapoint/periods:
    get:
      description: Returns the oldest and newest stored timestamps for one attribute.
        The asset and attribute must be readable by the authenticated user and configured
        for datapoint storage.
      operationId: getDatapointPeriod
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: query
        name: attributeName
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatapointPeriod"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a datapoint period of an asset attribute
      tags:
      - Asset Datapoint
  /asset/datapoint/{assetId}/{attributeName}:
    post:
      description: Returns stored historical values for one attribute. A null body
        returns the available series; a polymorphic query body controls the time range
        and retrieval or aggregation strategy. Anonymous access requires public-read
        access on both asset and attribute.
      operationId: getDatapoints
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: path
        name: attributeName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              All values:
                description: All values
                summary: Return every datapoint in a one-day inclusive range
                value:
                  type: all
                  fromTime: 2026-01-01T00:00:00Z
                  toTime: 2026-01-02T00:00:00Z
              Hourly average:
                description: Hourly average
                summary: Average one day of values into hourly buckets and fill gaps
                value:
                  type: interval
                  fromTimestamp: 1767225600000
                  toTimestamp: 1767312000000
                  interval: 1 hour
                  formula: AVG
                  gapFill: true
              LTTB downsampling:
                description: LTTB downsampling
                summary: Downsample one day to at most 500 representative points
                value:
                  type: lttb
                  fromTimestamp: 1767225600000
                  toTimestamp: 1767312000000
                  amountOfPoints: 500
              Nearest value:
                description: Nearest value
                summary: Return the closest datapoint at or before a Unix-seconds
                  timestamp
                value:
                  type: nearest
                  fromTimestamp: 1767312000
            schema:
              oneOf:
              - $ref: "#/components/schemas/AssetDatapointAllQuery"
              - $ref: "#/components/schemas/AssetDatapointIntervalQuery"
              - $ref: "#/components/schemas/AssetDatapointLTTBQuery"
              - $ref: "#/components/schemas/AssetDatapointNearestQuery"
        description: "Optional polymorphic datapoint query. Set type to all, interval,\
          \ lttb, or nearest. Omit the body to return the available stored series."
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ValueDatapointObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "413":
          content:
            text/plain:
              schema:
                type: string
          description: The request or generated response exceeds the configured size
            limit
      summary: Retrieve the historical datapoints of an asset attribute
      tags:
      - Asset Datapoint
  /asset/parent:
    delete:
      description: Clears the parent reference of every asset listed in repeated assetIds
        query parameters.
      operationId: deleteAssetsParent
      parameters:
      - description: Asset IDs to move to the realm root. Repeat the query parameter
          for multiple assets.
        example: 7A6p4AnLTkKxJUCQAAABAA
        explode: true
        in: query
        name: assetIds
        required: true
        schema:
          type: array
          items:
            type: string
          maxItems: 2147483647
          minItems: 1
        style: form
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Move assets to the realm root
      tags:
      - Asset
  /asset/partial/{assetId}:
    get:
      description: Returns the asset identity and properties without loading attributes
        or path data. The same access rules as getAsset apply.
      operationId: getPartialAsset
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a partially loaded asset
      tags:
      - Asset
  /asset/predicted/{assetId}/{attributeName}:
    post:
      description: Queries predicted values for one attribute using the supplied time-range
        and aggregation criteria. Anonymous access requires public-read access on
        both asset and attribute.
      operationId: getPredictedDatapoints
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: path
        name: attributeName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AssetDatapointQuery"
        description: "Optional time range, ordering, limit, and aggregation strategy\
          \ for predicted values."
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ValueDatapointObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Retrieve the predicted datapoints of an asset attribute
      tags:
      - Asset Predicted Datapoint
    put:
      description: Replaces or adds predicted values for one attribute. Anonymous
        access is allowed only when the asset and attribute are public-write; authenticated
        callers require attribute-write access.
      operationId: writePredictedDatapoints
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: path
        name: attributeName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/ValueDatapointObject"
        description: Timestamped predicted values to store for the attribute.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Write the predicted datapoints of an asset attribute
      tags:
      - Asset Predicted Datapoint
  /asset/query:
    post:
      description: Executes an AssetQuery after constraining realm and linked-asset
        access. Anonymous callers receive public-readable assets only; the query select
        clause controls which fields are populated.
      operationId: queryAssets
      requestBody:
        content:
          application/json:
            examples:
              Find sensors:
                description: Find sensors
                summary: Find Thing assets with sensor in their name and select two
                  attributes
                value:
                  realm:
                    name: building
                  types:
                  - ThingAsset
                  names:
                  - match: CONTAINS
                    caseSensitive: false
                    value: sensor
                  select:
                    attributes:
                    - temperature
                    - humidity
                  orderBy:
                    property: NAME
                    descending: false
                  limit: 100
                  offset: 0
            schema:
              $ref: "#/components/schemas/AssetQuery"
        description: Optional asset query. An omitted or empty query selects all assets
          visible to the caller.
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
      summary: Retrieve assets using a query
      tags:
      - Asset
  /asset/tree:
    post:
      description: "Applies the same authorization and selection rules as queryAssets,\
        \ then returns a hierarchy optimized for tree display rather than a flat asset\
        \ array."
      operationId: queryAssetTree
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AssetQuery"
        description: "Optional asset query controlling the roots, filters, and fields\
          \ included in the returned tree."
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetTree"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
      summary: Retrieve an optimized asset tree using a query
      tags:
      - Asset
  /asset/user/current:
    get:
      description: "Returns partial linked assets for a restricted user, root assets\
        \ for an unrestricted realm user, and an empty array for a super user. Attributes\
        \ and paths are omitted; use getAsset for full details."
      operationId: getCurrentUserAssets
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve assets accessible to the current user
      tags:
      - Asset
  /asset/user/link:
    get:
      description: "Returns user-asset links in the required realm, optionally filtered\
        \ by userId and assetId. Missing users or assets produce an empty result;\
        \ restricted users cannot call this operation."
      operationId: getUserAssetLinks
      parameters:
      - description: OpenRemote realm name. Defaults to the authenticated realm.
        example: building
        in: query
        name: realm
        schema:
          type: string
      - description: Only return links for this user.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: userId
        schema:
          type: string
      - description: Only return links for this asset.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/UserAssetLink"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve links between assets and users
      tags:
      - Asset
    post:
      description: "Creates all supplied links as one operation. Every item must identify\
        \ the same realm and user, and every referenced realm, user, and asset must\
        \ exist."
      operationId: createUserAssetLinks
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/UserAssetLink"
        description: Links to create. Every item must have the same realm and user
          ID.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Create links between users and assets
      tags:
      - Asset
  /asset/user/link/delete:
    post:
      description: Removes all supplied links. Every item must identify the same realm
        and user.
      operationId: deleteUserAssetLinks
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/UserAssetLink"
        description: Links to remove. Every item must have the same realm and user
          ID.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete user asset links
      tags:
      - Asset
  /asset/user/link/{realm}/{userId}:
    delete:
      description: Removes every asset link belonging to the user in the requested
        realm.
      operationId: deleteAllUserAssetLinks
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete all links for a user
      tags:
      - Asset
  /asset/user/link/{realm}/{userId}/{assetId}:
    delete:
      description: "Removes the link identified by realm, user, and asset. The caller\
        \ must be allowed to administer asset links in that realm."
      operationId: deleteUserAssetLink
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete a link between an asset and user
      tags:
      - Asset
  /asset/{assetId}:
    get:
      description: "Returns a fully loaded asset including its path and attributes.\
        \ Access is constrained to the caller's realm and, for restricted users, linked\
        \ assets."
      operationId: getAsset
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve an asset
      tags:
      - Asset
    put:
      description: "Replaces mutable asset data while preserving the path identifier.\
        \ Realm, parent, restricted-user, and private-metadata rules are validated;\
        \ disallowed restricted-user fields may be ignored."
      operationId: updateAsset
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Update an asset:
                description: Update an asset
                summary: Rename an asset and update its attribute values
                value:
                  id: 7A6p4AnLTkKxJUCQAAABAA
                  version: 3
                  type: ThingAsset
                  name: Boiler room sensor
                  realm: building
                  accessPublicRead: false
                  attributes:
                    temperature:
                      name: temperature
                      type: number
                      value: 22.1
                    humidity:
                      name: humidity
                      type: number
                      value: 48
            schema:
              $ref: "#/components/schemas/AssetObject"
        description: "Complete asset representation to store. The body ID, when present,\
          \ must match the path ID; type and realm cannot be changed."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetObject"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "409":
          content:
            text/plain:
              schema:
                type: string
          description: The request conflicts with the current state of the resource
      security:
      - openid: []
      summary: Update an asset
      tags:
      - Asset
  /asset/{assetId}/attribute/{attributeName}:
    put:
      description: "Submits an asynchronous attribute write using the current server\
        \ time. The result reports whether the event was accepted, not whether downstream\
        \ processing ultimately succeeded. Anonymous writes require public-write metadata."
      operationId: writeAttributeValue
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: path
        name: attributeName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Numeric value:
                description: Numeric value
                summary: Write a number attribute
                value: 21.5
            schema:
              type: string
              nullable: true
        description: Any JSON value accepted by the attribute's value descriptor.
          JSON null clears the value.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The request completed successfully
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The attribute write failed
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "406":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The supplied value is not valid for the attribute
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The attribute event queue is full; retry the write later
      summary: Write a value to one asset attribute
      tags:
      - Asset
  /asset/{assetId}/attribute/{attributeName}/{timestamp}:
    put:
      description: Submits an asynchronous attribute write using the supplied Unix
        timestamp in milliseconds. The result reports acceptance only; anonymous writes
        require public-write metadata.
      operationId: writeAttributeValueWithTimestamp
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Attribute name as defined by the asset model.
        example: temperature
        in: path
        name: attributeName
        required: true
        schema:
          type: string
      - description: Unix timestamp in milliseconds.
        example: 1767225600000
        in: path
        name: timestamp
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            examples:
              Timestamped numeric value:
                description: Timestamped numeric value
                summary: Write a number with the path timestamp
                value: 21.5
            schema:
              type: string
              nullable: true
        description: Any JSON value accepted by the attribute's value descriptor.
          JSON null clears the value.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The request completed successfully
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The attribute write failed
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "406":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The supplied value is not valid for the attribute
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AttributeWriteResult"
          description: The attribute event queue is full; retry the write later
      summary: Write a timestamped value to one asset attribute
      tags:
      - Asset
  /asset/{parentAssetId}/child:
    put:
      description: "Sets parentAssetId as the parent of every asset listed in repeated\
        \ assetIds query parameters. Parent and children must satisfy realm, access,\
        \ and hierarchy constraints."
      operationId: updateAssetParent
      parameters:
      - description: Asset that will become the new parent.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: parentAssetId
        required: true
        schema:
          type: string
      - description: Child asset IDs to move. Repeat the query parameter for multiple
          assets.
        example: 7A6p4AnLTkKxJUCQAAABAA
        explode: true
        in: query
        name: assetIds
        required: true
        schema:
          type: array
          items:
            type: string
          maxItems: 2147483647
          minItems: 1
        style: form
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Move assets below a new parent
      tags:
      - Asset
  /configuration/manager:
    get:
      description: Returns the public Manager application configuration used by clients
        before and after authentication.
      operationId: getManagerConfig
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ManagerAppConfig"
          description: The request completed successfully
      summary: Retrieve the manager configuration JSON
      tags:
      - Configuration
    put:
      description: Replaces manager_config.json and returns the stored configuration.
        This administrative change affects Manager UI branding and behavior.
      operationId: updateConfiguration
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ManagerAppConfig"
        description: Complete public Manager UI configuration to persist as manager_config.json.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ManagerAppConfig"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Update manager configuration
      tags:
      - Configuration
  /configuration/manager/file:
    post:
      description: "Decodes and stores the supplied FileInfo under the requested relative\
        \ path, then returns its Manager API path."
      operationId: fileUpload
      parameters:
      - description: Relative storage path and filename for the image.
        example: images/logo.svg
        in: query
        name: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/FileInfo"
        description: File metadata and Base64 or text contents to store.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: string
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Upload a Manager configuration image
      tags:
      - Configuration
  /configuration/manager/image/{filename}:
    get:
      description: Streams a previously uploaded configuration image using its detected
        media type.
      operationId: getManagerConfigImage
      parameters:
      - description: Relative image path below the Manager configuration image directory.
        example: images/logo.svg
        in: path
        name: filename
        required: true
        schema:
          type: string
          pattern: .+
      responses:
        "200":
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
          description: The image file
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve a Manager configuration image
      tags:
      - Configuration
  /console/register:
    post:
      description: "Creates an anonymous console registration when id is absent, or\
        \ updates an existing registration when id is present. Authenticated new registrations\
        \ are linked to the caller; updates require that link. The returned registration\
        \ contains the durable asset ID for later calls."
      operationId: register
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ConsoleRegistration"
        description: "Console platform, version, display name, and notification-provider\
          \ registrations. Omit id to create a registration; include the returned\
          \ id to update it."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConsoleRegistration"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "409":
          content:
            text/plain:
              schema:
                type: string
          description: The request conflicts with the current state of the resource
      summary: Create or update the registration for a console
      tags:
      - Console
  /dashboard:
    post:
      description: Creates a dashboard in an accessible realm. The server assigns
        the authenticated user as owner and initially stores the dashboard with shared
        access.
      operationId: createDashboard
      requestBody:
        content:
          application/json:
            examples:
              Operations dashboard:
                description: Operations dashboard
                summary: Create an empty responsive dashboard
                value:
                  realm: building
                  displayName: Operations overview
                  template:
                    columns: 12
                    refreshInterval: FIVE_MIN
                    screenPresets:
                    - id: desktop
                      displayName: Desktop
                      breakpoint: 1024
                      scalingPreset: KEEP_LAYOUT
            schema:
              $ref: "#/components/schemas/Dashboard"
        description: Dashboard definition to create. The server assigns ownerId and
          initially forces SHARED access.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Dashboard"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Create a dashboard
      tags:
      - Dashboard
    put:
      description: Updates an existing dashboard when the authenticated user can modify
        it in the dashboard's realm.
      operationId: updateDashboard
      requestBody:
        content:
          application/json:
            examples:
              Update operations dashboard:
                description: Update operations dashboard
                summary: Rename an existing shared dashboard
                value:
                  id: operations-overview
                  version: 2
                  realm: building
                  ownerId: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
                  access: SHARED
                  displayName: Building operations overview
                  template:
                    columns: 12
                    refreshInterval: FIVE_MIN
                    screenPresets:
                    - id: desktop
                      displayName: Desktop
                      breakpoint: 1024
                      scalingPreset: KEEP_LAYOUT
            schema:
              $ref: "#/components/schemas/Dashboard"
        description: "Complete dashboard definition to update, including its id and\
          \ realm."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Dashboard"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Update a dashboard
      tags:
      - Dashboard
  /dashboard/all/{realm}:
    get:
      description: "Returns dashboards visible to the caller in the requested realm.\
        \ Anonymous callers receive public dashboards only; authenticated access also\
        \ depends on roles, ownership, and linked assets."
      operationId: getAllRealmDashboards
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Dashboard"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
      summary: Retrieve all accessible dashboards
      tags:
      - Dashboard
  /dashboard/query:
    post:
      description: "Executes a dashboard query after constraining it to the caller's\
        \ realm, roles, ownership, and asset access. A missing body uses the request\
        \ realm and default visibility rules."
      operationId: queryDashboards
      requestBody:
        content:
          application/json:
            examples:
              Find operations dashboards:
                description: Find operations dashboards
                summary: Find public or shared dashboards by name in one realm
                value:
                  realm:
                    name: building
                  names:
                  - match: CONTAINS
                    caseSensitive: false
                    value: operations
                  conditions:
                    dashboard:
                      access:
                      - PUBLIC
                      - SHARED
                  start: 0
                  limit: 50
            schema:
              $ref: "#/components/schemas/DashboardQuery"
        description: "Optional dashboard filters, realm, access rules, sorting, and\
          \ pagination. An omitted body uses the request realm and default visibility\
          \ rules."
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Dashboard"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
      summary: Retrieve dashboards using a query
      tags:
      - Dashboard
  /dashboard/{realm}/{dashboardId}:
    delete:
      description: Permanently removes a dashboard when the authenticated user can
        modify it in the requested realm.
      operationId: deleteDashboard
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Dashboard identifier.
        example: operations-overview
        in: path
        name: dashboardId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Delete a dashboard
      tags:
      - Dashboard
    get:
      description: Returns one dashboard only when it is visible to the caller. Inaccessible
        and nonexistent dashboards both return 404 to avoid disclosing their existence.
      operationId: getDashboard
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Dashboard identifier.
        example: operations-overview
        in: path
        name: dashboardId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Dashboard"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Retrieve a dashboard
      tags:
      - Dashboard
  /flow:
    get:
      description: Returns every supported flow node definition except the internal
        LOG_OUTPUT node.
      operationId: getAllNodeDefinitions
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Node"
          description: The request completed successfully
      summary: Retrieve all node definitions
      tags:
      - Flow
  /flow/{name}:
    get:
      description: Resolves one flow node definition by its model name.
      operationId: getNodeDefinition
      parameters:
      - description: Exact model name of the flow node definition.
        example: Attribute
        in: path
        name: name
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Node"
          description: The request completed successfully
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve a node definition by name
      tags:
      - Flow
  /flow/{type}:
    get:
      description: Returns supported flow node definitions whose category matches
        the requested node type.
      operationId: getAllNodeDefinitionsByType
      parameters:
      - description: Flow node category to filter by.
        example: INPUT
        in: path
        name: type
        required: true
        schema:
          type: string
          enum:
          - INPUT
          - PROCESSOR
          - OUTPUT
          - THEN
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Node"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
      summary: Retrieve all node definitions by type
      tags:
      - Flow
  /gateway/connection:
    delete:
      description: Removes connections for all repeated realm query parameters. Deleting
        multiple realms is restricted to super users.
      operationId: deleteConnections
      parameters:
      - description: Realm names whose gateway connections should be removed. Repeat
          the query parameter for multiple realms.
        example: building
        explode: true
        in: query
        name: realm
        required: true
        schema:
          type: array
          items:
            type: string
        style: form
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete the gateway connections of multiple realms
      tags:
      - Gateway
    get:
      description: "Returns every configured central-manager connection. Unlike the\
        \ single-realm endpoint, this operation is restricted to super users."
      operationId: getConnections
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/GatewayConnection"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the gateway connections of all realms
      tags:
      - Gateway
  /gateway/connection/{realm}:
    delete:
      description: Removes the central-manager connection for one realm. Realm administrators
        can remove their own connection; super users can remove any connection.
      operationId: deleteConnection
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete the gateway connection of a realm
      tags:
      - Gateway
    get:
      description: "Returns the central-manager connection configured for a realm,\
        \ or null when none exists. Realm administrators can read their own realm;\
        \ super users can read any realm."
      operationId: getConnection
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GatewayConnection"
          description: The request completed successfully
        "204":
          description: No gateway connection is configured for the realm
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the gateway connection of a realm
      tags:
      - Gateway
    put:
      description: "Creates or replaces the connection for the path realm. The server\
        \ forces the local realm, including realm predicates in attribute filters,\
        \ to match the path."
      operationId: setConnection
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GatewayConnection"
        description: Central-manager connection settings. localRealm and realms in
          attribute filters are forced to match the path realm.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Update the gateway connection of a realm
      tags:
      - Gateway
  /gateway/status/{realm}:
    get:
      description: Returns the live connection state for the requested local realm.
      operationId: getConnectionStatus
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: string
                enum:
                - DISCONNECTED
                - CONNECTING
                - DISCONNECTING
                - CONNECTED
                - DISABLED
                - WAITING
                - ERROR
                - STOPPED
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the gateway connection status of a realm
      tags:
      - Gateway
  /gateway/tunnel:
    delete:
      description: "Stops the tunnel identified by the supplied gateway, target, and\
        \ port information. When realm is omitted, the authenticated realm is used."
      operationId: stopTunnel
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GatewayTunnelInfo"
        description: "Tunnel identity returned by startTunnel, including gateway and\
          \ allocated endpoint information."
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Stop a tunnel for a gateway
      tags:
      - Gateway
    post:
      description: "Requests a TCP tunnel through a connected gateway and returns\
        \ its allocated local endpoint. When realm is omitted, the authenticated realm\
        \ is used."
      operationId: startTunnel
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GatewayTunnelInfo"
        description: "Gateway, realm, target host, and target port for the requested\
          \ tunnel. Realm defaults to the authenticated realm."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GatewayTunnelInfo"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "417":
          description: The gateway could not establish the requested tunnel
      security:
      - openid: []
      summary: Start a tunnel for a gateway
      tags:
      - Gateway
  /gateway/tunnel/{realm}:
    get:
      description: Returns active tunnels for all gateway assets in the requested
        realm. Restricted users cannot list an entire realm.
      operationId: getAllActiveTunnelInfos
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/GatewayTunnelInfo"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve all active gateway tunnels in a realm
      tags:
      - Gateway
  /gateway/tunnel/{realm}/{id}:
    get:
      description: Returns active tunnels for one gateway asset. Restricted users
        may query only a linked gateway.
      operationId: getGatewayActiveTunnelInfos
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Gateway asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/GatewayTunnelInfo"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the active tunnels of a gateway
      tags:
      - Gateway
  /gateway/tunnel/{realm}/{id}/{target}/{targetPort}:
    get:
      description: "Returns the tunnel matching realm, gateway, target host, and target\
        \ port, or null when no active tunnel matches."
      operationId: getActiveTunnelInfo
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Gateway asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Host or IP address reachable from the gateway.
        example: 192.168.1.20
        in: path
        name: target
        required: true
        schema:
          type: string
      - description: TCP port on the target host.
        example: 22
        in: path
        name: targetPort
        required: true
        schema:
          type: integer
          format: int32
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GatewayTunnelInfo"
          description: The request completed successfully
        "204":
          description: No active tunnel matches the requested endpoint
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve one active gateway tunnel
      tags:
      - Gateway
  /health:
    get:
      description: Returns health data keyed by registered health-provider name. A
        null provider result is represented as JSON null.
      operationId: getHealthStatus
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: object
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the health status of the system
      tags:
      - Status
  /info:
    get:
      description: "Returns public bootstrap information, including the Manager version\
        \ and identity-provider URL."
      operationId: getInfo
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: object
          description: The request completed successfully
      summary: Retrieve the system information
      tags:
      - Status
  /map:
    get:
      description: Returns realm-aware public MapLibre settings with externally reachable
        URLs derived from proxy headers.
      operationId: getSettings
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ObjectNode"
          description: The request completed successfully
      summary: Retrieve the style used for MapLibre GL
      tags:
      - Map
    put:
      description: Stores the map configuration and returns the resulting public MapLibre
        settings.
      operationId: saveSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MapConfig"
        description: "Map provider, style, bounds, and custom-map settings to persist."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ObjectNode"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Update map settings
      tags:
      - Map
  /map/deleteMap:
    delete:
      description: Deletes the installed custom MBTiles database and returns the fallback
        public map settings.
      operationId: deleteMap
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ObjectNode"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Remove the custom MBTiles map
      tags:
      - Map
  /map/getCustomMapInfo:
    get:
      description: Reports whether custom MBTiles data is installed and the maximum
        accepted upload size.
      operationId: getCustomMapInfo
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ObjectNode"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Retrieve custom-map status and upload limit
      tags:
      - Map
  /map/tile/{zoom}/{column}/{row}:
    get:
      description: "Returns a pre-compressed Mapbox vector tile for the requested\
        \ zoom, column, and row coordinates."
      operationId: getTile
      parameters:
      - description: Web Mercator zoom level.
        example: 14
        in: path
        name: zoom
        required: true
        schema:
          type: integer
          format: int32
      - description: Web Mercator tile X coordinate.
        example: 8392
        in: path
        name: column
        required: true
        schema:
          type: integer
          format: int32
      - description: Web Mercator tile Y coordinate.
        example: 5469
        in: path
        name: row
        required: true
        schema:
          type: integer
          format: int32
      responses:
        "200":
          content:
            application/vnd.mapbox-vector-tile:
              schema:
                type: string
                format: binary
          description: Gzip-compressed vector tile
          headers:
            Content-Encoding:
              description: Indicates that the tile bytes are already compressed
              schema:
                type: string
                _enum:
                - gzip
              style: simple
        "204":
          description: No tile exists at the requested coordinates
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
      summary: Retrieve vector tile data for MapLibre GL
      tags:
      - Map
  /map/upload:
    post:
      description: Stores the raw request body as the realm's custom MBTiles database
        and returns the resulting public map settings.
      operationId: uploadMap
      parameters:
      - description: Original MBTiles filename used for validation and storage.
        example: building.mbtiles
        in: query
        name: filename
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
        description: Raw MBTiles SQLite database bytes.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ObjectNode"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "413":
          content:
            text/plain:
              schema:
                type: string
          description: The request or generated response exceeds the configured size
            limit
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Upload a custom MBTiles map
      tags:
      - Map
  /model/assetDescriptors:
    get:
      description: "Returns the descriptors used to construct supported asset types,\
        \ using a gateway model when the optional parent context resolves below a\
        \ gateway."
      operationId: getAssetDescriptors
      parameters:
      - description: Optional parent asset used to select the local or gateway model
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      - description: "Optional parent asset type, primarily for assets that have not\
          \ been persisted yet"
        example: GroupAsset
        in: query
        name: parentType
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetDescriptorObject"
          description: The request completed successfully
      summary: Retrieve the available asset descriptors
      tags:
      - Asset Model
  /model/assetInfo/{assetType}:
    get:
      description: "Returns metadata for one asset type from this Manager or, when\
        \ parentId is below a gateway, from that gateway's model. An unknown or gateway-provided\
        \ type that is not locally available returns no content."
      operationId: getAssetInfo
      parameters:
      - description: Optional parent asset used to select the local or gateway model
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      - description: Asset type name
        example: ThingAsset
        in: path
        name: assetType
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetTypeInfo"
          description: The request completed successfully
        "204":
          description: No model information is available for the requested asset type
      summary: Retrieve the asset type information of an asset type
      tags:
      - Asset Model
  /model/assetInfos:
    get:
      description: "Returns type metadata from this Manager by default. When parentId\
        \ identifies an asset below a gateway, the gateway's model is used instead;\
        \ parentType can provide type context for a new parent that does not yet exist."
      operationId: getAssetInfos
      parameters:
      - description: Optional parent asset used to select the local or gateway model
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      - description: "Optional parent asset type, primarily for assets that have not\
          \ been persisted yet"
        example: GroupAsset
        in: query
        name: parentType
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetTypeInfo"
          description: The request completed successfully
      summary: Retrieve the asset type information of each available asset type
      tags:
      - Asset Model
  /model/getValueDescriptorSchema:
    get:
      description: Returns the JSON Schema and a weak ETag for the named value descriptor.
        Send If-None-Match on later requests to receive 304 when the schema has not
        changed.
      operationId: getValueDescriptorSchema
      parameters:
      - description: Value descriptor name
        example: number
        in: query
        name: name
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
          description: The current JSON Schema
          headers:
            ETag:
              description: Weak entity tag identifying this schema version
              schema:
                type: string
                example: W/"17af8b28"
              style: simple
        "304":
          description: The supplied ETag still identifies the current schema
          headers:
            ETag:
              description: Entity tag supplied by the client
              schema:
                type: string
              style: simple
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Retrieve the JSON Schema of the specified value descriptor
      tags:
      - Asset Model
  /model/metaItemDescriptors:
    get:
      description: "Returns attribute metadata descriptors keyed by descriptor name,\
        \ using a gateway model when parentId resolves below a gateway."
      operationId: getMetaItemDescriptors
      parameters:
      - description: Optional parent asset used to select the local or gateway model
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/MetaItemDescriptorObject"
          description: The request completed successfully
      summary: Retrieve the available meta item descriptors
      tags:
      - Asset Model
  /model/valueDescriptors:
    get:
      description: "Returns attribute value descriptors keyed by descriptor name,\
        \ using a gateway model when parentId resolves below a gateway."
      operationId: getValueDescriptors
      parameters:
      - description: Optional parent asset used to select the local or gateway model
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: parentId
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/ValueDescriptorObject"
          description: The request completed successfully
      summary: Retrieve the available value descriptors
      tags:
      - Asset Model
  /notification:
    delete:
      description: "Permanently removes all records matching the optional ID, type,\
        \ time, realm, user, and asset filters. This bulk operation is restricted\
        \ to a super user."
      operationId: removeNotifications
      parameters:
      - description: Delete only this sent-notification record.
        example: 42
        in: query
        name: id
        schema:
          type: integer
          format: int64
      - description: Delete records with this notification message type.
        example: push
        in: query
        name: type
        schema:
          type: string
      - description: "Inclusive lower bound for the sent timestamp, in Unix milliseconds."
        example: 1767225600000
        in: query
        name: from
        schema:
          type: integer
          format: int64
      - description: "Exclusive upper bound for the sent timestamp, in Unix milliseconds."
        example: 1767312000000
        in: query
        name: to
        schema:
          type: integer
          format: int64
      - description: Delete records associated with this realm.
        example: building
        in: query
        name: realmId
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: userId
        schema:
          type: string
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete sent notifications matching filter criteria
      tags:
      - Notification
    get:
      description: "Returns sent-notification records filtered by identity, message\
        \ type, time, realm, target, source, sorting, and pagination. Results are\
        \ realm-scoped and sensitive target/source identifiers are redacted when the\
        \ caller lacks user or asset read permission."
      operationId: getNotifications
      parameters:
      - description: Return only this sent-notification record.
        example: 42
        in: query
        name: id
        schema:
          type: integer
          format: int64
      - description: Notification message type discriminator.
        example: push
        in: query
        name: type
        schema:
          type: string
      - description: "Inclusive lower bound for the sent timestamp, in Unix milliseconds."
        example: 1767225600000
        in: query
        name: from
        schema:
          type: integer
          format: int64
      - description: "Exclusive upper bound for the sent timestamp, in Unix milliseconds."
        example: 1767312000000
        in: query
        name: to
        schema:
          type: integer
          format: int64
      - description: Return notifications associated with this realm.
        example: building
        in: query
        name: realmId
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: userId
        schema:
          type: string
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        schema:
          type: string
      - description: Origin that created the notification.
        in: query
        name: source
        schema:
          type: string
          enum:
          - INTERNAL
          - CLIENT
          - GLOBAL_RULESET
          - REALM_RULESET
          - ASSET_RULESET
      - description: Field used to order the result set.
        in: query
        name: sort
        schema:
          type: string
          enum:
          - TITLE
          - SOURCE
          - STATUS
          - SENT_ON
          - DELIVERED_ON
      - description: Reverse the selected sort order.
        example: true
        in: query
        name: descending
        schema:
          type: boolean
      - description: Number of matching records to skip.
        example: 0
        in: query
        name: offset
        schema:
          type: integer
          format: int32
      - description: Maximum number of records to return.
        example: 100
        in: query
        name: limit
        schema:
          type: integer
          format: int32
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SentNotification"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve sent notifications matching filter criteria
      tags:
      - Notification
  /notification/alert:
    post:
      description: "Queues a notification for delivery. Authorization is checked for\
        \ every target; if any target is inaccessible, the complete request fails\
        \ rather than sending a partial set."
      operationId: sendNotification
      requestBody:
        content:
          application/json:
            examples:
              Push notification:
                description: Push notification
                summary: Send a high-priority asset alert to one user
                value:
                  name: High temperature alert
                  message:
                    type: push
                    title: Temperature alert
                    body: Boiler room temperature reached 42 °C.
                    priority: HIGH
                    data:
                      assetId: 7A6p4AnLTkKxJUCQAAABAA
                  targets:
                  - type: USER
                    id: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
                    locale: en
            schema:
              $ref: "#/components/schemas/Notification"
        description: "Message, source, and one or more delivery targets to queue."
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Send a notification to one or more targets
      tags:
      - Notification
  /notification/count:
    get:
      description: "Returns the count for the same realm-scoped type, time, target,\
        \ and source filters supported by getNotifications without loading notification\
        \ records."
      operationId: getNotificationsCount
      parameters:
      - description: Notification message type discriminator.
        example: push
        in: query
        name: type
        schema:
          type: string
      - description: "Inclusive lower bound for the sent timestamp, in Unix milliseconds."
        example: 1767225600000
        in: query
        name: from
        schema:
          type: integer
          format: int64
      - description: "Exclusive upper bound for the sent timestamp, in Unix milliseconds."
        example: 1767312000000
        in: query
        name: to
        schema:
          type: integer
          format: int64
      - description: Count notifications associated with this realm.
        example: building
        in: query
        name: realmId
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: userId
        schema:
          type: string
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: query
        name: assetId
        schema:
          type: string
      - description: Origin that created the notification.
        in: query
        name: source
        schema:
          type: string
          enum:
          - INTERNAL
          - CLIENT
          - GLOBAL_RULESET
          - REALM_RULESET
          - ASSET_RULESET
      responses:
        "200":
          content:
            application/json:
              schema:
                type: integer
                format: int64
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Count sent notifications matching filter criteria
      tags:
      - Notification
  /notification/{notificationId}:
    delete:
      description: Permanently removes one sent-notification record. This operation
        is restricted to a super user and is idempotent when the ID does not exist.
      operationId: removeNotification
      parameters:
      - description: Numeric sent-notification identifier.
        example: 42
        in: path
        name: notificationId
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete a sent notification
      tags:
      - Notification
  /notification/{notificationId}/acknowledged:
    put:
      description: Marks one target's notification as acknowledged and stores the
        optional JSON acknowledgement value. Access rules are identical to notificationDelivered.
      operationId: notificationAcknowledged
      parameters:
      - description: "User, asset, or realm target identifier whose acknowledgement\
          \ state is updated."
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: targetId
        required: true
        schema:
          type: string
      - description: Numeric sent-notification identifier.
        example: 42
        in: path
        name: notificationId
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              type: string
              nullable: true
        description: Optional arbitrary JSON acknowledgement value.
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Acknowledge a notification
      tags:
      - Notification
  /notification/{notificationId}/delivered:
    put:
      description: "Marks one target's notification as delivered after matching both\
        \ notificationId and targetId. Anonymous callers may update notifications\
        \ sent to a public asset; authenticated callers are constrained to their own\
        \ user, realm, or accessible assets."
      operationId: notificationDelivered
      parameters:
      - description: "User, asset, or realm target identifier whose delivery state\
          \ is updated."
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: query
        name: targetId
        required: true
        schema:
          type: string
      - description: Numeric sent-notification identifier.
        example: 42
        in: path
        name: notificationId
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Mark a notification as delivered
      tags:
      - Notification
  /provisioning:
    get:
      description: Returns every provisioning configuration. This operation is restricted
        to a super administrator.
      operationId: getProvisioningConfigs
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ProvisioningConfigObjectObject"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve all provisioning configurations
      tags:
      - Provisioning
    post:
      description: Persists a new provisioning configuration and returns its generated
        numeric identifier. This operation is restricted to a super administrator.
      operationId: createProvisioningConfig
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisioningConfigObjectObject"
        description: Complete typed provisioning configuration to create.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: integer
                format: int64
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Create a provisioning configuration
      tags:
      - Provisioning
  /provisioning/{id}:
    delete:
      description: Permanently removes the provisioning configuration identified by
        the path. This operation is restricted to a super administrator.
      operationId: deleteProvisioningConfig
      parameters:
      - description: Numeric provisioning configuration identifier.
        example: 12
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Delete a provisioning configuration
      tags:
      - Provisioning
    put:
      description: Replaces the provisioning configuration identified by the path.
        This operation is restricted to a super administrator.
      operationId: updateProvisioningConfig
      parameters:
      - description: Numeric provisioning configuration identifier.
        example: 12
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisioningConfigObjectObject"
        description: Complete typed provisioning configuration to replace the existing
          configuration.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Update a provisioning configuration
      tags:
      - Provisioning
  /realm:
    get:
      description: Returns complete realm records from the identity provider. This
        operation is restricted to a super user.
      operationId: getAllRealms
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Realm"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      security:
      - openid: []
      summary: Retrieve all realms
      tags:
      - Realm
    post:
      description: Creates and configures a realm in the identity provider. This operation
        is restricted to a super user.
      operationId: createRealm
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Realm"
        description: "Realm name, display name, activation state, and optional identity-provider\
          \ settings."
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "409":
          content:
            text/plain:
              schema:
                type: string
          description: The request conflicts with the current state of the resource
      security:
      - openid: []
      summary: Create a new realm
      tags:
      - Realm
  /realm/accessible:
    get:
      description: Returns only realm name and display name. Super users receive all
        realms; authenticated users receive their realm; anonymous callers receive
        the request realm.
      operationId: getAccessibleRealms
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Realm"
          description: The request completed successfully
        "500":
          content:
            text/plain:
              schema:
                type: string
          description: The operation failed because of an unexpected server error
      summary: Retrieve realms accessible to the caller
      tags:
      - Realm
  /realm/{name}:
    delete:
      description: Permanently deletes a realm from the identity provider. The master
        realm cannot be deleted; related Manager data is not automatically removed.
      operationId: deleteRealm
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: name
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The master realm cannot be deleted
      security:
      - openid: []
      summary: Delete a realm
      tags:
      - Realm
    get:
      description: Returns complete details for a named active realm when it is accessible
        to the caller. Regular users cannot use this endpoint to inspect other realms.
      operationId: getRealm
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: name
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Realm"
          description: The request completed successfully
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Retrieve an accessible realm
      tags:
      - Realm
    put:
      description: Updates a realm through the identity provider. Super-user access
        is required; the master realm cannot be renamed or disabled.
      operationId: updateRealm
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Realm"
        description: Complete realm settings to apply; the path name identifies the
          existing realm.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "405":
          description: The requested mutation is not allowed for the master realm
        "409":
          content:
            text/plain:
              schema:
                type: string
          description: The request conflicts with the current state of the resource
      security:
      - openid: []
      summary: Update a realm
      tags:
      - Realm
  /rules:
    get:
      description: Returns global rulesets filtered by repeated language parameters.
        fullyPopulate controls whether rule source and other large fields are loaded;
        super-user access is required.
      operationId: getGlobalRulesets
      parameters:
      - description: Rule languages to include; repeat the query parameter for multiple
          values.
        explode: true
        in: query
        name: language
        schema:
          type: array
          items:
            type: string
            enum:
            - JAVASCRIPT
            - GROOVY
            - JSON
            - FLOW
        style: form
      - description: "Include rule source, meta, and other large fields instead of\
          \ summary records."
        example: true
        in: query
        name: fullyPopulate
        schema:
          type: boolean
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/GlobalRuleset"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve global rulesets
      tags:
      - Rule
    post:
      description: Creates and deploys a global ruleset and returns its numeric ID.
        Super-user access is required; legacy JavaScript rulesets cannot be created.
      operationId: createGlobalRuleset
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalRuleset"
        description: "Global ruleset name, language, source, enabled state, and optional\
          \ metadata."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: integer
                format: int64
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Create a global ruleset
      tags:
      - Rule
  /rules/asset:
    post:
      description: Creates and deploys a ruleset for an accessible asset and returns
        its numeric ID. The assetId is taken from the request body.
      operationId: createAssetRuleset
      requestBody:
        content:
          application/json:
            examples:
              Asset alert ruleset:
                description: Asset alert ruleset
                summary: Create an enabled JSON ruleset for one asset
                value:
                  assetId: 7A6p4AnLTkKxJUCQAAABAA
                  name: High temperature alert
                  lang: JSON
                  enabled: true
                  accessPublicRead: false
                  rules: "{\"rules\":[{\"name\":\"High temperature alert\",\"when\"\
                    :{\"operator\":\"OR\",\"groups\":[{\"operator\":\"AND\",\"items\"\
                    :[{\"assets\":{\"ids\":[\"7A6p4AnLTkKxJUCQAAABAA\"],\"attributes\"\
                    :{\"items\":[{\"name\":{\"predicateType\":\"string\",\"match\"\
                    :\"EXACT\",\"value\":\"temperature\"},\"value\":{\"predicateType\"\
                    :\"number\",\"operator\":\"GREATER_THAN\",\"value\":40}}]}}}]}]},\"\
                    then\":[{\"action\":\"alarm\",\"alarm\":{\"title\":\"High temperature\"\
                    ,\"content\":\"%TRIGGER_ASSETS%\",\"severity\":\"HIGH\",\"status\"\
                    :\"OPEN\"}}]}]}"
            schema:
              $ref: "#/components/schemas/AssetRuleset"
        description: "Asset ruleset including its target assetId, name, language,\
          \ source, and enabled state."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: integer
                format: int64
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Create an asset ruleset
      tags:
      - Rule
  /rules/asset/for/{assetId}:
    get:
      description: Returns asset rulesets filtered by language. Callers without full
        access receive public rulesets only; a nonexistent asset produces an empty
        array.
      operationId: getAssetRulesets
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      - description: Rule languages to include; repeat the query parameter for multiple
          values.
        explode: true
        in: query
        name: language
        schema:
          type: array
          items:
            type: string
            enum:
            - JAVASCRIPT
            - GROOVY
            - JSON
            - FLOW
        style: form
      - description: "Include rule source, meta, and other large fields instead of\
          \ summary records."
        example: true
        in: query
        name: fullyPopulate
        schema:
          type: boolean
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/AssetRuleset"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
      summary: Retrieve rulesets for an asset
      tags:
      - Rule
  /rules/asset/{id}:
    delete:
      description: Permanently removes and undeploys one ruleset from an accessible
        asset.
      operationId: deleteAssetRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Delete an asset ruleset
      tags:
      - Rule
    get:
      description: Returns one fully populated asset ruleset when the caller can access
        its realm and owning asset.
      operationId: getAssetRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AssetRuleset"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve an asset ruleset
      tags:
      - Rule
    put:
      description: Replaces and redeploys one asset ruleset. The ID must match and
        an existing ruleset cannot be reassigned to another asset.
      operationId: updateAssetRuleset
      parameters:
      - description: Numeric ruleset identifier; must match the body id.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AssetRuleset"
        description: Complete replacement asset ruleset; its id and assetId must match
          the existing ruleset.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update an asset ruleset
      tags:
      - Rule
  /rules/geofences/{assetId}:
    get:
      description: Extracts geofence definitions relevant to the asset. Anonymous
        access requires a public-readable asset; authenticated restricted users require
        an asset link.
      operationId: getAssetGeofences
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/GeofenceDefinition"
          description: The request completed successfully
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      summary: Retrieve geofences for an asset
      tags:
      - Rule
  /rules/info/asset/{assetId}:
    get:
      description: Returns runtime status and error counts for an accessible asset
        engine. Returns null when the asset or its engine does not exist.
      operationId: getAssetEngineInfo
      parameters:
      - description: Globally unique 22-character asset identifier.
        example: 7A6p4AnLTkKxJUCQAAABAA
        in: path
        name: assetId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RulesEngineInfo"
          description: The request completed successfully
        "204":
          description: The asset or its rules engine does not exist
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve information about an asset rules engine
      tags:
      - Rule
  /rules/info/global:
    get:
      description: "Returns runtime status and compilation/execution error counts\
        \ for the global engine, or null when that engine is not running. Super-user\
        \ access is required."
      operationId: getGlobalEngineInfo
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RulesEngineInfo"
          description: The request completed successfully
        "204":
          description: The global rules engine is not running
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve information about the global rules engine
      tags:
      - Rule
  /rules/info/realm/{realm}:
    get:
      description: "Returns runtime status and error counts for an accessible realm\
        \ engine, or null when that engine is not running. Restricted users cannot\
        \ inspect realm engines."
      operationId: getRealmEngineInfo
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RulesEngineInfo"
          description: The request completed successfully
        "204":
          description: The requested realm rules engine is not running
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve information about a realm rules engine
      tags:
      - Rule
  /rules/realm:
    post:
      description: Creates and deploys a ruleset in its body realm and returns its
        numeric ID. Restricted users cannot create realm rulesets; legacy JavaScript
        is not accepted.
      operationId: createRealmRuleset
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RealmRuleset"
        description: "Realm ruleset including its target realm, name, language, source,\
          \ and enabled state."
        required: true
      responses:
        "200":
          content:
            '*/*':
              schema:
                type: integer
                format: int64
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Create a realm ruleset
      tags:
      - Rule
  /rules/realm/for/{realm}:
    get:
      description: "Returns realm rulesets filtered by language. Anonymous, restricted,\
        \ or callers without read-rules permission receive public rulesets only; fullyPopulate\
        \ controls loading of rule source."
      operationId: getRealmRulesets
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Rule languages to include; repeat the query parameter for multiple
          values.
        explode: true
        in: query
        name: language
        schema:
          type: array
          items:
            type: string
            enum:
            - JAVASCRIPT
            - GROOVY
            - JSON
            - FLOW
        style: form
      - description: "Include rule source, meta, and other large fields instead of\
          \ summary records."
        example: true
        in: query
        name: fullyPopulate
        schema:
          type: boolean
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/RealmRuleset"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The caller does not have permission to access the requested
            resource
      summary: Retrieve rulesets for a realm
      tags:
      - Rule
  /rules/realm/{id}:
    delete:
      description: Permanently removes and undeploys one ruleset from an accessible
        realm.
      operationId: deleteRealmRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Delete a realm ruleset
      tags:
      - Rule
    get:
      description: Returns one fully populated realm ruleset when its realm is accessible
        to the caller.
      operationId: getRealmRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RealmRuleset"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a realm ruleset
      tags:
      - Rule
    put:
      description: Replaces and redeploys one realm ruleset. Path and body IDs and
        the existing realm must match; legacy JavaScript cannot be updated.
      operationId: updateRealmRuleset
      parameters:
      - description: Numeric ruleset identifier; must match the body id.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RealmRuleset"
        description: Complete replacement realm ruleset; its id and realm must match
          the existing ruleset.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update a realm ruleset
      tags:
      - Rule
  /rules/{id}:
    delete:
      description: Permanently removes and undeploys one global ruleset. Super-user
        access is required.
      operationId: deleteGlobalRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Delete a global ruleset
      tags:
      - Rule
    get:
      description: Returns one fully populated global ruleset including transient
        deployment status and errors. Super-user access is required.
      operationId: getGlobalRuleset
      parameters:
      - description: Numeric ruleset identifier.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GlobalRuleset"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a global ruleset
      tags:
      - Rule
    put:
      description: Replaces and redeploys the identified global ruleset. Path and
        body IDs must match; legacy JavaScript rulesets cannot be updated.
      operationId: updateGlobalRuleset
      parameters:
      - description: Numeric ruleset identifier; must match the body id.
        example: 27
        in: path
        name: id
        required: true
        schema:
          type: integer
          format: int64
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalRuleset"
        description: Complete replacement global ruleset; its id must match the path.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update a global ruleset
      tags:
      - Rule
  /service:
    get:
      description: Returns all active realm-scoped service registrations for an active
        realm accessible to the caller.
      operationId: getServices
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: query
        name: realm
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ExternalService"
          description: List of registered external services
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: List registered external services for a realm
      tags:
      - Services
    post:
      description: Registers a realm-scoped service instance for the request realm.
        The caller must be a service account; the returned object contains the assigned
        instance ID and initial lease state.
      operationId: registerService
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ExternalService"
        description: Realm-scoped service metadata and lease settings; instanceId
          is assigned by the Manager.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ExternalService"
          description: Service registered successfully
        "400":
          description: Invalid external service object
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "409":
          description: ExternalService instance already registered
      security:
      - openid: []
      summary: Register an external service with the OpenRemote Manager
      tags:
      - Services
  /service/global:
    get:
      description: Returns active registrations marked as globally available across
        realms.
      operationId: getGlobalServices
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/ExternalService"
          description: List of registered external services
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: List globally available external services
      tags:
      - Services
    post:
      description: Registers a service visible in every realm. The caller must be
        a super-user service account and the request must use the master realm.
      operationId: registerGlobalService
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ExternalService"
        description: Globally visible service metadata and lease settings; instanceId
          is assigned by the Manager.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ExternalService"
          description: Service registered successfully
        "400":
          description: Invalid external service object
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "409":
          description: ExternalService instance already registered
      security:
      - openid: []
      summary: Register a global external service with the OpenRemote Manager
      tags:
      - Services
  /service/{serviceId}/{instanceId}:
    delete:
      description: Removes an active service registration. The caller must be the
        service account that registered it; global-service removal additionally requires
        a super user.
      operationId: deregisterService
      parameters:
      - description: Stable service type identifier chosen by the service.
        example: weather
        in: path
        name: serviceId
        required: true
        schema:
          type: string
      - description: Numeric instance identifier assigned during registration.
        example: 1
        in: path
        name: instanceId
        required: true
        schema:
          type: integer
          format: int32
      responses:
        "204":
          description: Service deregistered successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          description: Service instance not found
      security:
      - openid: []
      summary: Deregister an external service
      tags:
      - Services
    get:
      description: "Returns one registered instance by stable service ID and numeric\
        \ instance ID, after verifying access to the service's realm."
      operationId: getService
      parameters:
      - description: Stable service type identifier chosen by the service.
        example: weather
        in: path
        name: serviceId
        required: true
        schema:
          type: string
          maxLength: 2147483647
          minLength: 1
      - description: Numeric instance identifier assigned during registration.
        example: 1
        in: path
        name: instanceId
        required: true
        schema:
          type: integer
          format: int32
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ExternalService"
          description: ExternalService retrieved successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          description: ExternalService not found
      security:
      - openid: []
      summary: Retrieve an external service instance
      tags:
      - Services
    put:
      description: Extends the lease of one service instance. The caller must be the
        service account that registered it; global-service heartbeats additionally
        require a super user.
      operationId: heartbeat
      parameters:
      - description: Stable service type identifier chosen by the service.
        example: weather
        in: path
        name: serviceId
        required: true
        schema:
          type: string
          maxLength: 2147483647
          minLength: 1
      - description: Numeric instance identifier assigned during registration.
        example: 1
        in: path
        name: instanceId
        required: true
        schema:
          type: integer
          format: int32
      responses:
        "204":
          description: Heartbeat sent successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          description: Service instance not found
      security:
      - openid: []
      summary: Renew an external service registration lease
      tags:
      - Services
  /syslog/config:
    get:
      description: Returns the current log-storage and retention configuration.
      operationId: getConfig
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SyslogConfig"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve the syslog configuration
      tags:
      - Syslog
    put:
      description: Validates and applies log-storage and retention settings.
      operationId: updateConfig
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SyslogConfig"
        description: "Log level, storage, and retention settings to apply."
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Update the syslog configuration
      tags:
      - Syslog
  /syslog/event:
    delete:
      description: Permanently removes all events from the configured syslog storage.
      operationId: clearEvents
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Clear stored syslog events
      tags:
      - Syslog
    get:
      description: "Returns a page of log events filtered by severity, Unix-millisecond\
        \ time range, categories, and subcategories. RFC 8288 Link headers point to\
        \ the next and last pages."
      operationId: getEvents
      parameters:
      - description: Minimum log severity to return.
        example: INFO
        in: query
        name: level
        schema:
          type: string
          enum:
          - INFO
          - WARN
          - ERROR
      - description: Maximum number of events per page.
        example: 100
        in: query
        name: per_page
        schema:
          type: integer
          format: int32
      - description: One-based result page number.
        example: 1
        in: query
        name: page
        schema:
          type: integer
          format: int32
      - description: "Inclusive lower bound for event timestamps, in Unix milliseconds."
        example: 1767225600000
        in: query
        name: from
        schema:
          type: integer
          format: int64
      - description: "Exclusive upper bound for event timestamps, in Unix milliseconds."
        example: 1767312000000
        in: query
        name: to
        schema:
          type: integer
          format: int64
      - description: Log categories to include; repeat the query parameter for multiple
          values.
        explode: true
        in: query
        name: category
        schema:
          type: array
          items:
            type: string
            enum:
            - ASSET
            - AGENT
            - NOTIFICATION
            - ALARM
            - RULES
            - PROTOCOL
            - GATEWAY
            - MODEL_AND_VALUES
            - API
            - DATA
        style: form
      - description: Log subcategories to include; repeat the query parameter for
          multiple values.
        example: org.openremote.manager.asset
        explode: true
        in: query
        name: subCategory
        schema:
          type: array
          items:
            type: string
        style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/SyslogEvent"
          description: The requested page of syslog events
          headers:
            Link:
              description: RFC 8288 pagination links for the next and last pages
              schema:
                type: string
              style: simple
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Retrieve stored syslog events
      tags:
      - Syslog
  /user/locale:
    put:
      description: Stores the supplied non-empty locale string as the caller's identity-provider
        locale attribute.
      operationId: updateCurrentUserLocale
      requestBody:
        content:
          application/json:
            schema:
              type: string
        description: "BCP 47 locale identifier for the current user, encoded as a\
          \ JSON string."
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update the current user's locale
      tags:
      - User
  /user/query:
    post:
      description: Executes a UserQuery. Non-super users are forced into their authenticated
        realm and cannot see system accounts; callers with read-users but not read-admin
        receive basic fields only.
      operationId: queryUsers
      requestBody:
        content:
          application/json:
            examples:
              Find human users:
                description: Find human users
                summary: Find human users by username in one realm
                value:
                  realmPredicate:
                    name: building
                  usernames:
                  - match: CONTAINS
                    caseSensitive: false
                    value: alex
                  serviceUsers: false
                  select:
                    basic: true
                  orderBy:
                    property: USERNAME
                    descending: false
                  limit: 100
                  offset: 0
            schema:
              $ref: "#/components/schemas/UserQuery"
        description: "Realm, identity, service-account, asset-link, and field-selection\
          \ criteria."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/User"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Query users based on criteria
      tags:
      - User
  /user/request-password-reset:
    put:
      description: Initiates the identity provider's configured password-reset action
        for the caller's own account.
      operationId: requestPasswordReset
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Request a password reset for the current user
      tags:
      - User
  /user/reset-password:
    put:
      description: Replaces the caller's own identity-provider credential using the
        supplied credential representation.
      operationId: updateOwnPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Credential"
        description: New credential value and whether it is temporary.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
      security:
      - openid: []
      summary: Update the current user's password
      tags:
      - User
  /user/update:
    put:
      description: Updates the caller's own profile. A supplied user ID must match
        the access token; role and realm administration are not provided by this endpoint.
      operationId: updateSelf
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/User"
        description: Editable profile fields for the currently authenticated user.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update the currently authenticated user
      tags:
      - User
  /user/user:
    get:
      description: Returns the identity-provider record corresponding to the current
        access token.
      operationId: getCurrentUser
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve the currently authenticated user
      tags:
      - User
  /user/userRealmRoles:
    get:
      description: Returns realm-level role names assigned to the caller.
      operationId: getCurrentUserRealmRoles
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve the current user's realm roles
      tags:
      - User
  /user/userRoles/{clientId}:
    get:
      description: Returns role names assigned to the caller for the named identity-provider
        client.
      operationId: getCurrentUserClientRoles
      parameters:
      - description: Identity-provider client identifier.
        example: openremote
        in: path
        name: clientId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve the current user's client roles
      tags:
      - User
  /user/{realm}/disconnect/{sessionID}:
    get:
      description: Terminates the active MQTT connection identified by sessionID.
      operationId: disconnectUserSession
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Active MQTT connection identifier returned by getUserSessions.
        example: mqtt-connection-7
        in: path
        name: sessionID
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Disconnect a user session
      tags:
      - User
  /user/{realm}/request-password-reset/{userId}:
    put:
      description: Asks the identity provider to send or initiate its configured password-reset
        action for the specified user.
      operationId: requestUserPasswordReset
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The caller cannot mutate a user in the requested realm
      security:
      - openid: []
      summary: Request a password reset for a user in a realm
      tags:
      - User
  /user/{realm}/reset-password/{userId}:
    put:
      description: Replaces a user's credential in an administered realm using the
        supplied credential representation.
      operationId: updatePassword
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Credential"
        description: New credential value and whether it is temporary.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The caller cannot mutate a user in the requested realm
      security:
      - openid: []
      summary: Update the password for a user in a realm
      tags:
      - User
  /user/{realm}/reset-secret/{userId}:
    get:
      description: Generates and returns a new client secret for a service user in
        an administered realm.
      operationId: resetSecret
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Service-user identifier whose client secret is regenerated.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: string
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Reset the secret for a user in a realm
      tags:
      - User
  /user/{realm}/roles:
    put:
      description: "Creates, updates, or removes role definitions for the default\
        \ OpenRemote client in the requested realm."
      operationId: updateRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/Role"
        description: Complete desired set of OpenRemote client role definitions; omitted
          existing roles are removed.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update OpenRemote client roles for a realm
      tags:
      - User
  /user/{realm}/userRealmRoles/{userId}:
    get:
      description: "Returns realm-level role names assigned to one user. Without read-admin\
        \ permission, callers may retrieve only their own roles."
      operationId: getUserRealmRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a user's realm roles
      tags:
      - User
    put:
      description: Replaces the user's assigned realm-level role names in an administered
        realm.
      operationId: updateUserRealmRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        description: Complete desired set of realm-role names for this user.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update a user's realm roles
      tags:
      - User
  /user/{realm}/userRoles/{userId}/{clientId}:
    get:
      description: "Returns role names assigned to one user for the named client.\
        \ Without read-admin permission, callers may retrieve only their own roles."
      operationId: getUserClientRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      - description: Identity-provider client identifier.
        example: openremote
        in: path
        name: clientId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a user's client roles
      tags:
      - User
    put:
      description: Replaces the user's assigned role names for the named client in
        an administered realm.
      operationId: updateUserClientRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      - description: Identity-provider client identifier.
        example: openremote
        in: path
        name: clientId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        description: Complete desired set of client-role names for this user.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update a user's client roles
      tags:
      - User
  /user/{realm}/userSessions/{userId}:
    get:
      description: "Returns active MQTT sessions for one user, including connection\
        \ ID, creation time, and remote address. Without read-admin permission, callers\
        \ may inspect only themselves."
      operationId: getUserSessions
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/UserSession"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve live sessions for a user
      tags:
      - User
  /user/{realm}/users:
    post:
      description: Creates an identity-provider user in a realm administered by the
        caller and returns the resulting user record.
      operationId: createUser
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              Create a human user:
                description: Create a human user
                summary: Create an enabled user with an English locale
                value:
                  username: alex
                  firstName: Alex
                  lastName: Morgan
                  email: alex@example.com
                  enabled: true
                  attributes:
                    locale:
                    - en
            schema:
              $ref: "#/components/schemas/User"
        description: New user profile; omit the id because it is assigned by the identity
          provider.
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "409":
          content:
            text/plain:
              schema:
                type: string
          description: The request conflicts with the current state of the resource
      security:
      - openid: []
      summary: Create a new user in a realm
      tags:
      - User
    put:
      description: Updates an existing identity-provider user in an administered realm.
        The master administrator cannot be disabled.
      operationId: updateUser
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/User"
        description: "User profile, enabled state, attributes, and identity-provider\
          \ fields to update."
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The request completed successfully
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The requested cross-realm or protected master-administrator
            mutation is not allowed
      security:
      - openid: []
      summary: Update a user in a realm
      tags:
      - User
  /user/{realm}/users/{userId}:
    delete:
      description: Permanently deletes a user from an administered realm. The master-realm
        administrator cannot be deleted.
      operationId: deleteUser
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
        "405":
          description: The master-realm administrator cannot be deleted
      security:
      - openid: []
      summary: Delete a user from a realm
      tags:
      - User
  /user/{realm}/{clientId}/roles:
    get:
      description: Returns all role definitions exposed by the named identity-provider
        client. Realm-administrator access is required.
      operationId: getClientRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider client identifier.
        example: openremote
        in: path
        name: clientId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Role"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve client roles for a realm and client
      tags:
      - User
    put:
      description: "Creates, updates, or removes role definitions for a named identity-provider\
        \ client."
      operationId: updateClientRoles
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider client identifier.
        example: openremote
        in: path
        name: clientId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/Role"
        description: Complete desired set of client role definitions; omitted existing
          roles are removed.
        required: true
      responses:
        "204":
          description: The request completed successfully; no response body is returned
        "400":
          content:
            text/plain:
              schema:
                type: string
          description: The request parameters or body are invalid
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Update client roles for a realm and client
      tags:
      - User
  /user/{realm}/{userId}:
    get:
      description: "Returns one user when it belongs to the requested accessible realm.\
        \ Without read-admin permission, callers may retrieve only their own user."
      operationId: getUser
      parameters:
      - description: OpenRemote realm name.
        example: building
        in: path
        name: realm
        required: true
        schema:
          type: string
      - description: Identity-provider user identifier.
        example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        in: path
        name: userId
        required: true
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The request completed successfully
        "401":
          content:
            text/plain:
              schema:
                type: string
          description: Authentication is required or the supplied credentials are
            invalid
        "403":
          content:
            text/plain:
              schema:
                type: string
          description: The authenticated user does not have permission to perform
            this operation
        "404":
          content:
            text/plain:
              schema:
                type: string
          description: The requested resource does not exist
      security:
      - openid: []
      summary: Retrieve a user in a realm
      tags:
      - User
components:
  schemas:
    AbstractNotificationMessage:
      type: object
      description: "Typed notification message; its discriminator selects email, push,\
        \ or another installed message subtype."
      discriminator:
        propertyName: type
      properties:
        type:
          type: string
    AgentDescriptor:
      type: object
      allOf:
      - $ref: "#/components/schemas/AssetDescriptorObject"
      - type: object
        properties:
          agentLinkType:
            type: string
          assetDiscovery:
            type: boolean
          assetImport:
            type: boolean
    AgentObjectObjectObject:
      type: object
      properties:
        accessPublicRead:
          type: boolean
          description: Allows anonymous callers to read this asset where an endpoint
            supports public access.
          example: false
        attributes:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AttributeObject"
          description: "Attributes keyed by attribute name. Each entry contains type,\
            \ value, timestamp, and optional metadata."
          properties:
            delegate:
              type: object
              additionalProperties:
                $ref: "#/components/schemas/AttributeObject"
        createdOn:
          type: string
          format: date-time
          description: Server-assigned asset creation time.
          example: 2026-01-01T00:00:00Z
          readOnly: true
        id:
          type: string
          description: Stable 22-character asset identifier. Omit when creating an
            asset.
          example: 7A6p4AnLTkKxJUCQAAABAA
          pattern: "^[0-9A-Za-z]{22}$"
        name:
          type: string
          description: Human-readable asset name.
          example: Boiler room sensor
          maxLength: 1023
          minLength: 1
        parentId:
          type: string
          description: Parent asset identifier. Omit for a root asset.
          example: 1ZyG7BmsTQ2cGmbuaMsi0A
          pattern: "^[0-9A-Za-z]{22}$"
        path:
          type: array
          description: Ancestor identifiers from the root through the parent.
          items:
            type: string
            description: Ancestor identifiers from the root through the parent.
            readOnly: true
          readOnly: true
        realm:
          type: string
          description: Realm that owns the asset; immutable after creation.
          example: building
          maxLength: 255
          minLength: 1
        type:
          type: string
          description: Registered asset subtype discriminator.
          example: ThingAsset
        version:
          type: integer
          format: int64
          description: Optimistic-lock version. Omit when creating an asset and preserve
            the latest value when updating it.
          example: 3
          minimum: 0
      required:
      - name
      - realm
    Alarm:
      type: object
      description: Operational alarm submitted to or returned by the alarm service.
      properties:
        assigneeId:
          type: string
          description: Identity-provider user assigned to handle the alarm.
          example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        content:
          type: string
          description: Detailed alarm message.
          example: Boiler room temperature reached 42 °C.
        realm:
          type: string
          description: Realm that owns the alarm.
          example: building
        severity:
          type: string
          description: Operational impact of the alarm.
          enum:
          - LOW
          - MEDIUM
          - HIGH
        source:
          type: string
          description: Kind of actor that created the alarm.
          enum:
          - MANUAL
          - CLIENT
          - GLOBAL_RULESET
          - REALM_RULESET
          - ASSET_RULESET
          - AGENT
          readOnly: true
        sourceId:
          type: string
          description: "Identifier of the rule, user, or system component that created\
            \ the alarm."
          readOnly: true
        status:
          type: string
          description: Current alarm workflow state.
          enum:
          - OPEN
          - ACKNOWLEDGED
          - IN_PROGRESS
          - RESOLVED
          - CLOSED
        title:
          type: string
          description: Short human-readable alarm title.
          example: Temperature threshold exceeded
      required:
      - realm
      - severity
      - source
      - sourceId
      - status
      - title
    AlarmAssetLink:
      type: object
      properties:
        assetName:
          type: string
        createdOn:
          type: string
          format: date-time
        id:
          $ref: "#/components/schemas/Id"
        parentAssetName:
          type: string
    AllowedValues:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
      - type: object
        properties:
          allowedValueNames:
            type: array
            items:
              type: string
          allowedValues:
            type: array
            items:
              type: object
    ArrayPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          index:
            type: integer
            format: int32
          lengthEquals:
            type: integer
            format: int32
          lengthGreaterThan:
            type: integer
            format: int32
          lengthLessThan:
            type: integer
            format: int32
          negated:
            type: boolean
          value:
            type: object
    AssetConditions:
      type: object
      properties:
        access:
          type: array
          items:
            type: string
            enum:
            - RESTRICTED
            - LINKED
            - REALM
        minAmount:
          type: string
          enum:
          - AT_LEAST_ONE
          - ALL
          - NONE
        parents:
          type: array
          items:
            $ref: "#/components/schemas/ParentPredicate"
    AssetDatapointAllQuery:
      type: object
      allOf:
      - $ref: "#/components/schemas/AssetDatapointQuery"
      description: "Returns every stored datapoint in the inclusive range, ordered\
        \ from newest to oldest. Use this when the complete series is needed without\
        \ aggregation or downsampling. Supports numeric, boolean, text, and JSON-compatible\
        \ complex attribute values."
    AssetDatapointIntervalQuery:
      type: object
      allOf:
      - $ref: "#/components/schemas/AssetDatapointQuery"
      - type: object
        properties:
          formula:
            type: string
            description: "Aggregation applied per bucket: `MIN`, `AVG`, and `MAX`\
              \ calculate the corresponding value; `DIFFERENCE` calculates the change\
              \ between the last values of consecutive buckets; `COUNT` counts datapoints;\
              \ `SUM` totals numeric values (or true values for booleans); `MODE`\
              \ selects the most frequent value; and `MEDIAN` selects the middle value.\
              \ `DIFFERENCE` is numeric only."
            enum:
            - MIN
            - AVG
            - MAX
            - DIFFERENCE
            - COUNT
            - SUM
            - MODE
            - MEDIAN
          gapFill:
            type: boolean
            description: "When true, returns empty buckets across the requested range\
              \ using time-bucket gap filling; their aggregate is generally null.\
              \ When false, only buckets containing datapoints are returned. Defaults\
              \ to false."
            example: true
          interval:
            type: string
            description: "PostgreSQL interval literal that sets the bucket width.\
              \ Include a positive amount and unit, for example `1 hour`, `5 minutes`,\
              \ or `1 day`."
            example: 1 hour
      description: Aggregates numeric or boolean datapoints from the inclusive range
        into aligned time buckets and returns buckets in chronological order. Use
        this to summarize a series at a regular resolution. Numeric attributes support
        every formula; boolean attributes support every formula except `DIFFERENCE`
        and are aggregated as 1 for true and 0 for false.
      required:
      - formula
      - interval
    AssetDatapointLTTBQuery:
      type: object
      allOf:
      - $ref: "#/components/schemas/AssetDatapointQuery"
      - type: object
        properties:
          amountOfPoints:
            type: integer
            format: int32
            description: Requested maximum number of representative datapoints after
              downsampling. Fewer points are returned when the range contains fewer
              datapoints.
            example: 500
      description: Downsamples numeric or boolean datapoints from the inclusive range
        with the Largest-Triangle-Three-Buckets (LTTB) algorithm while preserving
        the series' visual shape. Use this to reduce a large series for charts. Results
        are chronological; boolean values are processed as 1 for true and 0 for false.
        Other attribute value types are rejected.
      required:
      - amountOfPoints
    AssetDatapointNearestQuery:
      type: object
      allOf:
      - $ref: "#/components/schemas/AssetDatapointQuery"
      description: "Returns at most one numeric datapoint: the closest value at or\
        \ before the requested time. Use `fromTimestamp` as a Unix-seconds timestamp\
        \ at the HTTP API boundary. `toTimestamp`, `fromTime`, and `toTime` are ignored.\
        \ The equality boundary is inclusive."
    AssetDatapointQuery:
      type: object
      description: "Polymorphic historical-datapoint query. Select `all` to return\
        \ every value, `interval` to aggregate values into time buckets, `lttb` to\
        \ downsample a numeric or boolean series, or `nearest` to retrieve the last\
        \ value at or before a time."
      discriminator:
        mapping:
          all: "#/components/schemas/AssetDatapointAllQuery"
          interval: "#/components/schemas/AssetDatapointIntervalQuery"
          lttb: "#/components/schemas/AssetDatapointLTTBQuery"
          nearest: "#/components/schemas/AssetDatapointNearestQuery"
        propertyName: type
      properties:
        fromTime:
          type: string
          format: date-time
          description: "Inclusive lower range bound for `all`, `interval`, and `lttb`\
            \ as an ISO local or offset date-time. A local value is interpreted in\
            \ the server time zone; an offset value is converted to the server time\
            \ zone. Takes precedence over `fromTimestamp` and is ignored by `nearest`."
          example: 2026-01-01T00:00:00Z
        fromTimestamp:
          type: integer
          format: int64
          description: "Inclusive lower range bound as Unix time in milliseconds for\
            \ `all`, `interval`, and `lttb`; ignored when `fromTime` is supplied.\
            \ For `nearest` this is instead the requested time in Unix seconds and\
            \ is the only time field used."
          example: 1767225600000
        toTime:
          type: string
          format: date-time
          description: "Inclusive upper range bound for `all`, `interval`, and `lttb`\
            \ as an ISO local or offset date-time. A local value is interpreted in\
            \ the server time zone; an offset value is converted to the server time\
            \ zone. Takes precedence over `toTimestamp` and is ignored by `nearest`."
          example: 2026-01-02T00:00:00Z
        toTimestamp:
          type: integer
          format: int64
          description: "Inclusive upper range bound as Unix time in milliseconds for\
            \ `all`, `interval`, and `lttb`; ignored when `toTime` is supplied and\
            \ not used by `nearest`."
          example: 1767312000000
        type:
          type: string
      required:
      - type
    AssetDescriptorObject:
      type: object
      discriminator:
        propertyName: descriptorType
      properties:
        colour:
          type: string
        descriptorType:
          type: string
        dynamic:
          type: boolean
        icon:
          type: string
        name:
          type: string
          pattern: ^\w+$
      required:
      - descriptorType
    AssetObject:
      type: object
      description: Polymorphic OpenRemote asset. The type discriminator selects a
        registered asset subtype; attributes are keyed by attribute name.
      discriminator:
        propertyName: type
      properties:
        accessPublicRead:
          type: boolean
          description: Allows anonymous callers to read this asset where an endpoint
            supports public access.
          example: false
        attributes:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AttributeObject"
          description: "Attributes keyed by attribute name. Each entry contains type,\
            \ value, timestamp, and optional metadata."
          properties:
            delegate:
              type: object
              additionalProperties:
                $ref: "#/components/schemas/AttributeObject"
        createdOn:
          type: string
          format: date-time
          description: Server-assigned asset creation time.
          example: 2026-01-01T00:00:00Z
          readOnly: true
        id:
          type: string
          description: Stable 22-character asset identifier. Omit when creating an
            asset.
          example: 7A6p4AnLTkKxJUCQAAABAA
          pattern: "^[0-9A-Za-z]{22}$"
        name:
          type: string
          description: Human-readable asset name.
          example: Boiler room sensor
          maxLength: 1023
          minLength: 1
        parentId:
          type: string
          description: Parent asset identifier. Omit for a root asset.
          example: 1ZyG7BmsTQ2cGmbuaMsi0A
          pattern: "^[0-9A-Za-z]{22}$"
        path:
          type: array
          description: Ancestor identifiers from the root through the parent.
          items:
            type: string
            description: Ancestor identifiers from the root through the parent.
            readOnly: true
          readOnly: true
        realm:
          type: string
          description: Realm that owns the asset; immutable after creation.
          example: building
          maxLength: 255
          minLength: 1
        type:
          type: string
          description: Registered asset subtype discriminator.
          example: ThingAsset
        version:
          type: integer
          format: int64
          description: Optimistic-lock version. Omit when creating an asset and preserve
            the latest value when updating it.
          example: 3
          minimum: 0
      required:
      - name
      - realm
    AssetQuery:
      type: object
      description: Composable asset search request. Populated filters are combined
        to restrict results; limit and offset provide pagination.
      properties:
        access:
          type: string
          description: Requested visibility class relative to the caller.
          enum:
          - PRIVATE
          - PROTECTED
          - PUBLIC
        attributes:
          $ref: "#/components/schemas/LogicGroupAttributePredicate"
        ids:
          type: array
          description: Match these exact asset identifiers.
          items:
            type: string
            description: Match these exact asset identifiers.
        limit:
          type: integer
          format: int32
          description: Maximum number of results; zero uses the server default.
          example: 100
        names:
          type: array
          items:
            $ref: "#/components/schemas/StringPredicate"
        offset:
          type: integer
          format: int32
          description: Number of matching results to skip.
          example: 0
        orderBy:
          $ref: "#/components/schemas/AssetQueryOrderBy"
        parents:
          type: array
          items:
            $ref: "#/components/schemas/ParentPredicate"
        paths:
          type: array
          items:
            $ref: "#/components/schemas/PathPredicate"
        realm:
          $ref: "#/components/schemas/RealmPredicate"
        recursive:
          type: boolean
          description: "When parent or path filters are used, include matching descendants."
          example: true
        select:
          $ref: "#/components/schemas/AssetQuerySelect"
        types:
          type: array
          description: Match registered asset type names; base types include their
            concrete subtypes.
          example:
          - ThingAsset
          items:
            type: string
            description: Match registered asset type names; base types include their
              concrete subtypes.
            example: "[\"ThingAsset\"]"
        userIds:
          type: array
          description: Match assets linked to any of these users.
          items:
            type: string
            description: Match assets linked to any of these users.
    AssetQueryOrderBy:
      type: object
      description: Asset result ordering.
      properties:
        descending:
          type: boolean
          description: Reverse the default ascending order.
          example: false
        property:
          type: string
          description: Asset property used for ordering.
          enum:
          - CREATED_ON
          - NAME
          - ASSET_TYPE
          - PARENT_ID
          - REALM
          example: NAME
    AssetQuerySelect:
      type: object
      description: Response projection for controlling which asset attributes are
        returned.
      properties:
        attributes:
          type: array
          description: Attribute names to include. An empty array excludes all attributes;
            null returns all attributes.
          example:
          - temperature
          - humidity
          items:
            type: string
            description: Attribute names to include. An empty array excludes all attributes;
              null returns all attributes.
            example: "[\"temperature\",\"humidity\"]"
    AssetRuleset:
      type: object
      properties:
        accessPublicRead:
          type: boolean
        assetId:
          type: string
        createdOn:
          type: string
          format: date-time
          description: Server-assigned creation time.
          readOnly: true
        enabled:
          type: boolean
          description: Whether the ruleset should be deployed and evaluated.
          example: true
        error:
          type: string
          description: "Latest compilation or execution error, when present."
          readOnly: true
        id:
          type: integer
          format: int64
          description: Server-assigned numeric ruleset identifier.
          example: 27
          readOnly: true
        lang:
          type: string
          description: Rules source language. JAVASCRIPT is retained for legacy records
            but cannot be newly created.
          enum:
          - JAVASCRIPT
          - GROOVY
          - JSON
          - FLOW
        lastModified:
          type: string
          format: date-time
          description: Server-assigned last modification time.
          readOnly: true
        meta:
          type: object
          additionalProperties:
            type: object
            description: Optional execution and presentation metadata.
          description: Optional execution and presentation metadata.
        name:
          type: string
          description: Human-readable ruleset name.
          example: High temperature alert
          maxLength: 255
          minLength: 3
        realm:
          type: string
        rules:
          type: string
          description: Rules source encoded according to lang.
        status:
          type: string
          description: Transient deployment status.
          enum:
          - READY
          - DEPLOYED
          - COMPILATION_ERROR
          - VALIDITY_PERIOD_ERROR
          - EXECUTION_ERROR
          - LOOP_ERROR
          - DISABLED
          - PAUSED
          - EXPIRED
          - REMOVED
          - EMPTY
          readOnly: true
        version:
          type: integer
          format: int64
          description: Optimistic-lock version.
          example: 2
          readOnly: true
      required:
      - lang
      - name
    AssetTree:
      type: object
      properties:
        assets:
          type: array
          items:
            $ref: "#/components/schemas/AssetTreeAsset"
        hasMore:
          type: boolean
    AssetTreeAsset:
      type: object
      properties:
        createdOn:
          type: string
          format: date-time
        hasChildren:
          type: boolean
        id:
          type: string
        name:
          type: string
        parentId:
          type: string
        path:
          type: array
          items:
            type: string
        type:
          type: string
    AssetTreeNode:
      type: object
      properties:
        asset:
          $ref: "#/components/schemas/AssetObject"
        children:
          type: array
          items:
            $ref: "#/components/schemas/AssetTreeNode"
    AssetTypeInfo:
      type: object
      properties:
        assetDescriptor:
          $ref: "#/components/schemas/AssetDescriptorObject"
        attributeDescriptors:
          type: array
          items:
            $ref: "#/components/schemas/AttributeDescriptorObject"
        metaItemDescriptors:
          type: array
          items:
            $ref: "#/components/schemas/MetaItemDescriptorObject"
        valueDescriptors:
          type: array
          items:
            $ref: "#/components/schemas/ValueDescriptorObject"
    AttributeDescriptorObject:
      type: object
      properties:
        constraints:
          type: array
          items:
            $ref: "#/components/schemas/ValueConstraint"
        format:
          $ref: "#/components/schemas/ValueFormat"
        meta:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MetaItemObject"
          properties:
            delegate:
              type: object
              additionalProperties:
                $ref: "#/components/schemas/MetaItemObject"
        name:
          type: string
        optional:
          type: boolean
        type:
          $ref: "#/components/schemas/ValueDescriptorObject"
        units:
          type: array
          items:
            type: string
    AttributeEvent:
      type: object
      properties:
        assetName:
          type: string
        assetType:
          type: string
        attributeState:
          $ref: "#/components/schemas/AttributeState"
        createdOn:
          type: string
          format: date-time
        deleted:
          type: boolean
        messageID:
          type: string
        oldValue:
          type: object
        oldValueTimestamp:
          type: integer
          format: int64
        parentId:
          type: string
        path:
          type: array
          items:
            type: string
        realm:
          type: string
        ref:
          $ref: "#/components/schemas/AttributeRef"
        timestamp:
          type: integer
          format: int64
        type:
          $ref: "#/components/schemas/ValueDescriptor"
        value:
          type: object
    AttributeMap:
      type: object
      additionalProperties:
        $ref: "#/components/schemas/AttributeObject"
      description: "Attributes keyed by attribute name. Each entry contains type,\
        \ value, timestamp, and optional metadata."
      properties:
        delegate:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AttributeObject"
    AttributeObject:
      type: object
      description: "Named typed asset value. Attribute JSON includes name, type, value,\
        \ optional Unix-millisecond timestamp, and optional metadata."
      properties:
        meta:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MetaItemObject"
          properties:
            delegate:
              type: object
              additionalProperties:
                $ref: "#/components/schemas/MetaItemObject"
        name:
          type: string
          description: Machine-readable name.
          example: temperature
          minLength: 1
          pattern: ^\w+$
        timestamp:
          type: integer
          format: int64
          description: Value timestamp in Unix milliseconds; zero means no explicit
            timestamp was supplied.
          example: 1767225600000
        type:
          $ref: "#/components/schemas/ValueDescriptorObject"
        value:
          type: object
          description: Typed JSON value; its shape is determined by type and may be
            null.
          nullable: true
          writeOnly: true
      required:
      - name
    AttributePredicate:
      type: object
      properties:
        meta:
          type: array
          items:
            $ref: "#/components/schemas/NameValuePredicate"
        name:
          $ref: "#/components/schemas/StringPredicate"
        negated:
          type: boolean
        path:
          type: array
          items:
            type: object
        previousValue:
          $ref: "#/components/schemas/ValuePredicate"
        timestampOlderThan:
          type: string
        value:
          $ref: "#/components/schemas/ValuePredicate"
    AttributeRef:
      type: object
      properties:
        id:
          type: string
          description: The asset identifier
          example: 7Bt8M3cXEP6BHPh8r47DYf
          pattern: "^[0-9A-Za-z]{22}$"
        name:
          type: string
          description: The attribute name
          example: location
          minLength: 1
          pattern: ^\w+$
      required:
      - name
    AttributeState:
      type: object
      properties:
        ref:
          $ref: "#/components/schemas/AttributeRef"
        value:
          type: object
    AttributeValuePredicate:
      type: object
      description: Predicate for matching an identity-provider user attribute by name
        and optional value.
      properties:
        name:
          $ref: "#/components/schemas/StringPredicate"
        negated:
          type: boolean
          description: Invert this attribute predicate.
          example: false
        value:
          $ref: "#/components/schemas/StringPredicate"
    AttributeWriteResult:
      type: object
      properties:
        failure:
          type: string
          enum:
          - ASSET_NOT_FOUND
          - ATTRIBUTE_NOT_FOUND
          - INSUFFICIENT_ACCESS
          - INVALID_VALUE
          - INTERCEPTOR_FAILURE
          - STATE_STORAGE_FAILED
          - CANNOT_PROCESS
          - QUEUE_FULL
          - UNKNOWN
          - ASSET_ID_MISSING
          - ATTRIBUTE_NAME_MISSING
        ref:
          $ref: "#/components/schemas/AttributeRef"
    BooleanPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          value:
            type: boolean
    CalendarEventPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          timestamp:
            type: string
            format: date-time
    Conditions:
      type: object
      properties:
        asset:
          $ref: "#/components/schemas/AssetConditions"
        dashboard:
          $ref: "#/components/schemas/DashboardConditions"
    ConsoleProvider:
      type: object
      properties:
        data:
          type: object
          additionalProperties:
            type: object
        disabled:
          type: boolean
        enabled:
          type: boolean
        hasPermission:
          type: boolean
        requiresPermission:
          type: boolean
        success:
          type: boolean
        version:
          type: string
    ConsoleRegistration:
      type: object
      properties:
        apps:
          type: array
          items:
            type: string
        id:
          type: string
        model:
          type: string
        name:
          type: string
          minLength: 1
        platform:
          type: string
          minLength: 1
        providers:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/ConsoleProvider"
        version:
          type: string
          minLength: 1
      required:
      - name
      - platform
      - providers
      - version
    Credential:
      type: object
      properties:
        temporary:
          type: boolean
        type:
          type: string
        value:
          type: string
    Dashboard:
      type: object
      description: "Realm-scoped Manager dashboard with ownership, access policy,\
        \ and a screen/widget template."
      properties:
        access:
          type: string
          enum:
          - PUBLIC
          - SHARED
          - PRIVATE
        createdOn:
          type: string
          format: date-time
        displayName:
          type: string
          minLength: 1
        id:
          type: string
        ownerId:
          type: string
        realm:
          type: string
          maxLength: 255
          minLength: 1
        template:
          $ref: "#/components/schemas/DashboardTemplate"
        version:
          type: integer
          format: int64
      required:
      - displayName
      - realm
      - template
    DashboardConditions:
      type: object
      properties:
        access:
          type: array
          items:
            type: string
            enum:
            - PUBLIC
            - SHARED
            - PRIVATE
    DashboardGridItem:
      type: object
      properties:
        h:
          type: integer
          format: int32
          minimum: 1
        id:
          type: string
        locked:
          type: boolean
        minH:
          type: integer
          format: int32
        minPixelH:
          type: integer
          format: int32
        minPixelW:
          type: integer
          format: int32
        minW:
          type: integer
          format: int32
        noMove:
          type: boolean
        noResize:
          type: boolean
        w:
          type: integer
          format: int32
          minimum: 1
        x:
          type: integer
          format: int32
        "y":
          type: integer
          format: int32
    DashboardQuery:
      type: object
      properties:
        conditions:
          $ref: "#/components/schemas/Conditions"
        ids:
          type: array
          items:
            type: string
        limit:
          type: integer
          format: int32
        names:
          type: array
          items:
            $ref: "#/components/schemas/StringPredicate"
        realm:
          $ref: "#/components/schemas/RealmPredicate"
        select:
          $ref: "#/components/schemas/Select"
        start:
          type: integer
          format: int32
        userIds:
          type: array
          items:
            type: string
    DashboardScreenPreset:
      type: object
      properties:
        breakpoint:
          type: integer
          format: int32
          minimum: 1
        displayName:
          type: string
          minLength: 1
        id:
          type: string
        redirectDashboardId:
          type: string
        scalingPreset:
          type: string
          enum:
          - WRAP_TO_SINGLE_COLUMN
          - KEEP_LAYOUT
          - REDIRECT
          - BLOCK_DEVICE
      required:
      - displayName
      - scalingPreset
    DashboardTemplate:
      type: object
      properties:
        columns:
          type: integer
          format: int32
          minimum: 1
        id:
          type: string
        maxScreenWidth:
          type: integer
          format: int32
          minimum: 1
        refreshInterval:
          type: string
          enum:
          - "OFF"
          - ONE_MIN
          - FIVE_MIN
          - QUARTER
          - ONE_HOUR
        screenPresets:
          type: array
          items:
            $ref: "#/components/schemas/DashboardScreenPreset"
        widgets:
          type: array
          items:
            $ref: "#/components/schemas/DashboardWidget"
      required:
      - screenPresets
    DashboardWidget:
      type: object
      properties:
        displayName:
          type: string
        gridItem:
          $ref: "#/components/schemas/DashboardGridItem"
        id:
          type: string
        widgetConfig:
          type: object
        widgetTypeId:
          type: string
      required:
      - displayName
      - gridItem
      - widgetTypeId
    DatapointPeriod:
      type: object
      properties:
        assetId:
          type: string
        attributeName:
          type: string
        latestTimestamp:
          type: integer
          format: int64
        oldestTimestamp:
          type: integer
          format: int64
    DateTimePredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          negate:
            type: boolean
          operator:
            type: string
            enum:
            - EQUALS
            - GREATER_THAN
            - GREATER_EQUALS
            - LESS_THAN
            - LESS_EQUALS
            - BETWEEN
          rangeValue:
            type: string
          value:
            type: string
    EmailNotificationMessage:
      type: object
      allOf:
      - $ref: "#/components/schemas/AbstractNotificationMessage"
      - type: object
        properties:
          bcc:
            type: array
            items:
              $ref: "#/components/schemas/Recipient"
          cc:
            type: array
            items:
              $ref: "#/components/schemas/Recipient"
          from:
            $ref: "#/components/schemas/Recipient"
          html:
            type: string
          replyTo:
            $ref: "#/components/schemas/Recipient"
          subject:
            type: string
          text:
            type: string
          to:
            type: array
            items:
              $ref: "#/components/schemas/Recipient"
    ExternalService:
      type: object
      description: Leased external-service registration advertised through the OpenRemote
        Manager.
      properties:
        homepageUrl:
          type: string
          description: Absolute URL of the service UI or configuration page.
          example: https://services.example.com/energy
          maxLength: 512
          minLength: 3
        icon:
          type: string
          description: Material Design Icons name used by Manager UIs.
          example: puzzle
        instanceId:
          type: integer
          format: int32
          description: Instance number assigned by the Manager during registration.
          example: 1
          readOnly: true
        isGlobal:
          type: boolean
          description: Whether the service is visible to every realm.
          readOnly: true
        label:
          type: string
          description: Human-readable service label.
          example: Energy Service
          maxLength: 255
          minLength: 1
        realm:
          type: string
          description: Realm that owns this registration.
          example: building
          readOnly: true
        serviceId:
          type: string
          description: Stable identifier shared by all instances of the same service.
          example: energy-service
          maxLength: 255
          minLength: 3
        status:
          type: string
          description: Current availability derived from the registration lease.
          enum:
          - AVAILABLE
          - UNAVAILABLE
        version:
          type: string
          description: Service implementation version.
          example: 1.4.0
          maxLength: 255
          minLength: 3
      required:
      - homepageUrl
      - label
      - serviceId
      - status
    FileInfo:
      type: object
      properties:
        binary:
          type: boolean
        contents:
          type: string
        name:
          type: string
    Future:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    FutureOrPresent:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    GatewayAssetSyncRule:
      type: object
      description: Synchronization rules keyed by asset type; use * as a wildcard.
      properties:
        accessPublicRead:
          type: boolean
        addAttributeMeta:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MetaMap"
        excludeAttributeMeta:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        excludeAttributes:
          type: array
          items:
            type: string
    GatewayAttributeFilter:
      type: object
      description: Ordered attribute-event filters; the first matching filter is applied.
      properties:
        delta:
          type: number
          format: double
        duration:
          type: string
        durationParsedMillis:
          type: integer
          format: int64
        matcher:
          $ref: "#/components/schemas/AssetQuery"
        skipAlways:
          type: boolean
        valueChange:
          type: boolean
    GatewayConnection:
      type: object
      description: "Connection from a local realm to a remote OpenRemote gateway,\
        \ including credentials and synchronization rules."
      properties:
        assetSyncRules:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/GatewayAssetSyncRule"
          description: Synchronization rules keyed by asset type; use * as a wildcard.
        attributeFilters:
          type: array
          description: Ordered attribute-event filters; the first matching filter
            is applied.
          items:
            $ref: "#/components/schemas/GatewayAttributeFilter"
        clientId:
          type: string
          description: Remote identity-provider client identifier.
          example: openremote
          maxLength: 255
          minLength: 1
        clientSecret:
          type: string
          format: password
          description: Remote identity-provider client secret.
          maxLength: 36
          minLength: 36
        disabled:
          type: boolean
          description: Keep the configuration but prevent connection and synchronization.
          example: false
        host:
          type: string
          description: Remote gateway hostname without a scheme.
          example: gateway.example.com
          maxLength: 255
          minLength: 1
        localRealm:
          type: string
          description: Local realm whose assets participate in this gateway connection.
          example: building
        port:
          type: integer
          format: int32
          description: Remote HTTPS or HTTP port.
          example: 443
          maximum: 65536
          minimum: 1
        realm:
          type: string
          description: Realm used to authenticate on the remote gateway.
          example: master
        secured:
          type: boolean
          description: Use TLS for the remote connection; defaults to true.
          example: true
      required:
      - clientId
      - clientSecret
      - host
    GatewayTunnelInfo:
      type: object
      properties:
        assignedPort:
          type: integer
          format: int32
        autoCloseTime:
          type: string
          format: date-time
        gatewayId:
          type: string
        hostname:
          type: string
        id:
          type: string
        realm:
          type: string
        target:
          type: string
        targetPort:
          type: integer
          format: int32
        type:
          type: string
          enum:
          - HTTPS
          - HTTP
          - TCP
    GeoJSONGeofencePredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          geoJSON:
            type: string
          negated:
            type: boolean
    GeoJsonConfig:
      type: object
      properties:
        layers:
          type: array
          items:
            type: object
        source:
          type: object
    GeofenceDefinition:
      type: object
      properties:
        httpMethod:
          type: string
        id:
          type: string
        lat:
          type: number
          format: double
        lng:
          type: number
          format: double
        radius:
          type: integer
          format: int32
        url:
          type: string
    GlobalRuleset:
      type: object
      properties:
        createdOn:
          type: string
          format: date-time
          description: Server-assigned creation time.
          readOnly: true
        enabled:
          type: boolean
          description: Whether the ruleset should be deployed and evaluated.
          example: true
        error:
          type: string
          description: "Latest compilation or execution error, when present."
          readOnly: true
        id:
          type: integer
          format: int64
          description: Server-assigned numeric ruleset identifier.
          example: 27
          readOnly: true
        lang:
          type: string
          description: Rules source language. JAVASCRIPT is retained for legacy records
            but cannot be newly created.
          enum:
          - JAVASCRIPT
          - GROOVY
          - JSON
          - FLOW
        lastModified:
          type: string
          format: date-time
          description: Server-assigned last modification time.
          readOnly: true
        meta:
          type: object
          additionalProperties:
            type: object
            description: Optional execution and presentation metadata.
          description: Optional execution and presentation metadata.
        name:
          type: string
          description: Human-readable ruleset name.
          example: High temperature alert
          maxLength: 255
          minLength: 3
        rules:
          type: string
          description: Rules source encoded according to lang.
        status:
          type: string
          description: Transient deployment status.
          enum:
          - READY
          - DEPLOYED
          - COMPILATION_ERROR
          - VALIDITY_PERIOD_ERROR
          - EXECUTION_ERROR
          - LOOP_ERROR
          - DISABLED
          - PAUSED
          - EXPIRED
          - REMOVED
          - EMPTY
          readOnly: true
        version:
          type: integer
          format: int64
          description: Optimistic-lock version.
          example: 2
          readOnly: true
      required:
      - lang
      - name
    Id:
      type: object
      properties:
        assetId:
          type: string
        realm:
          type: string
        userId:
          type: string
    JsonNode:
      type: object
    LocalizedNotificationMessage:
      type: object
      allOf:
      - $ref: "#/components/schemas/AbstractNotificationMessage"
      - type: object
        properties:
          defaultLanguage:
            type: string
          languages:
            type: object
            additionalProperties:
              $ref: "#/components/schemas/AbstractNotificationMessage"
    LogicGroupAttributePredicate:
      type: object
      properties:
        groups:
          type: array
          items:
            $ref: "#/components/schemas/LogicGroupAttributePredicate"
        items:
          type: array
          items:
            $ref: "#/components/schemas/AttributePredicate"
        operator:
          type: string
          enum:
          - AND
          - OR
    ManagerAppConfig:
      type: object
      properties:
        languages:
          type: object
          additionalProperties:
            type: string
        loadLocales:
          type: boolean
        manager:
          $ref: "#/components/schemas/ManagerConfig"
        pages:
          type: object
          additionalProperties:
            type: object
        realms:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/ManagerAppRealmConfig"
    ManagerAppRealmConfig:
      type: object
      properties:
        appTitle:
          type: string
        favicon:
          type: string
        headers:
          type: array
          items:
            type: string
        language:
          type: string
        logo:
          type: string
        logoMobile:
          type: string
        notifications:
          $ref: "#/components/schemas/ManagerAppRealmNotificationConfig"
        styles:
          type: string
    ManagerAppRealmNotificationConfig:
      type: object
      properties:
        defaultLanguage:
          type: string
        languages:
          type: array
          items:
            type: string
    ManagerConfig:
      type: object
      properties:
        appVersion:
          type: string
        applyConfigToAdmin:
          type: boolean
        auth:
          type: string
          enum:
          - KEYCLOAK
          - NONE
        autoLogin:
          type: boolean
        clientId:
          type: string
        configureTranslationsOptions:
          type: object
        consoleAutoEnable:
          type: boolean
        defaultLanguage:
          type: string
        eventProviderType:
          type: string
          enum:
          - WEBSOCKET
          - POLLING
        keycloakUrl:
          type: string
        loadDescriptors:
          type: boolean
        loadIcons:
          type: boolean
        loadTranslations:
          type: array
          items:
            type: string
        managerUrl:
          type: string
        pollingIntervalMillis:
          type: integer
          format: int32
        realm:
          type: string
        translationsLoadPath:
          type: string
    MapConfig:
      type: object
      properties:
        glyphs:
          type: string
        layers:
          type: array
          items:
            type: object
        options:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MapRealmConfig"
        override:
          type: string
        sources:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MapSourceConfig"
        sprite:
          type: string
    MapRealmConfig:
      type: object
      properties:
        bounds:
          type: array
          items:
            type: number
            format: float
        boxZoom:
          type: boolean
        center:
          type: array
          items:
            type: number
            format: float
        geoJson:
          $ref: "#/components/schemas/GeoJsonConfig"
        geocodeUrl:
          type: string
        maxZoom:
          type: integer
          format: int32
        minZoom:
          type: integer
          format: int32
        zoom:
          type: integer
          format: int32
    MapSourceConfig:
      type: object
      properties:
        attribution:
          type: string
        bounds:
          type: array
          items:
            type: number
            format: float
        custom:
          type: boolean
        maxzoom:
          type: integer
          format: int32
        minzoom:
          type: integer
          format: int32
        scheme:
          type: string
        tiles:
          type: array
          items:
            type: string
        type:
          type: string
        url:
          type: string
    Max:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
      - type: object
        properties:
          max:
            type: number
    MetaItemDescriptorObject:
      type: object
      properties:
        constraints:
          type: array
          items:
            $ref: "#/components/schemas/ValueConstraint"
        format:
          $ref: "#/components/schemas/ValueFormat"
        name:
          type: string
        type:
          $ref: "#/components/schemas/ValueDescriptorObject"
        units:
          type: array
          items:
            type: string
    MetaItemObject:
      type: object
      properties:
        name:
          type: string
          description: Machine-readable name.
          example: temperature
          minLength: 1
          pattern: ^\w+$
        type:
          $ref: "#/components/schemas/ValueDescriptorObject"
        value:
          type: object
          description: Typed JSON value; its shape is determined by type and may be
            null.
          nullable: true
          writeOnly: true
      required:
      - name
    MetaMap:
      type: object
      additionalProperties:
        $ref: "#/components/schemas/MetaItemObject"
      properties:
        delegate:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/MetaItemObject"
    Min:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
      - type: object
        properties:
          min:
            type: number
    NameValuePredicate:
      type: object
      properties:
        name:
          $ref: "#/components/schemas/StringPredicate"
        negated:
          type: boolean
        path:
          type: array
          items:
            type: object
        value:
          $ref: "#/components/schemas/ValuePredicate"
    Node:
      type: object
      properties:
        displayCharacter:
          type: string
        id:
          type: string
        inputs:
          type: array
          items:
            $ref: "#/components/schemas/NodeSocket"
        internals:
          type: array
          items:
            $ref: "#/components/schemas/NodeInternal"
        name:
          type: string
        outputs:
          type: array
          items:
            $ref: "#/components/schemas/NodeSocket"
        position:
          $ref: "#/components/schemas/NodePosition"
        priority:
          type: integer
          format: int32
        size:
          $ref: "#/components/schemas/NodePosition"
        type:
          type: string
          enum:
          - INPUT
          - PROCESSOR
          - OUTPUT
          - THEN
    NodeInternal:
      type: object
      properties:
        breakType:
          type: string
          enum:
          - NEW_LINE
          - SPACER
        name:
          type: string
        picker:
          $ref: "#/components/schemas/Picker"
        value:
          type: object
    NodePosition:
      type: object
      properties:
        x:
          type: number
          format: float
        "y":
          type: number
          format: float
    NodeSocket:
      type: object
      properties:
        id:
          type: string
        index:
          type: integer
          format: int32
        name:
          type: string
        nodeId:
          type: string
        type:
          type: string
          enum:
          - NUMBER
          - NUMBER_ARRAY
          - STRING
          - BOOLEAN
          - TRIGGER
          - COLOR
          - ANY
    NotBlank:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    NotEmpty:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    NotNull:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    Notification:
      type: object
      description: "Notification submission containing a typed message, one or more\
        \ targets, and optional repeat scheduling."
      properties:
        message:
          $ref: "#/components/schemas/AbstractNotificationMessage"
        name:
          type: string
          description: Optional human-readable notification name used in delivery
            records.
          example: High temperature alert
        repeatFrequency:
          type: string
          description: Optional repeat cadence for scheduled delivery.
          enum:
          - ALWAYS
          - ONCE
          - HOURLY
          - DAILY
          - WEEKLY
          - MONTHLY
          - ANNUALLY
        repeatInterval:
          type: string
          description: Repeat interval expression interpreted with repeatFrequency.
        targets:
          type: array
          description: One or more recipients. Authorization is checked for the complete
            set before anything is queued.
          items:
            $ref: "#/components/schemas/Target"
    NumberPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          negate:
            type: boolean
          operator:
            type: string
            enum:
            - EQUALS
            - GREATER_THAN
            - GREATER_EQUALS
            - LESS_THAN
            - LESS_EQUALS
            - BETWEEN
          rangeValue:
            type: number
          value:
            type: number
    ObjectNode:
      type: object
    Option:
      type: object
      properties:
        name:
          type: string
        value:
          type: object
    ParentPredicate:
      type: object
      description: Matches assets by direct parent identifier; a null id represents
        root assets.
      properties:
        id:
          type: string
          description: Direct parent asset identifier; null selects root assets.
          nullable: true
    Past:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    PastOrPresent:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
    PathPredicate:
      type: object
      description: Matches an asset ancestry path represented as ordered asset identifiers.
      properties:
        path:
          type: array
          description: Ordered asset identifiers in the ancestry path.
          items:
            type: string
            description: Ordered asset identifiers in the ancestry path.
    Pattern:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
      - type: object
        properties:
          flags:
            type: array
            items:
              type: string
              enum:
              - UNIX_LINES
              - CASE_INSENSITIVE
              - COMMENTS
              - MULTILINE
              - DOTALL
              - UNICODE_CASE
              - CANON_EQ
          regexp:
            type: string
    Picker:
      type: object
      properties:
        options:
          type: array
          items:
            $ref: "#/components/schemas/Option"
        type:
          type: string
          enum:
          - TEXT
          - MULTILINE
          - NUMBER
          - DROPDOWN
          - DOUBLE_DROPDOWN
          - CHECKBOX
          - ASSET_ATTRIBUTE
          - COLOR
          - DATE
    ProvisioningConfigObjectObject:
      type: object
      description: Polymorphic device-provisioning configuration. The type discriminator
        selects the provisioning mechanism.
      discriminator:
        propertyName: type
      properties:
        assetTemplate:
          type: string
          description: Optional asset JSON template applied to newly provisioned devices.
        createdOn:
          type: string
          format: date-time
        data:
          type: object
        disabled:
          type: boolean
          description: Prevent new provisioning while retaining the configuration.
          example: false
        id:
          type: integer
          format: int64
          description: Server-assigned numeric configuration identifier.
          example: 12
          minimum: 1
          readOnly: true
        lastModified:
          type: string
          format: date-time
        name:
          type: string
          description: Human-readable configuration name.
          example: Factory sensors
          maxLength: 255
          minLength: 1
        realm:
          type: string
          description: Realm in which devices and users are provisioned.
          example: building
        restrictedUser:
          type: boolean
          description: Create the provisioned user with restricted-user access.
          example: true
        type:
          type: string
          description: Provisioning mechanism discriminator.
          example: x509
          maxLength: 100
          minLength: 3
        userRoles:
          type: array
          description: Client roles granted to the provisioned user.
          items:
            type: string
            description: Client roles granted to the provisioned user.
            enum:
            - read:admin
            - read:logs
            - read:users
            - read:map
            - read:assets
            - read:rules
            - read:insights
            - read:alarms
            - read:notifications
            - read:services
            - write:services
            - write:user
            - write:admin
            - write:logs
            - write:assets
            - write:attributes
            - write:rules
            - write:insights
            - write:alarms
            - write:notifications
            - read
            - write
      required:
      - name
    PushNotificationAction:
      type: object
      properties:
        data:
          type: object
        httpMethod:
          type: string
        openInBrowser:
          type: boolean
        silent:
          type: boolean
        url:
          type: string
    PushNotificationButton:
      type: object
      properties:
        action:
          $ref: "#/components/schemas/PushNotificationAction"
        title:
          type: string
    PushNotificationMessage:
      type: object
      allOf:
      - $ref: "#/components/schemas/AbstractNotificationMessage"
      - type: object
        properties:
          action:
            $ref: "#/components/schemas/PushNotificationAction"
          body:
            type: string
          buttons:
            type: array
            items:
              $ref: "#/components/schemas/PushNotificationButton"
          data:
            type: object
            additionalProperties:
              type: object
          expiration:
            type: integer
            format: int64
          priority:
            type: string
            enum:
            - NORMAL
            - HIGH
          target:
            type: string
          targetType:
            type: string
            enum:
            - DEVICE
            - TOPIC
            - CONDITION
          title:
            type: string
    RadialGeofencePredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          lat:
            type: number
            format: double
          lng:
            type: number
            format: double
          negated:
            type: boolean
          radius:
            type: integer
            format: int32
    Realm:
      type: object
      description: "Identity-provider realm and its authentication, registration,\
        \ theme, token, and role settings."
      properties:
        accessTokenLifespan:
          type: integer
          format: int32
          description: Access-token lifetime in seconds.
          example: 300
        accountTheme:
          type: string
        adminTheme:
          type: string
        displayName:
          type: string
          description: Human-readable realm label.
          example: Building Management
        duplicateEmailsAllowed:
          type: boolean
        emailTheme:
          type: string
        enabled:
          type: boolean
          description: Whether users can authenticate against this realm.
          example: true
        id:
          type: string
          description: Identity-provider internal realm identifier.
          readOnly: true
        loginTheme:
          type: string
        loginWithEmail:
          type: boolean
        name:
          type: string
          description: Stable realm name used in API paths and tokens.
          example: building
        notBefore:
          type: number
          format: double
        passwordPolicy:
          type: array
          description: Identity-provider password-policy rules.
          items:
            type: string
            description: Identity-provider password-policy rules.
        realmRoles:
          type: array
          description: Realm-level roles available for assignment.
          items:
            $ref: "#/components/schemas/RealmRole"
          uniqueItems: true
        registrationAllowed:
          type: boolean
        registrationEmailAsUsername:
          type: boolean
        rememberMe:
          type: boolean
        resetPasswordAllowed:
          type: boolean
        verifyEmail:
          type: boolean
    RealmPredicate:
      type: object
      description: Matches an exact realm name.
      properties:
        name:
          type: string
          description: Realm name.
          example: building
    RealmRole:
      type: object
      description: Realm-level roles available for assignment.
      properties:
        description:
          type: string
        name:
          type: string
    RealmRuleset:
      type: object
      properties:
        accessPublicRead:
          type: boolean
        createdOn:
          type: string
          format: date-time
          description: Server-assigned creation time.
          readOnly: true
        enabled:
          type: boolean
          description: Whether the ruleset should be deployed and evaluated.
          example: true
        error:
          type: string
          description: "Latest compilation or execution error, when present."
          readOnly: true
        id:
          type: integer
          format: int64
          description: Server-assigned numeric ruleset identifier.
          example: 27
          readOnly: true
        lang:
          type: string
          description: Rules source language. JAVASCRIPT is retained for legacy records
            but cannot be newly created.
          enum:
          - JAVASCRIPT
          - GROOVY
          - JSON
          - FLOW
        lastModified:
          type: string
          format: date-time
          description: Server-assigned last modification time.
          readOnly: true
        meta:
          type: object
          additionalProperties:
            type: object
            description: Optional execution and presentation metadata.
          description: Optional execution and presentation metadata.
        name:
          type: string
          description: Human-readable ruleset name.
          example: High temperature alert
          maxLength: 255
          minLength: 3
        realm:
          type: string
        rules:
          type: string
          description: Rules source encoded according to lang.
        status:
          type: string
          description: Transient deployment status.
          enum:
          - READY
          - DEPLOYED
          - COMPILATION_ERROR
          - VALIDITY_PERIOD_ERROR
          - EXECUTION_ERROR
          - LOOP_ERROR
          - DISABLED
          - PAUSED
          - EXPIRED
          - REMOVED
          - EMPTY
          readOnly: true
        version:
          type: integer
          format: int64
          description: Optimistic-lock version.
          example: 2
          readOnly: true
      required:
      - lang
      - name
    Recipient:
      type: object
      properties:
        address:
          type: string
        name:
          type: string
    RectangularGeofencePredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          latMax:
            type: number
            format: double
          latMin:
            type: number
            format: double
          lngMax:
            type: number
            format: double
          lngMin:
            type: number
            format: double
          negated:
            type: boolean
    Role:
      type: object
      properties:
        assigned:
          type: boolean
        composite:
          type: boolean
        compositeRoleIds:
          type: array
          items:
            type: string
        description:
          type: string
        id:
          type: string
        name:
          type: string
    RulesEngineInfo:
      type: object
      properties:
        compilationErrorCount:
          type: integer
          format: int32
        executionErrorCount:
          type: integer
          format: int32
        status:
          type: string
          enum:
          - STOPPED
          - RUNNING
          - ERROR
    Select:
      type: object
      properties:
        metadata:
          type: boolean
        template:
          type: boolean
    SentAlarm:
      type: object
      properties:
        acknowledgedOn:
          type: string
          format: date-time
        asset:
          type: array
          items:
            $ref: "#/components/schemas/AssetObject"
        assigneeId:
          type: string
        assigneeUsername:
          type: string
        content:
          type: string
        createdOn:
          type: string
          format: date-time
        id:
          type: integer
          format: int64
        lastModified:
          type: string
          format: date-time
        realm:
          type: string
        severity:
          type: string
          enum:
          - LOW
          - MEDIUM
          - HIGH
        source:
          type: string
          enum:
          - MANUAL
          - CLIENT
          - GLOBAL_RULESET
          - REALM_RULESET
          - ASSET_RULESET
          - AGENT
        sourceId:
          type: string
        sourceUsername:
          type: string
        status:
          type: string
          enum:
          - OPEN
          - ACKNOWLEDGED
          - IN_PROGRESS
          - RESOLVED
          - CLOSED
        title:
          type: string
      required:
      - realm
      - severity
      - source
      - status
    SentNotification:
      type: object
      description: "One target-specific notification delivery record, including delivery\
        \ and acknowledgement state."
      properties:
        acknowledgedOn:
          type: string
          format: date-time
          description: Time the target acknowledged the notification.
          readOnly: true
        acknowledgement:
          type: string
          description: Optional JSON acknowledgement value serialized as text.
        deliveredOn:
          type: string
          format: date-time
          description: Time the target marked the notification delivered.
          readOnly: true
        error:
          type: string
          description: Delivery error detail when sending failed.
        id:
          type: integer
          format: int64
          description: Server-assigned numeric delivery-record identifier.
          example: 42
          readOnly: true
        message:
          $ref: "#/components/schemas/AbstractNotificationMessage"
        name:
          type: string
          description: Human-readable notification name.
          example: High temperature alert
        realm:
          type: string
          description: Realm associated with the delivery record.
          example: building
        sentOn:
          type: string
          format: date-time
          description: Time the notification was sent or attempted.
          readOnly: true
        source:
          type: string
          description: Kind of actor that created the notification.
          enum:
          - INTERNAL
          - CLIENT
          - GLOBAL_RULESET
          - REALM_RULESET
          - ASSET_RULESET
        sourceId:
          type: string
          description: "Identifier of the user, rule, or component that created the\
            \ notification."
        target:
          type: string
          description: Kind of delivery target.
          enum:
          - REALM
          - USER
          - ASSET
          - CUSTOM
        targetId:
          type: string
          description: "User, asset, realm, or custom target identifier."
        type:
          type: string
          description: Notification message type discriminator.
          example: push
      required:
      - realm
      - source
      - target
      - targetId
      - type
    Size:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValueConstraint"
      - type: object
        properties:
          max:
            type: integer
            format: int32
          min:
            type: integer
            format: int32
    StringPredicate:
      type: object
      description: "String matcher supporting exact, prefix, suffix, or contains matching,\
        \ case sensitivity, and negation."
      properties:
        caseSensitive:
          type: boolean
        match:
          type: string
          enum:
          - EXACT
          - BEGIN
          - END
          - CONTAINS
        negate:
          type: boolean
        value:
          type: string
    SyslogConfig:
      type: object
      properties:
        storedCategories:
          type: array
          items:
            type: string
            enum:
            - ASSET
            - AGENT
            - NOTIFICATION
            - ALARM
            - RULES
            - PROTOCOL
            - GATEWAY
            - MODEL_AND_VALUES
            - API
            - DATA
        storedLevel:
          type: string
          enum:
          - INFO
          - WARN
          - ERROR
        storedMaxAgeMinutes:
          type: integer
          format: int32
      required:
      - storedCategories
      - storedLevel
      - storedMaxAgeMinutes
    SyslogEvent:
      type: object
      description: "Persisted Manager log event with Unix-millisecond timestamp, severity,\
        \ category, optional subcategory, and message."
      properties:
        category:
          type: string
          description: High-level Manager subsystem category.
          enum:
          - ASSET
          - AGENT
          - NOTIFICATION
          - ALARM
          - RULES
          - PROTOCOL
          - GATEWAY
          - MODEL_AND_VALUES
          - API
          - DATA
        id:
          type: integer
          format: int64
          description: Server-assigned numeric event identifier.
          readOnly: true
        level:
          type: string
          description: Log severity.
          enum:
          - INFO
          - WARN
          - ERROR
        message:
          type: string
          description: Rendered log message.
        messageID:
          type: string
        subCategory:
          type: string
          description: "Optional component, logger, or class within the category."
          example: org.openremote.manager.asset
        timestamp:
          type: integer
          format: int64
      required:
      - category
      - level
    Target:
      type: object
      description: "Delivery target. The target type determines whether id refers\
        \ to a user, asset, realm, or custom address."
      properties:
        allowedLocales:
          type: array
          items:
            type: string
          uniqueItems: true
        data:
          type: object
        id:
          type: string
        locale:
          type: string
        type:
          type: string
          enum:
          - REALM
          - USER
          - ASSET
          - CUSTOM
    User:
      type: object
      description: Identity-provider user or service account. Administrative fields
        may be omitted according to caller permissions.
      properties:
        attributes:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        createdOn:
          type: string
          format: date-time
          description: Identity creation time.
          example: 2026-01-01T00:00:00Z
          readOnly: true
        email:
          type: string
          description: Email address.
          example: alex@example.com
        enabled:
          type: boolean
          description: Whether this identity can authenticate.
          example: true
        firstName:
          type: string
          description: Given name.
          example: Alex
        id:
          type: string
          description: Identity-provider user identifier.
          example: 2f1c17e5-72b8-4dbe-9f8d-c49e66f82e10
        lastName:
          type: string
          description: Family name.
          example: Morgan
        realm:
          type: string
          description: Realm name that owns the user.
          example: building
        realmId:
          type: string
          description: Identity-provider internal realm identifier.
          readOnly: true
        secret:
          type: string
          description: Client secret for a service user. Returned only by operations
            that explicitly expose or reset it.
          readOnly: true
        serviceAccount:
          type: boolean
        username:
          type: string
          maxLength: 255
          minLength: 3
          pattern: "^(?=[\\p{IsLatin}|\\p{IsCommon}]+$)(?=[^<>&\"'\\s\\v\\h$%!#?§\
            ,;:*~/\\\\|^=\\[\\]{}()`\\p{Cntrl}]+$).*$"
    UserAssetLink:
      type: object
      properties:
        assetName:
          type: string
        createdOn:
          type: string
          format: date-time
        id:
          $ref: "#/components/schemas/Id"
        parentAssetName:
          type: string
        userFullName:
          type: string
    UserQuery:
      type: object
      description: "Composable identity-provider user search request. Populated restrictions\
        \ are combined, except role arrays which match any supplied role."
      properties:
        assets:
          type: array
          description: Match users linked to any of these asset identifiers.
          items:
            type: string
            description: Match users linked to any of these asset identifiers.
        attributes:
          type: array
          description: Attribute predicates combined with AND.
          items:
            $ref: "#/components/schemas/AttributeValuePredicate"
        clientRoles:
          type: array
          items:
            $ref: "#/components/schemas/StringPredicate"
        ids:
          type: array
          description: Match these exact identity-provider user identifiers.
          items:
            type: string
            description: Match these exact identity-provider user identifiers.
        limit:
          type: integer
          format: int32
          description: Maximum number of results.
          example: 100
        offset:
          type: integer
          format: int32
          description: Number of matching results to skip.
          example: 0
        orderBy:
          $ref: "#/components/schemas/UserQueryOrderBy"
        pathPredicate:
          $ref: "#/components/schemas/PathPredicate"
        realmPredicate:
          $ref: "#/components/schemas/RealmPredicate"
        realmRoles:
          type: array
          items:
            $ref: "#/components/schemas/StringPredicate"
        select:
          $ref: "#/components/schemas/UserQuerySelect"
        serviceUsers:
          type: boolean
          description: "True selects service users, false selects human users, null\
            \ includes both."
          nullable: true
        usernames:
          type: array
          items:
            $ref: "#/components/schemas/StringPredicate"
    UserQueryOrderBy:
      type: object
      description: User result ordering.
      properties:
        descending:
          type: boolean
          description: Reverse the default ascending order.
          example: false
        property:
          type: string
          description: User property used for ordering.
          enum:
          - CREATED_ON
          - FIRST_NAME
          - LAST_NAME
          - USERNAME
          - EMAIL
          example: USERNAME
    UserQuerySelect:
      type: object
      description: User response projection.
      properties:
        basic:
          type: boolean
          description: "Return basic identity fields only, omitting administrative\
            \ details."
          example: true
    UserSession:
      type: object
      properties:
        ID:
          type: string
        remoteAddress:
          type: string
        startTimeMillis:
          type: integer
          format: int64
        username:
          type: string
    ValueAnyPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
    ValueConstraint:
      type: object
      discriminator:
        propertyName: type
      properties:
        message:
          type: string
        type:
          type: string
      required:
      - type
    ValueDatapointObject:
      type: object
      properties:
        x:
          type: integer
          format: int64
        "y":
          type: object
    ValueDescriptor:
      type: object
      properties:
        arrayDimensions:
          type: integer
          format: int32
        constraints:
          type: array
          items:
            $ref: "#/components/schemas/ValueConstraint"
        format:
          $ref: "#/components/schemas/ValueFormat"
        jsonType:
          type: string
        metaUseOnly:
          type: boolean
        name:
          type: string
          pattern: "^\\w+(\\[\\])?$"
        units:
          type: array
          items:
            type: string
    ValueDescriptorObject:
      type: object
      properties:
        arrayDimensions:
          type: integer
          format: int32
        constraints:
          type: array
          items:
            $ref: "#/components/schemas/ValueConstraint"
        format:
          $ref: "#/components/schemas/ValueFormat"
        jsonType:
          type: string
        metaUseOnly:
          type: boolean
        name:
          type: string
          pattern: "^\\w+(\\[\\])?$"
        units:
          type: array
          items:
            type: string
    ValueEmptyPredicate:
      type: object
      allOf:
      - $ref: "#/components/schemas/ValuePredicate"
      - type: object
        properties:
          negate:
            type: boolean
    ValueFormat:
      type: object
      properties:
        asBoolean:
          type: boolean
        asDate:
          type: boolean
        asMomentary:
          type: boolean
        asNumber:
          type: boolean
        asOnOff:
          type: boolean
        asOpenClosed:
          type: boolean
        asPressedReleased:
          type: boolean
        asSlider:
          type: boolean
        dateStyle:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        day:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        dayPeriod:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        era:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        fractionalSecondDigits:
          type: integer
          format: int32
        hour:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        hour12:
          type: boolean
        iso8601:
          type: boolean
        maximumFractionDigits:
          type: integer
          format: int32
        maximumSignificantDigits:
          type: integer
          format: int32
        minimumFractionDigits:
          type: integer
          format: int32
        minimumIntegerDigits:
          type: integer
          format: int32
        minimumSignificantDigits:
          type: integer
          format: int32
        minute:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        momentJsFormat:
          type: string
        month:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        multiline:
          type: boolean
        resolution:
          type: number
        second:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        timeStyle:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        timeZoneName:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        useGrouping:
          type: boolean
        week:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        weekday:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
        year:
          type: string
          enum:
          - numeric
          - 2-digit
          - full
          - long
          - medium
          - short
          - narrow
    ValuePredicate:
      type: object
      discriminator:
        propertyName: predicateType
      properties:
        predicateType:
          type: string
      required:
      - predicateType
    X509ProvisioningConfig:
      type: object
      allOf:
      - $ref: "#/components/schemas/ProvisioningConfigObjectObject"
      - type: object
        properties:
          data:
            $ref: "#/components/schemas/X509ProvisioningData"
      required:
      - name
    X509ProvisioningData:
      type: object
      properties:
        CACertPEM:
          type: string
        ignoreExpiryDate:
          type: boolean
  securitySchemes:
    openid:
      flows:
        authorizationCode:
          authorizationUrl: /auth/realms/master/protocol/openid-connect/auth
          refreshUrl: /auth/realms/master/protocol/openid-connect/token
          scopes:
            profile: profile
          tokenUrl: /auth/realms/master/protocol/openid-connect/token
        clientCredentials:
          refreshUrl: /auth/realms/master/protocol/openid-connect/token
          scopes:
            profile: profile
          tokenUrl: /auth/realms/master/protocol/openid-connect/token
      type: oauth2