{"components":{"securitySchemes":{"CIRequestId":{"description":"Gateway-injected correlation id. A present-but-blank (whitespace-only) value is whitespace-trimmed and treated as missing, yielding `401 unauthenticated`. Distinct from the W3C trace id that fills the error-envelope `id` field.\n","in":"header","name":"CI-Request-Id","type":"apiKey"},"CIRole":{"description":"Gateway-injected comma-separated caller roles (`super-admin`, `compliance-officer`; see the `CallerRole` schema). Unknown roles are ignored. The header must be present, but an empty value is valid: it means an authenticated caller with no roles (mutations then fail the role gate with 403).\n","in":"header","name":"CI-Role","type":"apiKey"},"CISubjectURN":{"description":"Gateway-injected caller URN. Must resolve to a provisioned KYC user; a missing header, a present-but-blank (whitespace-only) value — the value is whitespace-trimmed and then treated as missing — or an unknown/unprovisioned subject yields `401 unauthenticated` with `source.header`.\n","in":"header","name":"CI-Subject-URN","type":"apiKey"}}},"info":{"description":"KYC.NEXT API — primary back-end service for case management, tenant\nand user administration, policy-template reads, and business-registry\nlookups.\n\nAll `/v1` operations require the gateway-injected identity headers\n`CI-Subject-URN`, `CI-Role`, and `CI-Request-Id`. A missing `CI-Subject-URN`\nor `CI-Request-Id`, an absent `CI-Role` header (present-but-empty is a\nvalid \"authenticated, no roles\" value), or a subject URN not provisioned as\na KYC user is rejected with `401 unauthenticated`. Reads of org-owned\nresources (tenants, users, cases) are confined to the caller's\ntenant: a resource in another tenant is indistinguishable from\na missing one and yields `404`, never `403`; platform-scope policy\ntemplates and the registry proxy are not org-confined. `403` is reserved\nfor the role gates on mutations, and for `tenant_not_provisioned` below.\n\nA tenant user (`urn:kyc:user:{tenant}:{user}`) unknown to KYC.NEXT is\nprovisioned on its first request from the gateway-injected\n`CI-Subject-Email` (required) and `CI-Subject-Name` (optional) headers;\nwithout `CI-Subject-Email` it stays unknown and gets `401`. If its tenant\nhas not been provisioned, every `/v1` call answers\n`403 tenant_not_provisioned` and nothing is written. A known user's cached\nemail, name and roles follow the same headers; authorization always uses\nthe request's `CI-Role`, never the cached roles. Tenants, and users of\nany other subject kind, are provisioned out-of-band.\n\nSuccess bodies and error bodies are both served as\n`application/vnd.api+json`; every error is a CIGBC error envelope. An\nunmatched route yields a `404 not_found` envelope; a known path hit with an\nunsupported method yields a `405 method_not_allowed` envelope.\n\ngoskell-managed operational routes (`/livez`, `/readyz`, `/metrics`) exist\nbut are outside this contract.\n","title":"kyc-api","version":"0.2.0"},"openapi":"3.1.0","paths":{},"security":[{"CIRequestId":[],"CIRole":[],"CISubjectURN":[]}],"servers":[{"url":"/"}],"x-readme":{"proxy-enabled":false}}