620 lines
17 KiB
YAML
620 lines
17 KiB
YAML
openapi: 3.1.0
|
|
info:
|
|
title: AIOS GitOps Controlled Access API
|
|
version: V1R1C0-chatgpt-actions
|
|
description: Controlled ChatGPT Actions API for AIOS online GitOps baseline. Read
|
|
endpoints are public. Write endpoints require Bearer token and create Git commits
|
|
on non-main branches.
|
|
servers:
|
|
- url: https://cnnetmkt.top
|
|
security: []
|
|
components:
|
|
securitySchemes:
|
|
bearerAuth:
|
|
type: http
|
|
scheme: bearer
|
|
bearerFormat: opaque-token
|
|
schemas:
|
|
BranchRequest:
|
|
type: object
|
|
required:
|
|
- branch
|
|
properties:
|
|
branch:
|
|
type: string
|
|
example: patch/chatgpt-actions-demo
|
|
base:
|
|
type: string
|
|
default: main
|
|
message:
|
|
type: string
|
|
FileCommitRequest:
|
|
type: object
|
|
required:
|
|
- branch
|
|
- path
|
|
- content
|
|
properties:
|
|
branch:
|
|
type: string
|
|
base:
|
|
type: string
|
|
default: main
|
|
create_branch:
|
|
type: boolean
|
|
default: false
|
|
path:
|
|
type: string
|
|
example: docs/gitops/chatgpt-change.md
|
|
content:
|
|
type: string
|
|
message:
|
|
type: string
|
|
CommitRequest:
|
|
type: object
|
|
properties:
|
|
branch:
|
|
type: string
|
|
paths:
|
|
type: array
|
|
items:
|
|
type: string
|
|
message:
|
|
type: string
|
|
PatchRequest:
|
|
type: object
|
|
required:
|
|
- patch_name
|
|
properties:
|
|
patch_name:
|
|
type: string
|
|
branch:
|
|
type: string
|
|
base:
|
|
type: string
|
|
default: main
|
|
risk:
|
|
type: string
|
|
enum:
|
|
- low
|
|
- medium
|
|
- high
|
|
description:
|
|
type: string
|
|
message:
|
|
type: string
|
|
TagRequest:
|
|
type: object
|
|
required:
|
|
- version
|
|
properties:
|
|
version:
|
|
type: string
|
|
example: V1R1C1
|
|
message:
|
|
type: string
|
|
execute:
|
|
type: boolean
|
|
description: Owner-approved calls only. Otherwise an approval request commit
|
|
is created.
|
|
RollbackRequest:
|
|
type: object
|
|
required:
|
|
- target_version
|
|
properties:
|
|
target_version:
|
|
type: string
|
|
reason:
|
|
type: string
|
|
branch:
|
|
type: string
|
|
ModelRequest:
|
|
type: object
|
|
required:
|
|
- provider_name
|
|
- base_url
|
|
- model_name
|
|
properties:
|
|
username:
|
|
type: string
|
|
provider_name:
|
|
type: string
|
|
base_url:
|
|
type: string
|
|
model_name:
|
|
type: string
|
|
display_name:
|
|
type: string
|
|
api_key_secret_ref:
|
|
type: string
|
|
description: Preferred. Git stores this secret_ref only.
|
|
api_key:
|
|
type: string
|
|
writeOnly: true
|
|
description: Accepted only for runtime secret storage; never committed to
|
|
Git or logs.
|
|
branch:
|
|
type: string
|
|
message:
|
|
type: string
|
|
ModelPriorityRequest:
|
|
type: object
|
|
required:
|
|
- items
|
|
properties:
|
|
username:
|
|
type: string
|
|
branch:
|
|
type: string
|
|
items:
|
|
type: array
|
|
items:
|
|
type: object
|
|
properties:
|
|
model_id:
|
|
type: string
|
|
priority:
|
|
type: integer
|
|
enabled:
|
|
type: boolean
|
|
fallback_policy:
|
|
type: string
|
|
NLRequest:
|
|
type: object
|
|
required:
|
|
- text
|
|
properties:
|
|
text:
|
|
type: string
|
|
branch:
|
|
type: string
|
|
LowRiskFileCommitRequest:
|
|
type: object
|
|
required:
|
|
- branch
|
|
- path
|
|
- content
|
|
- message
|
|
properties:
|
|
branch:
|
|
type: string
|
|
description: Non-main patch branch. Must start with patch/ or request/.
|
|
example: patch/gpt-actions-consequential-governance
|
|
base:
|
|
type: string
|
|
default: main
|
|
description: Base branch used when create_branch is true.
|
|
create_branch:
|
|
type: boolean
|
|
default: false
|
|
path:
|
|
type: string
|
|
description: File path constrained by the operation path scope.
|
|
example: reports/example-report.md
|
|
content:
|
|
type: string
|
|
description: File content. Must not include secrets, credentials, passwords,
|
|
API keys, private keys, or token values.
|
|
message:
|
|
type: string
|
|
description: Commit message. Must not include secrets or credentials.
|
|
example: 'docs(actions): add GPT Actions governance evidence'
|
|
MainFileCommitRequest:
|
|
type: object
|
|
required:
|
|
- path
|
|
- content
|
|
- message
|
|
properties:
|
|
branch:
|
|
type: string
|
|
default: main
|
|
description: Main branch. This high-risk operation requires explicit owner
|
|
intent.
|
|
path:
|
|
type: string
|
|
description: File path for explicit main-branch maintenance. Secret paths
|
|
are always rejected.
|
|
content:
|
|
type: string
|
|
description: File content. Must not include secrets, credentials, passwords,
|
|
API keys, private keys, or token values.
|
|
message:
|
|
type: string
|
|
description: Commit message. Must not include secrets or credentials.
|
|
RollbackRequestAction:
|
|
type: object
|
|
required:
|
|
- target_version
|
|
- reason
|
|
properties:
|
|
target_version:
|
|
type: string
|
|
example: V1R1C4
|
|
reason:
|
|
type: string
|
|
example: Owner-approved rollback request
|
|
branch:
|
|
type: string
|
|
example: request/rollback-V1R1C4
|
|
paths:
|
|
/api/base:
|
|
get:
|
|
operationId: getBaseline
|
|
summary: Read current AIOS baseline
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
/api/ver:
|
|
get:
|
|
operationId: listVersions
|
|
summary: List GitOps versions
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
/api/diff:
|
|
get:
|
|
operationId: getDiff
|
|
summary: Read Git diff between refs
|
|
parameters:
|
|
- in: query
|
|
name: from
|
|
schema:
|
|
type: string
|
|
default: HEAD~1
|
|
- in: query
|
|
name: to
|
|
schema:
|
|
type: string
|
|
default: HEAD
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
/api/patch:
|
|
get:
|
|
operationId: listPatches
|
|
summary: List patch records
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
post:
|
|
operationId: createPatch
|
|
summary: Create a patch branch and commit metadata
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/PatchRequest'
|
|
responses:
|
|
'200':
|
|
description: Patch branch committed
|
|
'401':
|
|
description: Unauthorized
|
|
'403':
|
|
description: Forbidden
|
|
x-openai-isConsequential: true
|
|
/api/model:
|
|
get:
|
|
operationId: readModelRegistry
|
|
summary: Read visible model registry and priority
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
post:
|
|
operationId: registerModel
|
|
summary: Register a custom model; API keys are stored as runtime secrets and
|
|
Git receives secret_ref only
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/ModelRequest'
|
|
responses:
|
|
'200':
|
|
description: Model registered and committed
|
|
'401':
|
|
description: Unauthorized
|
|
'403':
|
|
description: Forbidden
|
|
x-openai-isConsequential: true
|
|
/api/run:
|
|
get:
|
|
operationId: getRuntimeStatus
|
|
summary: Read runtime status
|
|
responses:
|
|
'200':
|
|
description: OK
|
|
/api/branch:
|
|
post:
|
|
operationId: createBranch
|
|
summary: Create a non-main branch and commit branch metadata
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/BranchRequest'
|
|
responses:
|
|
'200':
|
|
description: Branch created
|
|
'401':
|
|
description: Unauthorized
|
|
'403':
|
|
description: Forbidden
|
|
x-openai-isConsequential: true
|
|
/api/file:
|
|
post:
|
|
operationId: commitFile
|
|
summary: Write a file and create a Git commit on a non-main branch
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/FileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed
|
|
'400':
|
|
description: Secret rejected or invalid path
|
|
'401':
|
|
description: Unauthorized
|
|
x-openai-isConsequential: true
|
|
/api/commit:
|
|
post:
|
|
operationId: commitChanges
|
|
summary: Commit existing workspace changes on a non-main branch
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: false
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/CommitRequest'
|
|
responses:
|
|
'200':
|
|
description: Commit result
|
|
'401':
|
|
description: Unauthorized
|
|
x-openai-isConsequential: true
|
|
/api/tag:
|
|
post:
|
|
operationId: requestOrCreateTag
|
|
summary: Request tag creation; owner execution is required for direct tag
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/TagRequest'
|
|
responses:
|
|
'200':
|
|
description: Tag request committed or tag created
|
|
'403':
|
|
description: Forbidden
|
|
x-openai-isConsequential: true
|
|
/api/rollback:
|
|
post:
|
|
operationId: requestRollback
|
|
summary: Commit a rollback request requiring owner/admin approval
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/RollbackRequest'
|
|
responses:
|
|
'200':
|
|
description: Rollback request committed
|
|
'401':
|
|
description: Unauthorized
|
|
x-openai-isConsequential: true
|
|
/api/model-priority:
|
|
put:
|
|
operationId: setModelPriority
|
|
summary: Set model priority and commit policy file
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/ModelPriorityRequest'
|
|
responses:
|
|
'200':
|
|
description: Priority updated and committed
|
|
'401':
|
|
description: Unauthorized
|
|
x-openai-isConsequential: true
|
|
/api/nl:
|
|
post:
|
|
operationId: planNaturalLanguageGitOpsAction
|
|
summary: Convert natural language to a safe committed plan without executing
|
|
V-level changes
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/NLRequest'
|
|
responses:
|
|
'200':
|
|
description: Plan committed
|
|
'401':
|
|
description: Unauthorized
|
|
x-openai-isConsequential: true
|
|
/api/gitops/report-file:
|
|
post:
|
|
operationId: commitReportFile
|
|
x-openai-isConsequential: false
|
|
x-aios-path-scope: reports/**
|
|
summary: Commit a report file to a controlled GitOps patch branch
|
|
description: Low-risk report write. Commits markdown or JSON evidence under
|
|
reports/** to a non-main patch branch. This operation must not write secrets,
|
|
credentials, token values, runtime secret files, rollback requests, or production
|
|
config.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/LowRiskFileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed successfully
|
|
'400':
|
|
description: Invalid branch, path, or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient
|
|
/api/gitops/docs-file:
|
|
post:
|
|
operationId: commitDocsFile
|
|
x-openai-isConsequential: false
|
|
x-aios-path-scope: docs/**
|
|
summary: Commit a docs file to a controlled GitOps patch branch
|
|
description: Low-risk documentation write under docs/** on a non-main patch
|
|
branch. It must not include real tokens, passwords, API keys, private keys,
|
|
credentials, rollback execution, or production config mutation.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/LowRiskFileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed successfully
|
|
'400':
|
|
description: Invalid branch, path, or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient
|
|
/api/gitops/proposal-file:
|
|
post:
|
|
operationId: commitProposalFile
|
|
x-openai-isConsequential: false
|
|
x-aios-path-scope: proposals/**
|
|
summary: Commit a proposal file to a controlled GitOps patch branch
|
|
description: Low-risk proposal write under proposals/** on a non-main patch
|
|
branch. It must not include real tokens, passwords, API keys, private keys,
|
|
credentials, runtime secret files, rollback execution, or production config
|
|
mutation.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/LowRiskFileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed successfully
|
|
'400':
|
|
description: Invalid branch, path, or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient
|
|
/api/gitops/patch-evidence:
|
|
post:
|
|
operationId: commitPatchEvidence
|
|
x-openai-isConsequential: false
|
|
x-aios-path-scope: reports/**, patches/**
|
|
summary: Commit patch evidence to a controlled GitOps patch branch
|
|
description: Low-risk evidence write under reports/** or patches/** on a non-main
|
|
patch branch. It must not include real tokens, passwords, API keys, private
|
|
keys, credentials, runtime secret files, rollback execution, or production
|
|
config mutation.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/LowRiskFileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed successfully
|
|
'400':
|
|
description: Invalid branch, path, or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient
|
|
/api/gitops/main-file:
|
|
post:
|
|
operationId: commitMainFile
|
|
x-openai-isConsequential: true
|
|
summary: Commit a file directly to main branch
|
|
description: High-risk explicit main-branch write. This operation exists only
|
|
for owner-approved maintenance and must not include real secrets, credentials,
|
|
passwords, private keys, API keys, token values, or runtime secret paths.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/MainFileCommitRequest'
|
|
responses:
|
|
'200':
|
|
description: File committed successfully
|
|
'400':
|
|
description: Invalid path or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient or owner approval missing
|
|
/api/gitops/rollback-request:
|
|
post:
|
|
operationId: createRollbackRequest
|
|
x-openai-isConsequential: true
|
|
summary: Create an owner-review rollback request
|
|
description: High-risk rollback request. Creates auditable rollback intent and
|
|
must never silently mutate production state or bypass owner/admin review.
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/RollbackRequestAction'
|
|
responses:
|
|
'200':
|
|
description: Rollback request committed
|
|
'400':
|
|
description: Invalid rollback request or secret-like content rejected
|
|
'401':
|
|
description: Authorization header was not injected
|
|
'403':
|
|
description: Authorization scope is insufficient or owner approval missing
|