api

type Activity struct {
	HostId     *openapi_types.UUID `json:"host_id,omitempty"`
	Id         openapi_types.UUID  `json:"id"`
	OccurredAt time.Time           `json:"occurred_at"`
	Severity   ActivitySeverity    `json:"severity"`
	Source     ActivitySource      `json:"source"`
	Summary    *string             `json:"summary,omitempty"`
	Title      string              `json:"title"`
}

type ActivityPage struct {
	HiddenCount int        `json:"hidden_count"`
	Items       []Activity `json:"items"`
	NextCursor  *string    `json:"next_cursor,omitempty"`
}

type ActivitySeverity string

type ActivitySource string

type AdminRolesResponse struct {
	Roles []RoleEntry `json:"roles"`
}

type AggregateScore struct {
	// CoveragePct Share of in-scope rules that produced a verdict, to one decimal. Non-null if and only if coverage_status is available.
	CoveragePct *float64 `json:"coverage_pct"`

	// CoverageStatus Whether the share of in-scope rules that produced a verdict can be stated, and when it cannot, why. unavailable_unclassified_skips means at least one skip carries no machine-readable reason, so an inapplicable rule cannot be told from an unevaluated one; the number is withheld rather than guessed.
	CoverageStatus AggregateScoreCoverageStatus `json:"coverage_status"`
	Envelope       ScoreEnvelope                `json:"envelope"`

	// Error Outcomes that errored, summed across the population.
	Error int64 `json:"error"`

	// Failing Rule outcomes that failed, summed across the population.
	Failing int64 `json:"failing"`

	// HostsScored Hosts that produced a score. The population the mean is over.
	HostsScored int `json:"hosts_scored"`

	// HostsTotal Active hosts. Always hosts_scored + hosts_without_score.
	HostsTotal int `json:"hosts_total"`

	// HostsWithoutScore Active hosts that produced no score: never scanned, scanned with no verdict, or carrying no rule that matches the lens.
	HostsWithoutScore int `json:"hosts_without_score"`

	// Passing Rule outcomes that passed, summed across the population.
	Passing int64 `json:"passing"`

	// ScorePct Equal-host mean of the per-host scores, to one decimal, so each host counts once whatever its rule count. NULL when no host produced a verdict, which is a different fact from every host failing every rule (that scores 0). It replaces a pooled ratio that weighted hosts by rule count and could not express absence.
	ScorePct *float64 `json:"score_pct"`

	// Skipped Outcomes that produced no verdict, summed across the population. They enter neither side of score_pct.
	Skipped int64 `json:"skipped"`
}

type AggregateScoreCoverageStatus string

type Alert struct {
	AcknowledgedAt *time.Time          `json:"acknowledged_at,omitempty"`
	AcknowledgedBy *openapi_types.UUID `json:"acknowledged_by,omitempty"`
	AlertType      string              `json:"alert_type"`
	Body           *string             `json:"body,omitempty"`
	CreatedAt      *time.Time          `json:"created_at,omitempty"`
	DedupKey       string              `json:"dedup_key"`
	DismissedAt    *time.Time          `json:"dismissed_at,omitempty"`
	DismissedBy    *openapi_types.UUID `json:"dismissed_by,omitempty"`
	HostId         *openapi_types.UUID `json:"host_id,omitempty"`
	Id             openapi_types.UUID  `json:"id"`
	OccurredAt     time.Time           `json:"occurred_at"`
	ResolvedAt     *time.Time          `json:"resolved_at,omitempty"`
	ResolvedBy     *openapi_types.UUID `json:"resolved_by,omitempty"`
	RuleId         *string             `json:"rule_id,omitempty"`
	Severity       AlertSeverity       `json:"severity"`
	SilencedBy     *openapi_types.UUID `json:"silenced_by,omitempty"`
	SilencedUntil  *time.Time          `json:"silenced_until,omitempty"`
	State          AlertState          `json:"state"`
	Tags           *map[string]string  `json:"tags,omitempty"`
	Title          string              `json:"title"`
	UpdatedAt      *time.Time          `json:"updated_at,omitempty"`
}

type AlertLifecycleRequest struct {
	Reason *string    `json:"reason,omitempty"`
	Until  *time.Time `json:"until,omitempty"`
}

type AlertSeverity string

type AlertState string

type AlertsPage struct {
	Items      []Alert `json:"items"`
	NextCursor *string `json:"next_cursor,omitempty"`
}

type ApiToken struct {
	CreatedAt  time.Time          `json:"created_at"`
	ExpiresAt  *time.Time         `json:"expires_at,omitempty"`
	Id         openapi_types.UUID `json:"id"`
	LastUsedAt *time.Time         `json:"last_used_at,omitempty"`
	Name       string             `json:"name"`

	// Prefix Non-secret display prefix (e.g. owk_a1b2c3d4)
	Prefix    string     `json:"prefix"`
	RevokedAt *time.Time `json:"revoked_at,omitempty"`

	// RoleId The role whose permissions the token carries
	RoleId string `json:"role_id"`
}

type ApiTokenCreateRequest struct {
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Name      string     `json:"name"`

	// RoleId Role the token acts as (must be a known role)
	RoleId string `json:"role_id"`
}

type ApiTokenCreated struct {
	// ApiToken API token metadata. The secret is NEVER included.
	ApiToken ApiToken `json:"api_token"`

	// Token The raw secret. Shown once.
	Token string `json:"token"`
}

type ApiTokenList struct {
	Tokens []ApiToken `json:"tokens"`
}

type ApproveRemediationJSONRequestBody = RemediationReview

type AuditEvent struct {
	Action        string                  `json:"action"`
	ActorId       *string                 `json:"actor_id,omitempty"`
	ActorLabel    *string                 `json:"actor_label,omitempty"`
	ActorType     string                  `json:"actor_type"`
	CorrelationId string                  `json:"correlation_id"`
	Detail        *map[string]interface{} `json:"detail,omitempty"`
	Id            openapi_types.UUID      `json:"id"`
	Message       *string                 `json:"message,omitempty"`
	OccurredAt    time.Time               `json:"occurred_at"`
	RecordedAt    *time.Time              `json:"recorded_at,omitempty"`
	Redactions    *[]string               `json:"redactions,omitempty"`
	ResourceId    *string                 `json:"resource_id,omitempty"`
	ResourceType  *string                 `json:"resource_type,omitempty"`
	Severity      *string                 `json:"severity,omitempty"`
}

type AuditEventsPage struct {
	Items []AuditEvent `json:"items"`

	// NextCursor Opaque cursor; pass as ?cursor= to fetch the next page
	NextCursor *string `json:"next_cursor"`
}

type AuthLoginRequest struct {
	Otp      *string `json:"otp,omitempty"`
	Password string  `json:"password"`
	Username string  `json:"username"`
}

type AuthLoginResponse struct {
	AccessToken string `json:"access_token"`

	// MfaEnrollmentRequired True when workspace policy requires MFA but the user has not enrolled. The session is still issued (soft enforcement); the client must force MFA enrollment before anything else.
	MfaEnrollmentRequired *bool          `json:"mfa_enrollment_required,omitempty"`
	RefreshToken          string         `json:"refresh_token"`
	User                  AuthMeResponse `json:"user"`
}

type AuthMFAEnrollResponse struct {
	ProvisioningUri string `json:"provisioning_uri"`
}

type AuthMFAVerifyRequest struct {
	Otp string `json:"otp"`
}

type AuthMePermissionsResponse struct {
	Identity struct {
		Id          string `json:"id"`
		IsAnonymous bool   `json:"is_anonymous"`
		Role        string `json:"role"`
	} `json:"identity"`
	Permissions []string `json:"permissions"`
}

type AuthMeResponse struct {
	// DisplayName Editable profile field (may be empty)
	DisplayName *string `json:"display_name,omitempty"`
	Email       string  `json:"email"`

	// FullName Editable profile field (may be empty)
	FullName *string            `json:"full_name,omitempty"`
	Id       openapi_types.UUID `json:"id"`

	// JobTitle Editable profile field (may be empty)
	JobTitle *string `json:"job_title,omitempty"`

	// Phone Editable profile field (may be empty)
	Phone *string `json:"phone,omitempty"`
	Role  string  `json:"role"`

	// Timezone IANA timezone
	Timezone *string `json:"timezone,omitempty"`
	Username string  `json:"username"`
}

type AuthMeUpdateRequest struct {
	DisplayName *string `json:"display_name,omitempty"`

	// Email Sign-in identity; must be unique among active users
	Email    *string `json:"email,omitempty"`
	FullName *string `json:"full_name,omitempty"`
	JobTitle *string `json:"job_title,omitempty"`
	Phone    *string `json:"phone,omitempty"`
	Timezone *string `json:"timezone,omitempty"`
}

type AuthPasswordChangeRequest struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

type AuthPolicy struct {
	// RequireMfa When true, every user must have MFA enrolled (soft-enforced at login).
	RequireMfa bool `json:"require_mfa"`

	// SessionAbsoluteTimeoutSeconds Absolute lifetime cap regardless of activity, in seconds.
	SessionAbsoluteTimeoutSeconds int `json:"session_absolute_timeout_seconds"`

	// SessionIdleTimeoutSeconds Inactivity window. A session expires this many seconds after its last use.
	SessionIdleTimeoutSeconds int                 `json:"session_idle_timeout_seconds"`
	UpdatedAt                 time.Time           `json:"updated_at"`
	UpdatedBy                 *openapi_types.UUID `json:"updated_by,omitempty"`
}

type AuthPolicyUpdateRequest struct {
	RequireMfa                    bool `json:"require_mfa"`
	SessionAbsoluteTimeoutSeconds int  `json:"session_absolute_timeout_seconds"`
	SessionIdleTimeoutSeconds     int  `json:"session_idle_timeout_seconds"`
}

type AuthRefreshRequest struct {
	RefreshToken string `json:"refresh_token"`
}

type BadRequest = ErrorEnvelope

type CapabilitiesResponse struct {
	Capabilities []Capability               `json:"capabilities"`
	Status       CapabilitiesResponseStatus `json:"status"`
	Tier         CapabilitiesResponseTier   `json:"tier"`
}

type CapabilitiesResponseStatus string

type CapabilitiesResponseTier string

type Capability struct {
	// Available Whether THIS deployment may use it now
	Available   bool   `json:"available"`
	Description string `json:"description"`

	// Id Registry id, e.g. remediation_execution
	Id   string         `json:"id"`
	Tier CapabilityTier `json:"tier"`
}

type CapabilityTier string

type CategoryEntry struct {
	Description string `json:"description"`
	Id          string `json:"id"`
}

type CategoryFreshness map[string]FreshnessEntry

type ChiServerOptions struct {
	BaseURL          string
	BaseRouter       chi.Router
	Middlewares      []MiddlewareFunc
	ErrorHandlerFunc func(w http.ResponseWriter, r *http.Request, err error)
}

type ComplianceConfig struct {
	// DefaultFramework Framework family id
	DefaultFramework string `json:"default_framework"`

	// EnabledFrameworks Allowlist of framework family ids offered as lenses. Empty (or omitted) means every family found in the corpus is available.
	EnabledFrameworks *[]string `json:"enabled_frameworks,omitempty"`
}

type ComplianceFramework struct {
	// Id Family id (e.g. "stig")
	Id string `json:"id"`

	// Keys Concrete corpus keys in this family (e.g. stig_rhel9, stig_rhel10)
	Keys []string `json:"keys"`

	// Label Display label (e.g. "STIG")
	Label string `json:"label"`
}

type ComplianceFrameworksResponse struct {
	Frameworks []ComplianceFramework `json:"frameworks"`
}

type ConnectivityBreakdown struct {
	// Critical unreachable + consecutive_failures<3
	Critical int64 `json:"critical"`

	// Degraded reachable + consecutive_failures>=1
	Degraded int64 `json:"degraded"`

	// Down consecutive_failures>=3
	Down int64 `json:"down"`

	// NeverProbed no host_liveness row exists
	NeverProbed int64 `json:"never_probed"`

	// Online reachable + consecutive_failures=0
	Online int64 `json:"online"`
}

type ConnectivityCheckResult struct {
	// ErrorType tcp_timeout, connection_refused, banner_mismatch, or tcp_error; null on success
	ErrorType *string `json:"error_type,omitempty"`

	// NewReachabilityStatus Post-hysteresis status (same value the periodic loop would write)
	NewReachabilityStatus ConnectivityCheckResultNewReachabilityStatus `json:"new_reachability_status"`
	ProbedAt              time.Time                                    `json:"probed_at"`
	Reachable             bool                                         `json:"reachable"`

	// ResponseTimeMs 0 on failure
	ResponseTimeMs int `json:"response_time_ms"`
}

type ConnectivityCheckResultNewReachabilityStatus string

type ConnectivityConfig struct {
	// CriticalSec Probe interval for unreachable hosts below the threshold (60..86400). Default 120 (2m)
	CriticalSec int `json:"critical_sec"`

	// DegradedSec Probe interval for reachable hosts with consecutive_failures>=1 (60..86400). Default 300 (5m)
	DegradedSec int `json:"degraded_sec"`

	// DownSec Probe interval for hosts at or above the threshold (60..86400). Default 1800 (30m)
	DownSec int `json:"down_sec"`

	// MaintenanceGlobal When true, probe loop ticks but probes no hosts
	MaintenanceGlobal bool `json:"maintenance_global"`

	// MaintenanceSec Persisted band interval for hosts in maintenance (60..86400). Default 3600 (60m). Not yet auto-applied; tracked for the per-host maintenance slice
	MaintenanceSec int `json:"maintenance_sec"`

	// OnlineSec Probe interval for reachable hosts with consecutive_failures=0 (60..86400). Default 900 (15m)
	OnlineSec int `json:"online_sec"`

	// RateLimit Max concurrent SSH connections during fleet sweeps (1..200)
	RateLimit int `json:"rate_limit"`

	// TimeoutSec Per-probe TCP-banner timeout in seconds (1..30)
	TimeoutSec int `json:"timeout_sec"`

	// UnreachableThreshold Consecutive failures before reachable→unreachable (1..10)
	UnreachableThreshold int `json:"unreachable_threshold"`
}

type ConnectivityConfigResponse struct {
	Config   ConnectivityConfig `json:"config"`
	Defaults ConnectivityConfig `json:"defaults"`
}

type ConnectivityStatus struct {
	// LastProbeAt Most recent probe-start time; null until the first tick
	LastProbeAt *time.Time `json:"last_probe_at,omitempty"`

	// MaintenanceActive Mirrors connectivity_config.maintenance_global
	MaintenanceActive    bool  `json:"maintenance_active"`
	ProbeCount           int64 `json:"probe_count"`
	ProbeFailureCount    int64 `json:"probe_failure_count"`
	ProbeSuccessCount    int64 `json:"probe_success_count"`
	StateTransitionCount int64 `json:"state_transition_count"`
}

type CreateReportScheduleJSONRequestBody = CreateReportScheduleRequest

type CreateReportScheduleRequest struct {
	// ChannelId An email notification channel.
	ChannelId openapi_types.UUID `json:"channel_id"`

	// DayOfMonth Required for monthly.
	DayOfMonth *int                                 `json:"day_of_month,omitempty"`
	Framework  *string                              `json:"framework,omitempty"`
	Frequency  CreateReportScheduleRequestFrequency `json:"frequency"`
	GroupId    *openapi_types.UUID                  `json:"group_id,omitempty"`

	// Hour Defaults to 6.
	Hour       *int                            `json:"hour,omitempty"`
	Kind       CreateReportScheduleRequestKind `json:"kind"`
	Name       string                          `json:"name"`
	PeriodDays *int                            `json:"period_days,omitempty"`

	// Weekday Required for weekly.
	Weekday *int `json:"weekday,omitempty"`
}

type CreateReportScheduleRequestFrequency string

type CreateReportScheduleRequestKind string

type CredentialCloneRequest struct {
	// IsDefault Mark this clone as the system default (only valid when scope=system)
	IsDefault *bool `json:"is_default,omitempty"`

	// Name Defaults to '<source name> (clone)' when omitted
	Name  *string                     `json:"name,omitempty"`
	Scope CredentialCloneRequestScope `json:"scope"`

	// ScopeId Required when scope=host
	ScopeId *openapi_types.UUID `json:"scope_id,omitempty"`
}

type CredentialCloneRequestScope string

type CredentialCreateRequest struct {
	AuthMethod           CredentialCreateRequestAuthMethod `json:"auth_method"`
	Description          *string                           `json:"description,omitempty"`
	IsDefault            *bool                             `json:"is_default,omitempty"`
	Name                 string                            `json:"name"`
	Password             *string                           `json:"password,omitempty"`
	PrivateKey           *string                           `json:"private_key,omitempty"`
	PrivateKeyPassphrase *string                           `json:"private_key_passphrase,omitempty"`
	Scope                CredentialCreateRequestScope      `json:"scope"`

	// ScopeId Required when scope=host (the host id); must be absent when scope=system.
	ScopeId  *openapi_types.UUID `json:"scope_id,omitempty"`
	Username string              `json:"username"`
}

type CredentialCreateRequestAuthMethod string

type CredentialCreateRequestScope string

type CredentialListResponse struct {
	Credentials []CredentialResponse `json:"credentials"`
}

type CredentialResponse struct {
	AuthMethod        CredentialResponseAuthMethod `json:"auth_method"`
	CreatedAt         *time.Time                   `json:"created_at,omitempty"`
	CreatedBy         *openapi_types.UUID          `json:"created_by,omitempty"`
	Description       *string                      `json:"description,omitempty"`
	Id                openapi_types.UUID           `json:"id"`
	IsActive          bool                         `json:"is_active"`
	IsDefault         bool                         `json:"is_default"`
	Name              string                       `json:"name"`
	Scope             CredentialResponseScope      `json:"scope"`
	ScopeId           *openapi_types.UUID          `json:"scope_id,omitempty"`
	SshKeyBits        *int                         `json:"ssh_key_bits,omitempty"`
	SshKeyComment     *string                      `json:"ssh_key_comment,omitempty"`
	SshKeyFingerprint *string                      `json:"ssh_key_fingerprint,omitempty"`
	SshKeyType        *string                      `json:"ssh_key_type,omitempty"`
	UpdatedAt         *time.Time                   `json:"updated_at,omitempty"`
	Username          string                       `json:"username"`
}

type CredentialResponseAuthMethod string

type CredentialResponseScope string

type CredentialUpdateRequest struct {
	AuthMethod  *CredentialUpdateRequestAuthMethod `json:"auth_method,omitempty"`
	Description *string                            `json:"description,omitempty"`

	// IsDefault Setting true on a system credential atomically demotes the previous system default
	IsDefault *bool   `json:"is_default,omitempty"`
	Name      *string `json:"name,omitempty"`

	// Password Re-encrypts and replaces the stored password when non-empty; omit to keep the current secret
	Password *string `json:"password,omitempty"`

	// PrivateKey Re-encrypts and replaces the stored key when non-empty; omit to keep the current secret
	PrivateKey *string `json:"private_key,omitempty"`

	// PrivateKeyPassphrase Re-encrypts and replaces the stored passphrase when non-empty; omit to keep the current secret
	PrivateKeyPassphrase *string `json:"private_key_passphrase,omitempty"`
	Username             *string `json:"username,omitempty"`
}

type CredentialUpdateRequestAuthMethod string

type CustomRoleCreateRequest struct {
	Description string   `json:"description"`
	Id          string   `json:"id"`
	Permissions []string `json:"permissions"`
}

type CustomRoleResponse struct {
	Description string   `json:"description"`
	Id          string   `json:"id"`
	IsBuiltIn   bool     `json:"is_built_in"`
	Permissions []string `json:"permissions"`
}

type DiscoveryConfig struct {
	// DetectOnFirstContact When true, POST /api/v1/hosts auto-enqueues a host.discovery job for the new host before returning 201. When false, new hosts stay at hosts.os_discovered_at NULL until the scheduler picks them up or an operator clicks Re-run discovery
	DetectOnFirstContact bool `json:"detect_on_first_contact"`

	// IntervalSec Per-host cadence — a host's discovery becomes due once now() - hosts.os_discovered_at exceeds this many seconds. 3600..604800. Default 86400 (24h)
	IntervalSec int `json:"interval_sec"`

	// MaintenanceGlobal When true, the scheduler loop ticks but enqueues no jobs and the host-create gate behaves as if detect_on_first_contact is false
	MaintenanceGlobal bool `json:"maintenance_global"`

	// RateLimit Max host.discovery jobs enqueued per scheduler tick (1..500). Default 25. Bounds thundering-herd on a fleet that hits NULL os_discovered_at simultaneously
	RateLimit int `json:"rate_limit"`
}

type DiscoveryConfigResponse struct {
	Config   DiscoveryConfig `json:"config"`
	Defaults DiscoveryConfig `json:"defaults"`
}

type DiscoverySweepResponse struct {
	// Enqueued Count of host.discovery jobs persisted by this sweep. Zero is a valid steady state (every host already discovered, or fleet empty)
	Enqueued int `json:"enqueued"`
}

type EchoRequest struct {
	Message string `json:"message"`
}

type EchoResponse struct {
	AuditEventId  *openapi_types.UUID `json:"audit_event_id,omitempty"`
	CorrelationId string              `json:"correlation_id"`
	Echoed        string              `json:"echoed"`
}

type EnqueueTestJobResponse struct {
	CorrelationId string             `json:"correlation_id"`
	JobId         openapi_types.UUID `json:"job_id"`
}

type ErrorEnvelope struct {
	Error struct {
		Code          string                  `json:"code"`
		CorrelationId *string                 `json:"correlation_id,omitempty"`
		Detail        *map[string]interface{} `json:"detail,omitempty"`
		Fault         ErrorEnvelopeErrorFault `json:"fault"`
		HumanMessage  string                  `json:"human_message"`
		Retryable     bool                    `json:"retryable"`
	} `json:"error"`
}

type ErrorEnvelopeErrorFault string

type EvaluateAlertRequest struct {
	Score int `json:"score"`
}

type Exception struct {
	ExpiresAt *time.Time         `json:"expires_at,omitempty"`
	HostId    openapi_types.UUID `json:"host_id"`

	// HostName Hostname, populated on list responses (empty on single-row lifecycle results)
	HostName    *string             `json:"host_name,omitempty"`
	Id          openapi_types.UUID  `json:"id"`
	Reason      string              `json:"reason"`
	RequestedAt time.Time           `json:"requested_at"`
	RequestedBy openapi_types.UUID  `json:"requested_by"`
	ReviewNote  *string             `json:"review_note,omitempty"`
	ReviewedAt  *time.Time          `json:"reviewed_at,omitempty"`
	ReviewedBy  *openapi_types.UUID `json:"reviewed_by,omitempty"`
	RuleId      string              `json:"rule_id"`
	Status      ExceptionStatus     `json:"status"`
}

type ExceptionList struct {
	Exceptions []Exception `json:"exceptions"`
}

type ExceptionRequest struct {
	// ExpiresAt Optional expiry; null means active until revoked
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Reason    string     `json:"reason"`
	RuleId    string     `json:"rule_id"`
}

type ExceptionReview struct {
	// Note Optional reviewer note
	Note *string `json:"note,omitempty"`
}

type ExceptionStatus string

type FleetComplianceStates struct {
	// States One entry per ComplianceState in ladder order; zero-count states included
	States []struct {
		HostCount int                              `json:"host_count"`
		State     FleetComplianceStatesStatesState `json:"state"`
	} `json:"states"`
}

type FleetComplianceStatesStatesState string

type FleetComplianceTrend struct {
	// Days One entry per day with snapshots, oldest first
	Days []struct {
		CriticalHosts int                `json:"critical_hosts"`
		Date          openapi_types.Date `json:"date"`
		Envelope      ScoreEnvelope      `json:"envelope"`
		Failing       int                `json:"failing"`

		// FormulaStatus mixed means the day's snapshots were produced by MORE THAN ONE formula. Those measure different things, so the day reports no score rather than their average. legacy_unknown means every snapshot predates the current formula; its score is preserved and is not comparable with an identified one.
		FormulaStatus FleetComplianceTrendDaysFormulaStatus `json:"formula_status"`

		// FormulaVersion 2 when formula_status is identified, otherwise null.
		FormulaVersion *int `json:"formula_version"`

		// Hosts Every host with a snapshot that day, including hosts that produced no score and are therefore not in score_pct.
		Hosts int `json:"hosts"`

		// HostsScored Hosts that produced a score that day.
		HostsScored int `json:"hosts_scored"`

		// HostsWithoutScore Hosts with a snapshot that day but no score.
		HostsWithoutScore int `json:"hosts_without_score"`

		// ScorePct Equal-host mean over the hosts that produced a score that day, to one decimal. Not a pooled ratio, so a host with many rules does not outweigh one with few. NULL when no host produced a score, and NULL when formula_status is mixed.
		ScorePct *float32 `json:"score_pct"`
	} `json:"days"`
}

type FleetComplianceTrendDaysFormulaStatus string

type FleetHostFailure struct {
	FailingRuleCount int64              `json:"failing_rule_count"`
	HostId           openapi_types.UUID `json:"host_id"`
}

type FleetLiveness struct {
	NeverProbed int64 `json:"never_probed"`
	Reachable   int64 `json:"reachable"`
	Unknown     int64 `json:"unknown"`
	Unreachable int64 `json:"unreachable"`
}

type FleetRecentChanges struct {
	Items []FleetTransaction `json:"items"`
}

type FleetRuleFailure struct {
	FailingHostCount int64  `json:"failing_host_count"`
	RuleId           string `json:"rule_id"`
}

type FleetScanQueue struct {
	Queued  int64 `json:"queued"`
	Running int64 `json:"running"`
}

type FleetTopFailingHosts struct {
	Items []FleetHostFailure `json:"items"`
}

type FleetTopFailingRules struct {
	Items []FleetRuleFailure `json:"items"`
}

type FleetTransaction struct {
	ChangeKind FleetTransactionChangeKind `json:"change_kind"`
	HostId     openapi_types.UUID         `json:"host_id"`
	Id         openapi_types.UUID         `json:"id"`
	OccurredAt time.Time                  `json:"occurred_at"`
	RuleId     string                     `json:"rule_id"`
	Severity   *string                    `json:"severity,omitempty"`
	Status     FleetTransactionStatus     `json:"status"`
}

type FleetTransactionChangeKind string

type FleetTransactionStatus string

type Forbidden = ErrorEnvelope

type FreshnessEntry struct {
	AttemptAt  time.Time `json:"attempt_at"`
	ObservedAt time.Time `json:"observed_at"`

	// Reason Present only on stale entries: why the category was not re-observed this run
	Reason *FreshnessEntryReason `json:"reason,omitempty"`
	Status FreshnessEntryStatus  `json:"status"`
}

type FreshnessEntryReason string

type FreshnessEntryStatus string

type GenerateReportRequest struct {
	// Framework Scope the report to this framework lens (framework_refs key).
	Framework *string `json:"framework,omitempty"`

	// GroupId Scope the report to this group's member hosts.
	GroupId *openapi_types.UUID `json:"group_id,omitempty"`

	// Kind The report kind; defaults to executive. attestation produces
	// the Framework Attestation (CSV/OSCAL bulk faces over the latest
	// completed scan per in-scope host); exception produces the
	// Exception Register; remediation produces the Remediation
	// Activity log over a look-back period.
	Kind *GenerateReportRequestKind `json:"kind,omitempty"`

	// PeriodDays Look-back window in days for time-windowed kinds (remediation):
	// the report covers requests filed in the last period_days.
	// Defaults to 30; ignored by point-in-time kinds.
	PeriodDays *int `json:"period_days,omitempty"`
}

type GenerateReportRequestKind string

type GetActivityParams struct {
	Source   *GetActivityParamsSource   `form:"source,omitempty" json:"source,omitempty"`
	Severity *GetActivityParamsSeverity `form:"severity,omitempty" json:"severity,omitempty"`
	HostId   *openapi_types.UUID        `form:"host_id,omitempty" json:"host_id,omitempty"`
	Since    *time.Time                 `form:"since,omitempty" json:"since,omitempty"`
	Until    *time.Time                 `form:"until,omitempty" json:"until,omitempty"`
	Cursor   *string                    `form:"cursor,omitempty" json:"cursor,omitempty"`
	Limit    *int                       `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetActivityParamsSeverity string

type GetActivityParamsSource string

type GetAlertsParams struct {
	State    *GetAlertsParamsState    `form:"state,omitempty" json:"state,omitempty"`
	HostId   *openapi_types.UUID      `form:"host_id,omitempty" json:"host_id,omitempty"`
	Severity *GetAlertsParamsSeverity `form:"severity,omitempty" json:"severity,omitempty"`
	Since    *time.Time               `form:"since,omitempty" json:"since,omitempty"`
	Until    *time.Time               `form:"until,omitempty" json:"until,omitempty"`
	Cursor   *string                  `form:"cursor,omitempty" json:"cursor,omitempty"`
	Limit    *int                     `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetAlertsParamsSeverity string

type GetAlertsParamsState string

type GetAuditEventsExportParams struct {
	// Format Output format. Defaults to csv.
	Format        *GetAuditEventsExportParamsFormat `form:"format,omitempty" json:"format,omitempty"`
	Action        *string                           `form:"action,omitempty" json:"action,omitempty"`
	CorrelationId *string                           `form:"correlation_id,omitempty" json:"correlation_id,omitempty"`
	ActorType     *string                           `form:"actor_type,omitempty" json:"actor_type,omitempty"`
	ResourceType  *string                           `form:"resource_type,omitempty" json:"resource_type,omitempty"`
	ResourceId    *string                           `form:"resource_id,omitempty" json:"resource_id,omitempty"`
	Since         *time.Time                        `form:"since,omitempty" json:"since,omitempty"`
	Until         *time.Time                        `form:"until,omitempty" json:"until,omitempty"`
}

type GetAuditEventsExportParamsFormat string

type GetAuditEventsParams struct {
	Action        *string `form:"action,omitempty" json:"action,omitempty"`
	CorrelationId *string `form:"correlation_id,omitempty" json:"correlation_id,omitempty"`
	ActorType     *string `form:"actor_type,omitempty" json:"actor_type,omitempty"`

	// ResourceType Filter to events whose resource_type matches (e.g. "host"). Pair with resource_id for a single resource's audit trail.
	ResourceType *string `form:"resource_type,omitempty" json:"resource_type,omitempty"`

	// ResourceId Filter to events whose resource_id matches (e.g. a host UUID). Typically paired with resource_type.
	ResourceId *string    `form:"resource_id,omitempty" json:"resource_id,omitempty"`
	Since      *time.Time `form:"since,omitempty" json:"since,omitempty"`
	Until      *time.Time `form:"until,omitempty" json:"until,omitempty"`
	Cursor     *string    `form:"cursor,omitempty" json:"cursor,omitempty"`
	Limit      *int       `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetAuthSSOCallbackParams struct {
	Code  *string `form:"code,omitempty" json:"code,omitempty"`
	State *string `form:"state,omitempty" json:"state,omitempty"`
	Error *string `form:"error,omitempty" json:"error,omitempty"`
}

type GetAuthSSOLoginParams struct {
	ReturnTo *string `form:"return_to,omitempty" json:"return_to,omitempty"`
}

type GetComplianceExceptionsParams struct {
	Status *GetComplianceExceptionsParamsStatus `form:"status,omitempty" json:"status,omitempty"`
	Limit  *int                                 `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetComplianceExceptionsParamsStatus string

type GetComplianceFrameworksParams struct {
	// All When true, return every corpus family, ignoring the enabled-frameworks allowlist.
	All *bool `form:"all,omitempty" json:"all,omitempty"`
}

type GetFleetComplianceTrendParams struct {
	// Days Trailing window in days; clamped into [1, 90]
	Days *int `form:"days,omitempty" json:"days,omitempty"`
}

type GetFleetRecentChangesParams struct {
	// Framework Filter to transactions whose framework_refs contains this key (v1.1.0).
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`

	// Since Filter to transactions strictly newer than this RFC3339 timestamp
	Since *time.Time `form:"since,omitempty" json:"since,omitempty"`
	Limit *int       `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetFleetScoreParams struct {
	// Framework Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0).
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
}

type GetFleetTopFailingHostsParams struct {
	// Framework Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0).
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
	Limit     *int    `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetFleetTopFailingRulesParams struct {
	// Framework Filter to host_rule_state rows whose framework_refs contains this key (v1.1.0).
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
	Limit     *int    `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetHostByIDParams struct {
	// Framework Filter compliance_summary to host_rule_state rows whose framework_refs contains this key (v1.2.0). Liveness is unaffected.
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
}

type GetHostComplianceParams struct {
	// Framework Filter to rows whose framework_refs contains this key and project its control ids; summary and categories are recomputed under the filter.
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
}

type GetHostComplianceTrendParams struct {
	// Days Trailing window in days; clamped into [1, 90]
	Days *int `form:"days,omitempty" json:"days,omitempty"`
}

type GetHostExceptionsParams struct {
	History *bool `form:"history,omitempty" json:"history,omitempty"`
}

type GetHostFailedRulesParams struct {
	// Limit Max rules returned. Clamped to [1, 100]; default 10.
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`

	// Framework Filter to rows whose framework_refs contains this key and project its control ids.
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
}

type GetHostMonitoringHistoryParams struct {
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetHostsParams struct {
	Environment *string `form:"environment,omitempty" json:"environment,omitempty"`
	Tag         *string `form:"tag,omitempty" json:"tag,omitempty"`

	// Framework Lens each host card's compliance_summary through a framework family (e.g. "stig") or a specific corpus key; omit for All rules.
	Framework *string `form:"framework,omitempty" json:"framework,omitempty"`
}

type GetIntelligenceEventsParams struct {
	HostId    *openapi_types.UUID                  `form:"host_id,omitempty" json:"host_id,omitempty"`
	EventCode *string                              `form:"event_code,omitempty" json:"event_code,omitempty"`
	Severity  *GetIntelligenceEventsParamsSeverity `form:"severity,omitempty" json:"severity,omitempty"`
	Since     *time.Time                           `form:"since,omitempty" json:"since,omitempty"`
	Until     *time.Time                           `form:"until,omitempty" json:"until,omitempty"`
	Cursor    *string                              `form:"cursor,omitempty" json:"cursor,omitempty"`
	Limit     *int                                 `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetIntelligenceEventsParamsSeverity string

type GetNotificationFeedParams struct {
	// Unread When true, return only unread notifications.
	Unread *bool `form:"unread,omitempty" json:"unread,omitempty"`

	// Limit Max items to return (default 50).
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetReportExportParams struct {
	// Format The face to render. Defaults to pdf.
	Format *GetReportExportParamsFormat `form:"format,omitempty" json:"format,omitempty"`
}

type GetReportExportParamsFormat string

type GetScansParams struct {
	HostId openapi_types.UUID `form:"host_id" json:"host_id"`
	Limit  *int               `form:"limit,omitempty" json:"limit,omitempty"`

	// Cursor queued_at of the last row already seen (RFC3339); omit to start at the newest
	Cursor *time.Time `form:"cursor,omitempty" json:"cursor,omitempty"`
}

type Group struct {
	// Color Design-token color key (e.g. info)
	Color       string             `json:"color"`
	CreatedAt   time.Time          `json:"created_at"`
	Id          openapi_types.UUID `json:"id"`
	Kind        GroupKind          `json:"kind"`
	Maintenance bool               `json:"maintenance"`

	// MatchFamily OS family an auto group matches on (empty for manual groups)
	MatchFamily *string         `json:"match_family,omitempty"`
	Membership  GroupMembership `json:"membership"`
	Name        string          `json:"name"`

	// Subtype Free-form sub-classifier (may be empty)
	Subtype string `json:"subtype"`

	// TargetFramework Compliance target framework family a member host is held to (empty for none). Only a site group may carry one.
	TargetFramework *string   `json:"target_framework,omitempty"`
	UpdatedAt       time.Time `json:"updated_at"`
}

type GroupCreate struct {
	Color *string         `json:"color,omitempty"`
	Kind  GroupCreateKind `json:"kind"`

	// MatchFamily Required for auto membership; must be empty for manual
	MatchFamily *string               `json:"match_family,omitempty"`
	Membership  GroupCreateMembership `json:"membership"`
	Name        string                `json:"name"`
	Subtype     *string               `json:"subtype,omitempty"`
}

type GroupCreateKind string

type GroupCreateMembership string

type GroupKind string

type GroupListResponse struct {
	Groups  []GroupWithRollup `json:"groups"`
	Summary GroupSummary      `json:"summary"`
}

type GroupMaintenanceRequest struct {
	On bool `json:"on"`
}

type GroupMember struct {
	HostId   openapi_types.UUID `json:"host_id"`
	Hostname string             `json:"hostname"`

	// Status Host monitoring band (online, down, unknown, ...)
	Status string `json:"status"`
}

type GroupMemberRequest struct {
	HostId openapi_types.UUID `json:"host_id"`
}

type GroupMembership string

type GroupRollup struct {
	CriticalHosts int            `json:"critical_hosts"`
	Down          int            `json:"down"`
	Hosts         int            `json:"hosts"`
	Members       []GroupMember  `json:"members"`
	Online        int            `json:"online"`
	Score         AggregateScore `json:"score"`
}

type GroupSummary struct {
	Groups           int            `json:"groups"`
	HostsMaintenance int            `json:"hosts_maintenance"`
	OsCategories     int            `json:"os_categories"`
	Score            AggregateScore `json:"score"`
	Sites            int            `json:"sites"`
	Ungrouped        int            `json:"ungrouped"`
}

type GroupTargetRequest struct {
	// TargetFramework Compliance target family id, or empty to clear the target.
	TargetFramework string `json:"target_framework"`
}

type GroupUpdate struct {
	Color   *string `json:"color,omitempty"`
	Name    string  `json:"name"`
	Subtype *string `json:"subtype,omitempty"`
}

type GroupWithRollup struct {
	// Color Design-token color key (e.g. info)
	Color       string              `json:"color"`
	CreatedAt   time.Time           `json:"created_at"`
	Id          openapi_types.UUID  `json:"id"`
	Kind        GroupWithRollupKind `json:"kind"`
	Maintenance bool                `json:"maintenance"`

	// MatchFamily OS family an auto group matches on (empty for manual groups)
	MatchFamily *string                   `json:"match_family,omitempty"`
	Membership  GroupWithRollupMembership `json:"membership"`
	Name        string                    `json:"name"`
	Rollup      GroupRollup               `json:"rollup"`

	// Subtype Free-form sub-classifier (may be empty)
	Subtype string `json:"subtype"`

	// TargetFramework Compliance target framework family a member host is held to (empty for none). Only a site group may carry one.
	TargetFramework *string   `json:"target_framework,omitempty"`
	UpdatedAt       time.Time `json:"updated_at"`
}

type GroupWithRollupKind string

type GroupWithRollupMembership string

type HealthResponse struct {
	DbConnected bool                 `json:"db_connected"`
	Status      HealthResponseStatus `json:"status"`
	Version     string               `json:"version"`
}

type HealthResponseStatus string

type HostComplianceCategory struct {
	// Category Kensa catalog category; uncategorized when the catalog lacks the rule.
	Category string `json:"category"`
	Failing  int64  `json:"failing"`
	Passing  int64  `json:"passing"`

	// ScorePct Passing over passing plus failing within this category, to one decimal, computed server side. NULL when the category produced no verdict. Sent rather than derived so the browser holds no compliance arithmetic (system-compliance-scoring C-14).
	ScorePct *float64 `json:"score_pct"`
	Total    int64    `json:"total"`
}

type HostComplianceFramework struct {
	Envelope ScoreEnvelope `json:"envelope"`

	// Failing Rows mapped to this framework with current_status fail.
	Failing     int    `json:"failing"`
	FrameworkId string `json:"framework_id"`

	// Label Display label for framework_id, taken from Kensa's framework vocabulary ("NIST SP 800-171 Rev 2", "CIS (RHEL 9)"). An id Kensa does not know is returned as it is. "All rules" on the overall entry, whose framework_id is "all".
	Label string `json:"label"`

	// Passing Rows mapped to this framework with current_status pass.
	Passing int `json:"passing"`

	// RuleCount Number of host_rule_state rows mapped to this framework.
	RuleCount int64 `json:"rule_count"`

	// ScorePct Passing over passing plus failing, to one decimal. NULL when this framework's rules produced no verdict. Not over rule_count, which counts rules that were skipped or errored. Powers the per-lens score on the View-as chips.
	ScorePct *float32 `json:"score_pct"`
}

type HostComplianceFrameworksResponse struct {
	Frameworks []HostComplianceFramework `json:"frameworks"`
	Overall    HostComplianceFramework   `json:"overall"`
}

type HostComplianceLensResponse struct {
	Categories  []HostComplianceCategory  `json:"categories"`
	Rules       []HostComplianceRule      `json:"rules"`
	ScanContext HostScanContext           `json:"scan_context"`
	Summary     HostComplianceLensSummary `json:"summary"`
}

type HostComplianceLensSummary struct {
	// CoveragePct Non-null if and only if coverage_status is available.
	CoveragePct *float64 `json:"coverage_pct"`

	// CoverageStatus Whether the share of in-scope rules that produced a verdict can be stated, and when it cannot, why.
	CoverageStatus HostComplianceLensSummaryCoverageStatus `json:"coverage_status"`
	Envelope       ScoreEnvelope                           `json:"envelope"`
	Error          int64                                   `json:"error"`
	Failing        int64                                   `json:"failing"`
	Passing        int64                                   `json:"passing"`

	// ScorePct Passing over passing plus failing, to one decimal. NULL when no rule produced a verdict, which is a different fact from every evaluated rule failing (that is 0).
	ScorePct *float64 `json:"score_pct"`
	Skipped  int64    `json:"skipped"`
	Total    int64    `json:"total"`
}

type HostComplianceLensSummaryCoverageStatus string

type HostComplianceRule struct {
	// Category Catalog category; uncategorized when unknown.
	Category string `json:"category"`

	// ControlIds Control ids for the requested framework; empty unless ?framework= is given.
	ControlIds []string `json:"control_ids"`

	// Description First sentence of the catalog description; empty when the catalog lacks the rule. Catalog text only, never stored check output.
	Description   string    `json:"description"`
	LastCheckedAt time.Time `json:"last_checked_at"`
	RuleId        string    `json:"rule_id"`

	// Severity Stored severity; empty when the scan recorded none.
	Severity string `json:"severity"`

	// Status current_status of the rule on this host (pass, fail, skipped, error).
	Status string `json:"status"`

	// Title Catalog title; falls back to rule_id when the catalog lacks the rule.
	Title string `json:"title"`
}

type HostComplianceSchedule struct {
	ComplianceState HostComplianceScheduleComplianceState `json:"compliance_state"`

	// HostMaintenance Per-host maintenance flag on the schedule row
	HostMaintenance bool `json:"host_maintenance"`

	// IntervalMinutes Current per-state interval; 0 when unseeded
	IntervalMinutes int `json:"interval_minutes"`

	// NextScanAt Null when the host has no schedule row yet
	NextScanAt *time.Time `json:"next_scan_at,omitempty"`

	// SchedulerEnabled The scan config enabled flag
	SchedulerEnabled bool `json:"scheduler_enabled"`

	// SchedulerPaused True when the scheduler dispatches nothing fleet-wide (disabled or global maintenance)
	SchedulerPaused bool `json:"scheduler_paused"`
}

type HostComplianceScheduleComplianceState string

type HostComplianceSummary struct {
	// CoveragePct Non-null if and only if coverage_status is available.
	CoveragePct *float64 `json:"coverage_pct"`

	// CoverageStatus Whether coverage can be stated for this host, and if not, why.
	CoverageStatus HostComplianceSummaryCoverageStatus `json:"coverage_status"`
	Envelope       ScoreEnvelope                       `json:"envelope"`
	Error          int64                               `json:"error"`
	Failing        int64                               `json:"failing"`
	Passing        int64                               `json:"passing"`

	// ScorePct Passing over passing plus failing, to one decimal. NULL when no rule produced a verdict. This is the PRIMARY single-host score, and it is computed server side: the host detail page used to derive passing/total in the browser, so a host whose rules all skipped displayed 0% instead of no score.
	ScorePct *float64 `json:"score_pct"`
	Skipped  int64    `json:"skipped"`
	Total    int64    `json:"total"`
}

type HostComplianceSummaryCoverageStatus string

type HostComplianceTrend struct {
	// Days One entry per day with a snapshot, oldest first
	Days []struct {
		Date     openapi_types.Date `json:"date"`
		Envelope ScoreEnvelope      `json:"envelope"`
		Failing  int                `json:"failing"`

		// FormulaStatus identified when the day's snapshot used the current formula; legacy_unknown when it predates it, in which case the score is preserved as stored and is NOT comparable with an identified one. mixed cannot occur on a host point: a snapshot is one host on one date under one lens and holds a single formula.
		FormulaStatus HostComplianceTrendDaysFormulaStatus `json:"formula_status"`

		// FormulaVersion 2 when formula_status is identified, otherwise null.
		FormulaVersion *int `json:"formula_version"`
		Passing        int  `json:"passing"`

		// ScorePct Passing over passing plus failing, to one decimal. NULL when that day's rules produced no verdict. The day still appears, with its counts, so the absence is explained rather than shown as a gap.
		ScorePct *float32 `json:"score_pct"`
		Total    int      `json:"total"`
	} `json:"days"`
}

type HostComplianceTrendDaysFormulaStatus string

type HostCreateRequest struct {
	Description *string             `json:"description,omitempty"`
	DisplayName *string             `json:"display_name,omitempty"`
	Environment *string             `json:"environment,omitempty"`
	GroupId     *openapi_types.UUID `json:"group_id,omitempty"`
	Hostname    string              `json:"hostname"`
	IpAddress   string              `json:"ip_address"`
	Port        *int                `json:"port,omitempty"`
	Tags        *[]string           `json:"tags,omitempty"`
	Username    *string             `json:"username,omitempty"`
}

type HostDetailResponse struct {
	ComplianceSummary HostComplianceSummary `json:"compliance_summary"`
	Host              HostResponse          `json:"host"`
	LastScanAt        *time.Time            `json:"last_scan_at,omitempty"`

	// Liveness Null when no liveness probe has ever run against this host.
	Liveness  *HostLiveness                `json:"liveness,omitempty"`
	ScanState *HostDetailResponseScanState `json:"scan_state,omitempty"`
}

type HostDetailResponseScanState string

type HostFailedRule struct {
	// Category Catalog category; empty when unknown.
	Category   string `json:"category"`
	CheckCount int    `json:"check_count"`

	// ControlIds Control ids for the requested framework; empty unless ?framework= is given.
	ControlIds    []string  `json:"control_ids"`
	LastCheckedAt time.Time `json:"last_checked_at"`
	RuleId        string    `json:"rule_id"`

	// Severity Stored severity; empty when the scan recorded none.
	Severity string `json:"severity"`

	// Title Catalog title; falls back to rule_id when the catalog lacks the rule.
	Title string `json:"title"`
}

type HostFailedRulesResponse struct {
	Rules []HostFailedRule `json:"rules"`

	// TotalFailing Count of ALL failing rows for the host (post-framework-filter, pre-limit).
	TotalFailing int64 `json:"total_failing"`
}

type HostListComplianceSummary struct {
	// CoveragePct Non-null if and only if coverage_status is available.
	CoveragePct *float64 `json:"coverage_pct"`

	// CoverageStatus Whether coverage can be stated for this host, and if not, why.
	CoverageStatus HostListComplianceSummaryCoverageStatus `json:"coverage_status"`

	// CriticalFailing Rows with current_status=fail and critical severity (case-insensitive).
	CriticalFailing int64         `json:"critical_failing"`
	Envelope        ScoreEnvelope `json:"envelope"`
	Error           int64         `json:"error"`
	Failing         int64         `json:"failing"`
	Passing         int64         `json:"passing"`

	// ScorePct Passing over passing plus failing, to one decimal, computed server side. NULL when the host produced no verdict. Added so the hosts list stops deriving a compliance percentage in the browser, which produced a second formula the rest of the product could not agree with (system-compliance-scoring C-14).
	ScorePct *float64 `json:"score_pct"`
	Skipped  int64    `json:"skipped"`
	Total    int64    `json:"total"`
}

type HostListComplianceSummaryCoverageStatus string

type HostListItem struct {
	Architecture  *string `json:"architecture,omitempty"`
	CheckPriority *int    `json:"check_priority,omitempty"`

	// ComplianceSummary Null when the host has no rows in its current corpus. That is not the same as never scanned: a completed scan that produced no outcome writes no rule state either, and the two are indistinguishable from this field alone.
	ComplianceSummary *HostListComplianceSummary `json:"compliance_summary,omitempty"`
	CreatedAt         *time.Time                 `json:"created_at,omitempty"`
	CreatedBy         *openapi_types.UUID        `json:"created_by,omitempty"`
	Description       *string                    `json:"description,omitempty"`
	DisplayName       *string                    `json:"display_name,omitempty"`
	Environment       string                     `json:"environment"`
	GroupId           *openapi_types.UUID        `json:"group_id,omitempty"`
	Hostname          string                     `json:"hostname"`
	Id                openapi_types.UUID         `json:"id"`
	IpAddress         string                     `json:"ip_address"`
	LastScanAt        *time.Time                 `json:"last_scan_at,omitempty"`
	LatestScanId      *openapi_types.UUID        `json:"latest_scan_id,omitempty"`

	// Liveness Null when no liveness probe has ever run against this host.
	Liveness           *HostLiveness          `json:"liveness,omitempty"`
	MaintenanceMode    *bool                  `json:"maintenance_mode,omitempty"`
	OsDiscoveredAt     *time.Time             `json:"os_discovered_at,omitempty"`
	OsFamily           *string                `json:"os_family,omitempty"`
	OsVersion          *string                `json:"os_version,omitempty"`
	PlatformIdentifier *string                `json:"platform_identifier,omitempty"`
	Port               int                    `json:"port"`
	ScanState          *HostListItemScanState `json:"scan_state,omitempty"`
	Tags               *[]string              `json:"tags,omitempty"`
	UpdatedAt          *time.Time             `json:"updated_at,omitempty"`
	Username           *string                `json:"username,omitempty"`
}

type HostListItemScanState string

type HostListResponse struct {
	Hosts []HostListItem `json:"hosts"`
}

type HostLiveness struct {
	ConsecutiveFailures           *int                           `json:"consecutive_failures,omitempty"`
	LastErrorType                 *string                        `json:"last_error_type,omitempty"`
	LastProbeAt                   *time.Time                     `json:"last_probe_at,omitempty"`
	LastResponseMs                *int                           `json:"last_response_ms,omitempty"`
	LastStateChangeAt             *time.Time                     `json:"last_state_change_at,omitempty"`
	MonitoringState               *HostLivenessMonitoringState   `json:"monitoring_state,omitempty"`
	PingConsecutiveFailures       *int                           `json:"ping_consecutive_failures,omitempty"`
	PingConsecutiveSuccesses      *int                           `json:"ping_consecutive_successes,omitempty"`
	PrivilegeConsecutiveFailures  *int                           `json:"privilege_consecutive_failures,omitempty"`
	PrivilegeConsecutiveSuccesses *int                           `json:"privilege_consecutive_successes,omitempty"`
	ReachabilityStatus            HostLivenessReachabilityStatus `json:"reachability_status"`
	SshConsecutiveFailures        *int                           `json:"ssh_consecutive_failures,omitempty"`
	SshConsecutiveSuccesses       *int                           `json:"ssh_consecutive_successes,omitempty"`
}

type HostLivenessMonitoringState string

type HostLivenessReachabilityStatus string

type HostMaintenanceRequest struct {
	// Enabled true = pause probes; false = resume
	Enabled bool `json:"enabled"`
}

type HostMonitoringHistoryEntry struct {
	CheckTime       time.Time                                 `json:"check_time"`
	ErrorMessage    *string                                   `json:"error_message,omitempty"`
	ErrorType       *string                                   `json:"error_type,omitempty"`
	FailedLayer     *HostMonitoringHistoryEntryFailedLayer    `json:"failed_layer,omitempty"`
	HostId          openapi_types.UUID                        `json:"host_id"`
	Id              int64                                     `json:"id"`
	MonitoringState HostMonitoringHistoryEntryMonitoringState `json:"monitoring_state"`
	PingOk          *bool                                     `json:"ping_ok,omitempty"`
	PreviousState   *HostMonitoringHistoryEntryPreviousState  `json:"previous_state,omitempty"`
	PrivilegeOk     *bool                                     `json:"privilege_ok,omitempty"`
	ResponseTimeMs  *int                                      `json:"response_time_ms,omitempty"`
	SshOk           *bool                                     `json:"ssh_ok,omitempty"`
}

type HostMonitoringHistoryEntryFailedLayer string

type HostMonitoringHistoryEntryMonitoringState string

type HostMonitoringHistoryEntryPreviousState string

type HostMonitoringHistoryResponse struct {
	Entries []HostMonitoringHistoryEntry `json:"entries"`
	HostId  openapi_types.UUID           `json:"host_id"`
}

type HostResponse struct {
	// Architecture e.g. x86_64, aarch64
	Architecture    *string             `json:"architecture,omitempty"`
	CheckPriority   *int                `json:"check_priority,omitempty"`
	CreatedAt       *time.Time          `json:"created_at,omitempty"`
	CreatedBy       *openapi_types.UUID `json:"created_by,omitempty"`
	Description     *string             `json:"description,omitempty"`
	DisplayName     *string             `json:"display_name,omitempty"`
	Environment     string              `json:"environment"`
	GroupId         *openapi_types.UUID `json:"group_id,omitempty"`
	Hostname        string              `json:"hostname"`
	Id              openapi_types.UUID  `json:"id"`
	IpAddress       string              `json:"ip_address"`
	MaintenanceMode *bool               `json:"maintenance_mode,omitempty"`
	OsDiscoveredAt  *time.Time          `json:"os_discovered_at,omitempty"`

	// OsFamily Distro ID from /etc/os-release (e.g. rhel, ubuntu, rocky, centos, almalinux, debian, opensuse-leap, sles); rollup family (rhel | debian | suse | alpine | arch | gentoo | other) ONLY when ID was empty; null pre-Discovery. Spec system-host-discovery v1.3.0 AC-22.
	OsFamily  *string `json:"os_family,omitempty"`
	OsVersion *string `json:"os_version,omitempty"`

	// PlatformIdentifier e.g. platform:el9
	PlatformIdentifier *string   `json:"platform_identifier,omitempty"`
	Port               int       `json:"port"`
	Tags               *[]string `json:"tags,omitempty"`

	// TargetFramework Host's own compliance target framework family (absent when unset/inheriting).
	TargetFramework *string    `json:"target_framework,omitempty"`
	UpdatedAt       *time.Time `json:"updated_at,omitempty"`
	Username        *string    `json:"username,omitempty"`
}

type HostScanContext struct {
	// DurationSeconds Wall-clock duration of the latest completed run (finished_at - started_at); null when never scanned or timestamps absent.
	DurationSeconds *int `json:"duration_seconds,omitempty"`

	// LastScanAt finished_at of the latest completed scan run; null when never scanned.
	LastScanAt *time.Time `json:"last_scan_at"`

	// PolicyVersion Policy version of the latest completed run; empty when never scanned.
	PolicyVersion string `json:"policy_version"`

	// ScanId id of the latest completed scan run; null when never scanned.
	ScanId *openapi_types.UUID `json:"scan_id"`

	// ScanState In-flight scan state for this host, independent of the latest COMPLETED run above. 'queued' = enqueued, awaiting a worker; 'running' = actively executing; null = no scan in flight. Drives the host-detail hero "Running"/"Queued" badge. Spec api-host-compliance AC-17.
	ScanState *HostScanContextScanState `json:"scan_state,omitempty"`
}

type HostScanContextScanState string

type HostSystemInfo struct {
	ApparmorEnabled   *bool              `json:"apparmor_enabled,omitempty"`
	Architecture      *string            `json:"architecture,omitempty"`
	CategoryFreshness *CategoryFreshness `json:"category_freshness,omitempty"`
	CollectedAt       time.Time          `json:"collected_at"`
	DiskFreeGb        *int               `json:"disk_free_gb,omitempty"`
	DiskTotalGb       *int               `json:"disk_total_gb,omitempty"`
	DiskUsedGb        *int               `json:"disk_used_gb,omitempty"`

	// FirewallService firewalld | ufw | nftables | iptables | empty
	FirewallService *string            `json:"firewall_service,omitempty"`
	FirewallStatus  *string            `json:"firewall_status,omitempty"`
	Fqdn            *string            `json:"fqdn,omitempty"`
	HostId          openapi_types.UUID `json:"host_id"`
	Hostname        *string            `json:"hostname,omitempty"`
	KernelName      *string            `json:"kernel_name,omitempty"`
	KernelRelease   *string            `json:"kernel_release,omitempty"`
	KernelVersion   *string            `json:"kernel_version,omitempty"`
	MemAvailableMb  *int               `json:"mem_available_mb,omitempty"`
	MemTotalMb      *int               `json:"mem_total_mb,omitempty"`

	// OsFamily Distro ID from /etc/os-release (rhel, ubuntu, rocky, ...); rollup family (rhel/debian/suse/alpine/arch/gentoo/other) only when ID was empty. Spec system-host-discovery v1.3.0 AC-22.
	OsFamily           *string `json:"os_family,omitempty"`
	OsId               *string `json:"os_id,omitempty"`
	OsIdLike           *string `json:"os_id_like,omitempty"`
	OsName             *string `json:"os_name,omitempty"`
	OsPrettyName       *string `json:"os_pretty_name,omitempty"`
	OsVersion          *string `json:"os_version,omitempty"`
	OsVersionFull      *string `json:"os_version_full,omitempty"`
	PlatformIdentifier *string `json:"platform_identifier,omitempty"`

	// SelinuxStatus Enforcing | Permissive | Disabled | empty if not present
	SelinuxStatus *string `json:"selinux_status,omitempty"`
	SwapTotalMb   *int    `json:"swap_total_mb,omitempty"`
}

type HostTargetRequest struct {
	// TargetFramework Compliance target family id, or empty to clear the host's own target.
	TargetFramework string `json:"target_framework"`
}

type HostUpdateRequest struct {
	Description *string             `json:"description,omitempty"`
	DisplayName *string             `json:"display_name,omitempty"`
	Environment *string             `json:"environment,omitempty"`
	GroupId     *openapi_types.UUID `json:"group_id,omitempty"`
	IpAddress   *string             `json:"ip_address,omitempty"`
	Port        *int                `json:"port,omitempty"`
	Tags        *[]string           `json:"tags,omitempty"`
	Username    *string             `json:"username,omitempty"`
}

type IntelligenceConfig struct {
	// IntervalSec Per-host cadence the scheduler advances next_intelligence_at by after a successful RunCycle (300..86400). Default 3600 (1h)
	IntervalSec int `json:"interval_sec"`

	// MaintenanceGlobal When true, the scheduler loop ticks but RunCycles no hosts
	MaintenanceGlobal bool `json:"maintenance_global"`

	// RateLimit Max concurrent RunCycles per scheduler instance (1..200). Default 10
	RateLimit int `json:"rate_limit"`
}

type IntelligenceConfigResponse struct {
	Config   IntelligenceConfig `json:"config"`
	Defaults IntelligenceConfig `json:"defaults"`
}

type IntelligenceEvent struct {
	CorrelationId *string                 `json:"correlation_id,omitempty"`
	Detail        *map[string]interface{} `json:"detail,omitempty"`
	DetectedAt    time.Time               `json:"detected_at"`

	// EventCode Closed taxonomy: e.g. system.package.updated
	EventCode  string                    `json:"event_code"`
	HostId     openapi_types.UUID        `json:"host_id"`
	Id         openapi_types.UUID        `json:"id"`
	OccurredAt time.Time                 `json:"occurred_at"`
	Severity   IntelligenceEventSeverity `json:"severity"`
}

type IntelligenceEventSeverity string

type IntelligenceEventsPage struct {
	Items      []IntelligenceEvent `json:"items"`
	NextCursor *string             `json:"next_cursor,omitempty"`
}

type IntelligenceState struct {
	CategoryFreshness *CategoryFreshness `json:"category_freshness,omitempty"`
	CollectedAt       time.Time          `json:"collected_at"`
	HostId            openapi_types.UUID `json:"host_id"`

	// Snapshot Free-form host_intelligence_state.snapshot — mirrors collector.Snapshot
	Snapshot map[string]interface{} `json:"snapshot"`
}

type InvalidParamFormatError struct {
	ParamName string
	Err       error
}

type LicenseStateResponse struct {
	ClockRollbackDetected *bool                      `json:"clock_rollback_detected,omitempty"`
	CustomerId            *string                    `json:"customer_id,omitempty"`
	ExpiresAt             *time.Time                 `json:"expires_at,omitempty"`
	Features              []string                   `json:"features"`
	InGracePeriod         *bool                      `json:"in_grace_period,omitempty"`
	Status                LicenseStateResponseStatus `json:"status"`
	Tier                  LicenseStateResponseTier   `json:"tier"`
	UsingPrevKey          *bool                      `json:"using_prev_key,omitempty"`
}

type LicenseStateResponseStatus string

type LicenseStateResponseTier string

type LicenseVerifyRequest struct {
	LicenseJwt string `json:"license_jwt"`
}

type LicenseVerifyResponse struct {
	ExpiresAt    *time.Time `json:"expires_at,omitempty"`
	Features     *[]string  `json:"features,omitempty"`
	IsValid      bool       `json:"is_valid"`
	Tier         *string    `json:"tier,omitempty"`
	VerifyResult string     `json:"verify_result"`
	Warnings     *[]string  `json:"warnings,omitempty"`
}

type ListRemediationRequestsParams struct {
	Status *ListRemediationRequestsParamsStatus `form:"status,omitempty" json:"status,omitempty"`
	HostId *openapi_types.UUID                  `form:"host_id,omitempty" json:"host_id,omitempty"`
	RuleId *string                              `form:"rule_id,omitempty" json:"rule_id,omitempty"`
	Limit  *int                                 `form:"limit,omitempty" json:"limit,omitempty"`
}

type ListRemediationRequestsParamsStatus string

type MethodNotAllowed = ErrorEnvelope

type MiddlewareFunc func(http.Handler) http.Handler

type NotFound = ErrorEnvelope

type NotificationChannel struct {
	CreatedAt time.Time `json:"created_at"`
	Enabled   bool      `json:"enabled"`

	// From Sender address (email channels)
	From *string            `json:"from,omitempty"`
	Id   openapi_types.UUID `json:"id"`
	Name string             `json:"name"`

	// SmtpEncryption SMTP transport security (email channels) - none|starttls|tls
	SmtpEncryption *string `json:"smtp_encryption,omitempty"`

	// SmtpInsecureSkipVerify Skip TLS cert verification for an internal relay with a self-signed/private-CA cert (email channels; STARTTLS/TLS only)
	SmtpInsecureSkipVerify *bool `json:"smtp_insecure_skip_verify,omitempty"`

	// SmtpPort SMTP port (email channels)
	SmtpPort *int `json:"smtp_port,omitempty"`

	// TagFilter Alert tags this channel matches; empty = every alert
	TagFilter map[string]string `json:"tag_filter"`

	// TargetHint Non-secret host (URL host or SMTP host)
	TargetHint string `json:"target_hint"`

	// To Recipient addresses (email channels)
	To        *[]string               `json:"to,omitempty"`
	Type      NotificationChannelType `json:"type"`
	UpdatedAt time.Time               `json:"updated_at"`

	// Username SMTP username (email; the password is never returned)
	Username *string `json:"username,omitempty"`
}

type NotificationChannelCreate struct {
	Enabled *bool `json:"enabled,omitempty"`

	// From Envelope From address (email).
	From *string `json:"from,omitempty"`
	Name string  `json:"name"`

	// Password SMTP auth password (email). Stored encrypted.
	Password *string `json:"password,omitempty"`

	// SmtpEncryption Transport security for the SMTP connection (email). 'starttls' (default) connects plaintext then requires a STARTTLS upgrade; 'tls' uses implicit TLS from connect (SMTPS, e.g. port 465); 'none' is plaintext for a trusted local relay. Omitted defaults to starttls.
	SmtpEncryption *NotificationChannelCreateSmtpEncryption `json:"smtp_encryption,omitempty"`

	// SmtpHost SMTP relay host (email). Stored encrypted.
	SmtpHost *string `json:"smtp_host,omitempty"`

	// SmtpInsecureSkipVerify Skip TLS certificate verification for the SMTP handshake (email). For an internal relay with a self-signed or private-CA cert only; a MITM-exposing downgrade, inert under 'none'. Defaults false.
	SmtpInsecureSkipVerify *bool `json:"smtp_insecure_skip_verify,omitempty"`

	// SmtpPort SMTP relay port (email)
	SmtpPort  *int               `json:"smtp_port,omitempty"`
	TagFilter *map[string]string `json:"tag_filter,omitempty"`

	// To Recipient addresses (email).
	To *[]string `json:"to,omitempty"`

	// Token Optional bearer token for webhook auth. Stored encrypted.
	Token *string                       `json:"token,omitempty"`
	Type  NotificationChannelCreateType `json:"type"`

	// Url Target URL (https, public host) for slack/webhook. Stored encrypted.
	Url *string `json:"url,omitempty"`

	// Username SMTP auth username (email). Stored encrypted.
	Username *string `json:"username,omitempty"`
}

type NotificationChannelCreateSmtpEncryption string

type NotificationChannelCreateType string

type NotificationChannelList struct {
	Channels []NotificationChannel `json:"channels"`
}

type NotificationChannelType string

type NotificationChannelUpdate struct {
	Enabled                bool                                     `json:"enabled"`
	From                   *string                                  `json:"from,omitempty"`
	Name                   string                                   `json:"name"`
	Password               *string                                  `json:"password,omitempty"`
	SmtpEncryption         *NotificationChannelUpdateSmtpEncryption `json:"smtp_encryption,omitempty"`
	SmtpHost               *string                                  `json:"smtp_host,omitempty"`
	SmtpInsecureSkipVerify *bool                                    `json:"smtp_insecure_skip_verify,omitempty"`
	SmtpPort               *int                                     `json:"smtp_port,omitempty"`
	TagFilter              *map[string]string                       `json:"tag_filter,omitempty"`
	To                     *[]string                                `json:"to,omitempty"`
	Token                  *string                                  `json:"token,omitempty"`
	Url                    *string                                  `json:"url,omitempty"`
	Username               *string                                  `json:"username,omitempty"`
}

type NotificationChannelUpdateSmtpEncryption string

type NotificationFeed struct {
	Items []NotificationFeedItem `json:"items"`

	// UnreadCount Count of the unread notifications (badge value)
	UnreadCount int `json:"unread_count"`
}

type NotificationFeedItem struct {
	Body *string `json:"body,omitempty"`

	// HostId Present for host-scoped changes
	HostId *openapi_types.UUID `json:"host_id,omitempty"`
	Id     openapi_types.UUID  `json:"id"`

	// Kind Change/alert kind, e.g. host_unreachable or drift_major
	Kind string `json:"kind"`

	// Link Deep-link target for the notification
	Link       *string   `json:"link,omitempty"`
	OccurredAt time.Time `json:"occurred_at"`

	// Read True when the caller has read it
	Read     bool                         `json:"read"`
	Severity NotificationFeedItemSeverity `json:"severity"`
	Title    string                       `json:"title"`
}

type NotificationFeedItemSeverity string

type NotificationReadResult struct {
	// MarkedRead Number of notifications marked read
	MarkedRead int `json:"marked_read"`
}

type OscalDocument map[string]interface{}

type PatchAuthMeJSONRequestBody = AuthMeUpdateRequest

type PatchCredentialByIDJSONRequestBody = CredentialUpdateRequest

type PatchGroupJSONRequestBody = GroupUpdate

type PatchHostByIDJSONRequestBody = HostUpdateRequest

type PatchNotificationChannelJSONRequestBody = NotificationChannelUpdate

type PatchUsersMePreferencesJSONRequestBody = UserPreferences

type PermissionEntry struct {
	Category    string `json:"category"`
	Dangerous   bool   `json:"dangerous"`
	Description string `json:"description"`
	Id          string `json:"id"`
}

type PermissionsRegistryResponse struct {
	Categories  []CategoryEntry   `json:"categories"`
	Permissions []PermissionEntry `json:"permissions"`
	Roles       []RoleEntry       `json:"roles"`
}

type PoliciesReloadResponse struct {
	Outcomes map[string]string `json:"outcomes"`
}

type PolicyDecisionResponse struct {
	Detail        *map[string]interface{} `json:"detail,omitempty"`
	HumanMessage  *string                 `json:"human_message,omitempty"`
	Outcome       string                  `json:"outcome"`
	PolicyType    string                  `json:"policy_type"`
	PolicyVersion string                  `json:"policy_version"`
	Reason        string                  `json:"reason"`
}

type PostAPITokenJSONRequestBody = ApiTokenCreateRequest

type PostAdminLicenseVerifyJSONRequestBody = LicenseVerifyRequest

type PostAlertAcknowledgeJSONRequestBody = AlertLifecycleRequest

type PostAlertDismissJSONRequestBody = AlertLifecycleRequest

type PostAlertResolveJSONRequestBody = AlertLifecycleRequest

type PostAlertSilenceJSONRequestBody = AlertLifecycleRequest

type PostAuthLoginJSONRequestBody = AuthLoginRequest

type PostAuthMFAVerifyJSONRequestBody = AuthMFAVerifyRequest

type PostAuthPasswordChangeJSONRequestBody = AuthPasswordChangeRequest

type PostAuthRefreshJSONRequestBody = AuthRefreshRequest

type PostCredentialCloneJSONRequestBody = CredentialCloneRequest

type PostCredentialsJSONRequestBody = CredentialCreateRequest

type PostDiagnosticsEchoJSONRequestBody = EchoRequest

type PostDiagnosticsEchoParams struct {
	IdempotencyKey string  `json:"Idempotency-Key"`
	XCorrelationId *string `json:"X-Correlation-Id,omitempty"`
}

type PostDiagnosticsEvaluateAlertJSONRequestBody = EvaluateAlertRequest

type PostDiagnosticsPremiumEchoJSONRequestBody = EchoRequest

type PostDiagnosticsPremiumEchoParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostDiagnosticsRequireHostReadJSONRequestBody = EchoRequest

type PostDiagnosticsRequireHostReadParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostDiagnosticsRequireHostWriteJSONRequestBody = EchoRequest

type PostDiagnosticsRequireHostWriteParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostDiagnosticsRequireRemediationExecuteJSONRequestBody = EchoRequest

type PostDiagnosticsRequireRemediationExecuteParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostExceptionApproveJSONRequestBody = ExceptionReview

type PostExceptionRejectJSONRequestBody = ExceptionReview

type PostExceptionRevokeJSONRequestBody = ExceptionReview

type PostGroupJSONRequestBody = GroupCreate

type PostGroupMaintenanceJSONRequestBody = GroupMaintenanceRequest

type PostGroupMemberJSONRequestBody = GroupMemberRequest

type PostGroupTargetJSONRequestBody = GroupTargetRequest

type PostHostConnectivityCheckParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostHostDiscoveryRunParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostHostExceptionJSONRequestBody = ExceptionRequest

type PostHostScanParams struct {
	IdempotencyKey string `json:"Idempotency-Key"`
}

type PostHostTargetJSONRequestBody = HostTargetRequest

type PostHostsJSONRequestBody = HostCreateRequest

type PostNotificationChannelJSONRequestBody = NotificationChannelCreate

type PostReportGenerateJSONRequestBody = GenerateReportRequest

type PostRolesCreateJSONRequestBody = CustomRoleCreateRequest

type PostSSOProviderJSONRequestBody = SSOProviderCreateRequest

type PostUserResetPasswordJSONRequestBody = UserPasswordResetRequest

type PostUserRolesAssignJSONRequestBody = UserRoleAssignRequest

type PostUserRolesUnassignJSONRequestBody = UserRoleAssignRequest

type PostUsersJSONRequestBody = UserCreateRequest

type ProjectedLift struct {
	Cis  *float64 `json:"cis,omitempty"`
	Nist *float64 `json:"nist,omitempty"`
	Stig *float64 `json:"stig,omitempty"`
}

type PutAuthPolicyJSONRequestBody = AuthPolicyUpdateRequest

type PutHostMaintenanceJSONRequestBody = HostMaintenanceRequest

type PutSSOProviderJSONRequestBody = SSOProviderUpdateRequest

type PutSystemComplianceConfigJSONRequestBody = ComplianceConfig

type PutSystemConnectivityConfigJSONRequestBody = ConnectivityConfig

type PutSystemDiscoveryConfigJSONRequestBody = DiscoveryConfig

type PutSystemIntelligenceConfigJSONRequestBody = IntelligenceConfig

type PutSystemScanConfigJSONRequestBody = ScanConfig

type PutSystemScanVariablesJSONRequestBody = ScanVariableOverrides

type RejectRemediationJSONRequestBody = RemediationReview

type RemediationPhase struct {
	// Capturable False when this phase's mechanism cannot record pre-state, which is
	// what makes a rule non-rollbackable.
	Capturable bool `json:"capturable"`

	// Detail Human-readable account of what this phase did, or why it did not.
	Detail    *string `json:"detail,omitempty"`
	Index     int     `json:"index"`
	Mechanism string  `json:"mechanism"`

	// Staged True when the change was written to the persist layer but the
	// running host has not converged, so a re-scan still reports the rule
	// failing until reboot.
	Staged bool `json:"staged"`

	// Stranded True for a non-capturable phase that succeeded before a later
	// failure. Rollback does NOT reverse it.
	Stranded bool `json:"stranded"`
	Success  bool `json:"success"`
}

type RemediationPlan struct {
	// Before What Kensa found on the host while planning, one entry per step.
	// Computed live and never stored, because a plan describes the host
	// as it is now.
	Before *[]struct {
		Index     int     `json:"index"`
		Mechanism string  `json:"mechanism"`
		Summary   *string `json:"summary,omitempty"`
	} `json:"before,omitempty"`
	CapturedAt *time.Time `json:"captured_at,omitempty"`

	// Checks The validators that would run after apply.
	Checks []struct {
		Name    string  `json:"name"`
		Summary *string `json:"summary,omitempty"`
	} `json:"checks"`

	// ControlChannelSensitive True when a step touches SSH, networking, PAM or firewall state.
	// Kensa arms a deadman timer before applying such a transaction, so
	// a fix that could lock you out reverts itself if you lose contact.
	ControlChannelSensitive bool                `json:"control_channel_sensitive"`
	EstimatedSeconds        *float32            `json:"estimated_seconds,omitempty"`
	PlanId                  *openapi_types.UUID `json:"plan_id,omitempty"`

	// ReversibleSteps How many steps Kensa actually captured pre-state for, counted from
	// the capture rather than from the rule's own claim about itself.
	ReversibleSteps int    `json:"reversible_steps"`
	RuleId          string `json:"rule_id"`

	// Steps The apply steps that would run, in order.
	Steps []RemediationPlanStep `json:"steps"`

	// Transactional False when the steps are not all-or-nothing.
	Transactional bool `json:"transactional"`

	// Undo How each applied step would be reversed. Rollback runs this in
	// reverse order.
	Undo []RemediationPlanStep `json:"undo"`

	// Warnings Kensa's own operator-facing notices about this plan.
	Warnings *[]string `json:"warnings,omitempty"`
}

type RemediationPlanStep struct {
	// Capturable False when this step cannot be reversed.
	Capturable *bool  `json:"capturable,omitempty"`
	Index      int    `json:"index"`
	Mechanism  string `json:"mechanism"`

	// Summary Kensa's human-readable description of the action.
	Summary *string `json:"summary,omitempty"`
}

type RemediationPreState struct {
	// Capturable False for phases whose mechanism cannot capture pre-state; `data` is then empty.
	Capturable bool                    `json:"capturable"`
	Data       *map[string]interface{} `json:"data,omitempty"`
	Index      int                     `json:"index"`
	Mechanism  string                  `json:"mechanism"`

	// Summary Kensa's one-line rendering of what was captured, from the handler
	// that captured it.
	//
	// Display text, not evidence. It carries no stability guarantee and
	// may change between Kensa releases, which is why the transaction
	// records the Kensa version that produced it. `data` remains the
	// authoritative capture. Elided by construction so no file body
	// appears, and a credential named inside a config line is redacted,
	// but it is not a secret scanner: treat it as operator-visible text.
	Summary *string `json:"summary,omitempty"`
}

type RemediationRequest struct {
	HostId openapi_types.UUID `json:"host_id"`

	// HostName Hostname, populated on list responses (empty on single-row lifecycle results)
	HostName *string            `json:"host_name,omitempty"`
	Id       openapi_types.UUID `json:"id"`

	// Mechanism Kensa remediation handler id (empty when unknown at request time)
	Mechanism *string `json:"mechanism,omitempty"`

	// ProjectedLift Estimated per-framework compliance-score delta (percentage points) if the rule flips to pass. Best-effort; a field is null when that framework's data is unavailable for the host.
	ProjectedLift  *ProjectedLift           `json:"projected_lift,omitempty"`
	RebootRequired *bool                    `json:"reboot_required,omitempty"`
	RequestedAt    time.Time                `json:"requested_at"`
	RequestedBy    openapi_types.UUID       `json:"requested_by"`
	ReviewNote     *string                  `json:"review_note,omitempty"`
	ReviewedAt     *time.Time               `json:"reviewed_at,omitempty"`
	ReviewedBy     *openapi_types.UUID      `json:"reviewed_by,omitempty"`
	RuleId         string                   `json:"rule_id"`
	ScanRunId      *openapi_types.UUID      `json:"scan_run_id,omitempty"`
	Status         RemediationRequestStatus `json:"status"`
	Transactional  *bool                    `json:"transactional,omitempty"`
}