{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/componecat-ai/json-schema/componecat-ai-credential-resource-schema.json",
  "title": "CredentialResource",
  "description": "A credential issued to a service account, as returned by the REST list and get endpoints.\nstring CredentialResource.Kind is `pat`, `oauth_client`, or `federated`; string? CredentialResource.ClientId\nis set only for an OAuth client and CredentialFederationResource? CredentialResource.Federation only for a federated trust.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/componecat-ai-openapi.yml#/components/schemas/CredentialResource",
  "required": [
    "id",
    "serviceAccountId",
    "name",
    "kind",
    "clientId",
    "federation",
    "createdAt",
    "expiresAt",
    "usedAt",
    "revokedAt",
    "scopes"
  ],
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "serviceAccountId": {
      "type": "string",
      "format": "uuid"
    },
    "name": {
      "type": "string"
    },
    "kind": {
      "type": "string"
    },
    "clientId": {
      "type": [
        "null",
        "string"
      ]
    },
    "federation": {
      "oneOf": [
        {
          "type": "null"
        },
        {
          "$ref": "#/$defs/CredentialFederationResource"
        }
      ]
    },
    "createdAt": {
      "type": "string",
      "format": "date-time"
    },
    "expiresAt": {
      "type": "string",
      "format": "date-time"
    },
    "usedAt": {
      "type": [
        "null",
        "string"
      ],
      "format": "date-time"
    },
    "revokedAt": {
      "type": [
        "null",
        "string"
      ],
      "format": "date-time"
    },
    "scopes": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/CredentialScopeResource"
      }
    }
  },
  "$defs": {
    "CredentialFederationResource": {
      "required": [
        "issuer",
        "subject",
        "audience",
        "metadataAddress",
        "issuerVerifiedAt"
      ],
      "type": "object",
      "properties": {
        "issuer": {
          "type": "string"
        },
        "subject": {
          "type": "string"
        },
        "audience": {
          "type": "string"
        },
        "metadataAddress": {
          "type": [
            "null",
            "string"
          ]
        },
        "issuerVerifiedAt": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        }
      },
      "description": "The registered trust tuple of a federated credential. (string CredentialFederationResource.Issuer,\nstring CredentialFederationResource.Subject, string CredentialFederationResource.Audience) is the trust's identity — how an incoming\nassertion resolves to this credential. string? CredentialFederationResource.MetadataAddress and\nDateTimeOffset? CredentialFederationResource.IssuerVerifiedAt are set only when the organization brought its own issuer."
    },
    "CredentialScopeResource": {
      "required": [
        "resource",
        "access",
        "canCreate",
        "overrides"
      ],
      "type": "object",
      "properties": {
        "resource": {
          "type": "string"
        },
        "access": {
          "type": "string"
        },
        "canCreate": {
          "type": "boolean"
        },
        "overrides": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/ResourceAccessResource"
          }
        }
      },
      "description": "One category grant on a credential: the resource category, its access floor (`none`,\n`read`, or `write`), the create capability, and any per-instance overrides.\nstring CredentialScopeResource.Access carries the same vocabulary the create endpoints accept in\nstring CredentialScopeRequest.Access."
    },
    "ResourceAccessResource": {
      "required": [
        "resourceId",
        "level"
      ],
      "type": "object",
      "properties": {
        "resourceId": {
          "type": "string",
          "format": "uuid"
        },
        "level": {
          "type": "string"
        }
      },
      "description": "A per-instance override raising a single resource above its category floor."
    }
  }
}