> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/integrations-and-apis/origin-studio-production-api/tenants.md).

# Tenants

Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access.

## Get all tenants

> Returns a paginated list of all tenants in the system. Results are ordered by creation date. Use the \`page.cursor\` query parameter to paginate through results.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"GetTenantResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFindOneResponse","description":"The response for a tenant find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/TenantAttributes","required":["fullName","key","plan"]}]},"relationships":{"$ref":"#/components/schemas/TenantRelationships"}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"TenantAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantAttributes","description":"Tenant profile: display name (fullName), key, plan, and optional contact info.","type":"object","additionalProperties":false,"required":["fullName","key","plan"],"properties":{"fullName":{"type":"string","description":"Display name for the tenant (e.g. studio or company name)."},"contactInfo":{"type":"object","description":"Optional contact details for the tenant.","properties":{"email":{"type":"string"},"phone":{"type":"string"},"address":{"type":"string"}},"additionalProperties":false},"key":{"type":"string","description":"Unique key identifying the tenant (used in URLs and references)."},"description":{"type":"string"},"policyStoreId":{"type":"string"},"auth0OrganizationId":{"type":"string","description":"The linked identity provider organization ID for this tenant."},"plan":{"type":"string","description":"Subscription plan (e.g. pro, team, enterprise)."},"planQuota":{"type":"object","description":"Resource quotas for the tenant plan.","properties":{"userCount":{"type":"number","description":"Maximum number of users allowed for the tenant."},"recordCount":{"type":"number","description":"Maximum number of records allowed for the tenant."},"deliveryRecordCount":{"type":"number","description":"Maximum number of delivery records allowed for the tenant."},"apiCallCount":{"type":"number","description":"Maximum number of API calls allowed per month."},"mediaStorageBytes":{"type":"number","description":"Maximum media storage in bytes."}},"additionalProperties":false},"audit":{"type":"object","description":"Audit log settings for the tenant.","properties":{"retention":{"type":"object","description":"Retention policy for audit log files.","required":["days"],"properties":{"days":{"type":"number","description":"Number of days to retain audit log files. Must be one of the allowed values: 1, 30, 60, 90, 365, 730, 1095, 1460, 1825, 2555."}},"additionalProperties":false}},"additionalProperties":false,"required":["retention"]}}},"TenantRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationships","description":"JSON:API relationship links for a tenant resource. `author` identifies the user who created the tenant; `updatedBy` identifies the user who last modified it (both with display name and tenant context in meta).","type":"object","properties":{"author":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}},"updatedBy":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/tenants":{"get":{"summary":"Get all tenants","description":"Returns a paginated list of all tenants in the system. Results are ordered by creation date. Use the `page.cursor` query parameter to paginate through results.","operationId":"tenantFindMany","tags":["Tenants"],"parameters":[{"name":"page.cursor","in":"query","description":"The cursor to use for pagination","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/GetTenantResponse"}},"meta":{"type":"object","properties":{"cursor":{"type":"string"}},"additionalProperties":false}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create a new tenant

> Create a new tenant in the system. When \`organizationId\` is omitted, an Auth0 organization is created using the tenant \`key\` as the organization name and \`fullName\` as the display name, unless that name is already taken.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreateTenantRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantCreateRequest","description":"Request body to create a tenant. Uses JSON:API format with attributes (fullName, key, plan, etc.).","type":"object","properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"allOf":[{"$ref":"#/components/schemas/BaseCreateRequest"},{"additionalProperties":false,"properties":{"id":{"type":"string"},"attributes":{"type":"object","required":["fullName","contactInfo","key","description","plan","planQuota"],"additionalProperties":false,"properties":{"fullName":{"type":"string"},"contactInfo":{"type":"object","required":["email"],"properties":{"email":{"type":"string"},"phone":{"type":"string"},"address":{"type":"string"}},"additionalProperties":false},"key":{"type":"string"},"description":{"type":"string"},"auth0UserId":{"type":"string","description":"Optional Auth0 user ID to add to the organization. If provided, this user will be added to the tenant's Auth0 organization."},"shouldCreateUsagePlan":{"type":"boolean"},"audit":{"type":"object","description":"Audit log settings for the tenant.","properties":{"retention":{"type":"object","description":"Retention policy for audit log files.","required":["days"],"properties":{"days":{"type":"number","description":"Number of days to retain audit log files. Must be one of: 1, 30, 60, 90, 365, 730, 1095, 1460, 1825, 2555. Defaults to 30 when omitted."}},"additionalProperties":false}},"additionalProperties":false,"required":["retention"]},"organizationId":{"type":"string","description":"Optional Auth0 organization id. When set, the tenant is linked to this pre-provisioned organization (it must exist). When omitted, an Auth0 organization is created with name equal to the tenant key and display_name equal to fullName, unless that organization name is already in use."},"plan":{"type":"string","enum":["pro","team","enterprise"]},"planQuota":{"type":"object","description":"Resource quotas for the tenant plan","required":["userCount","recordCount","deliveryRecordCount","apiCallCount","mediaStorageBytes"],"additionalProperties":false,"properties":{"userCount":{"type":"number","description":"Maximum number of users allowed for the tenant"},"recordCount":{"type":"number","description":"Maximum number of records allowed for the tenant"},"deliveryRecordCount":{"type":"number","description":"Maximum number of delivery records allowed for the tenant"},"apiCallCount":{"type":"number","description":"Maximum number of API calls allowed per month"},"mediaStorageBytes":{"type":"number","description":"Maximum media storage in bytes"}}}}}},"required":["id","attributes"]}]}},"required":["data"],"additionalProperties":false},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"BaseCreateRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseCreateRequest","description":"Base JSON:API shape for create requests. The `type` field is required and must match the target resource type. The `id` field is optional; if omitted, the server generates a unique ID for the new resource.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["type"]},"TenantCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantCreateOneResponse","description":"The response for a tenant create one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/tenants":{"post":{"summary":"Create a new tenant","operationId":"tenantCreateOne","description":"Create a new tenant in the system. When `organizationId` is omitted, an Auth0 organization is created using the tenant `key` as the organization name and `fullName` as the display name, unless that name is already taken.","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTenantRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TenantCreateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get a tenant by ID

> Returns a single tenant by its unique ID. The special value \`me\` can be used as the \`tenantId\` to retrieve the tenant associated with the caller's JWT token.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"GetTenantResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFindOneResponse","description":"The response for a tenant find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/TenantAttributes","required":["fullName","key","plan"]}]},"relationships":{"$ref":"#/components/schemas/TenantRelationships"}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"TenantAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantAttributes","description":"Tenant profile: display name (fullName), key, plan, and optional contact info.","type":"object","additionalProperties":false,"required":["fullName","key","plan"],"properties":{"fullName":{"type":"string","description":"Display name for the tenant (e.g. studio or company name)."},"contactInfo":{"type":"object","description":"Optional contact details for the tenant.","properties":{"email":{"type":"string"},"phone":{"type":"string"},"address":{"type":"string"}},"additionalProperties":false},"key":{"type":"string","description":"Unique key identifying the tenant (used in URLs and references)."},"description":{"type":"string"},"policyStoreId":{"type":"string"},"auth0OrganizationId":{"type":"string","description":"The linked identity provider organization ID for this tenant."},"plan":{"type":"string","description":"Subscription plan (e.g. pro, team, enterprise)."},"planQuota":{"type":"object","description":"Resource quotas for the tenant plan.","properties":{"userCount":{"type":"number","description":"Maximum number of users allowed for the tenant."},"recordCount":{"type":"number","description":"Maximum number of records allowed for the tenant."},"deliveryRecordCount":{"type":"number","description":"Maximum number of delivery records allowed for the tenant."},"apiCallCount":{"type":"number","description":"Maximum number of API calls allowed per month."},"mediaStorageBytes":{"type":"number","description":"Maximum media storage in bytes."}},"additionalProperties":false},"audit":{"type":"object","description":"Audit log settings for the tenant.","properties":{"retention":{"type":"object","description":"Retention policy for audit log files.","required":["days"],"properties":{"days":{"type":"number","description":"Number of days to retain audit log files. Must be one of the allowed values: 1, 30, 60, 90, 365, 730, 1095, 1460, 1825, 2555."}},"additionalProperties":false}},"additionalProperties":false,"required":["retention"]}}},"TenantRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationships","description":"JSON:API relationship links for a tenant resource. `author` identifies the user who created the tenant; `updatedBy` identifies the user who last modified it (both with display name and tenant context in meta).","type":"object","properties":{"author":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}},"updatedBy":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/tenants/{tenantId}":{"get":{"summary":"Get a tenant by ID","description":"Returns a single tenant by its unique ID. The special value `me` can be used as the `tenantId` to retrieve the tenant associated with the caller's JWT token.","operationId":"tenantFindOne","tags":["Tenants"],"parameters":[{"name":"tenantId","in":"path","description":"The tenant ID","required":true,"schema":{"anyOf":[{"type":"string"},{"type":"string","enum":["me"]}]}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetTenantResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Update a tenant by ID

> Updates an existing tenant by its unique ID. Only the fields provided in the request body are modified. The updated tenant is returned in the response.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UpdateTenantRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantUpdateRequest","description":"The request to update a tenant.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"fullName":{"type":"string"},"description":{"type":"string"},"contactInfo":{"type":"object","additionalProperties":false,"properties":{"email":{"type":"string"},"phone":{"type":"string"},"address":{"type":"string"}}},"plan":{"type":"string","enum":["pro","team","enterprise"]},"planQuota":{"type":"object","additionalProperties":false,"properties":{"userCount":{"type":"number"},"recordCount":{"type":"number"},"deliveryRecordCount":{"type":"number"},"apiCallCount":{"type":"number"},"mediaStorageBytes":{"type":"number"}}},"audit":{"type":"object","additionalProperties":false,"required":["retention"],"properties":{"retention":{"type":"object","additionalProperties":false,"required":["days"],"properties":{"days":{"type":"number"}}}}}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"GetTenantResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFindOneResponse","description":"The response for a tenant find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/TenantAttributes","required":["fullName","key","plan"]}]},"relationships":{"$ref":"#/components/schemas/TenantRelationships"}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"TenantAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantAttributes","description":"Tenant profile: display name (fullName), key, plan, and optional contact info.","type":"object","additionalProperties":false,"required":["fullName","key","plan"],"properties":{"fullName":{"type":"string","description":"Display name for the tenant (e.g. studio or company name)."},"contactInfo":{"type":"object","description":"Optional contact details for the tenant.","properties":{"email":{"type":"string"},"phone":{"type":"string"},"address":{"type":"string"}},"additionalProperties":false},"key":{"type":"string","description":"Unique key identifying the tenant (used in URLs and references)."},"description":{"type":"string"},"policyStoreId":{"type":"string"},"auth0OrganizationId":{"type":"string","description":"The linked identity provider organization ID for this tenant."},"plan":{"type":"string","description":"Subscription plan (e.g. pro, team, enterprise)."},"planQuota":{"type":"object","description":"Resource quotas for the tenant plan.","properties":{"userCount":{"type":"number","description":"Maximum number of users allowed for the tenant."},"recordCount":{"type":"number","description":"Maximum number of records allowed for the tenant."},"deliveryRecordCount":{"type":"number","description":"Maximum number of delivery records allowed for the tenant."},"apiCallCount":{"type":"number","description":"Maximum number of API calls allowed per month."},"mediaStorageBytes":{"type":"number","description":"Maximum media storage in bytes."}},"additionalProperties":false},"audit":{"type":"object","description":"Audit log settings for the tenant.","properties":{"retention":{"type":"object","description":"Retention policy for audit log files.","required":["days"],"properties":{"days":{"type":"number","description":"Number of days to retain audit log files. Must be one of the allowed values: 1, 30, 60, 90, 365, 730, 1095, 1460, 1825, 2555."}},"additionalProperties":false}},"additionalProperties":false,"required":["retention"]}}},"TenantRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationships","description":"JSON:API relationship links for a tenant resource. `author` identifies the user who created the tenant; `updatedBy` identifies the user who last modified it (both with display name and tenant context in meta).","type":"object","properties":{"author":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}},"updatedBy":{"type":"object","required":["data"],"additionalProperties":false,"properties":{"data":{"type":"object","required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/tenants/{tenantId}":{"patch":{"summary":"Update a tenant by ID","description":"Updates an existing tenant by its unique ID. Only the fields provided in the request body are modified. The updated tenant is returned in the response.","operationId":"tenantUpdateOne","tags":["Tenants"],"parameters":[{"name":"tenantId","description":"The ID of the tenant to update","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTenantRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetTenantResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get the feature entitlements for a tenant

> Returns every entitlement-governed feature for the tenant: whether the tenant's plan grants it, whether the tenant has activated it, and the effective result. Features the plan does not grant are returned flagged rather than omitted, so they can be surfaced as an upsell. Features absent from the registry are not governed by entitlements, never appear here, and are simply available.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TenantFeatureFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureFindManyResponse","description":"The response for a tenant feature find many request. Returns every registered feature, including those the tenant's plan does not grant. An empty array means no feature is governed by entitlements yet.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TenantFeatureResource"}},"links":{"type":"object","additionalProperties":false,"required":["self"],"properties":{"self":{"type":"string"}}}}},"TenantFeatureResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureResource","description":"A JSON:API resource object for one entitlement-governed feature. The resource `id` is the feature's registry key.","type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string","description":"The feature's registry key."},"type":{"type":"string","enum":["features"]},"attributes":{"$ref":"#/components/schemas/TenantFeatureAttributes"},"relationships":{"type":"object","additionalProperties":false,"properties":{"author":{"type":"object","additionalProperties":false,"required":["data"],"description":"Who activated the feature. Absent until activation.","properties":{"data":{"type":"object","additionalProperties":false,"required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","additionalProperties":false,"required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}}}}},"links":{"type":"object","additionalProperties":false,"properties":{"related":{"type":"string"}}}}}}},"links":{"type":"object","additionalProperties":false,"properties":{"self":{"type":"string"}}}}},"TenantFeatureAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureAttributes","description":"Effective state of one entitlement-governed feature for one tenant. `granted` is decided by the tenant's plan and `enabled` by the tenant's own admins; `effective` is the conjunction and is the only value UI and handlers should gate on. Features the plan does not grant are still returned, flagged rather than omitted, so they can be surfaced as an upsell.","type":"object","additionalProperties":false,"required":["granted","enabled","effective"],"properties":{"granted":{"type":"boolean","description":"The tenant's plan offers this feature."},"enabled":{"type":"boolean","description":"The tenant has activated this feature. Activation is permanent in v1: there is no deactivation path."},"effective":{"type":"boolean","description":"Both granted and enabled. The value to gate behaviour on."},"availableOn":{"type":"array","items":{"type":"string","enum":["pro","team","enterprise"]},"description":"Plans that offer this feature. Omitted when every plan offers it. An empty array means the feature has been withdrawn from all plans."},"created":{"type":"string","format":"date-time","description":"When the tenant activated the feature. Absent until activation."},"updated":{"type":"string","format":"date-time","description":"When the activation was last modified. Absent until activation."}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/features":{"get":{"summary":"Get the feature entitlements for a tenant","description":"Returns every entitlement-governed feature for the tenant: whether the tenant's plan grants it, whether the tenant has activated it, and the effective result. Features the plan does not grant are returned flagged rather than omitted, so they can be surfaced as an upsell. Features absent from the registry are not governed by entitlements, never appear here, and are simply available.","operationId":"tenantFeatureFindMany","tags":["Tenants"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TenantFeatureFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Activate a feature for a tenant

> Activates a released feature for the tenant. Activation is forward-only in v1: \`enabled\` may only be \`true\` and there is no deactivation path. Re-activating an already active feature succeeds without a second write. Rejected when the tenant's plan does not grant the feature.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UpdateTenantFeatureRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IUpdateTenantFeatureRequest","description":"The request to activate a feature for a tenant. Activation is forward-only in v1, so `enabled` may only be `true`; sending `false` is rejected by validation rather than silently ignored. Deactivation is a v2 concern, at which point the constraint on `enabled` is relaxed.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"type":{"type":"string","enum":["features"]},"attributes":{"type":"object","additionalProperties":false,"required":["enabled"],"properties":{"enabled":{"type":"boolean","const":true,"description":"Must be true. Activation cannot be undone in v1."}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"TenantFeatureFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureFindOneResponse","description":"The response for a single tenant feature, returned after activation.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"$ref":"#/components/schemas/TenantFeatureResource"},"links":{"type":"object","additionalProperties":false,"required":["self"],"properties":{"self":{"type":"string"}}}}},"TenantFeatureResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureResource","description":"A JSON:API resource object for one entitlement-governed feature. The resource `id` is the feature's registry key.","type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string","description":"The feature's registry key."},"type":{"type":"string","enum":["features"]},"attributes":{"$ref":"#/components/schemas/TenantFeatureAttributes"},"relationships":{"type":"object","additionalProperties":false,"properties":{"author":{"type":"object","additionalProperties":false,"required":["data"],"description":"Who activated the feature. Absent until activation.","properties":{"data":{"type":"object","additionalProperties":false,"required":["id","type","meta"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["users"]},"meta":{"type":"object","additionalProperties":false,"required":["tenantId","type","displayName"],"properties":{"tenantId":{"type":"string"},"type":{"type":"string"},"displayName":{"type":"string"}}}}},"links":{"type":"object","additionalProperties":false,"properties":{"related":{"type":"string"}}}}}}},"links":{"type":"object","additionalProperties":false,"properties":{"self":{"type":"string"}}}}},"TenantFeatureAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantFeatureAttributes","description":"Effective state of one entitlement-governed feature for one tenant. `granted` is decided by the tenant's plan and `enabled` by the tenant's own admins; `effective` is the conjunction and is the only value UI and handlers should gate on. Features the plan does not grant are still returned, flagged rather than omitted, so they can be surfaced as an upsell.","type":"object","additionalProperties":false,"required":["granted","enabled","effective"],"properties":{"granted":{"type":"boolean","description":"The tenant's plan offers this feature."},"enabled":{"type":"boolean","description":"The tenant has activated this feature. Activation is permanent in v1: there is no deactivation path."},"effective":{"type":"boolean","description":"Both granted and enabled. The value to gate behaviour on."},"availableOn":{"type":"array","items":{"type":"string","enum":["pro","team","enterprise"]},"description":"Plans that offer this feature. Omitted when every plan offers it. An empty array means the feature has been withdrawn from all plans."},"created":{"type":"string","format":"date-time","description":"When the tenant activated the feature. Absent until activation."},"updated":{"type":"string","format":"date-time","description":"When the activation was last modified. Absent until activation."}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/features/{featureKey}":{"patch":{"summary":"Activate a feature for a tenant","description":"Activates a released feature for the tenant. Activation is forward-only in v1: `enabled` may only be `true` and there is no deactivation path. Re-activating an already active feature succeeds without a second write. Rejected when the tenant's plan does not grant the feature.","operationId":"tenantFeatureUpdateOne","tags":["Tenants"],"parameters":[{"name":"featureKey","description":"The registry key of the feature to activate","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTenantFeatureRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TenantFeatureFindOneResponse"}}}},"400":{"description":"Bad Request - deactivation is not supported in v1","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden - the tenant's plan does not grant this feature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found - unknown feature key","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## GET /policyTemplates

> List policy templates

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyTemplateFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateFindManyResponse","description":"The response for a policy template find many request.","additionalProperties":false,"required":["data","links"],"type":"object","properties":{"data":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates":{"get":{"summary":"List policy templates","operationId":"policyTemplateFindMany","tags":["Tenants"],"parameters":[{"name":"filter.label","description":"Filter by display label","in":"query","required":false,"schema":{"type":"string"}},{"name":"filter.resourceType","description":"Filter by resource type","in":"query","required":false,"schema":{"type":"string","enum":["record","contributor","delivery","bulkActions"]}},{"name":"filter.lifecycleStatusId","description":"Only templates whose workTypeLifecycleAccess references this lifecycle status id, for any work type. Used to find the policies blocking a status deletion, and to deep-link the Policies screen from that flow.","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyTemplateFindManyResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## POST /policyTemplates

> Create a policy template

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreatePolicyTemplateRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateCreateRequest","description":"The request for creating a policy template.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"$ref":"#/components/schemas/PolicyTemplateAttributes"}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateCreateOneResponse","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates":{"post":{"summary":"Create a policy template","operationId":"policyTemplateCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatePolicyTemplateRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyTemplateCreateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## GET /policyTemplates/{templateId}

> Get a policy template by ID

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyTemplateFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateFindOneResponse","description":"The response for a policy template find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"},"assignmentsCount":{"type":"number","description":"Number of active assignments for this template"}},"required":["tenantId"],"additionalProperties":false}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates/{templateId}":{"get":{"summary":"Get a policy template by ID","operationId":"policyTemplateFindOne","tags":["Tenants"],"parameters":[{"name":"templateId","description":"The ID of the policy template","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyTemplateFindOneResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## DELETE /policyTemplates/{templateId}

> Delete a policy template

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WriteMetaOnlyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteMetaOnlyRequest","description":"Optional request body carrying only audit metadata, used by mutations that otherwise take no body (e.g. resource DELETEs). Lets clients attach meta.audit.source/reason to such operations. The body itself is optional; it is not otherwise required.","type":"object","additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates/{templateId}":{"delete":{"summary":"Delete a policy template","operationId":"policyTemplateDeleteOne","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WriteMetaOnlyRequest"}}}},"tags":["Tenants"],"parameters":[{"name":"templateId","description":"The ID of the policy template to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict — template has active policies","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## PATCH /policyTemplates/{templateId}

> Update a policy template

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyTemplateUpdateOneRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateUpdateOneRequest","description":"The request for a policy template update request.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"label":{"type":"string"},"description":{"type":"string"},"actions":{"type":"array","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateUpdateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateUpdateOneResponse","description":"The response for a policy template update one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates/{templateId}":{"patch":{"summary":"Update a policy template","operationId":"policyTemplateUpdateOne","tags":["Tenants"],"parameters":[{"name":"templateId","description":"The ID of the policy template to update","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyTemplateUpdateOneRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyTemplateUpdateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## GET /policyTemplates/{templateId}/policies

> List policies for a policy template

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyFindManyResponse","description":"The response for a policy find many request.","additionalProperties":false,"required":["data","links","included"],"type":"object","properties":{"data":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policies"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"},"next":{"type":"string","nullable":true}},"additionalProperties":false},"included":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"meta":{"type":"object","properties":{"cursor":{"type":"string","nullable":true}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyAttributes","description":"The attributes for a policy.","additionalProperties":false,"required":["resourceType"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this policy applies to"}}},"PolicyRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyRelationships","description":"Relationships for a policy: tenant, role, and security tag.","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"},"role":{"$ref":"#/components/schemas/RoleRelationship"},"template":{"$ref":"#/components/schemas/PolicyTemplateRelationship"},"securityTag":{"$ref":"#/components/schemas/SecurityTagRelationship"}},"required":["tenant","role"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"RoleRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IRoleRelationship","description":"A relationship to a role","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["userRoles"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateRelationship","description":"A relationship to a policy template","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"SecurityTagRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagRelationship","description":"A relationship to a security tag","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates/{templateId}/policies":{"get":{"summary":"List policies for a policy template","operationId":"policyTemplatePoliciesFindMany","tags":["Tenants"],"parameters":[{"name":"templateId","description":"The ID of the policy template","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyFindManyResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## POST /policyTemplates/{templateId}/policies

> Create policies from a template (cartesian product of roles x security tags)

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"AssignPolicyTemplateRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAssignPolicyTemplateRequest","description":"Request to create policies from a template for given roles and optional security tags.","type":"object","required":["data"],"additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","required":["type","attributes"],"additionalProperties":false,"properties":{"type":{"type":"string","enum":["policies"]},"attributes":{"type":"object","required":["roleIds"],"additionalProperties":false,"properties":{"roleIds":{"type":"array","items":{"type":"string"},"minItems":1,"description":"Role IDs to assign"},"securityTagIds":{"type":"array","items":{"type":"string"},"description":"Security tag IDs (required for record type, ignored for contributor/delivery)"}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"PolicyFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyFindManyResponse","description":"The response for a policy find many request.","additionalProperties":false,"required":["data","links","included"],"type":"object","properties":{"data":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policies"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"},"next":{"type":"string","nullable":true}},"additionalProperties":false},"included":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"meta":{"type":"object","properties":{"cursor":{"type":"string","nullable":true}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyAttributes","description":"The attributes for a policy.","additionalProperties":false,"required":["resourceType"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this policy applies to"}}},"PolicyRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyRelationships","description":"Relationships for a policy: tenant, role, and security tag.","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"},"role":{"$ref":"#/components/schemas/RoleRelationship"},"template":{"$ref":"#/components/schemas/PolicyTemplateRelationship"},"securityTag":{"$ref":"#/components/schemas/SecurityTagRelationship"}},"required":["tenant","role"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"RoleRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IRoleRelationship","description":"A relationship to a role","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["userRoles"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateRelationship","description":"A relationship to a policy template","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"SecurityTagRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagRelationship","description":"A relationship to a security tag","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policyTemplates/{templateId}/policies":{"post":{"summary":"Create policies from a template (cartesian product of roles x security tags)","operationId":"policyTemplatePoliciesCreate","tags":["Tenants"],"parameters":[{"name":"templateId","description":"The ID of the policy template","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssignPolicyTemplateRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get all policies for a tenant

> Returns Security Policies belonging to the caller's tenant. Security Policies define what actions a Role can perform on specific resources (Records, Contributors, etc.) optionally scoped to a Security Tag. Results can be filtered by policy label, role ID, or security tag ID and paginated using \`page.cursor\`. Result ordering follows the underlying index order for deterministic cursor continuation.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyFindManyResponse","description":"The response for a policy find many request.","additionalProperties":false,"required":["data","links","included"],"type":"object","properties":{"data":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policies"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"},"next":{"type":"string","nullable":true}},"additionalProperties":false},"included":{"type":"array","items":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyTemplateAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyTemplateRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"}},"required":["tenantId"],"additionalProperties":false}}}},"meta":{"type":"object","properties":{"cursor":{"type":"string","nullable":true}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyAttributes","description":"The attributes for a policy.","additionalProperties":false,"required":["resourceType"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this policy applies to"}}},"PolicyRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyRelationships","description":"Relationships for a policy: tenant, role, and security tag.","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"},"role":{"$ref":"#/components/schemas/RoleRelationship"},"template":{"$ref":"#/components/schemas/PolicyTemplateRelationship"},"securityTag":{"$ref":"#/components/schemas/SecurityTagRelationship"}},"required":["tenant","role"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"RoleRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IRoleRelationship","description":"A relationship to a role","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["userRoles"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateRelationship","description":"A relationship to a policy template","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"SecurityTagRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagRelationship","description":"A relationship to a security tag","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateAttributes","description":"The attributes for a policy template.","additionalProperties":false,"required":["resourceType","name","label","actions"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this template targets"},"name":{"type":"string","description":"The name of the policy template, cannot be changed after creation"},"label":{"type":"string","description":"The display label for the policy template"},"description":{"type":"string","description":"The description of the policy template"},"actions":{"type":"array","description":"The actions allowed by this policy template","items":{"type":"string"}},"locales":{"type":"array","items":{"type":"string"}},"workTypeEntityAccess":{"type":"object","additionalProperties":{"type":"object","properties":{"creditsAccess":{"type":"boolean"},"mediaAccess":{"type":"array","items":{"type":"string"}},"externalDataAccess":{"type":"boolean"}},"additionalProperties":false}},"workTypes":{"type":"array","items":{"$ref":"#/components/schemas/WorkTypes"}},"lifecyclePhases":{"type":"array","items":{"type":"string","enum":["drafting","published"]}},"workTypeLifecycleAccess":{"type":"object","description":"Per-work-type lifecycle status access, keyed by work type. Requires the statusBasedPermissions entitlement. Its presence makes the policy status-based; lifecyclePhases is then derived from these statuses. Status ids are not unique across work types, which is why this is keyed by work type.","additionalProperties":{"type":"array","items":{"type":"string"}}},"sectionIds":{"type":"array","items":{"type":"string"}},"createSources":{"type":"array","items":{"type":"string","enum":["custom","origin"]}},"updateTypes":{"type":"array","items":{"type":"string","enum":["regular","publish"]}}}},"WorkTypes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"WorkTypes","description":"The classification type of an entertainment work. `Movie` is a standalone feature-length film. `MovieEdit` is a variation of a Movie. `Series` is a TV or streaming series. `Season` is a season within a Series. `Episode` is a single episode within a Season. `EpisodeEdit` is a variation of an Episode. `Compilation` is an editorially curated collection of existing records.","type":"string","enum":["Movie","MovieEdit","Series","Season","Episode","EpisodeEdit","Compilation"]},"PolicyTemplateRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyTemplateRelationships","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policies":{"get":{"summary":"Get all policies for a tenant","description":"Returns Security Policies belonging to the caller's tenant. Security Policies define what actions a Role can perform on specific resources (Records, Contributors, etc.) optionally scoped to a Security Tag. Results can be filtered by policy label, role ID, or security tag ID and paginated using `page.cursor`. Result ordering follows the underlying index order for deterministic cursor continuation.","operationId":"policyFindMany","tags":["Tenants"],"parameters":[{"name":"page.cursor","description":"The cursor to use for pagination","in":"query","required":false,"schema":{"type":"string"}},{"name":"page.size","description":"The number of policies to return per page, default is 50, maximum is 200","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":200,"default":50}},{"name":"filter.role.id","description":"Filter by role ID","in":"query","required":false,"schema":{"type":"string"}},{"name":"filter.resourceType","description":"Filter by resource type","in":"query","required":false,"schema":{"type":"string","enum":["record","contributor","delivery","bulkActions"]}},{"name":"filter.template.id","description":"Filter by template ID","in":"query","required":false,"schema":{"type":"string"}},{"name":"filter.securityTag.id","description":"Filter by security tag ID","in":"query","required":false,"schema":{"type":"string"}},{"name":"filter.lifecycleStatusId","description":"Only assignments whose policy template grants this lifecycle status, for any work type.","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyFindManyResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get a policy by ID

> Returns a single Security Policy by its unique ID, scoped to the caller's tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyFindOneResponse","description":"The response for a policy find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes","relationships"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policies"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/PolicyAttributes"}]},"relationships":{"$ref":"#/components/schemas/PolicyRelationships"},"meta":{"type":"object","properties":{"tenantId":{"type":"string","description":"The tenant ID"},"avpPolicy":{"type":"object","description":"The AVP policy details","properties":{"resource":{"type":"object","properties":{"entityType":{"type":"string"},"entityId":{"type":"string"}},"required":["entityType","entityId"],"additionalProperties":false},"principal":{"type":"object","properties":{"entityType":{"type":"string"},"entityId":{"type":"string"}},"required":["entityType","entityId"],"additionalProperties":false},"actions":{"type":"array","items":{"type":"object","properties":{"actionType":{"type":"string"},"actionId":{"type":"string"}},"required":["actionType","actionId"],"additionalProperties":false}},"effect":{"type":"string","enum":["Permit","Forbid"]}},"additionalProperties":false}},"required":["tenantId"],"additionalProperties":false}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"PolicyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyAttributes","description":"The attributes for a policy.","additionalProperties":false,"required":["resourceType"],"type":"object","properties":{"resourceType":{"type":"string","enum":["record","contributor","delivery","bulkActions"],"description":"The resource type this policy applies to"}}},"PolicyRelationships":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IPolicyRelationships","description":"Relationships for a policy: tenant, role, and security tag.","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"},"role":{"$ref":"#/components/schemas/RoleRelationship"},"template":{"$ref":"#/components/schemas/PolicyTemplateRelationship"},"securityTag":{"$ref":"#/components/schemas/SecurityTagRelationship"}},"required":["tenant","role"],"additionalProperties":false},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"RoleRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IRoleRelationship","description":"A relationship to a role","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["userRoles"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"PolicyTemplateRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyTemplateRelationship","description":"A relationship to a policy template","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["policyTemplates"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"SecurityTagRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagRelationship","description":"A relationship to a security tag","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data"],"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policies/{policyId}":{"get":{"summary":"Get a policy by ID","description":"Returns a single Security Policy by its unique ID, scoped to the caller's tenant.","operationId":"policyFindOne","tags":["Tenants"],"parameters":[{"name":"policyId","description":"The ID of the policy","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyFindOneResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Delete a policy by ID

> Permanently deletes a Security Policy by its unique ID. This action is irreversible. Users whose access depended on this policy will immediately lose the associated permissions.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WriteMetaOnlyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteMetaOnlyRequest","description":"Optional request body carrying only audit metadata, used by mutations that otherwise take no body (e.g. resource DELETEs). Lets clients attach meta.audit.source/reason to such operations. The body itself is optional; it is not otherwise required.","type":"object","additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policies/{policyId}":{"delete":{"summary":"Delete a policy by ID","description":"Permanently deletes a Security Policy by its unique ID. This action is irreversible. Users whose access depended on this policy will immediately lose the associated permissions.","operationId":"policyDeleteOne","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WriteMetaOnlyRequest"}}}},"tags":["Tenants"],"parameters":[{"name":"policyId","description":"The ID of the policy to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Execute atomic operations on policies

> Execute one or more atomic remove operations on policies. All specified policies are deleted in a single call.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"PolicyAtomicOperationsRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IPolicyAtomicOperationsRequest","description":"JSON:API Atomic Operations request for managing policies. Supports `remove` operations to delete one or more policies in a single call.","type":"object","properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"atomic:operations":{"type":"array","maxItems":100,"items":{"type":"object","properties":{"op":{"const":"remove"},"ref":{"$ref":"#/components/schemas/policyRefObject"}},"required":["op","ref"],"additionalProperties":false}}},"required":["atomic:operations"],"additionalProperties":false,"definitions":{"policyRefObject":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","const":"policies"}},"required":["id","type"],"additionalProperties":false}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"policyRefObject":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","const":"policies"}},"required":["id","type"],"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/policies/operations":{"post":{"summary":"Execute atomic operations on policies","operationId":"policyAtomicOperations","description":"Execute one or more atomic remove operations on policies. All specified policies are deleted in a single call.","tags":["Tenants"],"requestBody":{"description":"List of atomic remove operations to apply to the specified policies.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyAtomicOperationsRequest"}}},"required":true},"responses":{"204":{"description":"No Content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get all security tags for a tenant

> Returns all Security Tags belonging to the caller's tenant. Security Tags are labels that can be applied to Records to scope access control: a Security Policy can restrict access to only Records that carry a specific Security Tag. Results can be filtered by tag name.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"SecurityTagFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagFindManyResponse","description":"The response for a security tag find many request.","additionalProperties":false,"required":["data","links"],"type":"object","properties":{"data":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/SecurityTagAttributes"}]}},"required":["attributes"],"additionalProperties":false}]}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"SecurityTagAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagAttributes","description":"The attributes of a security tag in a tenant.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/securityTags":{"get":{"summary":"Get all security tags for a tenant","description":"Returns all Security Tags belonging to the caller's tenant. Security Tags are labels that can be applied to Records to scope access control: a Security Policy can restrict access to only Records that carry a specific Security Tag. Results can be filtered by tag name.","operationId":"securityTagFindMany","tags":["Tenants"],"parameters":[{"name":"filter.name","description":"Filter security tags by name","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityTagFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create a new security tag for a tenant

> Creates a new Security Tag for the caller's tenant. Once created, the tag can be assigned to Records and referenced in Security Policies to restrict record-level access.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreateSecurityTagRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagCreateRequest","description":"The request to create a security tag in a tenant.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"description":{"type":"string"},"name":{"type":"string"}},"required":["description","name"]}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"SecurityTagCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"ISecurityTagCreateOneResponse","description":"Response after creating a security tag. Contains the new security tag resource and self link.","additionalProperties":false,"required":["data","links"],"properties":{"data":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/SecurityTagAttributes","required":["description","name"]}]}},"required":["attributes"],"additionalProperties":false}]},"links":{"type":"object","properties":{"self":{"type":"string"}},"required":["self"],"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"SecurityTagAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagAttributes","description":"The attributes of a security tag in a tenant.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}}}},"paths":{"/securityTags":{"post":{"summary":"Create a new security tag for a tenant","description":"Creates a new Security Tag for the caller's tenant. Once created, the tag can be assigned to Records and referenced in Security Policies to restrict record-level access.","operationId":"securityTagCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSecurityTagRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityTagCreateOneResponse"}}}}}}}}}
```

## Get a security tag by ID

> Returns a single Security Tag by its unique ID, scoped to the caller's tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"SecurityTagFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagFindOneResponse","description":"The response for a security tag find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/SecurityTagAttributes","required":["description"]}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"SecurityTagAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagAttributes","description":"The attributes of a security tag in a tenant.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}}}},"paths":{"/securityTags/{securityTagId}":{"get":{"summary":"Get a security tag by ID","description":"Returns a single Security Tag by its unique ID, scoped to the caller's tenant.","operationId":"securityTagFindOne","tags":["Tenants"],"parameters":[{"name":"securityTagId","description":"The ID of the security tag to retrieve","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityTagFindOneResponse"}}}}}}}}}
```

## Delete a security tag by ID

> Permanently deletes a Security Tag by its unique ID. This action is irreversible. Any Records that were tagged with this Security Tag and any Policies that referenced it will no longer have the tag association.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WriteMetaOnlyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteMetaOnlyRequest","description":"Optional request body carrying only audit metadata, used by mutations that otherwise take no body (e.g. resource DELETEs). Lets clients attach meta.audit.source/reason to such operations. The body itself is optional; it is not otherwise required.","type":"object","additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/securityTags/{securityTagId}":{"delete":{"summary":"Delete a security tag by ID","description":"Permanently deletes a Security Tag by its unique ID. This action is irreversible. Any Records that were tagged with this Security Tag and any Policies that referenced it will no longer have the tag association.","operationId":"securityTagDeleteOne","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WriteMetaOnlyRequest"}}}},"tags":["Tenants"],"parameters":[{"name":"securityTagId","description":"The ID of the security tag to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Update a security tag by ID

> Updates an existing Security Tag by its unique ID. Only the fields provided in the request body are modified. The updated tag is returned in the response.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UpdateSecurityTagRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagUpdateRequest","description":"The request to update a security tag in a tenant.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string"},"description":{"type":"string"}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"SecurityTagFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagFindOneResponse","description":"The response for a security tag find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["securityTags"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/SecurityTagAttributes","required":["description"]}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"SecurityTagAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ISecurityTagAttributes","description":"The attributes of a security tag in a tenant.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/securityTags/{securityTagId}":{"patch":{"summary":"Update a security tag by ID","description":"Updates an existing Security Tag by its unique ID. Only the fields provided in the request body are modified. The updated tag is returned in the response.","operationId":"securityTagUpdateOne","tags":["Tenants"],"parameters":[{"name":"securityTagId","description":"The ID of the security tag to update","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSecurityTagRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityTagFindOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get all api keys for a tenant

> Returns all API Keys belonging to the caller's tenant. API Keys enable machine-to-machine (M2M) authentication against the Origin Studio API and are associated with one or more Roles that determine their permissions. Note: the secret key value is only returned at creation time and cannot be retrieved later.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ApiKeyFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyFindManyResponse","description":"The response for a api key find many request.","additionalProperties":false,"required":["data","links"],"type":"object","properties":{"data":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/ApiKeyAttributes"}]}},"required":["attributes"],"additionalProperties":false}]}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"ApiKeyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyAttributes","description":"The attributes of an api key in a tenant. The raw key value is never returned here — it is available only in the create response, which uses ApiKeyCreateAttributes.json.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}},"valuePreview":{"description":"Masked, non-secret preview of the key value, e.g. ak_prd_••••••••1a2b. Used to identify a key in a list.","type":"string"},"expiresAt":{"description":"ISO 8601 timestamp after which the key is refused.","type":"string"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/apiKeys":{"get":{"summary":"Get all api keys for a tenant","description":"Returns all API Keys belonging to the caller's tenant. API Keys enable machine-to-machine (M2M) authentication against the Origin Studio API and are associated with one or more Roles that determine their permissions. Note: the secret key value is only returned at creation time and cannot be retrieved later.","operationId":"apiKeyFindMany","tags":["Tenants"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create a new api key for a tenant

> Creates a new API Key for the caller's tenant. The secret key value is only returned once in this response and cannot be retrieved again — store it securely. The key can be assigned to one or more Roles to define its permissions within the tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreateApiKeyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyCreateRequest","description":"The request to create an api key in a tenant. Roles are specified via `relationships.roles` as an array of role resource identifiers.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes","relationships"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["apiKeys"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"description":{"type":"string"},"name":{"type":"string"},"expiresInDays":{"description":"Validity window for the key. The key stops authenticating once this many days have passed since creation. Defaults to 90 when omitted.","type":"integer","enum":[30,60,90,180,365]}},"required":["description","name"]},"relationships":{"type":"object","additionalProperties":false,"required":["roles"],"properties":{"roles":{"type":"object","additionalProperties":false,"required":["data"],"properties":{"data":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["id","type"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["userRoles"]}}}}}}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ApiKeyCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IApiKeyCreateOneResponse","description":"Response after creating an API key. Contains the new API key resource and self link. This is the only response that includes the raw key value.","additionalProperties":false,"required":["data","links"],"properties":{"data":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/ApiKeyCreateAttributes","required":["description","name","value"]}]}},"required":["attributes"],"additionalProperties":false}]},"links":{"type":"object","properties":{"self":{"type":"string"}},"required":["self"],"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"ApiKeyCreateAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyCreateAttributes","description":"Attributes returned when an API key is created. This is the only response that carries the raw key value — it is stored only as a hash, so it cannot be retrieved again. Clients must surface it to the user immediately.","type":"object","additionalProperties":false,"required":["description","name","value"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}},"value":{"description":"The raw API key, shown exactly once. Format: ak_<env>_<32 hex chars>.","type":"string"},"valuePreview":{"description":"Masked, non-secret preview of the key value, e.g. ak_prd_••••••••1a2b.","type":"string"},"expiresAt":{"description":"ISO 8601 timestamp after which the key is refused.","type":"string"}}}}},"paths":{"/apiKeys":{"post":{"summary":"Create a new api key for a tenant","description":"Creates a new API Key for the caller's tenant. The secret key value is only returned once in this response and cannot be retrieved again — store it securely. The key can be assigned to one or more Roles to define its permissions within the tenant.","operationId":"apiKeyCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyCreateOneResponse"}}}}}}}}}
```

## Get an api key by ID

> Returns metadata for a single API Key by its unique ID, scoped to the caller's tenant. The secret key value is not included in the response.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ApiKeyFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyFindOneResponse","description":"The response for a api key find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["apiKeys"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/ApiKeyAttributes","required":["description"]}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"ApiKeyAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IApiKeyAttributes","description":"The attributes of an api key in a tenant. The raw key value is never returned here — it is available only in the create response, which uses ApiKeyCreateAttributes.json.","type":"object","additionalProperties":false,"required":["description","name"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}},"valuePreview":{"description":"Masked, non-secret preview of the key value, e.g. ak_prd_••••••••1a2b. Used to identify a key in a list.","type":"string"},"expiresAt":{"description":"ISO 8601 timestamp after which the key is refused.","type":"string"}}}}},"paths":{"/apiKeys/{apiKeyId}":{"get":{"summary":"Get an api key by ID","description":"Returns metadata for a single API Key by its unique ID, scoped to the caller's tenant. The secret key value is not included in the response.","operationId":"apiKeyFindOne","tags":["Tenants"],"parameters":[{"name":"apiKeyId","description":"The ID of the api key to retrieve","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyFindOneResponse"}}}}}}}}}
```

## Delete an api key by ID

> Permanently revokes and deletes an API Key by its unique ID. Any clients using this key will immediately lose access to the API. This action is irreversible.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WriteMetaOnlyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteMetaOnlyRequest","description":"Optional request body carrying only audit metadata, used by mutations that otherwise take no body (e.g. resource DELETEs). Lets clients attach meta.audit.source/reason to such operations. The body itself is optional; it is not otherwise required.","type":"object","additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/apiKeys/{apiKeyId}":{"delete":{"summary":"Delete an api key by ID","description":"Permanently revokes and deletes an API Key by its unique ID. Any clients using this key will immediately lose access to the API. This action is irreversible.","operationId":"apiKeyDeleteOne","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WriteMetaOnlyRequest"}}}},"tags":["Tenants"],"parameters":[{"name":"apiKeyId","description":"The ID of the api key to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get all AI assistant configs for a tenant

> Returns all AI assistant configurations for the caller's tenant. Shows which model provider and model are selected, and whether an API key is configured.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"AiAssistantConfigFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigFindManyResponse","description":"The response for an AI assistant config find many request.","additionalProperties":false,"required":["data","links"],"type":"object","properties":{"data":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/AiAssistantConfigAttributes"}]}},"required":["attributes"],"additionalProperties":false}]}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"AiAssistantConfigAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigAttributes","description":"Per-tenant AI assistant settings (read-only view). Shows which model provider is configured, the selected model, and whether an API key is stored.","type":"object","additionalProperties":false,"required":["modelProvider","modelId","apiKeyConfigured","created","updated"],"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"The model provider type. 'bedrock' uses a Fabric-provided model. 'custom' uses a model and API key you provide."},"modelId":{"type":"string","minLength":1,"description":"The model identifier. For custom providers this is the string LiteLLM routes on, normally provider-qualified (e.g. anthropic/claude-sonnet-4); for bedrock it is the Fabric-managed Bedrock model id."},"apiKeyConfigured":{"type":"boolean","description":"Whether an API key has been securely stored for this configuration."},"apiKeyArn":{"type":"string","description":"Reference to the stored API key. The raw key is never returned. Omitted when apiKeyConfigured is false."},"created":{"type":"string","format":"date-time","description":"When this configuration was created"},"updated":{"type":"string","format":"date-time","description":"When this configuration was last updated"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/aiAssistantConfigs":{"get":{"summary":"Get all AI assistant configs for a tenant","description":"Returns all AI assistant configurations for the caller's tenant. Shows which model provider and model are selected, and whether an API key is configured.","operationId":"aiAssistantConfigFindMany","tags":["Tenants"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiAssistantConfigFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create the AI assistant config for a tenant

> Create the AI assistant configuration for the caller's tenant. Choose 'bedrock' for a Fabric-provided model or 'custom' to bring your own model and API key. A tenant may only have one configuration.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreateAiAssistantConfigRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigCreateRequest","description":"The request to create the AI assistant config for a tenant. A tenant may only have one.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"type":{"type":"string","enum":["aiAssistantConfigs"]},"attributes":{"$ref":"#/components/schemas/CreateAiAssistantConfigAttributes"}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"CreateAiAssistantConfigAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ICreateAiAssistantConfigAttributes","description":"Attributes for creating an AI assistant configuration. Choose modelProvider 'bedrock' for a Fabric-provided model, or 'custom' to bring your own model and API key.","type":"object","additionalProperties":false,"required":["modelProvider"],"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"Model source: 'bedrock' uses a Fabric-provided model (no API key needed), 'custom' lets you bring your own model and API key."},"modelId":{"type":"string","minLength":1,"description":"The model to use, as LiteLLM routes on it — normally provider-qualified, e.g. anthropic/claude-sonnet-4. Required with 'custom' modelProvider."},"apiKey":{"type":"string","description":"Write-only. Your provider API key. Stored securely and never returned in responses. Required with 'custom' modelProvider if apiKeyArn is not provided."},"apiKeyArn":{"type":"string","description":"Reference to a previously stored API key. Use this instead of apiKey if your key is already registered."}}},"AiAssistantConfigCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IAiAssistantConfigCreateOneResponse","description":"Response after creating a tenant's AI assistant config. Contains the new resource and self link.","additionalProperties":false,"required":["data","links"],"properties":{"data":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/AiAssistantConfigAttributes"}]}},"required":["attributes"],"additionalProperties":false}]},"links":{"type":"object","properties":{"self":{"type":"string"}},"required":["self"],"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"AiAssistantConfigAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigAttributes","description":"Per-tenant AI assistant settings (read-only view). Shows which model provider is configured, the selected model, and whether an API key is stored.","type":"object","additionalProperties":false,"required":["modelProvider","modelId","apiKeyConfigured","created","updated"],"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"The model provider type. 'bedrock' uses a Fabric-provided model. 'custom' uses a model and API key you provide."},"modelId":{"type":"string","minLength":1,"description":"The model identifier. For custom providers this is the string LiteLLM routes on, normally provider-qualified (e.g. anthropic/claude-sonnet-4); for bedrock it is the Fabric-managed Bedrock model id."},"apiKeyConfigured":{"type":"boolean","description":"Whether an API key has been securely stored for this configuration."},"apiKeyArn":{"type":"string","description":"Reference to the stored API key. The raw key is never returned. Omitted when apiKeyConfigured is false."},"created":{"type":"string","format":"date-time","description":"When this configuration was created"},"updated":{"type":"string","format":"date-time","description":"When this configuration was last updated"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/aiAssistantConfigs":{"post":{"summary":"Create the AI assistant config for a tenant","description":"Create the AI assistant configuration for the caller's tenant. Choose 'bedrock' for a Fabric-provided model or 'custom' to bring your own model and API key. A tenant may only have one configuration.","operationId":"aiAssistantConfigCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAiAssistantConfigRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiAssistantConfigCreateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict — a config already exists for this tenant","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get an AI assistant configuration by ID

> Returns a single AI assistant configuration by its unique ID, scoped to the caller's tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"AiAssistantConfigFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigFindOneResponse","description":"The response for an AI assistant config find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["aiAssistantConfigs"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/AiAssistantConfigAttributes"}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"AiAssistantConfigAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigAttributes","description":"Per-tenant AI assistant settings (read-only view). Shows which model provider is configured, the selected model, and whether an API key is stored.","type":"object","additionalProperties":false,"required":["modelProvider","modelId","apiKeyConfigured","created","updated"],"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"The model provider type. 'bedrock' uses a Fabric-provided model. 'custom' uses a model and API key you provide."},"modelId":{"type":"string","minLength":1,"description":"The model identifier. For custom providers this is the string LiteLLM routes on, normally provider-qualified (e.g. anthropic/claude-sonnet-4); for bedrock it is the Fabric-managed Bedrock model id."},"apiKeyConfigured":{"type":"boolean","description":"Whether an API key has been securely stored for this configuration."},"apiKeyArn":{"type":"string","description":"Reference to the stored API key. The raw key is never returned. Omitted when apiKeyConfigured is false."},"created":{"type":"string","format":"date-time","description":"When this configuration was created"},"updated":{"type":"string","format":"date-time","description":"When this configuration was last updated"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/aiAssistantConfigs/{aiAssistantConfigId}":{"get":{"summary":"Get an AI assistant configuration by ID","description":"Returns a single AI assistant configuration by its unique ID, scoped to the caller's tenant.","operationId":"aiAssistantConfigFindOne","tags":["Tenants"],"parameters":[{"name":"aiAssistantConfigId","description":"The ID of the AI assistant config to retrieve","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiAssistantConfigFindOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Delete an AI assistant configuration

> Permanently delete the AI assistant configuration for the caller's tenant. Any stored API key is also removed.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/aiAssistantConfigs/{aiAssistantConfigId}":{"delete":{"summary":"Delete an AI assistant configuration","description":"Permanently delete the AI assistant configuration for the caller's tenant. Any stored API key is also removed.","operationId":"aiAssistantConfigDeleteOne","tags":["Tenants"],"parameters":[{"name":"aiAssistantConfigId","description":"The ID of the AI assistant config to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Update an AI assistant configuration

> Update the AI assistant configuration for the caller's tenant. Only the fields provided are modified. You can change the model provider, model, API key, or endpoint URL. Stored API keys are rotated automatically when a new key is provided.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UpdateAiAssistantConfigRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigUpdateRequest","description":"Request to update the AI assistant configuration. All attributes are optional — only provided fields are modified.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["aiAssistantConfigs"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"Change the model provider type. Switching between 'bedrock' and 'custom' is supported."},"modelId":{"type":"string","minLength":1,"description":"The model identifier, as LiteLLM routes on it — normally provider-qualified, e.g. anthropic/claude-sonnet-4."},"apiKey":{"type":"string","description":"Write-only. Your provider API key. Stored securely and never returned. Use this to rotate an existing key."},"apiKeyArn":{"type":"string","description":"Reference to a previously stored API key."}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"AiAssistantConfigFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigFindOneResponse","description":"The response for an AI assistant config find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["aiAssistantConfigs"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/AiAssistantConfigAttributes"}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"AiAssistantConfigAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAiAssistantConfigAttributes","description":"Per-tenant AI assistant settings (read-only view). Shows which model provider is configured, the selected model, and whether an API key is stored.","type":"object","additionalProperties":false,"required":["modelProvider","modelId","apiKeyConfigured","created","updated"],"properties":{"modelProvider":{"type":"string","enum":["bedrock","custom"],"description":"The model provider type. 'bedrock' uses a Fabric-provided model. 'custom' uses a model and API key you provide."},"modelId":{"type":"string","minLength":1,"description":"The model identifier. For custom providers this is the string LiteLLM routes on, normally provider-qualified (e.g. anthropic/claude-sonnet-4); for bedrock it is the Fabric-managed Bedrock model id."},"apiKeyConfigured":{"type":"boolean","description":"Whether an API key has been securely stored for this configuration."},"apiKeyArn":{"type":"string","description":"Reference to the stored API key. The raw key is never returned. Omitted when apiKeyConfigured is false."},"created":{"type":"string","format":"date-time","description":"When this configuration was created"},"updated":{"type":"string","format":"date-time","description":"When this configuration was last updated"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/aiAssistantConfigs/{aiAssistantConfigId}":{"patch":{"summary":"Update an AI assistant configuration","description":"Update the AI assistant configuration for the caller's tenant. Only the fields provided are modified. You can change the model provider, model, API key, or endpoint URL. Stored API keys are rotated automatically when a new key is provided.","operationId":"aiAssistantConfigUpdateOne","tags":["Tenants"],"parameters":[{"name":"aiAssistantConfigId","description":"The ID of the AI assistant config to update","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAiAssistantConfigRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AiAssistantConfigFindOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Get all event subscriptions for a tenant

> Returns all Event Subscriptions registered for the caller's tenant. Event Subscriptions configure webhook endpoints to receive real-time notifications when specific platform events occur (e.g., record created, job completed).

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventSubscriptionFindManyResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionFindManyResponse","description":"The response for a event subscription find many request.","additionalProperties":false,"required":["data","links"],"type":"object","properties":{"data":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/EventSubscriptionAttributes"}]}},"required":["attributes"],"additionalProperties":false}]}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false},"meta":{"type":"object","properties":{"awsRegion":{"type":"string"},"awsAccountId":{"type":"string"},"tenantId":{"type":"string"},"awsSubscriptions":{"type":"array","items":{"type":"object","properties":{"subscriptionArn":{"type":"string"},"pendingConfirmation":{"type":"boolean"}},"required":["subscriptionArn","pendingConfirmation"],"additionalProperties":false}}},"required":["awsRegion","awsAccountId","tenantId"," awsSubscriptions"],"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"EventSubscriptionAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionAttributes","description":"The attributes of a event subscription in a tenant.","type":"object","additionalProperties":false,"required":["name","type","endpoint","subscriptionArn"],"properties":{"name":{"type":"string"},"type":{"type":"string"},"endpoint":{"type":"string"},"subscriptionArn":{"type":"string"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/eventSubscriptions":{"get":{"summary":"Get all event subscriptions for a tenant","description":"Returns all Event Subscriptions registered for the caller's tenant. Event Subscriptions configure webhook endpoints to receive real-time notifications when specific platform events occur (e.g., record created, job completed).","operationId":"eventSubscriptionFindMany","tags":["Tenants"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventSubscriptionFindManyResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create a new event subscription for a tenant

> Creates a new Event Subscription for the caller's tenant. Specify the event types to subscribe to and the URL of the webhook endpoint that should receive the notifications.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CreateEventSubscriptionRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionCreateOneRequest","description":"The request to create an event subscription in a tenant.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["eventSubscriptions"]},"attributes":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string"},"type":{"type":"string"},"endpoint":{"type":"string"}},"required":["name","type","endpoint"]}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"EventSubscriptionCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","title":"IEventSubscriptionCreateOneResponse","description":"Response after creating an event subscription. Contains the new subscription resource and self link.","additionalProperties":false,"required":["data","links"],"properties":{"data":{"allOf":[{"$ref":"#/components/schemas/BaseResource"},{"type":"object","properties":{"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/EventSubscriptionAttributes","required":["name","type","endpoint"]}]}},"required":["attributes"],"additionalProperties":false}]},"links":{"type":"object","properties":{"self":{"type":"string"}},"required":["self"],"additionalProperties":false}}},"BaseResource":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResource","description":"JSON:API resource identifier. All Origin Studio API resource objects include at least an `id` (unique string identifier) and a `type` (the JSON:API resource type name, e.g. records, contributors).","type":"object","properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["id","type"],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"EventSubscriptionAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionAttributes","description":"The attributes of a event subscription in a tenant.","type":"object","additionalProperties":false,"required":["name","type","endpoint","subscriptionArn"],"properties":{"name":{"type":"string"},"type":{"type":"string"},"endpoint":{"type":"string"},"subscriptionArn":{"type":"string"}}}}},"paths":{"/eventSubscriptions":{"post":{"summary":"Create a new event subscription for a tenant","description":"Creates a new Event Subscription for the caller's tenant. Specify the event types to subscribe to and the URL of the webhook endpoint that should receive the notifications.","operationId":"eventSubscriptionCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateEventSubscriptionRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventSubscriptionCreateOneResponse"}}}}}}}}}
```

## Get an event subscription by ID

> Returns a single Event Subscription by its unique ID, scoped to the caller's tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventSubscriptionFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionFindOneResponse","description":"The response for a event subscription find one request.","type":"object","additionalProperties":false,"required":["data","links"],"properties":{"data":{"type":"object","required":["id","type","attributes"],"additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["eventSubscriptions"]},"attributes":{"allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"$ref":"#/components/schemas/EventSubscriptionAttributes"}]}}},"links":{"type":"object","required":["self"],"properties":{"self":{"type":"string"}},"additionalProperties":false}}},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"EventSubscriptionAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IEventSubscriptionAttributes","description":"The attributes of a event subscription in a tenant.","type":"object","additionalProperties":false,"required":["name","type","endpoint","subscriptionArn"],"properties":{"name":{"type":"string"},"type":{"type":"string"},"endpoint":{"type":"string"},"subscriptionArn":{"type":"string"}}}}},"paths":{"/eventSubscriptions/{eventSubscriptionId}":{"get":{"summary":"Get an event subscription by ID","description":"Returns a single Event Subscription by its unique ID, scoped to the caller's tenant.","operationId":"eventSubscriptionFindOne","tags":["Tenants"],"parameters":[{"name":"eventSubscriptionId","description":"The ID of the event subscription to retrieve","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventSubscriptionFindOneResponse"}}}}}}}}}
```

## Delete an event subscription by ID

> Permanently deletes an Event Subscription by its unique ID. The webhook endpoint will no longer receive notifications for the subscribed event types.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"WriteMetaOnlyRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteMetaOnlyRequest","description":"Optional request body carrying only audit metadata, used by mutations that otherwise take no body (e.g. resource DELETEs). Lets clients attach meta.audit.source/reason to such operations. The body itself is optional; it is not otherwise required.","type":"object","additionalProperties":false,"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/eventSubscriptions/{eventSubscriptionId}":{"delete":{"summary":"Delete an event subscription by ID","description":"Permanently deletes an Event Subscription by its unique ID. The webhook endpoint will no longer receive notifications for the subscribed event types.","operationId":"eventSubscriptionDeleteOne","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WriteMetaOnlyRequest"}}}},"tags":["Tenants"],"parameters":[{"name":"eventSubscriptionId","description":"The ID of the event subscription to delete","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create a new tenant job

> Initiates a new long-running Tenant Job for the caller's tenant. The job type is specified in the request body. Returns a job ID that can be used to poll the job status via \`GET /backgroundJobs/{jobId}\`.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TenantJobCreateOneRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantJobCreateOneRequest","description":"Request body to create a tenant background job. Specify job type and parameters.","type":"object","definitions":{"ITenantFullDeleteJobParameters":{"type":"object","properties":{"tenantIdToDelete":{"type":"string","description":"The ID of the tenant to delete"}},"required":["tenantIdToDelete"],"additionalProperties":false},"ITenantSyncSystemPoliciesJobParameters":{"type":"object","properties":{"tenantIdToSync":{"type":"string","description":"Optional: sync only this tenant instead of all tenants"}},"additionalProperties":false}},"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"allOf":[{"$ref":"#/components/schemas/BaseCreateRequest"},{"type":"object","properties":{"attributes":{"type":"object","properties":{"type":{"type":"string","enum":["fullTenantDelete","syncSystemPolicies"],"description":"The type of tenant job to create"},"parameters":{"oneOf":[{"$ref":"#/components/schemas/ITenantFullDeleteJobParameters"},{"$ref":"#/components/schemas/ITenantSyncSystemPoliciesJobParameters"}]}},"required":["type","parameters"],"additionalProperties":false}},"required":["attributes"],"additionalProperties":false}]}},"required":["data"],"additionalProperties":false},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"BaseCreateRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseCreateRequest","description":"Base JSON:API shape for create requests. The `type` field is required and must match the target resource type. The `id` field is optional; if omitted, the server generates a unique ID for the new resource.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string"},"type":{"type":"string"}},"required":["type"]},"ITenantFullDeleteJobParameters":{"type":"object","properties":{"tenantIdToDelete":{"type":"string","description":"The ID of the tenant to delete"}},"required":["tenantIdToDelete"],"additionalProperties":false},"ITenantSyncSystemPoliciesJobParameters":{"type":"object","properties":{"tenantIdToSync":{"type":"string","description":"Optional: sync only this tenant instead of all tenants"}},"additionalProperties":false},"TenantJobCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantJobCreateOneResponse","description":"Response after creating a tenant background job. Contains the new job resource and self link.","type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/BaseCreateRequest"},{"additionalProperties":false,"properties":{"id":{"type":"string"},"attributes":{"$ref":"#/components/schemas/TenantJob"},"links":{"type":"object","properties":{"self":{"type":"string"}},"required":["self"]},"relationships":{"type":"object","properties":{"tenant":{"$ref":"#/components/schemas/TenantRelationship"}},"required":["tenant"],"additionalProperties":false}},"required":["id","attributes","links","relationships"]}]}},"required":["data"],"additionalProperties":false},"TenantJob":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantJob","description":"Attributes for a tenant-level background job (e.g. full tenant delete). Extends generic background job attributes.","type":"object","allOf":[{"$ref":"#/components/schemas/BackgroundJobAttributes"},{"type":"object","properties":{"type":{"type":"string","enum":["fullTenantDelete","syncSystemPolicies"]},"parameters":{"type":"object","additionalProperties":true}},"required":["type","parameters"],"additionalProperties":false}],"required":["arn","status","created","updated","type","parameters"],"additionalProperties":false},"BackgroundJobAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBackgroundJobAttributes","description":"Attributes for a background job. Background jobs represent long-running asynchronous operations (e.g. contributor deletion, tenant data export). Includes current status, job type, parameters, optional output on completion, optional error details on failure, and optional item progress counts for batch jobs.","type":"object","allOf":[{"$ref":"#/components/schemas/BaseResourceAttributes"},{"type":"object","properties":{"type":{"type":"string"},"parameters":{"type":"object"},"status":{"$ref":"#/components/schemas/BackgroundJobStatus"},"output":{"type":"object"},"totalItemsCount":{"type":"integer","minimum":0,"description":"Total number of items in a batch job, when applicable."},"successItemsCount":{"type":"integer","minimum":0,"description":"Number of items processed successfully in a batch job, when applicable."},"failedItemsCount":{"type":"integer","minimum":0,"description":"Number of items that failed in a batch job, when applicable."},"error":{"type":"object","properties":{"message":{"type":"string"},"code":{"type":"string"}},"required":["message","code"],"additionalProperties":false}},"required":["type","parameters","status"],"additionalProperties":false}],"additionalProperties":false},"BaseResourceAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBaseResourceAttributes","description":"Common timestamps present on all resource attribute objects. `created` is the ISO 8601 date-time when the resource was first created; `updated` is the date-time of the most recent modification.","type":"object","additionalProperties":false,"required":["created","updated"],"properties":{"created":{"type":"string","format":"date-time"},"updated":{"type":"string","format":"date-time"}}},"BackgroundJobStatus":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IBackgroundJobStatus","description":"Status of a background job: ABORTED, FAILED, PENDING_REDRIVE, RUNNING, SUCCEEDED, or TIMED_OUT.","type":"string","enum":["ABORTED","FAILED","PENDING_REDRIVE","RUNNING","SUCCEEDED","TIMED_OUT"]},"TenantRelationship":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ITenantRelationship","description":"A relationship to a tenant","type":"object","properties":{"data":{"additionalProperties":false,"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["tenants"]}},"required":["id","type"]},"links":{"$ref":"#/components/schemas/LinksRelated"}},"required":["data","links"],"additionalProperties":false},"LinksRelated":{"$schema":"http://json-schema.org/draft-07/schema#","title":"ILinks","description":"A JSON:API links object with an absolute or relative 'related' link","type":"object","required":["related"],"properties":{"related":{"type":"string"}},"additionalProperties":false},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/tenantJobs":{"post":{"summary":"Create a new tenant job","description":"Initiates a new long-running Tenant Job for the caller's tenant. The job type is specified in the request body. Returns a job ID that can be used to poll the job status via `GET /backgroundJobs/{jobId}`.","operationId":"tenantJobCreateOne","tags":["Tenants"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TenantJobCreateOneRequest"}}}},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TenantJobCreateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Create the usage plan for a tenant

> Create the usage plan configuration for the provided tenant.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Tenants","description":"Manage policies, security tags, and other resources in the context of a tenant. A tenant is an organizational unit (e.g. a company or studio) that owns its own resources. A security policy defines what a role can do within a tenant. A security tag is a label used to categorize resources and restrict access."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/usagePlans":{"post":{"summary":"Create the usage plan for a tenant","description":"Create the usage plan configuration for the provided tenant.","operationId":"usagePlanCreateOne","tags":["Tenants"],"parameters":[{"name":"tenantId","description":"The ID of the tenant to create the usage plan for.","in":"query","required":true,"style":"form","explode":false,"schema":{"type":"string"}}],"responses":{"204":{"description":"No content"},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Conflict — a usage plan already exists for this tenant","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```