{
  "openapi": "3.1.0",
  "info": {
    "title": "RiskAlign Public API",
    "version": "1.0.0",
    "description": "Read-only access to risks, controls, evidence, and the audit trail, plus an inbound webhook slot. All endpoints require a tenant-scoped Bearer API key issued from the in-app Admin → API Keys screen."
  },
  "servers": [
    {
      "url": "https://riskalignplatform.com",
      "description": "Production"
    },
    {
      "url": "https://riskalign.app",
      "description": "Production (mirror)"
    }
  ],
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "rak_*"
      }
    }
  },
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "paths": {
    "/api/public/v1/risks": {
      "get": {
        "summary": "List risks",
        "parameters": [
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "maximum": 500,
              "default": 100
            }
          },
          {
            "name": "updated_since",
            "in": "query",
            "schema": {
              "type": "string",
              "format": "date-time"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "401": {
            "description": "Unauthorized"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/public/v1/risks/{id}": {
      "get": {
        "summary": "Get one risk with linked control IDs and open-issue count",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "404": {
            "description": "Not found"
          }
        }
      }
    },
    "/api/public/v1/controls": {
      "get": {
        "summary": "List controls",
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/api/public/v1/evidence": {
      "get": {
        "summary": "List evidence items",
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/api/public/v1/audit-trail": {
      "get": {
        "summary": "List audit-trail entries (SIEM export)",
        "parameters": [
          {
            "name": "since",
            "in": "query",
            "schema": {
              "type": "string",
              "format": "date-time"
            }
          },
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "maximum": 1000,
              "default": 200
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/api/public/v1/webhooks/control-test-result": {
      "post": {
        "summary": "Inbound: external control test result",
        "description": "HMAC-signed webhook. Headers: X-RiskAlign-Tenant, X-RiskAlign-Signature: sha256=<hex>, Idempotency-Key.",
        "responses": {
          "200": {
            "description": "Recorded (or replay no-op)"
          },
          "401": {
            "description": "Bad signature"
          }
        }
      }
    }
  }
}