openapi: 3.0.3
info:
  title: EcoKure Assurance Runtime pilot API
  version: 0.1.0
  description: >-
    Bounded integration contract for a tenant-scoped EcoKure pilot. The exact
    payload and Control Pack are agreed with the customer before production.
servers:
  - url: https://ecokure.com
    description: Canonical public address; use the customer deployment URL for a pilot.
security:
  - ApiKey: []
paths:
  /api/access/verify:
    post:
      summary: Verify a tenant-scoped API key
      security: [{ApiKey: []}]
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/ScopeRequest'}
      responses:
        '200':
          description: Credential is active and has the requested scope.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/AccessResult'}
        '401': {description: Invalid, expired or revoked key.}
  /api/biochangegate/run:
    post:
      summary: Run the bounded BioChangeGate pilot fixture
      description: >-
        Demonstration endpoint only. A customer deployment replaces the
        fixture with an agreed workflow adapter and customer-controlled key.
      security: [{ApiKey: []}]
      responses:
        '200':
          description: Signed EvidencePack generated and verified.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/EvidencePackResponse'}
        '401': {description: Missing or invalid tenant credential.}
        '503': {description: Signing or runtime dependency unavailable.}
  /api/biochangegate/demo-run:
    post:
      summary: Run the public synthetic BioChangeGate fixture
      description: No credential is required. This endpoint is demonstration-only and contains no customer data.
      security: []
      responses:
        '200':
          description: Synthetic signed EvidencePack generated and verified.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/EvidencePackResponse'}
  /evidence-pack/demo.json:
    get:
      summary: Download the public synthetic EvidencePack
      security: []
      responses:
        '200':
          description: Non-customer demonstration pack.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/EvidencePack'}
components:
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-Key
  schemas:
    ScopeRequest:
      type: object
      required: [scope]
      properties:
        scope: {type: string, enum: [access:verify, taxonomy:read, evidence:write]}
    AccessResult:
      type: object
      required: [ok, tenant_id, scopes]
      properties:
        ok: {type: boolean}
        tenant_id: {type: string}
        scopes: {type: array, items: {type: string}}
        expires_at: {type: string, format: date-time, nullable: true}
    EvidencePackResponse:
      type: object
      required: [ok, evidence_pack]
      properties:
        ok: {type: boolean}
        evidence_pack: {$ref: '#/components/schemas/EvidencePack'}
    EvidencePack:
      type: object
      required: [pack_type, verification_state, workflow, records, chain_root, chain_tip]
      properties:
        pack_type: {type: string}
        verification_state: {type: string}
        workflow: {type: string}
        decision: {type: string, enum: [ALLOW, REVIEW, BLOCK, ABSTAIN]}
        chain_root: {type: string}
        chain_tip: {type: string}
        records: {type: array, items: {type: object}}
        limitations: {type: array, items: {type: string}}
