openapi: 3.0.3
info:
  title: Shoehorn Security API
  description: Security overview, findings, and posture assessment.
  version: 1.0.0

servers:
  - url: https://shoehorn.example.com/api/v1
    description: Production

paths:
  /security/overview:
    get:
      summary: Get security overview
      description: |
        Returns the overall security posture for the tenant, including
        entity counts by security grade, risk distribution, and trends.
      tags: [Security]
      responses:
        '200':
          description: Security overview
          content:
            application/json:
              schema:
                type: object
                properties:
                  overall_grade: { type: string, enum: [A+, A, B, C, D, F] }
                  total_entities: { type: integer }
                  by_grade:
                    type: object
                    additionalProperties: { type: integer }
                  findings_summary:
                    type: object
                    properties:
                      critical: { type: integer }
                      high: { type: integer }
                      medium: { type: integer }
                      low: { type: integer }
                      info: { type: integer }

  /security/findings:
    get:
      summary: List security findings
      description: Returns security findings across all entities.
      tags: [Security]
      parameters:
        - name: severity
          in: query
          schema: { type: string, enum: [critical, high, medium, low, info] }
        - name: entity_id
          in: query
          schema: { type: string }
        - name: type
          in: query
          schema: { type: string }
        - name: status
          in: query
          schema: { type: string, enum: [open, acknowledged, resolved, false_positive] }
        - name: limit
          in: query
          schema: { type: integer, default: 20 }
        - name: cursor
          in: query
          schema: { type: string }
      responses:
        '200':
          description: Paginated security findings
          content:
            application/json:
              schema:
                type: object
                properties:
                  findings:
                    type: array
                    items: { $ref: '#/components/schemas/SecurityFinding' }
                  pagination:
                    type: object
                    properties:
                      total: { type: integer }
                      nextCursor: { type: string }

  /security/findings/{id}:
    get:
      summary: Get security finding details
      tags: [Security]
      parameters:
        - name: id
          in: path
          required: true
          schema: { type: string }
      responses:
        '200':
          description: Finding details with remediation guidance
          content:
            application/json:
              schema: { $ref: '#/components/schemas/SecurityFinding' }

components:
  schemas:
    SecurityFinding:
      type: object
      properties:
        id: { type: string, format: uuid }
        entity_id: { type: string }
        entity_name: { type: string }
        type: { type: string, description: "e.g., missing_owner, no_readme, exposed_secret" }
        severity: { type: string, enum: [critical, high, medium, low, info] }
        status: { type: string, enum: [open, acknowledged, resolved, false_positive] }
        title: { type: string }
        description: { type: string }
        remediation: { type: string, description: Suggested fix }
        source: { type: string, description: "e.g., scorecard, scanner, manual" }
        created_at: { type: string, format: date-time }
        resolved_at: { type: string, format: date-time }
