openapi: 3.1.0
info:
  title: DareTap Share API
  version: 1.3.0
  description: Independent games, shared competition services. Millisecond Unix
    timestamps; UTC periods. No client secret in public code. Guest identities
    remain per installation until explicitly attached to an optional OIDC
    account. New public leaderboards require an account; historical sharing
    remains independent. Errors use stable codes. No production deployment is
    implied by this contract. Legacy /api endpoints remain separate and
    compatible.
servers:
  - url: https://daretapshare.com/api/v1
  - url: http://127.0.0.1:8790/api/v1
    description: Local development
paths:
  /health:
    get:
      summary: Check service and D1 availability
      operationId: get_health
      description: Check service and D1 availability
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Health"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /games:
    get:
      summary: Registered games; connected is an explicit integration status
      operationId: get_games
      description: Registered games; connected is an explicit integration status
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GameList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /games/{gameId}:
    get:
      summary: Read a registered game
      operationId: get_games__gameId_
      description: Read a registered game
      security: []
      parameters:
        - name: gameId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Game"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /games/{gameId}/modes:
    get:
      summary: Read versioned modes
      operationId: get_games__gameId__modes
      description: Read versioned modes
      security: []
      parameters:
        - name: gameId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ModeList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/anonymous:
    post:
      summary: Create an independent anonymous identity
      operationId: post_auth_anonymous
      description: Cookie transport is same-origin only, requires Origin, and returns
        HttpOnly Secure cookies without body credentials. Bearer transport
        returns a short-lived access token and a rotating 30-day refresh token.
        Browsers on other sites keep tokens in memory. Creating a profile does
        not publish it. This bootstrap operation is intentionally not
        replayable; on an ambiguous failure retry creates a new independent
        identity.
      security: []
      parameters: []
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Auth"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AnonymousInput"
  /auth/refresh:
    post:
      summary: Rotate a refresh token exactly once
      operationId: post_auth_refresh
      description: Cookie transport sends an empty JSON object and Origin. Bearer
        transport sends refreshToken. Concurrent refresh attempts have one
        winner. Refresh does not extend the initial 30-day lifetime.
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Auth"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RefreshInput"
  /auth/logout:
    post:
      summary: Revoke this device session
      operationId: post_auth_logout
      description: Revoke this device session
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/config:
    get:
      summary: Read account availability without blocking guest gameplay
      operationId: get_auth_config
      description: Read account availability without blocking guest gameplay
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AuthConfig"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/login:
    post:
      summary: Begin same-origin OIDC authorization code + PKCE
      operationId: post_auth_login
      description: Requires Origin matching Share. Sets a ten-minute HttpOnly
        transaction cookie. The browser navigates to the returned Logto URL. 16+
        self-attestation is required. claimGuest is explicit consent to attach
        this browser’s owned Share guest activity. Does not publish the profile.
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Redirect"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LoginInput"
  /auth/callback:
    get:
      summary: Validate one-time state, cookie, PKCE, nonce and signed ID token, then
        establish a Share session
      security: []
      parameters:
        - name: state
          in: query
          required: true
          schema:
            type: string
        - name: code
          in: query
          schema:
            type: string
        - name: error
          in: query
          schema:
            type: string
      responses:
        "303":
          description: Redirect to the stored local destination, or /me?auth=failed. No
            provider tokens in the URL.
          headers:
            Location:
              schema:
                type: string
  /auth/exchange:
    post:
      summary: Exchange a fresh native or other first-party login for a Share session
      operationId: post_auth_exchange
      description: Requires a configured Share API resource and a separate allowlisted
        client. Can be tested free in Logto Dev; production API resources
        require an explicitly approved compatible plan. Submit a resource access
        token (Share audience and allowlisted client_id) and its same-subject ID
        token (exact client audience, SDK-validated nonce, auth_time within five
        minutes). The ID token is a single-use login proof, never an API bearer.
        Request max_age=0 when signing in; subsequent Share renewal uses
        /auth/refresh. On an ambiguous exchange failure, sign in again. No
        client secret is embedded in native code.
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Auth"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ExchangeInput"
  /auth/guest-proof:
    post:
      summary: Mint a ten-minute private ownership proof before switching from guest
        to account
      operationId: post_auth_guest_proof
      description: Mint a ten-minute private ownership proof before switching from
        guest to account
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GuestProof"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EmptyInput"
  /auth/claim:
    post:
      summary: Attach owned guest activity without rewriting its IDs
      operationId: post_auth_claim
      description: Requires an account authenticated in the past ten minutes. Retrying
        the same proof for the same account succeeds; another account cannot
        claim it. All guest device tokens are revoked. Source scores keep their
        trust classification.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Claimed"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ClaimInput"
  /auth/claim-legacy:
    post:
      summary: Link the current owned historical Puzzle cookie to the account
      operationId: post_auth_claim_legacy
      description: Requires fresh authentication plus the valid __Host-daretap cookie.
        Read-only projection of unexpired historical daily shares and duels.
        Does not convert scores into verified records or extend historical TTLs.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Claimed"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EmptyInput"
  /auth/link-source:
    post:
      summary: Attach an application’s privately authenticated guest tracker
      operationId: post_auth_link_source
      description: Fresh account authentication and a short-lived source-server signed
        assertion are both required. A public challenge URL never proves
        ownership. See docs/accounts.md for the versioned HS256 integration
        contract.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Linked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SourceLinkInput"
  /auth/reauthenticate:
    post:
      summary: Begin or complete native step-up authentication
      operationId: post_auth_reauthenticate
      description: POST {} returns a single-use nonce bound to the current device.
        Perform OIDC login with this nonce and max_age=0, then POST
        {nonce,idToken}. Signature, issuer, exact account subject, client
        audience, nonce and recent auth_time are checked. Web uses /auth/login
        instead.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Reauthentication"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReauthenticationInput"
  /auth/account-center:
    get:
      summary: Get the Logto security center URL for explicit login-method management
      operationId: get_auth_account_center
      description: Get the Logto security center URL for explicit login-method management
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Redirect"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/backchannel-logout:
    post:
      summary: Consume a signed OIDC logout token and revoke matching Share sessions
      operationId: post_auth_backchannel_logout
      description: Consume a signed OIDC logout token and revoke matching Share sessions
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                logout_token:
                  type: string
              required:
                - logout_token
              additionalProperties: false
  /players/me/sessions:
    get:
      summary: List the account’s own device sessions
      operationId: get_players_me_sessions
      description: List the account’s own device sessions
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccountSessions"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/sessions/{sessionId}:
    delete:
      summary: Revoke an owned session; sessionId=all revokes every device
      operationId: delete_players_me_sessions__sessionId_
      description: Requires recent authentication. Current-session or all-session
        revocation also clears Share cookies. This is Share session revocation;
        Logto sessions can be managed in its security center.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: sessionId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/apps:
    get:
      summary: List linked applications
      operationId: get_players_me_apps
      description: List linked applications
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LinkedApps"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/links:
    get:
      summary: Read owned opaque source link IDs, without source credentials
      operationId: get_players_me_links
      description: A game backend may call this endpoint with the user’s Share session
        to verify that its stored linkId belongs to that signed-in account.
        Never trust a client-supplied linkId without this check.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccountLinks"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /admin/account-jobs:
    get:
      summary: Monitor aggregate pending external account cleanup without personal data
      operationId: get_admin_account_jobs
      description: Monitor aggregate pending external account cleanup without personal data
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccountJobs"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/apps/{applicationId}:
    delete:
      summary: Unlink application activity, revoke its sessions and queue backend
        unlinking
      operationId: delete_players_me_apps__applicationId_
      description: The durable callback snapshots each original linkId before deleting
        the link. Source receivers must compare the signed linkId with their
        current mapping atomically; delayed jobs cannot unlink a newer
        connection. See the sourceAccountUnlinked webhook.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: applicationId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/dares:
    get:
      summary: Read private, unexpired activity from linked games
      operationId: get_players_me_dares
      description: 50 entries per page. Private projection only, never a
        verified-score submission endpoint. Source TTLs and deleted tombstones
        are respected.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: cursor
          in: query
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DareActivityList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/dares/{activityId}/seen:
    post:
      summary: Mark an owned activity as read
      operationId: post_players_me_dares__activityId__seen
      description: Mark an owned activity as read
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: activityId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EmptyInput"
  /players/me/export:
    get:
      summary: Export private profile, results and challenge summaries without secrets
        or traces
      operationId: get_players_me_export
      description: Export private profile, results and challenge summaries without
        secrets or traces
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccountExport"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /integrations/{applicationId}/activity:
    post:
      summary: Ingest a signed versioned source projection idempotently
      operationId: post_integrations__applicationId__activity
      description: "Server-to-server only: HS256 bearer assertion with
        issuer=applicationId, audience=PUBLIC_ORIGIN/api/v1/integrations,
        kind=activity, sub=linkId, jti=eventId, bodyHash=SHA256(canonical JSON),
        iat and exp <= five minutes. Per-application Wrangler secret; never ship
        it to a client. Exact origin allowlist; queries, fragments and userinfo
        are rejected. HTTPS required except HTTP localhost/127.0.0.1 URLs when
        ENVIRONMENT=development, ALLOW_LOCAL=true, and PUBLIC_ORIGIN is also
        HTTP loopback. This exception never applies in staging/production."
      security: []
      parameters:
        - name: applicationId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ActivityInput"
  /players/me:
    get:
      summary: Read private profile
      operationId: get_players_me
      description: Read private profile
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Profile"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      summary: Edit profile and publication preference
      operationId: patch_players_me
      description: Edit profile and publication preference
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Profile"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProfileInput"
    delete:
      summary: Delete identity, credentials, sessions, scores and challenges
      operationId: delete_players_me
      description: Delete identity, credentials, sessions, scores and challenges
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Deleted"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/{publicId}:
    get:
      summary: Read an opt-in public profile
      operationId: get_players__publicId_
      description: Read an opt-in public profile
      security: []
      parameters:
        - name: publicId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PublicProfile"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/{publicId}/stats:
    get:
      summary: Read public aggregate achievements
      operationId: get_players__publicId__stats
      description: Read public aggregate achievements
      security: []
      parameters:
        - name: publicId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Stats"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/stats:
    get:
      summary: Read own verified statistics
      operationId: get_players_me_stats
      description: Read own verified statistics
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Stats"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/records:
    get:
      summary: Read own verified performances, including private ones
      operationId: get_players_me_records
      description: Read own verified performances, including private ones
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RecordList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /competitions:
    get:
      summary: List available comparable competitions
      operationId: get_competitions
      description: List available comparable competitions
      security: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: gameId
          in: query
          required: false
          schema:
            type: string
        - name: applicationId
          in: query
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CompetitionList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /competitions/{competitionId}:
    get:
      summary: Read official conditions without private solutions
      operationId: get_competitions__competitionId_
      description: Read official conditions without private solutions
      security: []
      parameters:
        - name: competitionId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Competition"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /sessions:
    post:
      summary: Open a ranked, expiring session
      operationId: post_sessions
      description: Open a ranked, expiring session
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Session"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SessionInput"
  /sessions/{sessionId}:
    get:
      summary: Read an owned session
      operationId: get_sessions__sessionId_
      description: Read an owned session
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: sessionId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Session"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /sessions/{sessionId}/complete:
    post:
      summary: Consume a session and validate its replay
      operationId: post_sessions__sessionId__complete
      description: Rules are chosen by the competition, not the client. A rejected
        trace consumes the session. Only server-verified results create records.
        A replay proves rule correctness, not human play or trusted device
        timing. Retrying an identical key and body returns the same result. A
        second body returns 409.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: sessionId
          in: path
          required: true
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Submission"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CompletionInput"
  /players/me/records/{recordId}/publication:
    put:
      summary: Publish or withdraw an owned verified result without changing profile
        visibility
      operationId: put_players_me_records__recordId__publication
      description: An account is required. Strict {published:boolean}, same-origin
        cookie writes and ownership checks apply. This idempotent desired state
        publishes only this receipt. Withdrawals override the legacy
        public-profile default. A private profile exposes only nickname/avatar,
        never its public ID or history link.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: recordId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Record"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PublicationInput"
  /leaderboards:
    get:
      summary: List leaderboards by competition
      operationId: get_leaderboards
      description: List leaderboards by competition
      security: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: gameId
          in: query
          required: false
          schema:
            type: string
        - name: applicationId
          in: query
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CompetitionList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /leaderboards/me:
    get:
      summary: Read own official rank, period best and private hypothetical comparison
      operationId: get_leaderboards_me
      description: Read own official rank, period best and private hypothetical comparison
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: competitionId
          in: query
          required: true
          schema:
            type: string
        - name: period
          in: query
          required: false
          schema:
            enum:
              - all-time
              - daily
              - weekly
            default: all-time
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PersonalBoard"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /leaderboards/{leaderboardId}:
    get:
      summary: Read top 100 with one best published result per account
      operationId: get_leaderboards__leaderboardId_
      description: leaderboardId equals competitionId. Server receipt time defines UTC
        daily/weekly periods. Weeks start Monday 00:00 UTC. Value, validator tie
        value, then server achievement time determine order. Exact ties share a
        rank. Private profiles may publish a chosen result separately; publicId
        is then null. Unpublished results, guests, suspended players and
        invalidated results are excluded.
      security: []
      parameters:
        - name: leaderboardId
          in: path
          required: true
          schema:
            type: string
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: period
          in: query
          required: false
          schema:
            enum:
              - all-time
              - daily
              - weekly
            default: all-time
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Board"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /records:
    get:
      summary: List verified performance receipts
      operationId: get_records
      description: List verified performance receipts
      security: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RecordList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /records/{recordId}:
    get:
      summary: Read a public verified record; current best flags are recalculated
      operationId: get_records__recordId_
      description: Read a public verified record; current best flags are recalculated
      security: []
      parameters:
        - name: recordId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Record"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /challenges/daily:
    get:
      summary: List official daily competitions for a UTC day
      operationId: get_challenges_daily
      description: List official daily competitions for a UTC day
      security: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: day
          in: query
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CompetitionList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /challenges:
    post:
      summary: Challenge friends using an owned public verified record
      operationId: post_challenges
      description: Challenge friends using an owned public verified record
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Challenge"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ChallengeInput"
  /challenges/{challengeId}:
    get:
      summary: Read challenge, matching conditions and comparison
      operationId: get_challenges__challengeId_
      description: Read challenge, matching conditions and comparison
      security: []
      parameters:
        - name: challengeId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Challenge"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      summary: Revoke an owned challenge
      operationId: delete_challenges__challengeId_
      description: Revoke an owned challenge
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: challengeId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /admin/applications:
    post:
      summary: Register an application without activating integration
      operationId: post_admin_applications
      description: Register an application without activating integration
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Registered"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApplicationInput"
  /admin/games:
    post:
      summary: Register a game
      operationId: post_admin_games
      description: Register a game
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Registered"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GameInput"
  /admin/modes:
    post:
      summary: Register a disabled versioned mode
      operationId: post_admin_modes
      description: Register a disabled versioned mode
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Registered"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ModeInput"
  /admin/competitions:
    post:
      summary: Create immutable validated conditions
      operationId: post_admin_competitions
      description: Create immutable validated conditions
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CreatedCompetition"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CompetitionInput"
  /admin/moderation:
    post:
      summary: Activate, suspend or invalidate with audit reason
      operationId: post_admin_moderation
      description: Activate, suspend or invalidate with audit reason
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ModerationInput"
  /admin/rejections:
    get:
      summary: Read latest rejection reasons without private traces
      operationId: get_admin_rejections
      description: Read latest rejection reasons without private traces
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Rejections"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /admin/metrics:
    get:
      summary: Read daily aggregate counters
      operationId: get_admin_metrics
      description: Read daily aggregate counters
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Metrics"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /catalogue:
    get:
      summary: List published ecosystem products and confirmed platform links
      operationId: get_catalogue
      description: List published ecosystem products and confirmed platform links
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ProductList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /admin/applications/{applicationId}/catalogue:
    patch:
      summary: Configure a product page independently of score integration activation
      operationId: patch_admin_applications__applicationId__catalogue
      description: Web URL must use the registered official origin. Store availability
        must be verified by the administrator; null means unavailable. No
        subscription or deployment.
      security:
        - CloudflareAccess: []
      parameters:
        - name: applicationId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CatalogueInput"
  /profiles/{handle}:
    get:
      summary: Read a public Passport by unique username
      operationId: get_profiles__handle_
      description: Read a public Passport by unique username
      security: []
      parameters:
        - name: handle
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PublicProfile"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/{publicId}/records:
    get:
      summary: Read records of a public profile
      operationId: get_players__publicId__records
      description: Read records of a public profile
      security: []
      parameters:
        - name: publicId
          in: path
          required: true
          schema:
            type: string
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RecordList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /handles/availability:
    get:
      summary: Check an ASCII normalized username without disclosing its owner
      operationId: get_handles_availability
      description: Check an ASCII normalized username without disclosing its owner
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: handle
          in: query
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Availability"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /players/me/handle:
    patch:
      summary: Reserve a unique username atomically
      operationId: patch_players_me_handle
      description: 3–24 ASCII lowercase letters/digits/underscores, letter first.
        Reserved brand/staff names blocked. Up to five handles per profile, old
        handles remain reserved and old URLs return 404. Does not publish the
        profile.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Profile"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/HandleInput"
  /players/me/preferences:
    get:
      summary: Read private Passport preferences
      operationId: get_players_me_preferences
      description: Read private Passport preferences
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Preferences"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      summary: Update language, in-app notifications and opt-in friend scores
      operationId: patch_players_me_preferences
      description: Update language, in-app notifications and opt-in friend scores
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Preferences"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PreferencesInput"
  /social/invitations:
    get:
      summary: List owned unexpired invitations, without tokens
      operationId: get_social_invitations
      description: List owned unexpired invitations, without tokens
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Invitations"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      summary: Create a seven-day revocable friend invitation
      operationId: post_social_invitations
      description: Generate and retain a 32-byte random hex token and idempotency key
        on the client for retries. Only a hash is stored. URL puts token in
        fragment. This token grants only the ability to request friendship; it
        is never account ownership proof.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Invitation"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/InviteInput"
  /social/invitations/{invitationId}:
    delete:
      summary: Revoke an owned invitation
      operationId: delete_social_invitations__invitationId_
      description: Revoke an owned invitation
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: invitationId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/invitations/preview:
    post:
      summary: Preview an invitation after sign-in
      operationId: post_social_invitations_preview
      description: Preview an invitation after sign-in
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/InvitePreview"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/InviteInput"
  /social/requests:
    post:
      summary: Request friendship via an invitation; repeated pair requests are
        idempotent
      operationId: post_social_requests
      description: No automatic acceptance for crossed requests. Accepted friendship
        requires explicit recipient approval. Declined requests have a 24-hour
        cooldown.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/FriendRequest"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/FriendRequestInput"
  /social/friends:
    get:
      summary: List up to 200 private friends and pending requests
      operationId: get_social_friends
      description: List up to 200 private friends and pending requests
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Friends"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/friends/{friendshipId}:
    patch:
      summary: Accept or decline an incoming request
      operationId: patch_social_friends__friendshipId_
      description: Accept or decline an incoming request
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: friendshipId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/FriendDecision"
    delete:
      summary: Remove a friendship or cancel a request
      operationId: delete_social_friends__friendshipId_
      description: Remove a friendship or cancel a request
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: friendshipId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/blocks:
    get:
      summary: List blocked players
      operationId: get_social_blocks
      description: List blocked players
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Blocks"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/blocks/{publicId}:
    post:
      summary: Block a player and remove mutual social access atomically
      operationId: post_social_blocks__publicId_
      description: Block a player and remove mutual social access atomically
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: publicId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EmptyInput"
    delete:
      summary: Unblock without restoring a friendship
      operationId: delete_social_blocks__publicId_
      description: Unblock without restoring a friendship
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: publicId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Revoked"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/leaderboard:
    get:
      summary: Read verified scores shared with accepted friends, plus own result
      operationId: get_social_leaderboard
      description: Explicit friendScores preference required for other participants.
        Does not publish private results or friend lists. Canonical aliases
        deduplicated. Same score rules and UTC periods as global boards.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: competitionId
          in: query
          required: true
          schema:
            type: string
        - name: period
          in: query
          required: false
          schema:
            enum:
              - all-time
              - daily
              - weekly
            default: all-time
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/FriendBoard"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/challenges:
    post:
      summary: Send an owned public verified challenge to an accepted friend
      operationId: post_social_challenges
      description: revengeOf optionally references an incoming direct challenge in the
        same competition. Public challenge mechanics remain unchanged. No
        push/email is sent.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Registered"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DirectInput"
    get:
      summary: List own active direct challenges
      operationId: get_social_challenges
      description: List own active direct challenges
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DirectChallengeList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/notifications:
    get:
      summary: Read private in-app notifications
      operationId: get_social_notifications
      description: Read private in-app notifications
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: cursor
          in: query
          schema:
            type: string
            pattern: ^\d{1,7}$
          description: Continuation returned in nextCursor, currently a decimal offset
            capped at 1,000,000. Treat it as opaque. Rankings return the top
            100. Live ranks can change between pages.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/NotificationList"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/notifications/{notificationId}/seen:
    post:
      summary: Mark an owned notification as read
      operationId: post_social_notifications__notificationId__seen
      description: Mark an owned notification as read
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: notificationId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EmptyInput"
  /achievements:
    get:
      summary: Read the versioned evidence-based badge catalogue
      operationId: get_achievements
      description: Computed from verified results and real challenge creation. No XP,
        currency or global inter-game score. Invalidated evidence may remove a
        badge.
      security: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Achievements"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /social/reports:
    post:
      summary: Report a public profile, friend or player already blocked by the reporter
      operationId: post_social_reports
      description: 3 attempts/minute and 10 new reports/day. Private moderation queue;
        does not automatically suspend a player. Retained at most 90 days.
      security:
        - BearerAuth: []
        - CookieAuth: []
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9_-]{16,80}$
          description: Persist across retries. Reusing the key with a different body
            returns 409.
      responses:
        "201":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Registered"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReportInput"
  /admin/reports:
    get:
      summary: Read up to 100 oldest open reports in a private moderation queue
      operationId: get_admin_reports
      description: Read up to 100 oldest open reports in a private moderation queue
      security:
        - CloudflareAccess: []
      parameters: []
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Reports"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /admin/reports/{reportId}:
    patch:
      summary: Review or dismiss a report with an audit reason
      operationId: patch_admin_reports__reportId_
      description: Review or dismiss a report with an audit reason
      security:
        - CloudflareAccess: []
      parameters:
        - name: reportId
          in: path
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Updated"
        "400":
          description: Invalid input
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "401":
          description: Invalid or expired credentials
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "403":
          description: Forbidden origin or ownership
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "404":
          description: Unavailable or private resource
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "409":
          description: Idempotency, rules version or competition conflict
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "410":
          description: Session expired
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "413":
          description: Body exceeds 64 KiB
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "415":
          description: JSON required
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "429":
          description: Rate or daily submission limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Service or security configuration unavailable
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewReportInput"
webhooks:
  sourceAccountUnlinked:
    post:
      summary: Unlink only the original source connection generation
      description: "Outbound POST to the configured source deletionUrl, not a Share
        route. HS256 JWT in Authorization: issuer=PUBLIC_ORIGIN,
        audience=applicationId, sub=private source tracker, kind=unlink,
        jti=body.eventId, iat/exp <= five minutes, required linkId=original
        queued connection ID (SourceUnlinkClaims). Validate before any mutation.
        Compare sub AND signed linkId atomically with the current source
        mapping. A different/newer mapping is a successful no-op. Preserve
        public challenges and participants. Keep an idempotent receipt for
        eventId. Missing linkId must never unlink an active mapping. Retries
        retain eventId and linkId but renew the signature. Legacy job IDs with
        recoverable original generations are migrated by 0012; other jobs remain
        pending."
      security: []
      parameters:
        - name: Authorization
          in: header
          required: true
          schema:
            type: string
            pattern: ^Bearer .+
          description: Dedicated per-application HS256 assertion; never a player bearer or
            a public credential.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SourceUnlinkBody"
      responses:
        "204":
          description: Original mapping removed, already removed, or superseded; no newer
            mapping was changed.
        "401":
          description: Invalid signature, issuer, audience or dates; no mutation.
        "404":
          description: Original mapping no longer exists; Share treats as completed.
        "409":
          description: Cannot safely apply the unlink (for example missing signed
            generation); no mutation, Share keeps the job pending.
        "503":
          description: Transient source failure; Share retries with backoff.
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
    CookieAuth:
      type: apiKey
      in: cookie
      name: __Host-share-access
      description: Same-origin only; Origin required on mutations.
    CloudflareAccess:
      type: apiKey
      in: header
      name: Cf-Access-Jwt-Assertion
      description: Cloudflare Access JWT, verified signature, issuer, audience and
        subject allowlist. Enforce MFA in Access policy.
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
          required:
            - code
            - message
            - requestId
          additionalProperties: false
      required:
        - error
      additionalProperties: false
    Health:
      type: object
      properties:
        ok:
          type: boolean
        version:
          type: string
        environment:
          type: string
        timezone:
          const: UTC
      required:
        - ok
        - version
        - environment
        - timezone
      additionalProperties: false
    PublicPlayer:
      type: object
      properties:
        publicId:
          type: string
        nickname:
          type: string
        handle:
          anyOf:
            - type: string
            - type: "null"
        avatar:
          type: string
        country:
          anyOf:
            - type: string
            - type: "null"
        createdAt:
          type: integer
      required:
        - publicId
        - nickname
        - handle
        - avatar
        - country
        - createdAt
      additionalProperties: false
    Profile:
      type: object
      properties:
        publicId:
          type: string
        nickname:
          type: string
        handle:
          anyOf:
            - type: string
            - type: "null"
        avatar:
          type: string
        country:
          anyOf:
            - type: string
            - type: "null"
        createdAt:
          type: integer
        visibility:
          enum:
            - private
            - public
        account:
          type: boolean
      required:
        - publicId
        - nickname
        - handle
        - avatar
        - country
        - createdAt
        - visibility
        - account
      additionalProperties: false
    PlayerSummary:
      type: object
      properties:
        publicId:
          anyOf:
            - type: string
            - type: "null"
        nickname:
          type: string
        avatar:
          type: string
      required:
        - publicId
        - nickname
        - avatar
      additionalProperties: false
    Auth:
      type: object
      properties:
        player:
          $ref: "#/components/schemas/Profile"
        expiresIn:
          type: integer
        accessToken:
          type: string
        refreshToken:
          type: string
      required:
        - player
        - expiresIn
      additionalProperties: false
    Stats:
      type: object
      properties:
        verifiedPerformances:
          type: integer
        competitions:
          type: integer
        achievements:
          type: array
          items:
            type: object
            properties:
              id:
                enum:
                  - first-verified
                  - three-games
                  - first-challenge
            required:
              - id
            additionalProperties: false
      required:
        - verifiedPerformances
        - competitions
        - achievements
      additionalProperties: false
    PublicProfile:
      type: object
      properties:
        publicId:
          type: string
        nickname:
          type: string
        handle:
          anyOf:
            - type: string
            - type: "null"
        avatar:
          type: string
        country:
          anyOf:
            - type: string
            - type: "null"
        createdAt:
          type: integer
        stats:
          $ref: "#/components/schemas/Stats"
      required:
        - publicId
        - nickname
        - handle
        - avatar
        - country
        - createdAt
        - stats
      additionalProperties: false
    Game:
      type: object
      properties:
        id:
          type: string
        applicationId:
          type: string
        names:
          type: object
          additionalProperties:
            type: string
        descriptions:
          type: object
          additionalProperties:
            type: string
        category:
          type: string
        icon:
          anyOf:
            - type: string
            - type: "null"
        status:
          type: string
        connected:
          type: boolean
        application:
          type: object
          properties:
            name:
              type: string
            type:
              type: string
            officialUrl:
              type: string
          required:
            - name
            - type
            - officialUrl
          additionalProperties: false
      required:
        - id
        - applicationId
        - names
        - descriptions
        - category
        - icon
        - status
        - connected
        - application
      additionalProperties: false
    Mode:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        rulesVersion:
          type: string
        resultType:
          type: string
        direction:
          enum:
            - asc
            - desc
        rules:
          type: object
        status:
          type: string
      required:
        - id
        - name
        - rulesVersion
        - resultType
        - direction
        - rules
        - status
      additionalProperties: false
    Competition:
      type: object
      properties:
        id:
          type: string
        modeId:
          type: string
        gameId:
          type: string
        title:
          type: string
        kind:
          enum:
            - standard
            - daily
        day:
          anyOf:
            - type: string
            - type: "null"
        contentVersion:
          type: string
        rulesVersion:
          type: string
        configuration:
          type: object
        rules:
          type: object
        conditionsHash:
          type: string
        startsAt:
          type: integer
        endsAt:
          type: integer
        status:
          type: string
        resultType:
          type: string
      required:
        - id
        - modeId
        - gameId
        - title
        - kind
        - day
        - contentVersion
        - rulesVersion
        - configuration
        - rules
        - conditionsHash
        - startsAt
        - endsAt
        - status
        - resultType
      additionalProperties: false
    Session:
      type: object
      properties:
        id:
          type: string
        competition:
          $ref: "#/components/schemas/Competition"
        rulesVersion:
          type: string
        nonce:
          type: string
        createdAt:
          type: integer
        expiresAt:
          type: integer
        status:
          enum:
            - open
            - completed
        challengeId:
          anyOf:
            - type: string
            - type: "null"
      required:
        - id
        - competition
        - rulesVersion
        - nonce
        - createdAt
        - expiresAt
        - status
        - challengeId
      additionalProperties: false
    Submission:
      type: object
      properties:
        id:
          type: string
        sessionId:
          type: string
        status:
          enum:
            - verified
            - rejected
            - invalidated
        value:
          anyOf:
            - type: number
            - type: "null"
        metrics:
          type: object
          additionalProperties:
            type: number
        trust:
          enum:
            - rules-verified
            - unverified
            - test-only
        reason:
          anyOf:
            - type: string
            - type: "null"
        recordId:
          anyOf:
            - type: string
            - type: "null"
      required:
        - id
        - sessionId
        - status
        - value
        - metrics
        - trust
        - reason
        - recordId
      additionalProperties: false
    Entry:
      type: object
      properties:
        rank:
          type: integer
        player:
          $ref: "#/components/schemas/PlayerSummary"
        value:
          type: number
        achievedAt:
          type: integer
        recordId:
          type: string
      required:
        - rank
        - player
        - value
        - achievedAt
        - recordId
      additionalProperties: false
    Board:
      type: object
      properties:
        competition:
          $ref: "#/components/schemas/Competition"
        period:
          enum:
            - all-time
            - daily
            - weekly
        participants:
          type: integer
        entries:
          type: array
          items:
            $ref: "#/components/schemas/Entry"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
        me:
          anyOf:
            - $ref: "#/components/schemas/Entry"
            - type: "null"
      required:
        - competition
        - period
        - participants
        - entries
        - nextCursor
        - me
      additionalProperties: false
    PersonalBoard:
      type: object
      properties:
        competitionId:
          type: string
        period:
          type: string
        participants:
          type: integer
        me:
          anyOf:
            - $ref: "#/components/schemas/Entry"
            - type: "null"
        personalBest:
          anyOf:
            - type: object
              properties:
                value:
                  type: number
                achievedAt:
                  type: integer
              required:
                - value
                - achievedAt
              additionalProperties: false
            - type: "null"
        comparison:
          anyOf:
            - type: object
              properties:
                rank:
                  type: integer
                referenceParticipants:
                  type: integer
              required:
                - rank
                - referenceParticipants
              additionalProperties: false
            - type: "null"
      required:
        - competitionId
        - period
        - participants
        - me
        - personalBest
        - comparison
      additionalProperties: false
    Record:
      type: object
      properties:
        publication:
          enum:
            - private
            - public
        id:
          type: string
        competitionId:
          type: string
        gameId:
          type: string
        modeId:
          type: string
        title:
          type: string
        value:
          type: number
        metrics:
          type: object
          additionalProperties:
            type: number
        trust:
          type: string
        verification:
          const: verified
        rulesVersion:
          type: string
        achievedAt:
          type: integer
        player:
          $ref: "#/components/schemas/PlayerSummary"
        rank:
          anyOf:
            - type: integer
            - type: "null"
        personalBest:
          type: boolean
        worldRecord:
          type: boolean
      required:
        - publication
        - id
        - competitionId
        - gameId
        - modeId
        - title
        - value
        - metrics
        - trust
        - verification
        - rulesVersion
        - achievedAt
        - player
        - rank
        - personalBest
        - worldRecord
      additionalProperties: false
    Challenge:
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        createdAt:
          type: integer
        expiresAt:
          type: integer
        status:
          const: active
        reference:
          $ref: "#/components/schemas/Record"
        competition:
          $ref: "#/components/schemas/Competition"
        routing:
          type: object
          properties:
            launchUrl:
              anyOf:
                - type: string
                - type: "null"
            officialUrl:
              anyOf:
                - type: string
                - type: "null"
            playUrl:
              anyOf:
                - type: string
                - type: "null"
            appLinksReady:
              type: boolean
          required:
            - launchUrl
            - officialUrl
            - playUrl
            - appLinksReady
          additionalProperties: false
        leaderboard:
          $ref: "#/components/schemas/Board"
      required:
        - id
        - url
        - createdAt
        - expiresAt
        - status
        - reference
        - competition
        - routing
        - leaderboard
      additionalProperties: false
    Deleted:
      type: object
      properties:
        deleted:
          const: true
      required:
        - deleted
      additionalProperties: false
    Revoked:
      type: object
      properties:
        revoked:
          const: true
      required:
        - revoked
      additionalProperties: false
    Updated:
      type: object
      properties:
        updated:
          const: true
      required:
        - updated
      additionalProperties: false
    Registered:
      type: object
      properties:
        id:
          type: string
      required:
        - id
      additionalProperties: false
    CreatedCompetition:
      type: object
      properties:
        id:
          type: string
        conditionsHash:
          type: string
      required:
        - id
        - conditionsHash
      additionalProperties: false
    Rejections:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              competition_id:
                type: string
              reason:
                anyOf:
                  - type: string
                  - type: "null"
              validator_version:
                type: string
              achieved_at:
                type: integer
            required:
              - id
              - competition_id
              - reason
              - validator_version
              - achieved_at
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    Metrics:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              day:
                type: string
              name:
                type: string
              count:
                type: integer
            required:
              - day
              - name
              - count
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    EmptyInput:
      $schema: https://json-schema.org/draft/2020-12/schema
      type: object
      properties: {}
      additionalProperties: false
    AuthConfig:
      type: object
      properties:
        enabled:
          type: boolean
        minimumAge:
          const: 16
        mobileExchange:
          type: boolean
      required:
        - enabled
        - minimumAge
        - mobileExchange
      additionalProperties: false
    Redirect:
      type: object
      properties:
        url:
          type: string
      required:
        - url
      additionalProperties: false
    GuestProof:
      type: object
      properties:
        proof:
          type: string
        expiresAt:
          type: integer
      required:
        - proof
        - expiresAt
      additionalProperties: false
    Claimed:
      type: object
      properties:
        claimed:
          const: true
      required:
        - claimed
      additionalProperties: false
    Linked:
      type: object
      properties:
        linkId:
          type: string
      required:
        - linkId
      additionalProperties: false
    LinkedApps:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type: string
            required:
              - id
              - name
            additionalProperties: false
        legacyAvailable:
          type: boolean
      required:
        - items
        - legacyAvailable
      additionalProperties: false
    SourceUnlinkBody:
      type: object
      properties:
        eventId:
          type: string
        action:
          const: unlink-account
      required:
        - eventId
        - action
      additionalProperties: false
    SourceUnlinkClaims:
      type: object
      properties:
        iss:
          type: string
        aud:
          type: string
        sub:
          type: string
        kind:
          const: unlink
        jti:
          type: string
        iat:
          type: integer
        exp:
          type: integer
        linkId:
          type: string
          pattern: ^link_[a-f0-9]{32}$
      required:
        - iss
        - aud
        - sub
        - kind
        - jti
        - iat
        - exp
        - linkId
      additionalProperties: false
    AccountLinks:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              applicationId:
                type: string
            required:
              - id
              - applicationId
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    AccountJobs:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              kind:
                type: string
              pending:
                type: integer
              oldestAt:
                type: integer
              maxAttempts:
                type: integer
            required:
              - kind
              - pending
              - oldestAt
              - maxAttempts
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    AccountSessions:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              applicationId:
                type: string
              createdAt:
                type: integer
              expiresAt:
                type: integer
              current:
                type: boolean
            required:
              - id
              - applicationId
              - createdAt
              - expiresAt
              - current
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    DareActivity:
      type: object
      properties:
        id:
          type: string
        role:
          enum:
            - creator
            - participant
        title:
          type: string
        url:
          type: string
        status:
          enum:
            - active
            - waiting
            - completed
        result:
          anyOf:
            - type: string
            - type: "null"
        updatedAt:
          type: integer
        expiresAt:
          type: integer
        unread:
          type: boolean
        application:
          type: string
        verification:
          enum:
            - source-reported
            - share-challenge
      required:
        - id
        - role
        - title
        - url
        - status
        - result
        - updatedAt
        - expiresAt
        - unread
        - application
        - verification
      additionalProperties: false
    AccountExport:
      type: object
      properties:
        profile:
          $ref: "#/components/schemas/Profile"
        results:
          type: array
          items:
            type: object
            properties:
              value:
                anyOf:
                  - type: number
                  - type: "null"
              metrics:
                type: string
              trust:
                type: string
              status:
                type: string
              achieved_at:
                type: integer
              title:
                type: string
            required:
              - value
              - metrics
              - trust
              - status
              - achieved_at
              - title
            additionalProperties: false
        dares:
          type: array
          items:
            $ref: "#/components/schemas/DareActivity"
        exportedAt:
          type: integer
        preferences:
          $ref: "#/components/schemas/Preferences"
        social:
          $ref: "#/components/schemas/SocialExport"
      required:
        - profile
        - results
        - dares
        - exportedAt
        - preferences
        - social
      additionalProperties: false
    Reauthentication:
      oneOf:
        - type: object
          properties:
            nonce:
              type: string
            expiresAt:
              type: integer
          required:
            - nonce
            - expiresAt
          additionalProperties: false
        - type: object
          properties:
            verified:
              const: true
          required:
            - verified
          additionalProperties: false
    DareActivityList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/DareActivity"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    LoginInput:
      type: object
      properties:
        ageConfirmed:
          type: boolean
          const: true
        claimGuest:
          default: false
          type: boolean
        locale:
          default: fr
          type: string
          enum:
            - fr
            - en
            - es
            - pt
        returnPath:
          default: /me
          type: string
          maxLength: 300
      required:
        - ageConfirmed
        - claimGuest
        - locale
        - returnPath
      additionalProperties: false
    ExchangeInput:
      type: object
      properties:
        accessToken:
          type: string
          minLength: 20
          maxLength: 12000
        idToken:
          type: string
          minLength: 20
          maxLength: 12000
        ageConfirmed:
          type: boolean
          const: true
      required:
        - accessToken
        - idToken
        - ageConfirmed
      additionalProperties: false
    ClaimInput:
      type: object
      properties:
        proof:
          type: string
          pattern: ^[a-f0-9]{64}$
      required:
        - proof
      additionalProperties: false
    SourceLinkInput:
      type: object
      properties:
        applicationId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,160}$
        assertion:
          type: string
          minLength: 20
          maxLength: 12000
      required:
        - applicationId
        - assertion
      additionalProperties: false
    ActivityInput:
      type: object
      properties:
        eventId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,160}$
        linkId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,160}$
        sourceId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,160}$
        role:
          type: string
          enum:
            - creator
            - participant
        version:
          type: integer
          exclusiveMinimum: 0
          maximum: 9007199254740991
        title:
          type: string
          minLength: 1
          maxLength: 120
        url:
          type: string
          maxLength: 2048
          format: uri
        status:
          type: string
          enum:
            - active
            - waiting
            - completed
            - deleted
        result:
          anyOf:
            - type: string
              maxLength: 120
            - type: "null"
        updatedAt:
          type: integer
          minimum: 0
          maximum: 9007199254740991
        expiresAt:
          type: integer
          exclusiveMinimum: 0
          maximum: 9007199254740991
      required:
        - eventId
        - linkId
        - sourceId
        - role
        - version
        - title
        - url
        - status
        - result
        - updatedAt
        - expiresAt
      additionalProperties: false
    ReauthenticationInput:
      anyOf:
        - type: object
          properties: {}
          additionalProperties: false
        - type: object
          properties:
            idToken:
              type: string
              minLength: 20
              maxLength: 12000
            nonce:
              type: string
              pattern: ^[a-f0-9]{64}$
          required:
            - idToken
            - nonce
          additionalProperties: false
    GameList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Game"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    ModeList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Mode"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    CompetitionList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Competition"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    RecordList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Record"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    AnonymousInput:
      type: object
      properties:
        published:
          type: boolean
      required:
        - published
      additionalProperties: false
    anonymousSchema:
      type: object
      properties:
        transport:
          default: cookie
          type: string
          enum:
            - cookie
            - bearer
      required:
        - transport
      additionalProperties: false
    RefreshInput:
      type: object
      properties:
        refreshToken:
          type: string
          pattern: ^[a-f0-9]{64}$
      additionalProperties: false
    PublicationInput:
      type: object
      properties:
        published:
          type: boolean
      required:
        - published
      additionalProperties: false
    ProfileInput:
      type: object
      properties:
        nickname:
          type: string
          minLength: 2
          maxLength: 24
          pattern: ^[\p{L}\p{N} _.-]+$
        avatar:
          type: string
          enum:
            - orbit
            - bolt
            - diamond
            - star
        visibility:
          type: string
          enum:
            - private
            - public
        country:
          anyOf:
            - type: string
              pattern: ^[A-Z]{2}$
            - type: "null"
      additionalProperties: false
    SessionInput:
      type: object
      properties:
        competitionId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        rulesVersion:
          type: string
          minLength: 1
          maxLength: 32
        challengeId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
      required:
        - competitionId
        - rulesVersion
      additionalProperties: false
    CompletionInput:
      type: object
      properties:
        nonce:
          type: string
          pattern: ^[a-f0-9]{64}$
        rulesVersion:
          type: string
          minLength: 1
          maxLength: 32
        trace:
          description: Validator-specific replay. Sudoku uses SudokuTrace; unknown trace
            formats are rejected by the server validator.
          anyOf:
            - $ref: "#/components/schemas/SudokuTrace"
            - type: object
              description: Future versioned game validators.
      required:
        - nonce
        - rulesVersion
        - trace
      additionalProperties: false
    ChallengeInput:
      type: object
      properties:
        recordId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
      required:
        - recordId
      additionalProperties: false
    CompetitionInput:
      type: object
      properties:
        id:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        modeId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        title:
          type: string
          minLength: 1
          maxLength: 100
        kind:
          type: string
          enum:
            - standard
            - daily
        day:
          anyOf:
            - type: string
              pattern: ^\d{4}-\d{2}-\d{2}$
            - type: "null"
        contentVersion:
          type: string
          minLength: 1
          maxLength: 32
        publicConfig:
          type: object
          propertyNames:
            type: string
          additionalProperties: {}
        privateConfig:
          type: object
          propertyNames:
            type: string
          additionalProperties: {}
        startsAt:
          type: integer
          minimum: 0
          maximum: 9007199254740991
        endsAt:
          type: integer
          exclusiveMinimum: 0
          maximum: 9007199254740991
      required:
        - id
        - modeId
        - title
        - kind
        - day
        - contentVersion
        - publicConfig
        - privateConfig
        - startsAt
        - endsAt
      additionalProperties: false
    ModerationInput:
      type: object
      properties:
        action:
          type: string
          enum:
            - invalidate_record
            - suspend_player
            - restore_player
            - suspend_competition
            - resume_competition
            - enable_mode
            - disable_mode
            - activate_game
            - disable_game
            - activate_application
            - disable_application
        target:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        reason:
          type: string
          minLength: 8
          maxLength: 500
      required:
        - action
        - target
        - reason
      additionalProperties: false
    ApplicationInput:
      type: object
      properties:
        id:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        name:
          type: string
          minLength: 1
          maxLength: 80
        type:
          type: string
          enum:
            - web
            - android
            - other
        officialUrl:
          type: string
          format: uri
        androidPackage:
          default: null
          anyOf:
            - type: string
              maxLength: 150
            - type: "null"
        playUrl:
          default: null
          anyOf:
            - type: string
              format: uri
            - type: "null"
        launchUrl:
          default: null
          anyOf:
            - type: string
              format: uri
            - type: "null"
        challengeParameter:
          default: null
          anyOf:
            - type: string
              pattern: ^[a-zA-Z][a-zA-Z0-9_]{0,30}$
            - type: "null"
      required:
        - id
        - name
        - type
        - officialUrl
        - androidPackage
        - playUrl
        - launchUrl
        - challengeParameter
      additionalProperties: false
    GameInput:
      type: object
      properties:
        id:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        applicationId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        names:
          type: object
          properties:
            en:
              type: string
              minLength: 1
              maxLength: 500
            fr:
              type: string
              maxLength: 500
            es:
              type: string
              maxLength: 500
            pt:
              type: string
              maxLength: 500
          required:
            - en
          additionalProperties: false
        descriptions:
          type: object
          properties:
            en:
              type: string
              minLength: 1
              maxLength: 500
            fr:
              type: string
              maxLength: 500
            es:
              type: string
              maxLength: 500
            pt:
              type: string
              maxLength: 500
          required:
            - en
          additionalProperties: false
        category:
          type: string
          minLength: 1
          maxLength: 40
      required:
        - id
        - applicationId
        - names
        - descriptions
        - category
      additionalProperties: false
    ModeInput:
      type: object
      properties:
        id:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        gameId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        name:
          type: string
          minLength: 1
          maxLength: 100
        rulesVersion:
          type: string
          minLength: 1
          maxLength: 32
        resultType:
          type: string
          enum:
            - score
            - time
            - level
            - correct
            - moves
            - composite
            - custom
        direction:
          type: string
          enum:
            - asc
            - desc
        validator:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        rules:
          type: object
          propertyNames:
            type: string
          additionalProperties: {}
        sessionTtl:
          type: integer
          minimum: 60
          maximum: 86400
        submissionsPerDay:
          type: integer
          minimum: 1
          maximum: 1000
      required:
        - id
        - gameId
        - name
        - rulesVersion
        - resultType
        - direction
        - validator
        - rules
        - sessionTtl
        - submissionsPerDay
      additionalProperties: false
    SudokuTrace:
      type: object
      properties:
        moves:
          type: array
          minItems: 1
          maxItems: 2000
          items:
            type: object
            properties:
              cell:
                type: integer
                minimum: 0
                maximum: 80
              value:
                type: integer
                minimum: 0
                maximum: 9
            required:
              - cell
              - value
            additionalProperties: false
      required:
        - moves
      additionalProperties: false
    Product:
      type: object
      properties:
        id:
          type: string
        slug:
          type: string
        name:
          type: string
        descriptions:
          type: object
          additionalProperties:
            type: string
        features:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        image:
          type: string
        officialUrl:
          type: string
        webUrl:
          anyOf:
            - type: string
            - type: "null"
        playUrl:
          anyOf:
            - type: string
            - type: "null"
        iosUrl:
          anyOf:
            - type: string
            - type: "null"
        platforms:
          type: array
          items:
            enum:
              - web
              - android
              - ios
        connected:
          type: boolean
      required:
        - id
        - slug
        - name
        - descriptions
        - features
        - image
        - officialUrl
        - webUrl
        - playUrl
        - iosUrl
        - platforms
        - connected
      additionalProperties: false
    Preferences:
      type: object
      properties:
        locale:
          enum:
            - en
            - fr
            - es
            - pt
        notifications:
          type: boolean
        friendScores:
          type: boolean
      required:
        - locale
        - notifications
        - friendScores
      additionalProperties: false
    Availability:
      type: object
      properties:
        available:
          type: boolean
      required:
        - available
      additionalProperties: false
    SocialPlayer:
      type: object
      properties:
        publicId:
          type: string
        nickname:
          type: string
        handle:
          anyOf:
            - type: string
            - type: "null"
        avatar:
          type: string
      required:
        - publicId
        - nickname
        - handle
        - avatar
      additionalProperties: false
    Friend:
      type: object
      properties:
        id:
          type: string
        state:
          enum:
            - pending
            - accepted
        incoming:
          type: boolean
        updatedAt:
          type: integer
        player:
          $ref: "#/components/schemas/SocialPlayer"
      required:
        - id
        - state
        - incoming
        - updatedAt
        - player
      additionalProperties: false
    Invitation:
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        expiresAt:
          type: integer
      required:
        - id
        - url
        - expiresAt
      additionalProperties: false
    Invitations:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              createdAt:
                type: integer
              expiresAt:
                type: integer
            required:
              - id
              - createdAt
              - expiresAt
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    InvitePreview:
      type: object
      properties:
        player:
          $ref: "#/components/schemas/SocialPlayer"
      required:
        - player
      additionalProperties: false
    FriendRequest:
      type: object
      properties:
        id:
          type: string
        state:
          enum:
            - pending
            - accepted
      required:
        - id
        - state
      additionalProperties: false
    Friends:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Friend"
      required:
        - items
      additionalProperties: false
    Blocks:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              publicId:
                type: string
              nickname:
                type: string
            required:
              - publicId
              - nickname
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    FriendBoard:
      type: object
      properties:
        competition:
          $ref: "#/components/schemas/Competition"
        period:
          type: string
        entries:
          type: array
          items:
            type: object
            properties:
              rank:
                type: integer
              player:
                $ref: "#/components/schemas/SocialPlayer"
              value:
                type: number
              achievedAt:
                type: integer
            required:
              - rank
              - player
              - value
              - achievedAt
            additionalProperties: false
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - competition
        - period
        - entries
        - nextCursor
      additionalProperties: false
    DirectChallenge:
      type: object
      properties:
        id:
          type: string
        challengeId:
          type: string
        competitionId:
          type: string
        revengeOf:
          anyOf:
            - type: string
            - type: "null"
        title:
          type: string
        createdAt:
          type: integer
        expiresAt:
          type: integer
        incoming:
          type: boolean
        player:
          $ref: "#/components/schemas/SocialPlayer"
      required:
        - id
        - challengeId
        - competitionId
        - revengeOf
        - title
        - createdAt
        - expiresAt
        - incoming
        - player
      additionalProperties: false
    Notification:
      type: object
      properties:
        id:
          type: string
        kind:
          enum:
            - friend-request
            - friend-accepted
            - challenge
            - record-beaten
        reference:
          type: string
        createdAt:
          type: integer
        seen:
          type: boolean
        player:
          $ref: "#/components/schemas/SocialPlayer"
      required:
        - id
        - kind
        - reference
        - createdAt
        - seen
        - player
      additionalProperties: false
    SocialExport:
      type: object
      properties:
        friends:
          type: array
          items:
            type: object
            properties:
              public_id:
                type: string
              nickname:
                type: string
              state:
                type: string
              updated_at:
                type: integer
            required:
              - public_id
              - nickname
              - state
              - updated_at
            additionalProperties: false
        blocks:
          type: array
          items:
            type: object
            properties:
              public_id:
                type: string
              created_at:
                type: integer
            required:
              - public_id
              - created_at
            additionalProperties: false
        notifications:
          type: array
          items:
            type: object
            properties:
              kind:
                type: string
              created_at:
                type: integer
              seen:
                type: integer
            required:
              - kind
              - created_at
              - seen
            additionalProperties: false
        reports:
          type: array
          items:
            type: object
            properties:
              reason:
                type: string
              details:
                type: string
              status:
                type: string
              created_at:
                type: integer
              targetPublicId:
                anyOf:
                  - type: string
                  - type: "null"
            required:
              - reason
              - details
              - status
              - created_at
              - targetPublicId
            additionalProperties: false
      required:
        - friends
        - blocks
        - notifications
        - reports
      additionalProperties: false
    ProductList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Product"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    DirectChallengeList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/DirectChallenge"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    NotificationList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Notification"
        nextCursor:
          anyOf:
            - type: string
            - type: "null"
      required:
        - items
        - nextCursor
      additionalProperties: false
    CatalogueInput:
      type: object
      properties:
        slug:
          type: string
          pattern: ^[a-z][a-z0-9-]{2,47}$
        descriptions:
          type: object
          properties:
            en:
              type: string
              minLength: 1
              maxLength: 500
            fr:
              type: string
              minLength: 1
              maxLength: 500
            es:
              type: string
              minLength: 1
              maxLength: 500
            pt:
              type: string
              minLength: 1
              maxLength: 500
          required:
            - en
          additionalProperties: false
        features:
          type: object
          properties:
            en:
              maxItems: 6
              type: array
              items:
                type: string
                minLength: 1
                maxLength: 500
            fr:
              maxItems: 6
              type: array
              items:
                type: string
                minLength: 1
                maxLength: 500
            es:
              maxItems: 6
              type: array
              items:
                type: string
                minLength: 1
                maxLength: 500
            pt:
              maxItems: 6
              type: array
              items:
                type: string
                minLength: 1
                maxLength: 500
          required:
            - en
          additionalProperties: false
        image:
          type: string
          pattern: ^\/characters\/[a-z-]+\.webp$
        webUrl:
          anyOf:
            - type: string
              maxLength: 500
              format: uri
            - type: "null"
        iosUrl:
          anyOf:
            - type: string
              maxLength: 500
              format: uri
            - type: "null"
        published:
          type: boolean
        position:
          type: integer
          minimum: 0
          maximum: 10000
      required:
        - slug
        - descriptions
        - features
        - image
        - webUrl
        - iosUrl
        - published
        - position
      additionalProperties: false
    HandleInput:
      type: object
      properties:
        handle:
          type: string
          pattern: ^[a-z][a-z0-9_]{2,23}$
      required:
        - handle
      additionalProperties: false
    PreferencesInput:
      type: object
      properties:
        locale:
          type: string
          enum:
            - en
            - fr
            - es
            - pt
        notifications:
          type: boolean
        friendScores:
          type: boolean
      additionalProperties: false
    ReportInput:
      type: object
      properties:
        publicId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        reason:
          type: string
          enum:
            - harassment
            - impersonation
            - cheating
            - other
        details:
          default: ""
          type: string
          maxLength: 500
      required:
        - publicId
        - reason
        - details
      additionalProperties: false
    ReviewReportInput:
      type: object
      properties:
        status:
          type: string
          enum:
            - reviewed
            - dismissed
        reason:
          type: string
          minLength: 8
          maxLength: 500
      required:
        - status
        - reason
      additionalProperties: false
    FriendRequestInput:
      anyOf:
        - type: object
          properties:
            token:
              type: string
              pattern: ^[a-f0-9]{64}$
          required:
            - token
          additionalProperties: false
        - type: object
          properties:
            publicId:
              type: string
              pattern: ^[a-zA-Z0-9_-]{1,80}$
          required:
            - publicId
          additionalProperties: false
    InviteInput:
      type: object
      properties:
        token:
          type: string
          pattern: ^[a-f0-9]{64}$
      required:
        - token
      additionalProperties: false
    FriendDecision:
      type: object
      properties:
        action:
          type: string
          enum:
            - accept
            - decline
      required:
        - action
      additionalProperties: false
    DirectInput:
      type: object
      properties:
        recipientId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        challengeId:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
        revengeOf:
          type: string
          pattern: ^[a-zA-Z0-9_-]{1,80}$
      required:
        - recipientId
        - challengeId
      additionalProperties: false
    Achievements:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              version:
                type: integer
              threshold:
                type: integer
              metric:
                type: string
              names:
                type: object
                additionalProperties:
                  type: string
            required:
              - id
              - version
              - threshold
              - metric
              - names
            additionalProperties: false
      required:
        - items
      additionalProperties: false
    Reports:
      type: object
      properties:
        items:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              reason:
                type: string
              details:
                type: string
              createdAt:
                type: integer
              targetPublicId:
                anyOf:
                  - type: string
                  - type: "null"
            required:
              - id
              - reason
              - details
              - createdAt
              - targetPublicId
            additionalProperties: false
      required:
        - items
      additionalProperties: false