> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Record decision

> Evaluates policies AND persists the result with full audit trail.

Supports idempotency: if the same idempotency_key is provided twice,
returns the original decision without re-evaluating.

Returns:
- **decision**: The recorded decision with full context
- **is_new**: False if returned from idempotency cache
- **duration_ms**: Total request duration



## OpenAPI

````yaml /api/openapi.json post /v1/decisions/record
openapi: 3.1.0
info:
  title: MeshQu API
  description: >-
    Governance infrastructure for policy-aware AI decisions. MeshQu does not run
    tools. It governs decisions about them.
  version: 1.9.0
  contact:
    name: MeshQu Support
    email: support@meshqu.com
  license:
    name: Proprietary
servers:
  - url: https://api.meshqu.com
    description: Deployed environment
security:
  - apiKey: []
    tenantId: []
tags:
  - name: Operations
    description: Health, readiness, metrics, and signing keys
  - name: Policies
    description: Policy management
  - name: Policy Groups
    description: Policy group management
  - name: Decisions
    description: Policy evaluation and recording
  - name: Chains
    description: Decision chain verification and sealing
  - name: Receipts
    description: Public receipt and bundle retrieval
  - name: Forms
    description: Attestation forms and public submission
  - name: Alerts
    description: Alert management and webhooks
  - name: Audit
    description: Audit log retrieval and verification
  - name: API Keys
    description: API key administration
  - name: Admin
    description: Tenant and platform administration
  - name: Dashboard
    description: Console dashboard data
  - name: Metrics
    description: Decision and overview metrics
  - name: Fields
    description: Field catalogue
  - name: Settings
    description: Tenant settings
  - name: Rule Creation Logs
    description: Rule authoring telemetry
paths:
  /v1/decisions/record:
    post:
      tags:
        - Decisions
      summary: Record decision
      description: |-
        Evaluates policies AND persists the result with full audit trail.

        Supports idempotency: if the same idempotency_key is provided twice,
        returns the original decision without re-evaluating.

        Returns:
        - **decision**: The recorded decision with full context
        - **is_new**: False if returned from idempotency cache
        - **duration_ms**: Total request duration
      operationId: postV1DecisionsRecord
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description: Request to record a decision with evaluation
              type: object
              properties:
                context:
                  description: Canonical DecisionContext for policy evaluation
                  type: object
                  properties:
                    decision_type:
                      minLength: 1
                      description: Type of decision being evaluated
                      type: string
                    fields:
                      description: Domain-agnostic field values for evaluation
                      type: object
                      additionalProperties: {}
                    evidence:
                      description: Supporting evidence for the decision
                      type: array
                      items:
                        type: object
                        properties:
                          kind:
                            description: >-
                              Type of evidence (document, graph_query,
                              external_api)
                            type: string
                          ref:
                            description: Reference identifier for the evidence
                            type: string
                          hash:
                            description: Content hash for verification
                            type: string
                          data:
                            description: Additional evidence metadata
                            type: object
                            additionalProperties: {}
                        required:
                          - kind
                    metadata:
                      additionalProperties: true
                      type: object
                      properties:
                        actor_id:
                          description: Actor making the request
                          type: string
                        correlation_id:
                          description: Request correlation ID
                          type: string
                        ip_address:
                          description: IP address of the requestor
                          type: string
                        user_agent:
                          description: User agent string
                          type: string
                        timestamp:
                          format: date-time
                          description: Request timestamp
                          type: string
                    source_artifact:
                      description: Cryptographic binding to a source document
                      type: object
                      properties:
                        type:
                          description: Type of source artifact
                          anyOf:
                            - type: string
                              enum:
                                - PDF
                            - type: string
                              enum:
                                - DOCX
                            - type: string
                              enum:
                                - JSON_PAYLOAD
                            - type: string
                              enum:
                                - IMAGE
                            - type: string
                              enum:
                                - STRING
                            - type: string
                              enum:
                                - OTHER
                        hash:
                          pattern: ^[a-f0-9]{64}$
                          description: >-
                            SHA-256 hash of the artifact (64 lowercase hex
                            characters)
                          type: string
                        hash_algorithm:
                          description: Hash algorithm used (currently only SHA-256)
                          type: string
                          enum:
                            - SHA-256
                        reference_id:
                          maxLength: 255
                          description: Client reference ID for the artifact
                          type: string
                        filename:
                          maxLength: 255
                          description: Original filename of the artifact
                          type: string
                        byte_size:
                          minimum: 0
                          description: Size of the artifact in bytes
                          type: integer
                      required:
                        - type
                        - hash
                        - hash_algorithm
                  required:
                    - decision_type
                    - fields
                options:
                  type: object
                  properties:
                    idempotency_key:
                      minLength: 1
                      maxLength: 255
                      description: Unique key to prevent duplicate recordings
                      type: string
                    chain:
                      description: Decision chain linkage for workflow/case grouping
                      type: object
                      properties:
                        chain_id:
                          format: uuid
                          description: >-
                            Chain ID to group this decision into an ordered
                            sequence
                          type: string
                        chain_step:
                          minimum: 1
                          description: >-
                            Step number within the chain (auto-assigned if
                            omitted)
                          type: integer
                        parent_decision_id:
                          format: uuid
                          description: >-
                            Parent decision within the same chain (causal
                            lineage)
                          type: string
                      required:
                        - chain_id
                action:
                  description: Action bound to this decision receipt
                  type: object
                  properties:
                    type:
                      description: >-
                        Type of action authorized (e.g., payment_execute,
                        loan_approve)
                      type: string
                    reference_id:
                      description: Client's reference ID for the action (e.g., INV-88423)
                      type: string
                    metadata:
                      description: Additional action metadata
                      type: object
                      additionalProperties: {}
                  required:
                    - type
                    - reference_id
                actor:
                  description: Actor attribution — who or what made this decision
                  type: object
                  properties:
                    id:
                      minLength: 1
                      maxLength: 255
                      description: Stable identifier for the actor
                      type: string
                    type:
                      description: Whether the actor is human or automated
                      anyOf:
                        - type: string
                          enum:
                            - human
                        - type: string
                          enum:
                            - automated
                    role:
                      maxLength: 255
                      description: >-
                        Caller-defined role label (e.g., MLRO,
                        compliance_analyst)
                      type: string
                    authority:
                      maxLength: 255
                      description: Freeform authority context (e.g., final_disposition)
                      type: string
                    display_name:
                      maxLength: 255
                      description: Human-readable name for UI/reports
                      type: string
                  required:
                    - id
                    - type
                evidence_manifest_digest:
                  description: >-
                    Evidence manifest digest — null or absent means no evidence
                    is bound
                  anyOf:
                    - pattern: ^[0-9a-f]{64}$
                      description: >-
                        SHA-256 hex digest (64 lowercase hex chars) of the
                        canonical evidence manifest
                      type: string
                    - type: 'null'
                evidence_manifest:
                  description: Full evidence manifest object — server stores and indexes it
                  anyOf:
                    - description: >-
                        Multi-item evidence manifest bound to a governed
                        decision
                      additionalProperties: false
                      type: object
                      properties:
                        manifest_version:
                          description: Manifest schema version. Currently locked to "1".
                          type: string
                          enum:
                            - '1'
                        items:
                          description: Evidence items examined for this decision
                          type: array
                          items:
                            description: >-
                              One artifact examined when making a governed
                              decision
                            additionalProperties: false
                            type: object
                            properties:
                              kind:
                                minLength: 1
                                description: >-
                                  Category of this evidence item (e.g.
                                  kyc_record, sanctions_screening_result). Named
                                  EvidenceItemKind values have UI labels;
                                  unknown strings are displayed verbatim.
                                type: string
                              mime_type:
                                minLength: 1
                                description: >-
                                  IANA media type of the artifact
                                  (caller-attested)
                                type: string
                              byte_length:
                                minimum: 0
                                description: >-
                                  Size of the artifact in bytes
                                  (caller-attested)
                                type: integer
                              source_system:
                                minLength: 1
                                description: >-
                                  Identifier of the system that produced or
                                  holds the artifact
                                type: string
                              artifact_locator:
                                description: >-
                                  Optional caller-attested pointer to the
                                  immutable, version-pinned artifact (additive
                                  v2.x)
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      scheme:
                                        minLength: 1
                                        description: >-
                                          Resolution scheme for uri (e.g. 's3',
                                          'https', 'dms', 'cas')
                                        type: string
                                      uri:
                                        minLength: 1
                                        description: >-
                                          Resolvable address of the artifact
                                          within the custodian environment
                                        type: string
                                      version_id:
                                        minLength: 1
                                        description: >-
                                          Immutable version pin; MAY be omitted
                                          only when uri is content-addressed
                                        type: string
                                    required:
                                      - scheme
                                      - uri
                                  - type: 'null'
                              retrieval_time:
                                format: date-time
                                description: >-
                                  ISO 8601 timestamp at which the artifact was
                                  retrieved from the source system
                                type: string
                              custodian_id:
                                description: >-
                                  Identifier of the custodian that provided or
                                  attests to this artifact
                                anyOf:
                                  - minLength: 1
                                    type: string
                                  - type: 'null'
                              normalization_profile:
                                description: >-
                                  Identifier of the normalisation profile
                                  applied before hashing, if any
                                anyOf:
                                  - minLength: 1
                                    type: string
                                  - type: 'null'
                              content_hash:
                                pattern: ^[0-9a-f]{64}$
                                description: >-
                                  SHA-256 content hash of the artifact (64
                                  lowercase hex chars)
                                type: string
                              signature:
                                description: >-
                                  Optional Ed25519 custodian signature over this
                                  item
                                anyOf:
                                  - description: >-
                                      Custodian signature over a single evidence
                                      item
                                    type: object
                                    properties:
                                      custodian_kid:
                                        minLength: 1
                                        description: >-
                                          Key ID of the custodian signing key
                                          (opaque string; convention:
                                          <custodian_id>/<label>)
                                        type: string
                                      signature:
                                        minLength: 1
                                        description: >-
                                          Ed25519 signature over
                                          sha256(canonical(item minus this
                                          field)), base64url-encoded
                                        type: string
                                      algorithm:
                                        description: >-
                                          Signing algorithm. Fixed to ed25519 in
                                          manifest_version 1.
                                        type: string
                                        enum:
                                          - ed25519
                                    required:
                                      - custodian_kid
                                      - signature
                                      - algorithm
                                  - type: 'null'
                            required:
                              - kind
                              - mime_type
                              - byte_length
                              - source_system
                              - retrieval_time
                              - content_hash
                        manifest_digest:
                          description: >-
                            Self-describing manifest digest (optional; computed
                            by server if absent)
                          anyOf:
                            - pattern: ^[0-9a-f]{64}$
                              description: >-
                                Pre-computed sha256(canonical(manifest minus
                                this field)). Server re-computes and validates
                                when present; computes when absent.
                              type: string
                            - type: 'null'
                      required:
                        - manifest_version
                        - items
                    - type: 'null'
              required:
                - context
        description: Request to record a decision with evaluation
      responses:
        '200':
          description: Response from record decision endpoint
          content:
            application/json:
              schema:
                description: Response from record decision endpoint
                type: object
                properties:
                  decision:
                    description: A recorded decision with full context
                    type: object
                    properties:
                      id:
                        format: uuid
                        type: string
                      tenant_id:
                        format: uuid
                        type: string
                      idempotency_key:
                        type: string
                      decision_type:
                        type: string
                      decision:
                        description: Decision outcome
                        anyOf:
                          - type: string
                            enum:
                              - ALLOW
                          - type: string
                            enum:
                              - DENY
                          - type: string
                            enum:
                              - REVIEW
                          - type: string
                            enum:
                              - ALERT
                      context:
                        description: Canonical DecisionContext for policy evaluation
                        type: object
                        properties:
                          decision_type:
                            minLength: 1
                            description: Type of decision being evaluated
                            type: string
                          fields:
                            description: Domain-agnostic field values for evaluation
                            type: object
                            additionalProperties: {}
                          evidence:
                            description: Supporting evidence for the decision
                            type: array
                            items:
                              type: object
                              properties:
                                kind:
                                  description: >-
                                    Type of evidence (document, graph_query,
                                    external_api)
                                  type: string
                                ref:
                                  description: Reference identifier for the evidence
                                  type: string
                                hash:
                                  description: Content hash for verification
                                  type: string
                                data:
                                  description: Additional evidence metadata
                                  type: object
                                  additionalProperties: {}
                              required:
                                - kind
                          metadata:
                            additionalProperties: true
                            type: object
                            properties:
                              actor_id:
                                description: Actor making the request
                                type: string
                              correlation_id:
                                description: Request correlation ID
                                type: string
                              ip_address:
                                description: IP address of the requestor
                                type: string
                              user_agent:
                                description: User agent string
                                type: string
                              timestamp:
                                format: date-time
                                description: Request timestamp
                                type: string
                          source_artifact:
                            description: Cryptographic binding to a source document
                            type: object
                            properties:
                              type:
                                description: Type of source artifact
                                anyOf:
                                  - type: string
                                    enum:
                                      - PDF
                                  - type: string
                                    enum:
                                      - DOCX
                                  - type: string
                                    enum:
                                      - JSON_PAYLOAD
                                  - type: string
                                    enum:
                                      - IMAGE
                                  - type: string
                                    enum:
                                      - STRING
                                  - type: string
                                    enum:
                                      - OTHER
                              hash:
                                pattern: ^[a-f0-9]{64}$
                                description: >-
                                  SHA-256 hash of the artifact (64 lowercase hex
                                  characters)
                                type: string
                              hash_algorithm:
                                description: Hash algorithm used (currently only SHA-256)
                                type: string
                                enum:
                                  - SHA-256
                              reference_id:
                                maxLength: 255
                                description: Client reference ID for the artifact
                                type: string
                              filename:
                                maxLength: 255
                                description: Original filename of the artifact
                                type: string
                              byte_size:
                                minimum: 0
                                description: Size of the artifact in bytes
                                type: integer
                            required:
                              - type
                              - hash
                              - hash_algorithm
                        required:
                          - decision_type
                          - fields
                      result:
                        description: Result of a policy evaluation
                        type: object
                        properties:
                          decision:
                            description: 'Final decision: ALLOW, DENY, REVIEW, or ALERT'
                            anyOf:
                              - type: string
                                enum:
                                  - ALLOW
                              - type: string
                                enum:
                                  - DENY
                              - type: string
                                enum:
                                  - REVIEW
                              - type: string
                                enum:
                                  - ALERT
                          violations:
                            description: List of policy violations detected
                            type: array
                            items:
                              type: object
                              properties:
                                rule_code:
                                  description: >-
                                    Unique code identifying the rule that was
                                    violated
                                  type: string
                                severity:
                                  description: Severity of the violation
                                  anyOf:
                                    - type: string
                                      enum:
                                        - low
                                    - type: string
                                      enum:
                                        - medium
                                    - type: string
                                      enum:
                                        - high
                                    - type: string
                                      enum:
                                        - critical
                                reason_code:
                                  description: >-
                                    Structured reason code for programmatic
                                    aggregation
                                  anyOf:
                                    - type: string
                                      enum:
                                        - FIELD_MISSING
                                    - type: string
                                      enum:
                                        - FIELD_FORBIDDEN
                                    - type: string
                                      enum:
                                        - FIELD_TOO_SHORT
                                    - type: string
                                      enum:
                                        - DATE_INVALID
                                    - type: string
                                      enum:
                                        - DATE_EXPIRED
                                    - type: string
                                      enum:
                                        - DATE_IN_FUTURE
                                    - type: string
                                      enum:
                                        - DATE_TOO_LATE
                                    - type: string
                                      enum:
                                        - DATE_TOO_EARLY
                                    - type: string
                                      enum:
                                        - DATE_ORDER_VIOLATED
                                    - type: string
                                      enum:
                                        - VALUE_NOT_NUMERIC
                                    - type: string
                                      enum:
                                        - VALUE_BELOW_MIN
                                    - type: string
                                      enum:
                                        - VALUE_ABOVE_MAX
                                    - type: string
                                      enum:
                                        - VALUE_NOT_GREATER_THAN
                                    - type: string
                                      enum:
                                        - VALUE_NOT_LESS_THAN
                                    - type: string
                                      enum:
                                        - VALUE_NOT_ALLOWED
                                    - type: string
                                      enum:
                                        - VALUE_FORBIDDEN
                                    - type: string
                                      enum:
                                        - LIST_MISCONFIGURED
                                reason:
                                  description: Human-readable explanation of the violation
                                  type: string
                                field:
                                  description: Field that triggered the violation
                                  type: string
                                actual_value:
                                  description: Actual value that caused the violation
                                expected_value:
                                  description: Expected value or constraint
                                details:
                                  description: Additional violation context
                                  type: object
                                  additionalProperties: {}
                                policy_id:
                                  format: uuid
                                  description: Policy ID that owns the violated rule
                                  type: string
                                is_shadow:
                                  description: >-
                                    Whether this violation came from a
                                    shadow-mode policy
                                  type: boolean
                              required:
                                - rule_code
                                - severity
                                - reason
                          rules_evaluated:
                            description: Number of rules evaluated
                            type: integer
                          rules_na:
                            description: >-
                              Number of rules skipped due to when clause not
                              matching
                            type: integer
                          na_rules:
                            description: Rules that were not applicable due to when clause
                            type: array
                            items:
                              type: object
                              properties:
                                rule_code:
                                  description: Rule code that was skipped
                                  type: string
                                when:
                                  description: The when clause that excluded the rule
                                reason:
                                  description: >-
                                    Human-readable reason why the rule was not
                                    applicable
                                  type: string
                              required:
                                - rule_code
                                - when
                                - reason
                          evaluation_time_ms:
                            description: Evaluation duration in milliseconds
                            type: number
                          timestamp:
                            format: date-time
                            description: ISO timestamp of the evaluation
                            type: string
                          policy_snapshot_id:
                            format: uuid
                            description: UUID of the frozen policy snapshot used
                            type: string
                          evaluated_rules_hash:
                            description: >-
                              SHA-256 hash of the evaluated rules (code,
                              condition, severity, when)
                            type: string
                          integrity_hash:
                            description: SHA-256 integrity hash of the entire evaluation
                            type: string
                          signature:
                            description: >-
                              Base64url-encoded Ed25519 signature over the
                              integrity hash
                            type: string
                          signature_kid:
                            description: Key ID of the signing key used
                            type: string
                          signature_algorithm:
                            description: Signature algorithm (ed25519)
                            type: string
                          transparency_anchor:
                            description: >-
                              Sigstore Rekor transparency anchor, null if
                              anchoring failed
                            anyOf:
                              - type: object
                                properties:
                                  provider:
                                    description: Transparency log provider
                                    type: string
                                  entry_uuid:
                                    description: Rekor entry UUID
                                    type: string
                                  log_index:
                                    description: Rekor log index
                                    type: integer
                                  inclusion_proof:
                                    type: object
                                    properties:
                                      hashes:
                                        type: array
                                        items:
                                          type: string
                                      log_index:
                                        type: integer
                                      root_hash:
                                        type: string
                                      tree_size:
                                        type: integer
                                    required:
                                      - hashes
                                      - log_index
                                      - root_hash
                                      - tree_size
                                  anchored_at:
                                    format: date-time
                                    description: When the entry was anchored
                                    type: string
                                  rekor_public_url:
                                    anyOf:
                                      - format: uri
                                        description: Direct URL to the Rekor entry
                                        type: string
                                      - type: 'null'
                                required:
                                  - provider
                                  - entry_uuid
                                  - log_index
                                  - inclusion_proof
                                  - anchored_at
                              - type: 'null'
                          action:
                            description: Action bound to the receipt (null when not bound)
                            anyOf:
                              - description: Action bound to this decision receipt
                                type: object
                                properties:
                                  type:
                                    description: >-
                                      Type of action authorized (e.g.,
                                      payment_execute, loan_approve)
                                    type: string
                                  reference_id:
                                    description: >-
                                      Client's reference ID for the action
                                      (e.g., INV-88423)
                                    type: string
                                  metadata:
                                    description: Additional action metadata
                                    type: object
                                    additionalProperties: {}
                                required:
                                  - type
                                  - reference_id
                              - type: 'null'
                          receipt_schema_version:
                            description: >-
                              Receipt envelope schema version (1 = legacy, 2 =
                              RCP2)
                            anyOf:
                              - type: number
                                enum:
                                  - 1
                              - type: number
                                enum:
                                  - 2
                          policy_snapshot_digest:
                            anyOf:
                              - pattern: ^[0-9a-f]{64}$
                                description: >-
                                  SHA-256 hex digest of the canonical policy
                                  snapshot
                                type: string
                              - type: 'null'
                          evidence_manifest_digest:
                            anyOf:
                              - pattern: ^[0-9a-f]{64}$
                                description: >-
                                  SHA-256 hex digest of the evidence manifest
                                  (if provided)
                                type: string
                              - type: 'null'
                          shadow_converted:
                            description: >-
                              Whether shadow mode converted this decision (DENY
                              suppressed to ALERT because every violation came
                              from a shadow-mode policy). Bound into the
                              integrity hash.
                            type: boolean
                          original_decision:
                            description: >-
                              Decision before shadow-mode conversion (null when
                              no conversion occurred). Bound into the integrity
                              hash.
                            anyOf:
                              - type: string
                                enum:
                                  - ALLOW
                              - type: string
                                enum:
                                  - DENY
                              - type: string
                                enum:
                                  - REVIEW
                              - type: string
                                enum:
                                  - ALERT
                              - type: 'null'
                        required:
                          - decision
                          - violations
                          - rules_evaluated
                          - evaluation_time_ms
                          - timestamp
                          - policy_snapshot_id
                          - evaluated_rules_hash
                          - integrity_hash
                          - transparency_anchor
                          - action
                      policy_snapshot_id:
                        format: uuid
                        type: string
                      correlation_id:
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_id:
                        description: Chain ID if this decision is part of a decision chain
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      chain_step:
                        description: Step number within the chain (1-based)
                        anyOf:
                          - type: integer
                          - type: 'null'
                      parent_decision_id:
                        description: Parent decision within the same chain
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      chain_integrity_hash:
                        description: >-
                          SHA-256 chain integrity hash (Phase 2 cryptographic
                          chain proof)
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature:
                        description: >-
                          Chain proof signature. Post-DAH-205 records carry
                          "chain-proof/v1:" + base64url(Ed25519 over the
                          domain-separated chain-proof/v1 envelope); legacy
                          records carry base64url(Ed25519 over the bare
                          chain_integrity_hash).
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature_kid:
                        description: Key ID that produced the chain signature
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature_algorithm:
                        description: Signature algorithm (ed25519)
                        anyOf:
                          - type: string
                          - type: 'null'
                      recorded_at:
                        format: date-time
                        type: string
                      created_at:
                        format: date-time
                        type: string
                      policy:
                        description: Policy metadata from the snapshot used for evaluation
                        type: object
                        properties:
                          id:
                            format: uuid
                            description: Policy ID
                            type: string
                          code:
                            description: Policy code (e.g., UCP600-14A)
                            type: string
                          name:
                            description: Human-readable policy name
                            type: string
                          version:
                            description: Policy version number
                            type: integer
                        required:
                          - id
                          - code
                          - name
                          - version
                      governance_source:
                        description: >-
                          Attribution of which tenant policies governed this
                          decision
                        type: object
                        properties:
                          tenant_id:
                            format: uuid
                            description: Tenant ID whose policies governed this decision
                            type: string
                          tenant_name:
                            description: >-
                              Human-readable tenant name (snapshot at evaluation
                              time)
                            type: string
                          level:
                            minimum: 0
                            description: >-
                              Governance level: 0 = local tenant, 1+ = inherited
                              from parent
                            type: integer
                        required:
                          - tenant_id
                          - tenant_name
                          - level
                      policy_group_id:
                        description: Policy group ID for filtering and audit
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      policy_group_code:
                        description: Policy group code for filtering and audit
                        anyOf:
                          - type: string
                          - type: 'null'
                      evaluated_policies:
                        description: >-
                          Policies evaluated in this decision (populated for
                          group evaluations)
                        type: array
                        items:
                          description: A policy that was evaluated as part of a decision
                          type: object
                          properties:
                            policy_id:
                              format: uuid
                              description: Policy ID
                              type: string
                            policy_code:
                              description: Policy code
                              type: string
                            policy_name:
                              description: Policy name
                              type: string
                            version:
                              description: Policy version at time of evaluation
                              type: integer
                            policy_group_id:
                              format: uuid
                              description: Policy group ID
                              type: string
                            policy_group_code:
                              description: Policy group code
                              type: string
                            shadow_mode:
                              description: Whether policy was in shadow mode
                              type: boolean
                            rules:
                              description: Rules that were evaluated within this policy
                              type: array
                              items:
                                description: A rule within an evaluated policy
                                type: object
                                properties:
                                  code:
                                    description: Rule code
                                    type: string
                                  name:
                                    description: Rule name
                                    type: string
                                  when:
                                    description: When clause for conditional applicability
                                required:
                                  - code
                                  - name
                            regulatory_refs:
                              description: Regulatory references this policy implements
                              type: array
                              items:
                                type: string
                          required:
                            - policy_id
                            - policy_code
                            - policy_name
                            - version
                            - shadow_mode
                      actor:
                        description: Actor attribution — who or what made this decision
                        type: object
                        properties:
                          id:
                            minLength: 1
                            maxLength: 255
                            description: Stable identifier for the actor
                            type: string
                          type:
                            description: Whether the actor is human or automated
                            anyOf:
                              - type: string
                                enum:
                                  - human
                              - type: string
                                enum:
                                  - automated
                          role:
                            maxLength: 255
                            description: >-
                              Caller-defined role label (e.g., MLRO,
                              compliance_analyst)
                            type: string
                          authority:
                            maxLength: 255
                            description: >-
                              Freeform authority context (e.g.,
                              final_disposition)
                            type: string
                          display_name:
                            maxLength: 255
                            description: Human-readable name for UI/reports
                            type: string
                        required:
                          - id
                          - type
                    required:
                      - id
                      - tenant_id
                      - idempotency_key
                      - decision_type
                      - decision
                      - context
                      - result
                      - policy_snapshot_id
                      - correlation_id
                      - chain_id
                      - chain_step
                      - parent_decision_id
                      - chain_integrity_hash
                      - chain_signature
                      - chain_signature_kid
                      - chain_signature_algorithm
                      - recorded_at
                      - created_at
                      - governance_source
                      - policy_group_id
                      - policy_group_code
                  is_new:
                    description: False if returned from idempotency cache
                    type: boolean
                  duration_ms:
                    description: Total request duration in milliseconds
                    type: number
                  timing:
                    description: Per-phase timing breakdown for the evaluation
                    type: object
                    properties:
                      total_ms:
                        description: Total evaluation duration in milliseconds
                        type: number
                      snapshot_resolve_ms:
                        description: Time to resolve policy snapshot in milliseconds
                        type: number
                      engine_evaluate_ms:
                        description: Time for pure policy engine evaluation in milliseconds
                        type: number
                      source:
                        description: >-
                          Source of the policy snapshot: cache hit or database
                          lookup
                        anyOf:
                          - type: string
                            enum:
                              - cache
                          - type: string
                            enum:
                              - db
                    required:
                      - total_ms
                      - snapshot_resolve_ms
                      - engine_evaluate_ms
                      - source
                  shadow_mode:
                    type: object
                    properties:
                      enabled:
                        description: >-
                          True if policy is in shadow mode (observe but not
                          enforce)
                        type: boolean
                      original_decision:
                        description: >-
                          Original decision before shadow mode conversion (only
                          present if converted)
                        anyOf:
                          - type: string
                            enum:
                              - DENY
                          - type: string
                            enum:
                              - REVIEW
                    required:
                      - enabled
                  governance_source:
                    description: >-
                      Attribution of which tenant policies governed this
                      decision
                    type: object
                    properties:
                      tenant_id:
                        format: uuid
                        description: Tenant ID whose policies governed this decision
                        type: string
                      tenant_name:
                        description: >-
                          Human-readable tenant name (snapshot at evaluation
                          time)
                        type: string
                      level:
                        minimum: 0
                        description: >-
                          Governance level: 0 = local tenant, 1+ = inherited
                          from parent
                        type: integer
                    required:
                      - tenant_id
                      - tenant_name
                      - level
                  actor:
                    description: Actor attribution — who or what made this decision
                    type: object
                    properties:
                      id:
                        minLength: 1
                        maxLength: 255
                        description: Stable identifier for the actor
                        type: string
                      type:
                        description: Whether the actor is human or automated
                        anyOf:
                          - type: string
                            enum:
                              - human
                          - type: string
                            enum:
                              - automated
                      role:
                        maxLength: 255
                        description: >-
                          Caller-defined role label (e.g., MLRO,
                          compliance_analyst)
                        type: string
                      authority:
                        maxLength: 255
                        description: Freeform authority context (e.g., final_disposition)
                        type: string
                      display_name:
                        maxLength: 255
                        description: Human-readable name for UI/reports
                        type: string
                    required:
                      - id
                      - type
                required:
                  - decision
                  - is_new
                  - duration_ms
                  - shadow_mode
                  - governance_source
        '201':
          description: Response from record decision endpoint
          content:
            application/json:
              schema:
                description: Response from record decision endpoint
                type: object
                properties:
                  decision:
                    description: A recorded decision with full context
                    type: object
                    properties:
                      id:
                        format: uuid
                        type: string
                      tenant_id:
                        format: uuid
                        type: string
                      idempotency_key:
                        type: string
                      decision_type:
                        type: string
                      decision:
                        description: Decision outcome
                        anyOf:
                          - type: string
                            enum:
                              - ALLOW
                          - type: string
                            enum:
                              - DENY
                          - type: string
                            enum:
                              - REVIEW
                          - type: string
                            enum:
                              - ALERT
                      context:
                        description: Canonical DecisionContext for policy evaluation
                        type: object
                        properties:
                          decision_type:
                            minLength: 1
                            description: Type of decision being evaluated
                            type: string
                          fields:
                            description: Domain-agnostic field values for evaluation
                            type: object
                            additionalProperties: {}
                          evidence:
                            description: Supporting evidence for the decision
                            type: array
                            items:
                              type: object
                              properties:
                                kind:
                                  description: >-
                                    Type of evidence (document, graph_query,
                                    external_api)
                                  type: string
                                ref:
                                  description: Reference identifier for the evidence
                                  type: string
                                hash:
                                  description: Content hash for verification
                                  type: string
                                data:
                                  description: Additional evidence metadata
                                  type: object
                                  additionalProperties: {}
                              required:
                                - kind
                          metadata:
                            additionalProperties: true
                            type: object
                            properties:
                              actor_id:
                                description: Actor making the request
                                type: string
                              correlation_id:
                                description: Request correlation ID
                                type: string
                              ip_address:
                                description: IP address of the requestor
                                type: string
                              user_agent:
                                description: User agent string
                                type: string
                              timestamp:
                                format: date-time
                                description: Request timestamp
                                type: string
                          source_artifact:
                            description: Cryptographic binding to a source document
                            type: object
                            properties:
                              type:
                                description: Type of source artifact
                                anyOf:
                                  - type: string
                                    enum:
                                      - PDF
                                  - type: string
                                    enum:
                                      - DOCX
                                  - type: string
                                    enum:
                                      - JSON_PAYLOAD
                                  - type: string
                                    enum:
                                      - IMAGE
                                  - type: string
                                    enum:
                                      - STRING
                                  - type: string
                                    enum:
                                      - OTHER
                              hash:
                                pattern: ^[a-f0-9]{64}$
                                description: >-
                                  SHA-256 hash of the artifact (64 lowercase hex
                                  characters)
                                type: string
                              hash_algorithm:
                                description: Hash algorithm used (currently only SHA-256)
                                type: string
                                enum:
                                  - SHA-256
                              reference_id:
                                maxLength: 255
                                description: Client reference ID for the artifact
                                type: string
                              filename:
                                maxLength: 255
                                description: Original filename of the artifact
                                type: string
                              byte_size:
                                minimum: 0
                                description: Size of the artifact in bytes
                                type: integer
                            required:
                              - type
                              - hash
                              - hash_algorithm
                        required:
                          - decision_type
                          - fields
                      result:
                        description: Result of a policy evaluation
                        type: object
                        properties:
                          decision:
                            description: 'Final decision: ALLOW, DENY, REVIEW, or ALERT'
                            anyOf:
                              - type: string
                                enum:
                                  - ALLOW
                              - type: string
                                enum:
                                  - DENY
                              - type: string
                                enum:
                                  - REVIEW
                              - type: string
                                enum:
                                  - ALERT
                          violations:
                            description: List of policy violations detected
                            type: array
                            items:
                              type: object
                              properties:
                                rule_code:
                                  description: >-
                                    Unique code identifying the rule that was
                                    violated
                                  type: string
                                severity:
                                  description: Severity of the violation
                                  anyOf:
                                    - type: string
                                      enum:
                                        - low
                                    - type: string
                                      enum:
                                        - medium
                                    - type: string
                                      enum:
                                        - high
                                    - type: string
                                      enum:
                                        - critical
                                reason_code:
                                  description: >-
                                    Structured reason code for programmatic
                                    aggregation
                                  anyOf:
                                    - type: string
                                      enum:
                                        - FIELD_MISSING
                                    - type: string
                                      enum:
                                        - FIELD_FORBIDDEN
                                    - type: string
                                      enum:
                                        - FIELD_TOO_SHORT
                                    - type: string
                                      enum:
                                        - DATE_INVALID
                                    - type: string
                                      enum:
                                        - DATE_EXPIRED
                                    - type: string
                                      enum:
                                        - DATE_IN_FUTURE
                                    - type: string
                                      enum:
                                        - DATE_TOO_LATE
                                    - type: string
                                      enum:
                                        - DATE_TOO_EARLY
                                    - type: string
                                      enum:
                                        - DATE_ORDER_VIOLATED
                                    - type: string
                                      enum:
                                        - VALUE_NOT_NUMERIC
                                    - type: string
                                      enum:
                                        - VALUE_BELOW_MIN
                                    - type: string
                                      enum:
                                        - VALUE_ABOVE_MAX
                                    - type: string
                                      enum:
                                        - VALUE_NOT_GREATER_THAN
                                    - type: string
                                      enum:
                                        - VALUE_NOT_LESS_THAN
                                    - type: string
                                      enum:
                                        - VALUE_NOT_ALLOWED
                                    - type: string
                                      enum:
                                        - VALUE_FORBIDDEN
                                    - type: string
                                      enum:
                                        - LIST_MISCONFIGURED
                                reason:
                                  description: Human-readable explanation of the violation
                                  type: string
                                field:
                                  description: Field that triggered the violation
                                  type: string
                                actual_value:
                                  description: Actual value that caused the violation
                                expected_value:
                                  description: Expected value or constraint
                                details:
                                  description: Additional violation context
                                  type: object
                                  additionalProperties: {}
                                policy_id:
                                  format: uuid
                                  description: Policy ID that owns the violated rule
                                  type: string
                                is_shadow:
                                  description: >-
                                    Whether this violation came from a
                                    shadow-mode policy
                                  type: boolean
                              required:
                                - rule_code
                                - severity
                                - reason
                          rules_evaluated:
                            description: Number of rules evaluated
                            type: integer
                          rules_na:
                            description: >-
                              Number of rules skipped due to when clause not
                              matching
                            type: integer
                          na_rules:
                            description: Rules that were not applicable due to when clause
                            type: array
                            items:
                              type: object
                              properties:
                                rule_code:
                                  description: Rule code that was skipped
                                  type: string
                                when:
                                  description: The when clause that excluded the rule
                                reason:
                                  description: >-
                                    Human-readable reason why the rule was not
                                    applicable
                                  type: string
                              required:
                                - rule_code
                                - when
                                - reason
                          evaluation_time_ms:
                            description: Evaluation duration in milliseconds
                            type: number
                          timestamp:
                            format: date-time
                            description: ISO timestamp of the evaluation
                            type: string
                          policy_snapshot_id:
                            format: uuid
                            description: UUID of the frozen policy snapshot used
                            type: string
                          evaluated_rules_hash:
                            description: >-
                              SHA-256 hash of the evaluated rules (code,
                              condition, severity, when)
                            type: string
                          integrity_hash:
                            description: SHA-256 integrity hash of the entire evaluation
                            type: string
                          signature:
                            description: >-
                              Base64url-encoded Ed25519 signature over the
                              integrity hash
                            type: string
                          signature_kid:
                            description: Key ID of the signing key used
                            type: string
                          signature_algorithm:
                            description: Signature algorithm (ed25519)
                            type: string
                          transparency_anchor:
                            description: >-
                              Sigstore Rekor transparency anchor, null if
                              anchoring failed
                            anyOf:
                              - type: object
                                properties:
                                  provider:
                                    description: Transparency log provider
                                    type: string
                                  entry_uuid:
                                    description: Rekor entry UUID
                                    type: string
                                  log_index:
                                    description: Rekor log index
                                    type: integer
                                  inclusion_proof:
                                    type: object
                                    properties:
                                      hashes:
                                        type: array
                                        items:
                                          type: string
                                      log_index:
                                        type: integer
                                      root_hash:
                                        type: string
                                      tree_size:
                                        type: integer
                                    required:
                                      - hashes
                                      - log_index
                                      - root_hash
                                      - tree_size
                                  anchored_at:
                                    format: date-time
                                    description: When the entry was anchored
                                    type: string
                                  rekor_public_url:
                                    anyOf:
                                      - format: uri
                                        description: Direct URL to the Rekor entry
                                        type: string
                                      - type: 'null'
                                required:
                                  - provider
                                  - entry_uuid
                                  - log_index
                                  - inclusion_proof
                                  - anchored_at
                              - type: 'null'
                          action:
                            description: Action bound to the receipt (null when not bound)
                            anyOf:
                              - description: Action bound to this decision receipt
                                type: object
                                properties:
                                  type:
                                    description: >-
                                      Type of action authorized (e.g.,
                                      payment_execute, loan_approve)
                                    type: string
                                  reference_id:
                                    description: >-
                                      Client's reference ID for the action
                                      (e.g., INV-88423)
                                    type: string
                                  metadata:
                                    description: Additional action metadata
                                    type: object
                                    additionalProperties: {}
                                required:
                                  - type
                                  - reference_id
                              - type: 'null'
                          receipt_schema_version:
                            description: >-
                              Receipt envelope schema version (1 = legacy, 2 =
                              RCP2)
                            anyOf:
                              - type: number
                                enum:
                                  - 1
                              - type: number
                                enum:
                                  - 2
                          policy_snapshot_digest:
                            anyOf:
                              - pattern: ^[0-9a-f]{64}$
                                description: >-
                                  SHA-256 hex digest of the canonical policy
                                  snapshot
                                type: string
                              - type: 'null'
                          evidence_manifest_digest:
                            anyOf:
                              - pattern: ^[0-9a-f]{64}$
                                description: >-
                                  SHA-256 hex digest of the evidence manifest
                                  (if provided)
                                type: string
                              - type: 'null'
                          shadow_converted:
                            description: >-
                              Whether shadow mode converted this decision (DENY
                              suppressed to ALERT because every violation came
                              from a shadow-mode policy). Bound into the
                              integrity hash.
                            type: boolean
                          original_decision:
                            description: >-
                              Decision before shadow-mode conversion (null when
                              no conversion occurred). Bound into the integrity
                              hash.
                            anyOf:
                              - type: string
                                enum:
                                  - ALLOW
                              - type: string
                                enum:
                                  - DENY
                              - type: string
                                enum:
                                  - REVIEW
                              - type: string
                                enum:
                                  - ALERT
                              - type: 'null'
                        required:
                          - decision
                          - violations
                          - rules_evaluated
                          - evaluation_time_ms
                          - timestamp
                          - policy_snapshot_id
                          - evaluated_rules_hash
                          - integrity_hash
                          - transparency_anchor
                          - action
                      policy_snapshot_id:
                        format: uuid
                        type: string
                      correlation_id:
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_id:
                        description: Chain ID if this decision is part of a decision chain
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      chain_step:
                        description: Step number within the chain (1-based)
                        anyOf:
                          - type: integer
                          - type: 'null'
                      parent_decision_id:
                        description: Parent decision within the same chain
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      chain_integrity_hash:
                        description: >-
                          SHA-256 chain integrity hash (Phase 2 cryptographic
                          chain proof)
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature:
                        description: >-
                          Chain proof signature. Post-DAH-205 records carry
                          "chain-proof/v1:" + base64url(Ed25519 over the
                          domain-separated chain-proof/v1 envelope); legacy
                          records carry base64url(Ed25519 over the bare
                          chain_integrity_hash).
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature_kid:
                        description: Key ID that produced the chain signature
                        anyOf:
                          - type: string
                          - type: 'null'
                      chain_signature_algorithm:
                        description: Signature algorithm (ed25519)
                        anyOf:
                          - type: string
                          - type: 'null'
                      recorded_at:
                        format: date-time
                        type: string
                      created_at:
                        format: date-time
                        type: string
                      policy:
                        description: Policy metadata from the snapshot used for evaluation
                        type: object
                        properties:
                          id:
                            format: uuid
                            description: Policy ID
                            type: string
                          code:
                            description: Policy code (e.g., UCP600-14A)
                            type: string
                          name:
                            description: Human-readable policy name
                            type: string
                          version:
                            description: Policy version number
                            type: integer
                        required:
                          - id
                          - code
                          - name
                          - version
                      governance_source:
                        description: >-
                          Attribution of which tenant policies governed this
                          decision
                        type: object
                        properties:
                          tenant_id:
                            format: uuid
                            description: Tenant ID whose policies governed this decision
                            type: string
                          tenant_name:
                            description: >-
                              Human-readable tenant name (snapshot at evaluation
                              time)
                            type: string
                          level:
                            minimum: 0
                            description: >-
                              Governance level: 0 = local tenant, 1+ = inherited
                              from parent
                            type: integer
                        required:
                          - tenant_id
                          - tenant_name
                          - level
                      policy_group_id:
                        description: Policy group ID for filtering and audit
                        anyOf:
                          - format: uuid
                            type: string
                          - type: 'null'
                      policy_group_code:
                        description: Policy group code for filtering and audit
                        anyOf:
                          - type: string
                          - type: 'null'
                      evaluated_policies:
                        description: >-
                          Policies evaluated in this decision (populated for
                          group evaluations)
                        type: array
                        items:
                          description: A policy that was evaluated as part of a decision
                          type: object
                          properties:
                            policy_id:
                              format: uuid
                              description: Policy ID
                              type: string
                            policy_code:
                              description: Policy code
                              type: string
                            policy_name:
                              description: Policy name
                              type: string
                            version:
                              description: Policy version at time of evaluation
                              type: integer
                            policy_group_id:
                              format: uuid
                              description: Policy group ID
                              type: string
                            policy_group_code:
                              description: Policy group code
                              type: string
                            shadow_mode:
                              description: Whether policy was in shadow mode
                              type: boolean
                            rules:
                              description: Rules that were evaluated within this policy
                              type: array
                              items:
                                description: A rule within an evaluated policy
                                type: object
                                properties:
                                  code:
                                    description: Rule code
                                    type: string
                                  name:
                                    description: Rule name
                                    type: string
                                  when:
                                    description: When clause for conditional applicability
                                required:
                                  - code
                                  - name
                            regulatory_refs:
                              description: Regulatory references this policy implements
                              type: array
                              items:
                                type: string
                          required:
                            - policy_id
                            - policy_code
                            - policy_name
                            - version
                            - shadow_mode
                      actor:
                        description: Actor attribution — who or what made this decision
                        type: object
                        properties:
                          id:
                            minLength: 1
                            maxLength: 255
                            description: Stable identifier for the actor
                            type: string
                          type:
                            description: Whether the actor is human or automated
                            anyOf:
                              - type: string
                                enum:
                                  - human
                              - type: string
                                enum:
                                  - automated
                          role:
                            maxLength: 255
                            description: >-
                              Caller-defined role label (e.g., MLRO,
                              compliance_analyst)
                            type: string
                          authority:
                            maxLength: 255
                            description: >-
                              Freeform authority context (e.g.,
                              final_disposition)
                            type: string
                          display_name:
                            maxLength: 255
                            description: Human-readable name for UI/reports
                            type: string
                        required:
                          - id
                          - type
                    required:
                      - id
                      - tenant_id
                      - idempotency_key
                      - decision_type
                      - decision
                      - context
                      - result
                      - policy_snapshot_id
                      - correlation_id
                      - chain_id
                      - chain_step
                      - parent_decision_id
                      - chain_integrity_hash
                      - chain_signature
                      - chain_signature_kid
                      - chain_signature_algorithm
                      - recorded_at
                      - created_at
                      - governance_source
                      - policy_group_id
                      - policy_group_code
                  is_new:
                    description: False if returned from idempotency cache
                    type: boolean
                  duration_ms:
                    description: Total request duration in milliseconds
                    type: number
                  timing:
                    description: Per-phase timing breakdown for the evaluation
                    type: object
                    properties:
                      total_ms:
                        description: Total evaluation duration in milliseconds
                        type: number
                      snapshot_resolve_ms:
                        description: Time to resolve policy snapshot in milliseconds
                        type: number
                      engine_evaluate_ms:
                        description: Time for pure policy engine evaluation in milliseconds
                        type: number
                      source:
                        description: >-
                          Source of the policy snapshot: cache hit or database
                          lookup
                        anyOf:
                          - type: string
                            enum:
                              - cache
                          - type: string
                            enum:
                              - db
                    required:
                      - total_ms
                      - snapshot_resolve_ms
                      - engine_evaluate_ms
                      - source
                  shadow_mode:
                    type: object
                    properties:
                      enabled:
                        description: >-
                          True if policy is in shadow mode (observe but not
                          enforce)
                        type: boolean
                      original_decision:
                        description: >-
                          Original decision before shadow mode conversion (only
                          present if converted)
                        anyOf:
                          - type: string
                            enum:
                              - DENY
                          - type: string
                            enum:
                              - REVIEW
                    required:
                      - enabled
                  governance_source:
                    description: >-
                      Attribution of which tenant policies governed this
                      decision
                    type: object
                    properties:
                      tenant_id:
                        format: uuid
                        description: Tenant ID whose policies governed this decision
                        type: string
                      tenant_name:
                        description: >-
                          Human-readable tenant name (snapshot at evaluation
                          time)
                        type: string
                      level:
                        minimum: 0
                        description: >-
                          Governance level: 0 = local tenant, 1+ = inherited
                          from parent
                        type: integer
                    required:
                      - tenant_id
                      - tenant_name
                      - level
                  actor:
                    description: Actor attribution — who or what made this decision
                    type: object
                    properties:
                      id:
                        minLength: 1
                        maxLength: 255
                        description: Stable identifier for the actor
                        type: string
                      type:
                        description: Whether the actor is human or automated
                        anyOf:
                          - type: string
                            enum:
                              - human
                          - type: string
                            enum:
                              - automated
                      role:
                        maxLength: 255
                        description: >-
                          Caller-defined role label (e.g., MLRO,
                          compliance_analyst)
                        type: string
                      authority:
                        maxLength: 255
                        description: Freeform authority context (e.g., final_disposition)
                        type: string
                      display_name:
                        maxLength: 255
                        description: Human-readable name for UI/reports
                        type: string
                    required:
                      - id
                      - type
                required:
                  - decision
                  - is_new
                  - duration_ms
                  - shadow_mode
                  - governance_source
        '400':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        description: Error code
                        type: string
                      message:
                        description: Human-readable message
                        type: string
                      details:
                        description: Additional error details
                    required:
                      - code
                      - message
                  correlation_id:
                    description: Request correlation ID
                    type: string
                required:
                  - error
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        description: Error code
                        type: string
                      message:
                        description: Human-readable message
                        type: string
                      details:
                        description: Additional error details
                    required:
                      - code
                      - message
                  correlation_id:
                    description: Request correlation ID
                    type: string
                required:
                  - error
        '409':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        description: Error code
                        type: string
                      message:
                        description: Human-readable message
                        type: string
                      details:
                        description: Additional error details
                    required:
                      - code
                      - message
                  correlation_id:
                    description: Request correlation ID
                    type: string
                required:
                  - error
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: mqu_<token>
      description: >-
        MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`.
        Mint one in the console (Settings → API keys).
    tenantId:
      type: apiKey
      name: X-MeshQu-Tenant-Id
      in: header
      description: >-
        Tenant UUID for multi-tenant isolation. Required on all authenticated
        routes — validated before authentication (middleware/tenant.ts), so a
        missing or non-UUID header returns 400 (MISSING_TENANT_ID /
        INVALID_TENANT_ID) before the API key is checked.

````