{
  "openapi": "3.1.0",
  "info": {
    "title": "Curbi Developer Projects beta",
    "version": "v24"
  },
  "servers": [
    {
      "url": "https://curbi.io"
    }
  ],
  "paths": {
    "/api/v1/session": {
      "get": {
        "summary": "Validate an existing confirmed developer identity",
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "responses": {
          "200": {
            "description": "Validated identity; grants no execution permission"
          },
          "401": {
            "description": "Missing or invalid bearer"
          },
          "503": {
            "description": "Identity provider unavailable"
          }
        }
      }
    },
    "/api/v1/projects": {
      "get": {
        "summary": "Read up to20 projects owned by the authenticated user",
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "responses": {
          "200": {
            "description": "Owner-isolated project list"
          },
          "401": {
            "description": "Authentication required"
          }
        }
      },
      "post": {
        "summary": "Save a new private policy project; no provider actions",
        "security": [
          {
            "bearerAuth": []
          }
        ],
        "parameters": [
          {
            "in": "header",
            "name": "Origin",
            "required": true,
            "schema": {
              "const": "https://curbi.io"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "name",
                  "policy"
                ],
                "additionalProperties": false,
                "properties": {
                  "name": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 80
                  },
                  "policy": {
                    "type": "object"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Saved with server-derived owner"
          },
          "400": {
            "description": "Invalid project"
          },
          "401": {
            "description": "Authentication required"
          },
          "403": {
            "description": "Origin or identity rejected"
          },
          "413": {
            "description": "Over20KB body"
          },
          "503": {
            "description": "Project store unavailable"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "description": "Existing Supabase confirmed-account access token. Do not put credentials in URLs. Not a Curbi execution grant."
      }
    }
  }
}