{
  "openapi": "3.1.0",
  "info": {
    "title": "Drel Public API",
    "version": "1.0.0",
    "summary": "Read-only API for AI Security Review cases produced by Drel.",
    "description": "Key-authed, read-only access to AI Security Review cases: case summaries, findings (threats), and sign-off state. Pair with the MCP server (POST /api/mcp) to pull a case's clearance decision, required controls, and evidence gaps directly into an agent's context. Human-facing quickstart and key management: https://drel.ai/developers. \n\n**Versioning & deprecation policy.** This API is versioned in the URL path (`/api/public/v1/*`); a breaking change ships as `/api/public/v2/*` alongside the existing `/v1`, never as an in-place change to `/v1`. Before any version is removed, Drel publishes at least 90 days' notice and adds `Deprecation` and `Sunset` response headers (RFC 8594) to every response on that version, in addition to updating this document. Nothing under `/v1` is currently deprecated. Full policy: https://drel.ai/developers#versioning.",
    "contact": {
      "name": "Drel",
      "email": "hello@drel.ai",
      "url": "https://drel.ai/developers"
    },
    "termsOfService": "https://drel.ai/terms"
  },
  "servers": [
    {
      "url": "https://app.drel.ai",
      "description": "Product workspace (recommended)"
    },
    {
      "url": "https://drel.ai",
      "description": "Marketing host — same API, same key"
    }
  ],
  "tags": [
    {
      "name": "cases",
      "description": "AI Security Review case data."
    },
    {
      "name": "mcp",
      "description": "Model Context Protocol server (JSON-RPC 2.0 over HTTP)."
    }
  ],
  "paths": {
    "/api/public/v1/cases": {
      "get": {
        "operationId": "listCases",
        "tags": [
          "cases"
        ],
        "summary": "List AI Security Review cases",
        "description": "Returns up to 200 cases visible to the authenticated API key, most recently assessed first. Use this to enumerate cases before fetching findings or sign-offs for a specific one. Rate limit: 60 requests/minute per API key.",
        "security": [
          {
            "ApiKeyAuth": []
          },
          {
            "ClerkOAuth": [
              "cases:read"
            ]
          }
        ],
        "responses": {
          "200": {
            "description": "Cases visible to this API key.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "cases": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "id": {
                            "type": "string",
                            "description": "Case id (UUID)."
                          },
                          "name": {
                            "type": "string"
                          },
                          "systemTypeLabel": {
                            "type": "string",
                            "nullable": true
                          },
                          "decision": {
                            "type": "string",
                            "nullable": true,
                            "enum": [
                              "proceed",
                              "conditional",
                              "restricted_pilot_only",
                              "hold",
                              "decline"
                            ],
                            "description": "Current disposition decision, if the case has one."
                          },
                          "lifecycleStage": {
                            "type": "string",
                            "nullable": true
                          },
                          "pendingSignOffs": {
                            "type": "integer",
                            "minimum": 0
                          },
                          "evidenceGaps": {
                            "type": "integer",
                            "minimum": 0
                          },
                          "lastAssessmentDate": {
                            "type": "string",
                            "format": "date-time",
                            "nullable": true
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid credentials (API key or OAuth access token). Rate-limited by IP before auth, so RateLimit-* headers are present here too. Carries WWW-Authenticate pointing at /.well-known/oauth-protected-resource.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "403": {
            "description": "Valid OAuth access token, but missing the required scope. Carries WWW-Authenticate with error=\"insufficient_scope\". Does not apply to API-key auth, which is unscoped.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "405": {
            "description": "Method not allowed. See the Allow header for what this endpoint accepts.",
            "headers": {
              "Allow": {
                "description": "Comma-separated list of allowed methods.",
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded. RateLimit-* headers on every response tell you the budget ahead of time; self-throttle before hitting this.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              },
              "Retry-After": {
                "description": "Seconds to wait before retrying.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "500": {
            "description": "Unexpected server error.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          }
        }
      }
    },
    "/api/public/v1/cases/{id}/findings": {
      "get": {
        "operationId": "getCaseFindings",
        "tags": [
          "cases"
        ],
        "summary": "Get findings (threats) for a case",
        "description": "Returns every threat register entry for the given case, scoped to the authenticated API key's workspace. Rate limit: 60 requests/minute per API key.",
        "security": [
          {
            "ApiKeyAuth": []
          },
          {
            "ClerkOAuth": [
              "cases:read"
            ]
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "Case id (UUID), from GET /api/public/v1/cases.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Findings for the case. Returns an empty array if the case has none or is not visible to this key.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "findings": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "id": {
                            "type": "string"
                          },
                          "title": {
                            "type": "string"
                          },
                          "description": {
                            "type": "string"
                          },
                          "severity": {
                            "type": "string",
                            "enum": [
                              "critical",
                              "high",
                              "medium",
                              "low"
                            ]
                          },
                          "evidenceState": {
                            "type": "string",
                            "enum": [
                              "explicit",
                              "inferred",
                              "assumed",
                              "unknown",
                              "missing_evidence",
                              "verified"
                            ]
                          },
                          "status": {
                            "type": "string"
                          },
                          "affectedComponents": {
                            "type": "array",
                            "items": {}
                          },
                          "frameworks": {
                            "type": "array",
                            "items": {
                              "type": "string"
                            },
                            "description": "Framework tags this finding maps to (e.g. OWASP LLM Top 10, EU AI Act)."
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid credentials (API key or OAuth access token). Rate-limited by IP before auth, so RateLimit-* headers are present here too. Carries WWW-Authenticate pointing at /.well-known/oauth-protected-resource.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "403": {
            "description": "Valid OAuth access token, but missing the required scope. Carries WWW-Authenticate with error=\"insufficient_scope\". Does not apply to API-key auth, which is unscoped.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "405": {
            "description": "Method not allowed. See the Allow header for what this endpoint accepts.",
            "headers": {
              "Allow": {
                "description": "Comma-separated list of allowed methods.",
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded. RateLimit-* headers on every response tell you the budget ahead of time; self-throttle before hitting this.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              },
              "Retry-After": {
                "description": "Seconds to wait before retrying.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "500": {
            "description": "Unexpected server error.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          }
        }
      }
    },
    "/api/public/v1/cases/{id}/sign-offs": {
      "get": {
        "operationId": "getCaseSignOffs",
        "tags": [
          "cases"
        ],
        "summary": "Get sign-off state for a case",
        "description": "Returns the multi-stakeholder sign-off block for the given case (role, status, signer, timestamp, comment). Never returns the sign-off request token. Rate limit: 60 requests/minute per API key.",
        "security": [
          {
            "ApiKeyAuth": []
          },
          {
            "ClerkOAuth": [
              "cases:read"
            ]
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "Case id (UUID), from GET /api/public/v1/cases.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Sign-off entries for the case.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "signOffs": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "role": {
                            "type": "string",
                            "enum": [
                              "security_architecture",
                              "ai_governance",
                              "dpo",
                              "business_owner",
                              "ciso_delegate"
                            ]
                          },
                          "user": {
                            "type": "string",
                            "nullable": true
                          },
                          "status": {
                            "type": "string",
                            "enum": [
                              "pending",
                              "approved",
                              "rejected"
                            ]
                          },
                          "signedAt": {
                            "type": "string",
                            "format": "date-time",
                            "nullable": true
                          },
                          "comment": {
                            "type": "string",
                            "nullable": true
                          },
                          "approverEmail": {
                            "type": "string",
                            "nullable": true
                          },
                          "requestedAt": {
                            "type": "string",
                            "format": "date-time",
                            "nullable": true
                          },
                          "reminderCount": {
                            "type": "integer",
                            "minimum": 0
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid credentials (API key or OAuth access token). Rate-limited by IP before auth, so RateLimit-* headers are present here too. Carries WWW-Authenticate pointing at /.well-known/oauth-protected-resource.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "403": {
            "description": "Valid OAuth access token, but missing the required scope. Carries WWW-Authenticate with error=\"insufficient_scope\". Does not apply to API-key auth, which is unscoped.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "405": {
            "description": "Method not allowed. See the Allow header for what this endpoint accepts.",
            "headers": {
              "Allow": {
                "description": "Comma-separated list of allowed methods.",
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded. RateLimit-* headers on every response tell you the budget ahead of time; self-throttle before hitting this.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              },
              "Retry-After": {
                "description": "Seconds to wait before retrying.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "500": {
            "description": "Unexpected server error.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          }
        }
      }
    },
    "/api/mcp": {
      "post": {
        "operationId": "invokeMcp",
        "tags": [
          "mcp"
        ],
        "summary": "Model Context Protocol server (JSON-RPC 2.0)",
        "description": "Single-endpoint MCP server using the Streamable HTTP transport (protocol version 2025-03-26). Supports four read-only methods: `initialize` (params: {}) — handshake, returns server capabilities and instructions; **no API key required**, rate limited 30/minute per IP; `ping` (params: {}) — spec-standard liveness check, returns `{}`; **no API key required**, rate limited 30/minute per IP; `resources/list` (params: { cursor?: string }) — paginated list of published cases as MCP resources (uri `drel://case/{id}`), auth required (API key, or OAuth access token with the `cases:read` scope), 60/minute per key; `resources/read` (params: { uri: string }) — returns the full clearance decision, required controls, key threats, evidence gaps and re-assessment triggers for one case as JSON text content, auth required (same as resources/list), 60/minute per key. Errors follow standard JSON-RPC 2.0 error codes and are returned with HTTP 200, per spec — except rate limiting (code -32029), which also sets HTTP 429 and Retry-After so a caller checking only the HTTP layer still sees it. **Auth is enforced per JSON-RPC method, not at the HTTP layer**: this operation has no security requirement at the transport level (POST succeeds without a key for `initialize`/`ping`) — the `ApiKeyAuth` and `ClerkOAuth` schemes are still declared below because `resources/list` and `resources/read` check for one of them once the request is dispatched.",
        "security": [],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "jsonrpc",
                  "method"
                ],
                "properties": {
                  "jsonrpc": {
                    "type": "string",
                    "enum": [
                      "2.0"
                    ]
                  },
                  "id": {
                    "oneOf": [
                      {
                        "type": "string"
                      },
                      {
                        "type": "integer"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "method": {
                    "type": "string",
                    "enum": [
                      "initialize",
                      "ping",
                      "resources/list",
                      "resources/read"
                    ],
                    "description": "MCP method to invoke. See the endpoint description for the params/result shape of each."
                  },
                  "params": {
                    "type": "object",
                    "description": "Method-specific parameters (see endpoint description)."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "JSON-RPC 2.0 response. Check for a top-level `error` key — most JSON-RPC errors are not surfaced as HTTP error statuses.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "jsonrpc",
                    "id"
                  ],
                  "properties": {
                    "jsonrpc": {
                      "type": "string",
                      "enum": [
                        "2.0"
                      ]
                    },
                    "id": {
                      "oneOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "integer"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "result": {
                      "type": "object",
                      "description": "Present on success. Shape depends on the method invoked."
                    },
                    "error": {
                      "type": "object",
                      "description": "Present on failure. Standard JSON-RPC 2.0 error object. Code -32029 (rate limited) also sets HTTP 429 + Retry-After; every other error stays HTTP 200 per JSON-RPC convention.",
                      "properties": {
                        "code": {
                          "type": "integer"
                        },
                        "message": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Malformed JSON or not a valid JSON-RPC 2.0 request.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "jsonrpc",
                    "id"
                  ],
                  "properties": {
                    "jsonrpc": {
                      "type": "string",
                      "enum": [
                        "2.0"
                      ]
                    },
                    "id": {
                      "oneOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "integer"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "result": {
                      "type": "object",
                      "description": "Present on success. Shape depends on the method invoked."
                    },
                    "error": {
                      "type": "object",
                      "description": "Present on failure. Standard JSON-RPC 2.0 error object. Code -32029 (rate limited) also sets HTTP 429 + Retry-After; every other error stays HTTP 200 per JSON-RPC convention.",
                      "properties": {
                        "code": {
                          "type": "integer"
                        },
                        "message": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid credentials (for resources/list, resources/read — API key or OAuth access token). Rate-limited by IP before auth, so RateLimit-* headers are present here too. Carries WWW-Authenticate pointing at /.well-known/oauth-protected-resource.",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "403": {
            "description": "Valid OAuth access token, but missing the required scope (for resources/list, resources/read). Carries WWW-Authenticate with error=\"insufficient_scope\". Does not apply to API-key auth, which is unscoped.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "405": {
            "description": "Method not allowed. GET returns a JSON body pointing at /.well-known/mcp.json; PUT/PATCH/DELETE are not supported.",
            "headers": {
              "Allow": {
                "description": "Comma-separated list of allowed methods.",
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded (JSON-RPC error code -32029).",
            "headers": {
              "RateLimit-Limit": {
                "description": "Requests allowed per window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Remaining": {
                "description": "Requests remaining in the current window.",
                "schema": {
                  "type": "integer"
                }
              },
              "RateLimit-Reset": {
                "description": "Seconds until the window resets.",
                "schema": {
                  "type": "integer"
                }
              },
              "Retry-After": {
                "description": "Seconds to wait before retrying.",
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "jsonrpc",
                    "id"
                  ],
                  "properties": {
                    "jsonrpc": {
                      "type": "string",
                      "enum": [
                        "2.0"
                      ]
                    },
                    "id": {
                      "oneOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "integer"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "result": {
                      "type": "object",
                      "description": "Present on success. Shape depends on the method invoked."
                    },
                    "error": {
                      "type": "object",
                      "description": "Present on failure. Standard JSON-RPC 2.0 error object. Code -32029 (rate limited) also sets HTTP 429 + Retry-After; every other error stays HTTP 200 per JSON-RPC convention.",
                      "properties": {
                        "code": {
                          "type": "integer"
                        },
                        "message": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "drel_pk_...",
        "description": "Drel API key, issued at Settings → MCP (https://app.drel.ai/settings/mcp). Send as `Authorization: Bearer drel_pk_...`. Shown once at creation; store it securely. Unscoped — a valid key can always call every operation. Not required for the MCP `initialize`/`ping` methods. See ClerkOAuth for the scoped, user-delegated alternative."
      },
      "ClerkOAuth": {
        "type": "oauth2",
        "description": "User-delegated OAuth 2.0 access token, issued by Clerk (this deployment's Authorization Server — Drel is the Resource Server only). Authorization Code + PKCE. See https://drel.ai/.well-known/oauth-protected-resource (RFC 9728) and https://drel.ai/.well-known/oauth-authorization-server (RFC 8414) for live discovery metadata, and /auth.md for the full explanation. Not an alternative for unattended/machine callers — use ApiKeyAuth for those; Clerk does not yet support the OAuth client-credentials grant.",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "https://clerk.drel.ai/oauth/authorize",
            "tokenUrl": "https://clerk.drel.ai/oauth/token",
            "scopes": {
              "cases:read": "Read case summaries, findings, and sign-off state — the entire current read surface."
            }
          }
        }
      }
    },
    "schemas": {
      "Problem": {
        "type": "object",
        "required": [
          "type",
          "title",
          "status",
          "detail",
          "code"
        ],
        "properties": {
          "type": {
            "type": "string",
            "format": "uri",
            "description": "Dereferenceable URI naming this error *type* — see the matching anchor at https://drel.ai/developers#errors."
          },
          "title": {
            "type": "string",
            "description": "Short, human-readable summary — constant for a given `code`."
          },
          "status": {
            "type": "integer",
            "description": "HTTP status of this response, repeated in the body per RFC 9457."
          },
          "detail": {
            "type": "string",
            "description": "Human-readable detail specific to this occurrence."
          },
          "error": {
            "type": "string",
            "deprecated": true,
            "description": "Alias of `detail`, kept for callers on the pre-RFC-9457 `{ error, code, hint }` shape."
          },
          "code": {
            "type": "string",
            "description": "Stable machine-readable error code — safe to branch on.",
            "enum": [
              "unauthorized",
              "insufficient_scope",
              "not_found",
              "method_not_allowed",
              "rate_limited",
              "service_unavailable",
              "internal_error"
            ]
          },
          "hint": {
            "type": "string",
            "description": "What the caller can do to recover, when applicable."
          }
        }
      },
      "CaseSummary": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "Case id (UUID)."
          },
          "name": {
            "type": "string"
          },
          "systemTypeLabel": {
            "type": "string",
            "nullable": true
          },
          "decision": {
            "type": "string",
            "nullable": true,
            "enum": [
              "proceed",
              "conditional",
              "restricted_pilot_only",
              "hold",
              "decline"
            ],
            "description": "Current disposition decision, if the case has one."
          },
          "lifecycleStage": {
            "type": "string",
            "nullable": true
          },
          "pendingSignOffs": {
            "type": "integer",
            "minimum": 0
          },
          "evidenceGaps": {
            "type": "integer",
            "minimum": 0
          },
          "lastAssessmentDate": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          }
        }
      },
      "Finding": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "severity": {
            "type": "string",
            "enum": [
              "critical",
              "high",
              "medium",
              "low"
            ]
          },
          "evidenceState": {
            "type": "string",
            "enum": [
              "explicit",
              "inferred",
              "assumed",
              "unknown",
              "missing_evidence",
              "verified"
            ]
          },
          "status": {
            "type": "string"
          },
          "affectedComponents": {
            "type": "array",
            "items": {}
          },
          "frameworks": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Framework tags this finding maps to (e.g. OWASP LLM Top 10, EU AI Act)."
          }
        }
      },
      "SignOff": {
        "type": "object",
        "properties": {
          "role": {
            "type": "string",
            "enum": [
              "security_architecture",
              "ai_governance",
              "dpo",
              "business_owner",
              "ciso_delegate"
            ]
          },
          "user": {
            "type": "string",
            "nullable": true
          },
          "status": {
            "type": "string",
            "enum": [
              "pending",
              "approved",
              "rejected"
            ]
          },
          "signedAt": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "comment": {
            "type": "string",
            "nullable": true
          },
          "approverEmail": {
            "type": "string",
            "nullable": true
          },
          "requestedAt": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "reminderCount": {
            "type": "integer",
            "minimum": 0
          }
        }
      },
      "JsonRpcRequest": {
        "type": "object",
        "required": [
          "jsonrpc",
          "method"
        ],
        "properties": {
          "jsonrpc": {
            "type": "string",
            "enum": [
              "2.0"
            ]
          },
          "id": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ]
          },
          "method": {
            "type": "string",
            "enum": [
              "initialize",
              "ping",
              "resources/list",
              "resources/read"
            ],
            "description": "MCP method to invoke. See the endpoint description for the params/result shape of each."
          },
          "params": {
            "type": "object",
            "description": "Method-specific parameters (see endpoint description)."
          }
        }
      },
      "JsonRpcResponse": {
        "type": "object",
        "required": [
          "jsonrpc",
          "id"
        ],
        "properties": {
          "jsonrpc": {
            "type": "string",
            "enum": [
              "2.0"
            ]
          },
          "id": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ]
          },
          "result": {
            "type": "object",
            "description": "Present on success. Shape depends on the method invoked."
          },
          "error": {
            "type": "object",
            "description": "Present on failure. Standard JSON-RPC 2.0 error object. Code -32029 (rate limited) also sets HTTP 429 + Retry-After; every other error stays HTTP 200 per JSON-RPC convention.",
            "properties": {
              "code": {
                "type": "integer"
              },
              "message": {
                "type": "string"
              }
            }
          }
        }
      }
    }
  },
  "security": [
    {
      "ApiKeyAuth": []
    },
    {
      "ClerkOAuth": [
        "cases:read"
      ]
    }
  ]
}