{"openapi":"3.1.0","info":{"title":"Fygment API","version":"1.0.0","summary":"Find, fetch, install and govern AI skills in a Fygment workspace.","description":"The platform for managing and governing AI skills across Claude, ChatGPT, Gemini, Copilot, Cursor and the other AI tools your team uses.\n\nAgents usually prefer the MCP server at https://fygment.dev/api/mcp (see https://fygment.dev/.well-known/mcp). This REST API exposes the same registry for scripts and integrations. Every error is JSON with `error`, `code`, `hint` and `docs_url`.\n\n**Versioning.** The major version is in the path: every operation below is served under https://fygment.dev/api/v1. Within v1, changes are additive only (new operations, optional parameters, response fields); clients must ignore fields they do not know. A breaking change ships as `/api/v2`, and v1 then keeps working for at least 12 months.\n\n**Deprecation.** A deprecated operation or path answers with an RFC 9745 `Deprecation` header and a `Link` to its `successor-version`; an RFC 8594 `Sunset` header announces the removal date at least 90 days ahead. The unversioned `/api/…` paths were deprecated on 2026-10-10 in favour of `/api/v1/…` and have no sunset date yet.\n\n**Rate limits.** Each credential may make 600 REST requests per 60 seconds (`RateLimit-Policy: \"rest\";q=600;w=60`); the MCP endpoint allows 300 per 60 seconds per user and workspace. The public index https://fygment.dev/api/v1 needs no token and allows 60 requests per 60 seconds per client IP (`RateLimit-Policy: \"anonymous\";q=60;w=60`). Responses carry `RateLimit-Policy`, and `RateLimit` when the remaining quota is known (draft-ietf-httpapi-ratelimit-headers), on successful responses as well as on 429. Over the limit, the API answers 429 with `Retry-After`.\n\nPolicy in full: https://fygment.dev/docs/api.","contact":{"name":"Fygment support","email":"admin@fygment.dev","url":"https://fygment.dev/support"},"termsOfService":"https://fygment.dev/terms","license":{"name":"Proprietary","url":"https://fygment.dev/terms"}},"externalDocs":{"description":"Fygment documentation","url":"https://fygment.dev/docs"},"servers":[{"url":"https://fygment.dev","description":"Production"}],"security":[{"oauth2":[]}],"tags":[{"name":"Meta","description":"The public API index: links, version and policies."},{"name":"Skills","description":"Search and read skills, versions and packages."},{"name":"Governance","description":"Feedback, change proposals and update checks."},{"name":"Installations","description":"Report and list where skills are installed."},{"name":"Audit","description":"Workspace audit trail (owners and admins)."}],"paths":{"/api/v1":{"get":{"operationId":"getApiIndex","security":[],"tags":["Meta"],"summary":"Get the API index","description":"The public entry point of the REST API: name and major version, links to this document, the docs, OAuth discovery and the MCP server card, and the deprecation and rate-limit policy. No token needed. Rate limited per client IP (`RateLimit-Policy: \"anonymous\";q=60;w=60`); every response carries the live `RateLimit` field and `Cache-Control: no-store`.","responses":{"200":{"description":"The API index.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiIndex"}}}},"429":{"description":"The client IP is over the anonymous rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills":{"get":{"operationId":"listSkills","tags":["Skills"],"summary":"Search the skills visible to the caller","description":"Lists approved skills in the workspace, optionally filtered by text, tag, stage, risk tier or target tool.","parameters":[{"name":"query","in":"query","description":"Free-text search over name and description.","schema":{"type":"string"}},{"name":"tag","in":"query","description":"Only skills with this tag.","schema":{"type":"string"}},{"name":"stage","in":"query","description":"Lifecycle stage.","schema":{"type":"string","enum":["draft","stable","deprecated"]}},{"name":"risk_tier","in":"query","description":"Risk tier.","schema":{"$ref":"#/components/schemas/RiskTier"}},{"name":"compatibility","in":"query","description":"Only skills compatible with this target.","schema":{"type":"string","enum":["agent_skills","claude_code","claude_desktop","openai_codex","chatgpt_mcp","openclaw"]}},{"name":"limit","in":"query","description":"Page size, 1 to 100.","schema":{"type":"integer","minimum":1,"maximum":100}},{"name":"offset","in":"query","description":"Number of results to skip.","schema":{"type":"integer","minimum":0}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"Matching skills.","content":{"application/json":{"schema":{"type":"object","required":["count","skills"],"properties":{"count":{"type":"integer"},"skills":{"type":"array","items":{"$ref":"#/components/schemas/SkillSummary"}}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}":{"get":{"operationId":"getSkill","tags":["Skills"],"summary":"Get one skill","description":"Returns the skill record, and optionally its current manifest, version list and feedback. Only a workspace owner or admin, the skill's owner or author, or a lead of a team it's shared with, gets the text of a version that hasn't passed review. Anyone else gets that version with `manifest_withheld: true`, and the latest approved version's manifest, named in `manifest_version`.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"include","in":"query","description":"Comma-separated extras: `manifest`, `versions`, `feedback`.","schema":{"type":"string","examples":["manifest,versions"]}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The skill.","content":{"application/json":{"schema":{"type":"object","required":["found","skill"],"properties":{"found":{"const":true},"skill":{"$ref":"#/components/schemas/Skill"},"manifest":{"type":"object","additionalProperties":true,"description":"Present with include=manifest."},"manifest_version":{"type":"string","description":"Present when `manifest` is the latest approved version, because the caller can't read the current one."},"manifest_withheld":{"const":true,"description":"Present with include=manifest, in place of `manifest`, when the caller can't read the current version and no approved version exists."},"versions":{"type":"array","items":{"$ref":"#/components/schemas/SkillVersion"},"description":"Present with include=versions."},"feedback":{"type":"array","items":{"type":"object","additionalProperties":true},"description":"Present with include=feedback."}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill, version or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/versions":{"get":{"operationId":"listSkillVersions","tags":["Skills"],"summary":"List the versions of a skill","description":"Returns every version of the skill with its approval state and whether a package artifact exists. A version that hasn't passed review keeps its row, with `manifest_withheld: true` and no text, unless the caller is a workspace owner or admin, the skill's owner or author, or a lead of a team it's shared with.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The versions.","content":{"application/json":{"schema":{"type":"object","required":["slug","count","versions"],"properties":{"slug":{"type":"string"},"current_version_id":{"type":["string","null"]},"count":{"type":"integer"},"versions":{"type":"array","items":{"$ref":"#/components/schemas/SkillVersion"}}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/diff":{"get":{"operationId":"getSkillDiff","tags":["Skills"],"summary":"Diff two versions of a skill","description":"Compares two versions and returns a unified text diff, a structured diff, or both. Only a workspace owner or admin, the skill's owner or author, or a lead of a team it's shared with, can compare a version that hasn't passed review. Anyone else gets 403, with the versions they can read in `details.available_versions`.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"from_version","in":"query","required":true,"description":"The older version, for example `1.2.0`.","schema":{"type":"string","minLength":1}},{"name":"to_version","in":"query","required":true,"description":"The newer version.","schema":{"type":"string","minLength":1}},{"name":"format","in":"query","description":"Which diff to return.","schema":{"type":"string","enum":["unified","structured","both"],"default":"both"}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The diff.","content":{"application/json":{"schema":{"type":"object","properties":{"unified":{"type":"string","description":"Unified text diff."},"structured":{"type":"object","additionalProperties":true,"description":"Field-level diff."}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill, version or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/export":{"get":{"operationId":"exportSkillPackage","security":[{"oauth2":["fygment:install"]}],"tags":["Skills"],"summary":"Build a signed package for a skill version","description":"Builds the package for a target tool, verifies its checksum and runs the trust review. Returns package metadata plus either base64 bytes or a scoped storage reference.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"version","in":"query","required":false,"description":"Version to export; defaults to the current published version.","schema":{"type":"string"}},{"name":"target","in":"query","description":"Package layout.","schema":{"type":"string","enum":["generic","claude_skill","claude_code","claude_desktop","openai_codex","chatgpt_mcp","remote_shell"],"default":"generic"}},{"name":"encoding","in":"query","description":"How the package bytes are returned.","schema":{"type":"string","enum":["base64","storage_path"],"default":"storage_path"}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PackageExport"}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill, version or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Package checksum verification failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"The trust review blocked the export.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"The trust review could not complete; the export is held for review.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/download":{"get":{"operationId":"downloadSkillPackage","security":[{"oauth2":["fygment:install"]}],"tags":["Skills"],"summary":"Download a skill package as a file","description":"Streams the published package as a zip (or `.skill` for the Claude skill target).","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"version","in":"query","required":false,"description":"Version to download; defaults to the current published version.","schema":{"type":"string"}},{"name":"target","in":"query","description":"Package layout.","schema":{"type":"string","enum":["generic","claude_skill"],"default":"generic"}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The package file.","content":{"application/zip":{"schema":{"type":"string","contentMediaType":"application/zip"}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill, published version or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Package checksum verification failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/updates":{"post":{"operationId":"checkSkillUpdates","tags":["Governance"],"summary":"Check installed skills for updates","description":"Compares the installed versions you send (or the installs already reported for the workspace) with the latest approved versions. The path slug is not used for filtering; pass the skills in `installed`.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"installed":{"type":"array","items":{"type":"object","required":["slug","version"],"properties":{"slug":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"target_harness":{"$ref":"#/components/schemas/TargetHarness"}}}},"include_tracked":{"type":"boolean","default":false,"description":"Also check installs already reported for this workspace."}}}}}},"responses":{"200":{"description":"One entry per checked skill, with `up_to_date` and `latest_version`.","content":{"application/json":{"schema":{"type":"object","required":["updates"],"properties":{"updates":{"type":"array","items":{"type":"object","additionalProperties":true}},"note":{"type":"string"}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/feedback":{"post":{"operationId":"submitSkillFeedback","security":[{"oauth2":["fygment:write"]}],"tags":["Governance"],"summary":"Send feedback on a skill","description":"Records feedback for the skill owner, optionally against a specific version.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["body"],"properties":{"severity":{"type":"string","enum":["info","minor","major","blocker"],"default":"info"},"body":{"type":"string","minLength":1,"maxLength":4000},"version":{"type":"string"}}}}}},"responses":{"201":{"description":"Feedback recorded.","content":{"application/json":{"schema":{"type":"object","required":["ok","feedbackId"],"properties":{"ok":{"const":true},"feedbackId":{"type":"string"}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/skills/{slug}/proposals":{"get":{"operationId":"listSkillProposals","tags":["Governance"],"summary":"List change proposals for a skill","description":"Returns proposals for the skill, optionally filtered by status.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"status","in":"query","description":"Proposal status.","schema":{"type":"string","enum":["open","approved","rejected","merged"]}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"responses":{"200":{"description":"The proposals.","content":{"application/json":{"schema":{"type":"object","required":["slug","count","proposals"],"properties":{"slug":{"type":"string"},"count":{"type":"integer"},"proposals":{"type":"array","items":{"type":"object","additionalProperties":true}}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"operationId":"createSkillProposal","security":[{"oauth2":["fygment:write"]}],"tags":["Governance"],"summary":"Propose a change to a skill","description":"Opens a proposal that the skill owner reviews before any change reaches users.","parameters":[{"name":"slug","in":"path","required":true,"description":"The skill slug, for example `research-helper`.","schema":{"type":"string","minLength":1}},{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["title","rationale"],"properties":{"base_version":{"type":"string","minLength":1},"title":{"type":"string","minLength":1,"maxLength":120},"rationale":{"type":"string","minLength":1,"maxLength":4000},"proposal_type":{"type":"string","enum":["version_change","share_to_team","publish_org"],"default":"version_change"},"target_team_ids":{"type":"array","items":{"type":"string","format":"uuid"},"default":[]},"source_type":{"type":"string","enum":["manual","transcript","content","feedback"],"default":"manual"},"source_ref":{"type":"string"},"patch":{"type":"object","properties":{"skill_md":{"type":"string"},"fygment_yaml":{"type":"string"},"workflow_yaml":{"type":"string"},"notes":{"type":"string"}}}}}}}},"responses":{"201":{"description":"Proposal opened.","content":{"application/json":{"schema":{"type":"object","required":["ok","proposalId","status"],"properties":{"ok":{"const":true},"proposalId":{"type":"string"},"status":{"type":"string"}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/installations":{"get":{"operationId":"listInstallations","tags":["Installations"],"summary":"List reported skill installations","description":"Lists where skills are installed in the workspace. Members see their own details; owners and admins see everyone.","parameters":[{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}},{"name":"slug","in":"query","description":"Only this skill.","schema":{"type":"string"}},{"name":"user_id","in":"query","description":"Only this user.","schema":{"type":"string"}},{"name":"target_harness","in":"query","description":"Only this tool.","schema":{"$ref":"#/components/schemas/TargetHarness"}},{"name":"outdated","in":"query","description":"Only installs behind the latest approved version.","schema":{"type":"string","enum":["true","false"]}}],"responses":{"200":{"description":"The installations.","content":{"application/json":{"schema":{"type":"object","required":["ok","installations"],"properties":{"ok":{"const":true},"installations":{"type":"array","items":{"type":"object","additionalProperties":true}}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"operationId":"reportInstallation","security":[{"oauth2":["fygment:install"]}],"tags":["Installations"],"summary":"Report that a skill was installed","description":"Records or updates an installation so drift and update checks know what is installed where.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["slug","version","target_harness","install_path_or_client_id","checksum"],"properties":{"slug":{"type":"string","minLength":1},"workspace":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"target_harness":{"$ref":"#/components/schemas/TargetHarness"},"install_path_or_client_id":{"type":"string","minLength":1},"checksum":{"type":"string","minLength":1}}}}}},"responses":{"200":{"description":"The installation record.","content":{"application/json":{"schema":{"type":"object","required":["ok","installation"],"properties":{"ok":{"const":true},"installation":{"type":"object","additionalProperties":true}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Skill or workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/v1/audit":{"get":{"operationId":"listAuditEntries","security":[{"oauth2":["fygment:read"]}],"tags":["Audit"],"summary":"Read the workspace audit trail","description":"Returns recent audit entries. Requires the workspace owner or admin role and the `fygment:read` scope.","parameters":[{"name":"workspace","in":"query","required":false,"description":"Workspace slug or id. Optional when the OAuth token is already bound to a workspace. Also accepted as `workspace_slug`, `workspace_id` or the `X-Fygment-Workspace` header.","schema":{"type":"string"}},{"name":"skill_id","in":"query","description":"Only entries for this skill.","schema":{"type":"string"}},{"name":"entity_type","in":"query","description":"Only entries for this entity type.","schema":{"type":"string"}},{"name":"entity_id","in":"query","description":"Only entries for this entity.","schema":{"type":"string"}},{"name":"actor_id","in":"query","description":"Only entries by this actor.","schema":{"type":"string"}},{"name":"limit","in":"query","description":"Page size, 1 to 500 (default 50).","schema":{"type":"integer","minimum":1,"maximum":500,"default":50}}],"responses":{"200":{"description":"The audit entries, newest first.","content":{"application/json":{"schema":{"type":"object","required":["entries"],"properties":{"entries":{"type":"array","items":{"type":"object","additionalProperties":true}}}}}},"headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"}}},"400":{"description":"Invalid parameters or body. `details` lists the validation issues.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing or invalid credentials, or a session cookie instead of a bearer token (v1 is bearer-only). The challenge names the v1 protected resource metadata.","headers":{"WWW-Authenticate":{"description":"`Bearer resource_metadata=\"https://fygment.dev/.well-known/oauth-protected-resource/api/v1\", scope=\"...\"`, with `error=\"invalid_token\"` when a token was sent but rejected. Request a token with `resource=https://fygment.dev/api/v1`.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"The caller lacks access to this workspace, or the token lacks the required scope. A missing scope also carries a step-up challenge in `WWW-Authenticate`.","headers":{"WWW-Authenticate":{"description":"Sent when an OAuth token lacks the scope: `Bearer error=\"insufficient_scope\", scope=\"...\", resource_metadata=\"...\", error_description=\"...\"`. Re-authorise with exactly that `scope` (the token's scopes plus the required one), then retry.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"The credential is over its rate limit. Wait for `Retry-After` seconds, then retry.","headers":{"RateLimit-Policy":{"$ref":"#/components/headers/RateLimitPolicy"},"RateLimit":{"$ref":"#/components/headers/RateLimit"},"Retry-After":{"$ref":"#/components/headers/RetryAfter"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}},"components":{"headers":{"RateLimitPolicy":{"description":"The quota policy (draft-ietf-httpapi-ratelimit-headers): name, quota `q` and window `w` in seconds.","schema":{"type":"string","examples":["\"rest\";q=600;w=60","\"anonymous\";q=60;w=60"]}},"RateLimit":{"description":"Requests remaining `r` in the current window and seconds `t` until a slot frees up.","schema":{"type":"string","examples":["\"rest\";r=0;t=12","\"anonymous\";r=59;t=60"]}},"RetryAfter":{"description":"Seconds to wait before retrying (RFC 9110).","schema":{"type":"integer","minimum":1}}},"securitySchemes":{"oauth2":{"type":"oauth2","description":"OAuth 2.1 with PKCE and dynamic client registration (RFC 7591). The REST API v1 is its own protected resource, https://fygment.dev/api/v1: request tokens with `resource=https://fygment.dev/api/v1` (RFC 8707). Protected resource metadata (RFC 9728): https://fygment.dev/.well-known/oauth-protected-resource/api/v1. Authorization server metadata: https://fygment.dev/.well-known/oauth-authorization-server. Bearer only: session cookies are not accepted on v1. MCP-resource tokens are accepted on v1 with `Deprecation` and `Sunset` headers until 2027-01-31T00:00:00Z; from that instant the REST layer refuses them with 401 `invalid_token` and an `error_description`; use a token issued for https://fygment.dev/api/v1.","flows":{"authorizationCode":{"authorizationUrl":"https://fygment.dev/authorize","tokenUrl":"https://fygment.dev/token","refreshUrl":"https://fygment.dev/token","scopes":{"fygment:read":"Read the workspace audit trail.","fygment:write":"Send feedback and open change proposals.","fygment:install":"Export and download packages, and report installations."}}}}},"schemas":{"Error":{"type":"object","required":["error"],"description":"Every API error. `error` is human-readable; `code` is stable and machine-readable.","properties":{"error":{"type":"string","description":"What went wrong."},"code":{"type":"string","description":"Stable error code.","examples":["bad_request","unauthorized","forbidden","not_found","conflict","unprocessable","rate_limited","server_error"]},"hint":{"type":"string","description":"How to resolve it."},"docs_url":{"type":"string","format":"uri"},"details":{"description":"Validation issues or other structured context."}}},"ApiIndex":{"type":"object","required":["name","major_version","base_url","links","rate_limits"],"additionalProperties":true,"properties":{"name":{"type":"string"},"major_version":{"type":"integer"},"base_url":{"type":"string","format":"uri"},"description":{"type":"string"},"links":{"type":"object","description":"OpenAPI document, docs page, OAuth discovery and MCP server card.","additionalProperties":{"type":"string","format":"uri"}},"versioning":{"type":"object","additionalProperties":true},"deprecation":{"type":"object","additionalProperties":true},"rate_limits":{"type":"object","additionalProperties":true,"properties":{"policies":{"type":"array","items":{"type":"object","required":["name","limit","window_seconds"],"properties":{"name":{"type":"string"},"scope":{"type":"string"},"limit":{"type":"integer"},"window_seconds":{"type":"integer"},"policy_header":{"type":"string"}}}}}}}},"RiskTier":{"type":"string","enum":["low","medium","high","critical"]},"TargetHarness":{"type":"string","enum":["claude_code","openai_codex","codex","claude_desktop","openclaw","opencode","cursor","generic"]},"SkillSummary":{"type":"object","required":["slug","name"],"properties":{"slug":{"type":"string"},"name":{"type":"string"},"description":{"type":["string","null"]},"stage":{"type":"string"},"risk_tier":{"$ref":"#/components/schemas/RiskTier"},"tags":{"type":"array","items":{"type":"string"}},"visibility":{"type":"string"},"current_version_id":{"type":["string","null"]}}},"Skill":{"type":"object","required":["id","slug","name"],"additionalProperties":true,"properties":{"id":{"type":"string"},"slug":{"type":"string"},"name":{"type":"string"},"description":{"type":["string","null"]},"stage":{"type":"string"},"risk_tier":{"$ref":"#/components/schemas/RiskTier"},"tags":{"type":"array","items":{"type":"string"}},"visibility":{"type":"string"},"current_version_id":{"type":["string","null"]}}},"SkillVersion":{"type":"object","required":["id","version"],"additionalProperties":true,"properties":{"id":{"type":"string"},"version":{"type":"string"},"package_checksum":{"type":["string","null"]},"has_package_artifact":{"type":"boolean"},"manifest_withheld":{"const":true,"description":"Present when the caller can't read this version's text, which is left out."}}},"PackageExport":{"type":"object","required":["ok","slug","version","filename","package_checksum"],"additionalProperties":true,"properties":{"ok":{"const":true},"slug":{"type":"string"},"skill_id":{"type":"string"},"version_id":{"type":"string"},"version":{"type":"string"},"target":{"type":"string"},"filename":{"type":"string"},"mime_type":{"type":"string"},"package_checksum":{"type":"string"},"checksum_verified":{"type":"boolean"},"size_bytes":{"type":"integer"},"encoding":{"type":"string","enum":["base64","storage_path"]},"package_base64":{"type":"string","description":"Present with encoding=base64."},"storage_path":{"type":"string","description":"Present with encoding=storage_path."},"package_signature":{"type":"object","additionalProperties":true},"trust_review":{"type":["object","null"],"additionalProperties":true}}}}}}