openapi: 3.1.2
info:
  title: CloudAMQP Instance API
  version: 1.0.0
  description: |
    This API allows you to manage alarms, integrations, RabbitMQ and LavinMQ, the firewall, VPC peering etc.

    [← Back to the CloudAMQP Customer API docs](index.html)

    ## Authentication

    Enter your Instance API key as password. Leave username empty.

    **Example using curl:**
    ```bash
    curl -u :xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx \
      https://api.cloudamqp.com/api/nodes
    ```

    **Getting your Instance API key:**

    You can get the Instance API key from the [get instance info endpoint](https://docs.cloudamqp.com/#tag/instances/get/instances/{id}) in the Customer CloudAMQP API. The API key is returned in the `apikey` field.
    Or you can find it in the CloudAMQP Console on the Instance details page.

    ## Terraform Provider

    Documentation for CloudAMQP Terraform provider can be found at the [Terraform Registry](https://registry.terraform.io/providers/cloudamqp/cloudamqp/latest/docs).

    - GitHub Repository: [cloudamqp/terraform-provider-cloudamqp](https://github.com/cloudamqp/terraform-provider-cloudamqp)
    - Quick Links
      - [Provider Documentation](https://registry.terraform.io/providers/cloudamqp/cloudamqp/latest/docs)
      - [Instance Resource](https://registry.terraform.io/providers/cloudamqp/cloudamqp/latest/docs/resources/instance)
      - [Alarm Resource](https://registry.terraform.io/providers/cloudamqp/cloudamqp/latest/docs/resources/alarm)

    ## Additional Resources

    - [CloudAMQP Console](https://customer.cloudamqp.com/)
    - [CloudAMQP Technical Changelog](changelog.html)

  contact:
    name: CloudAMQP
    url: https://www.cloudamqp.com

servers:
  - url: https://api.cloudamqp.com/api
    description: CloudAMQP Instance API Server (use instance-specific API key)

security:
  - apiKeyAuth: []

tags:
  - name: Account
    description: Account operations for password and API key rotation
  - name: Nodes
    description: Node management and version information
  - name: Plugins
    description: RabbitMQ plugin management
  - name: Custom Domain
    description: Custom domain and Let's Encrypt certificate management
  - name: Custom Certificate
    description: Bring your own custom certificate.
  - name: Firewall
    description: Firewall configuration and security rules
  - name: Actions
    description: Instance and cluster actions (restart, upgrade, etc.)
  - name: Alarms
    description: Alarm and notification management
  - name: EventBridge
    description: AWS EventBridge integration management
  - name: Webhooks
    description: Webhook integration management
  - name: RabbitMQ Config
    description: RabbitMQ configuration management
  - name: Logs
    x-displayName: General Operations
  - name: Logs/Grafana Cloud
    x-displayName: Grafana Cloud (Loki)
  - name: Logs/Uptrace
    x-displayName: Uptrace
  - name: Logs/Azure Monitor
    x-displayName: Azure Monitor
  - name: Logs/CloudWatch
    x-displayName: CloudWatch
  - name: Logs/Coralogix
    x-displayName: Coralogix
  - name: Logs/Datadog
    x-displayName: Datadog
  - name: Logs/Logentries
    x-displayName: Logentries
  - name: Logs/Loggly
    x-displayName: Loggly
  - name: Logs/Papertrail
    x-displayName: Papertrail
  - name: Logs/Scalyr
    x-displayName: DataSet(Scalyr)
  - name: Logs/Splunk
    x-displayName: Splunk
  - name: Logs/Splunk v2
    x-displayName: Splunk v2
  - name: Metrics
    x-displayName: General Operations
  - name: Metrics/Azure Monitor
    x-displayName: Azure Monitor
  - name: Metrics/CloudWatch
    x-displayName: CloudWatch
  - name: Metrics/CloudWatch v2
    x-displayName: CloudWatch v2
  - name: Metrics/CloudWatch v3
    x-displayName: CloudWatch v3
  - name: Metrics/Datadog
    x-displayName: Datadog
  - name: Metrics/Datadog v2
    x-displayName: Datadog v2
  - name: Metrics/Datadog v3
    x-displayName: Datadog v3
  - name: Metrics/Dynatrace
    x-displayName: Dynatrace
  - name: Metrics/Grafana Cloud
    x-displayName: Grafana Cloud (Mimir)
  - name: Metrics/Librato
    x-displayName: Librato
  - name: Metrics/New Relic v2
    x-displayName: New Relic v2
  - name: Metrics/New Relic v3
    x-displayName: New Relic v3
  - name: Metrics/Splunk
    x-displayName: Splunk
  - name: Metrics/Splunk v2
    x-displayName: Splunk v2
  - name: Metrics/Stackdriver
    x-displayName: Stackdriver
  - name: Metrics/Stackdriver v2
    x-displayName: Stackdriver v2
  - name: Maintenance
    description: Maintenance window management
  - name: VPC
    description: VPC peering operations
  - name: VPC Connect
    description: AWS PrivateLink and Azure Private Link connections
  - name: OAuth 2.0
    x-displayName: OAuth 2.0 configuration
  - name: Trust Store
    description: Trust store configuration for certificate validation
  - name: Jobs
    description: Job status and tracking asyncronous actions

x-tagGroups:
  - name: Account
    tags:
      - Account
  - name: Broker
    tags:
      - Actions
      - Nodes
      - RabbitMQ Config
      - Plugins
      - OAuth 2.0
      - Trust Store
  - name: Networking
    tags:
      - Firewall
      - Custom Domain
      - Custom Certificate
      - VPC
      - VPC Connect
  - name: Connectors
    tags:
      - Webhooks
      - EventBridge
  - name: Maintenance
    tags:
      - Maintenance
  - name: Monitoring
    tags:
      - Alarms
  - name: Log Integrations
    tags:
      - Logs
      - Logs/Grafana Cloud
      - Logs/Uptrace
      - Logs/Azure Monitor
      - Logs/CloudWatch
      - Logs/Coralogix
      - Logs/Datadog
      - Logs/Logentries
      - Logs/Loggly
      - Logs/Papertrail
      - Logs/Scalyr
      - Logs/Splunk
  - name: Metrics Integrations
    tags:
      - Metrics
      - Metrics/Azure Monitor
      - Metrics/CloudWatch
      - Metrics/CloudWatch v2
      - Metrics/CloudWatch v3
      - Metrics/Datadog
      - Metrics/Datadog v2
      - Metrics/Datadog v3
      - Metrics/Dynatrace
      - Metrics/Grafana Cloud
      - Metrics/Librato
      - Metrics/New Relic v2
      - Metrics/New Relic v3
      - Metrics/Splunk
      - Metrics/Splunk v2
      - Metrics/Stackdriver
      - Metrics/Stackdriver v2
  - name: Jobs
    tags:
      - Jobs

components:
  securitySchemes:
    apiKeyAuth:
      type: http
      scheme: basic
      x-username-optional: true
      x-default-username: ""
      description: |
        Enter your Instance API key as password. Leave username empty.

        **Example with curl:**
        ```bash
        curl -u :xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx https://api.cloudamqp.com/api/nodes
        ```

        > [!tip]
        > See the [Authentication](#authentication---read-this-first) section in the info block for more details.

  schemas:
    Node:
      type: object
      properties:
        name:
          type: string
          description: Node name
          example: some-server-01
        hostname:
          type: string
          description: External hostname
          example: some-server-01.rmq.cloudamqp.com
        configured:
          type: boolean
          description: Whether node is configured
          example: true
        rabbitmq_version:
          type: string
          description: RabbitMQ version
          example: 3.10.5
        erlang_version:
          type: string
          description: Erlang version
          example: 24.1.7
        running:
          type: boolean
          description: Whether node is running
          example: true
        disk_size:
          type: integer
          description: Base disk size in GB
          example: 20
        additional_disk_size:
          type: integer
          description: Additional disk size in GB
          example: 0
        availability_zone:
          type: string
          description: Availability zone ID
          example: availability_zone_id
        hostname_internal:
          type: string
          description: Internal hostname
          example: some-server-01.in.rmq.cloudamqp.com

    Plugin:
      type: object
      properties:
        name:
          type: string
          description: Plugin name
          example: rabbitmq_management
        version:
          type: string
          description: Plugin version
          example: 3.10.5
        description:
          type: string
          description: Plugin description
        enabled:
          type: boolean
          description: Whether plugin is enabled

    Recipient:
      type: object
      properties:
        id:
          type: integer
          description: Recipient ID
          example: 1
        type:
          type: string
          description: Recipient type
          enum:
            [
              email,
              webhook,
              pagerduty,
              opsgenie,
              opsgenie-eu,
              victorops,
              slack,
              teams,
            ]
          example: email
        value:
          type: string
          description: Recipient endpoint (email, URL, etc.)
          example: team@example.com
        name:
          type: string
          description: Recipient name
          example: Default
        options:
          type: object
          description: Additional options
          nullable: true

    RecipientCreate:
      type: object
      required:
        - type
        - value
      properties:
        type:
          type: string
          description: The type of notification to be sent
          enum:
            [
              email,
              webhook,
              pagerduty,
              opsgenie,
              opsgenie-eu,
              victorops,
              slack,
              teams,
            ]
        value:
          type: string
          description: Endpoint to where the notification will be sent
        name:
          type: string
          description: Optional name for the recipient

    Alarm:
      type: object
      properties:
        id:
          type: integer
          description: Alarm ID
          example: 7395
        type:
          type: string
          description: Alarm type
          enum: [cpu, memory, disk, disk_auto_resize, netsplit, server_unreachable, notice]
          example: cpu
        enabled:
          type: boolean
          description: Whether alarm is enabled
          example: true
        value_threshold:
          type: integer
          description: Value threshold to trigger alarm
          example: 90
        value_calculation:
          type: string
          description: How to treat value threshold (for disk and disk_auto_resize alarms)
          enum: [fixed, percentage]
          example: fixed
        time_threshold:
          type: integer
          description: Duration in seconds the value_threshold should be active before triggering
          example: 600
        allow_downtime:
          type: boolean
          description: >-
            For disk_auto_resize alarms only. Whether the automatic resize may
            proceed even if it requires brief downtime.
          example: false
        recipients:
          type: array
          items:
            type: integer
          description: Recipient IDs to receive notifications
          example: [1]

    AlarmUpdate:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          description: Enable or disable the alarm
        value_threshold:
          type: integer
          description: Value threshold to trigger the alarm (required for cpu, memory, disk, disk_auto_resize)
        value_calculation:
          type: string
          description: How to treat value threshold (for disk and disk_auto_resize alarms)
          enum: [fixed, percentage]
        time_threshold:
          type: integer
          description: Duration in seconds (required for cpu, memory, disk, disk_auto_resize)
        allow_downtime:
          type: boolean
          description: >-
            For disk_auto_resize alarms only. Allow the automatic resize to
            proceed even if it requires brief downtime. Defaults to false.
        recipients:
          type: array
          items:
            type: integer
          description: Recipient IDs to receive notifications
    AlarmCreate:
      type: object
      required:
        - type
        - enabled
      properties:
        type:
          type: string
          description: The alarm type
          enum: [cpu, memory, disk, disk_auto_resize, netsplit, server_unreachable, notice]
        enabled:
          type: boolean
          description: Enable or disable the alarm
        value_threshold:
          type: integer
          description: Value threshold to trigger the alarm (required for cpu, memory, disk, disk_auto_resize)
        value_calculation:
          type: string
          description: How to treat value threshold (for disk and disk_auto_resize alarms)
          enum: [fixed, percentage]
        time_threshold:
          type: integer
          description: Duration in seconds (required for cpu, memory, disk, disk_auto_resize)
        allow_downtime:
          type: boolean
          description: >-
            For disk_auto_resize alarms only. Allow the automatic resize to
            proceed even if it requires brief downtime. Defaults to false.
        recipients:
          type: array
          items:
            type: integer
          description: Recipient IDs to receive notifications

    LogIntegration:
      type: object
      properties:
        id:
          type: integer
          description: Integration ID
          example: 10
        type:
          type: string
          description: Integration type (e.g., papertrail, scalyr, splunk, datadog, etc.)
        config:
          type: object
          description: Integration configuration (varies by integration type)
        error:
          type: string
          description: Error message if any
        account_id:
          type: string
          description: Account ID

    CustomDomain:
      type: object
      required:
        - hostname
        - hostnames
        - configured
      properties:
        hostname:
          type: string
          nullable: true
          description: First configured custom domain or SNI hostname, or null when none is configured
          example: myname.mydomain
        hostnames:
          type: array
          description: All configured custom domain or SNI hostnames
          items:
            type: string
          example:
            - myname.mydomain
        configured:
          type: boolean
          description: Whether a custom domain or custom certificate is configured
          example: true
    CustomCert:
      type: object
      description: Schema for uploading a custom SSL/TLS certificate, including the key and CA chain.
      required:
        - sni_hosts
        - private_key
        - cert
        - ca
      properties:
        sni_hosts:
          oneOf:
            - type: array
              minItems: 1
              maxItems: 100
              uniqueItems: true
              items:
                type: string
            - type: string
          description: |
            Hostname(s) to serve this certificate for using Server Name Indication (SNI).

            Use an array when configuring multiple hostnames.
            A comma or space separated string is also accepted for backwards compatibility.

            Each requested hostname must be covered by the certificate common name or subject alternative names.
            Hostnames must be valid ASCII DNS hostnames.
            Wildcard certificates are accepted, but wildcard hostnames are not valid SNI hostnames; list each hostname explicitly.
          example:
            - app.yourdomain.com
            - mqtt.yourdomain.com
        private_key:
          type: string
          description: The PEM-encoded private key corresponding to the certificate.
          format: textarea
          example: |
            -----BEGIN PRIVATE KEY-----
            MIICXAIBAK...
            -----END PRIVATE KEY-----
        cert:
          type: string
          description: The PEM-encoded server certificate.
          format: textarea
          example: |
            -----BEGIN CERTIFICATE-----
            MIID5TCCAs2gAwIBAg...
            -----END CERTIFICATE-----
        ca:
          type: string
          description: The PEM-encoded Certificate Authority (CA).
          format: textarea
          example: |
            -----BEGIN CERTIFICATE-----
            MIIDQzCCAiugAwIBAg...
            -----END CERTIFICATE-----

    FirewallRule:
      type: object
      properties:
        description:
          type: string
          description: Rule description
          example: My rule
        ip:
          type: string
          description: CIDR IP range
          example: 0.0.0.0/0
        ports:
          type: array
          items:
            type: integer
          description: Ports to open
          example: [80]
        services:
          type: array
          items:
            type: string
            enum:
              [
                AMQP,
                AMQPS,
                HTTPS,
                MQTT,
                MQTTS,
                STOMP,
                STOMPS,
                STREAM,
                STREAM_SSL,
              ]
          description: Services to allow
          example: [AMQP, AMQPS, MQTT]

    EventBridge:
      type: object
      properties:
        id:
          type: integer
          description: EventBridge ID
          example: 1
        account_id:
          type: string
          format: uuid
          description: Account ID
        aws_region:
          type: string
          description: AWS region
          example: eu-north-1
        aws_account_id:
          type: integer
          description: AWS account ID
          example: 123456789012
        vhost:
          type: string
          description: Virtual host name
          example: yhfhkuqb
        queue:
          type: string
          description: Queue name
          example: eventbridge_queue
        status:
          type: string
          nullable: true
          description: Status (null unless error)
        with_headers:
          type: boolean
          description: Include message headers in event data
          example: true

    EventBridgeCreate:
      type: object
      required:
        - vhost
        - queue
        - aws_region
        - aws_account_id
      properties:
        vhost:
          type: string
          description: The VHost the queue resides in
        queue:
          type: string
          description: A (durable) queue on your RabbitMQ instance
        aws_region:
          type: string
          description: The AWS region where you want the events to be sent to
        aws_account_id:
          type: integer
          description: The AWS Account ID where you want the events to be sent to
        with_headers:
          type: boolean
          description: Include message headers in the event data
          default: false

    Webhook:
      type: object
      properties:
        id:
          type: integer
          description: Webhook ID
          example: 1
        name:
          type: string
          nullable: true
          description: Label for the webhook
          example: my-webhook
        webhook_uri:
          type: string
          description: Webhook endpoint URL
          example: http://www.example.com/endpoint
        queue:
          type: string
          description: Queue name
          example: push-queue
        last_status:
          type: string
          nullable: true
          description: Last webhook status
        concurrency:
          type: integer
          description: Max simultaneous outstanding requests
          example: 10
        timeout:
          type: integer
          description: The request timeout for webhook_uri
          example: 30
        signing_secret:
          type: string
          nullable: true
          description: Secret key(s) for HMAC-SHA256 signature verification. When configured, webhook requests include webhook-id, webhook-timestamp, and webhook-signature headers. Multiple secrets can be specified (space-separated) for key rotation.
          example: my-secret-key-123
        vhost:
          type: string
          description: Virtual host name
          example: hptqevnp

    WebhookCreate:
      type: object
      required:
        - webhook_uri
        - queue
        - vhost
        - concurrency
      properties:
        name:
          type: string
          description: Optional label for the webhook
          example: my-webhook
        webhook_uri:
          type: string
          description: The URL to POST the messages to
          example: https://your-endpoint.com/webhook
        queue:
          type: string
          description: The queue to consume from
          example: your-queue
        vhost:
          type: string
          description: The vhost to connect to
          example: your-vhost
        concurrency:
          type: integer
          description: Max simultaneous outstanding requests to the endpoint
          minimum: 1
          example: 10
        timeout:
          type: integer
          description: The request timeout for webhook_uri
          minimum: 1
          maximum: 90
          default: 30
          example: 30
        signing_secret:
          type: string
          description: Optional secret key(s) for HMAC-SHA256 signature verification. When configured, webhook requests will include webhook-id, webhook-timestamp, and webhook-signature headers. Multiple secrets can be specified (space-separated) for zero-downtime key rotation.
          example: my-secret-key-123

    RabbitMQConfig:
      type: object
      additionalProperties: true
      example:
        rabbitmq_prometheus.return_per_object_metrics: null
        rabbit.heartbeat: 120
        rabbit.channel_max: 0
        rabbit.consumer_timeout: 7200000
        rabbit.vm_memory_high_watermark: 0.81
        ra.wal_max_size_bytes: 512

    RabbitMQConfigSetting:
      type: object
      properties:
        name:
          type: string
          description: Setting name
          example: ra.wal_max_size_bytes
        type:
          type: string
          description: Setting type
          enum: [boolean, int, float, symbol]
          example: int
        desc:
          type: string
          description: Setting description
          example: >-
            Maximum size in MiB of the Raft write-ahead log kept in memory before it is rolled
            over to disk. The default is chosen automatically based on your plan's memory. On
            plan changes, this resets to the new plan's default, unless your current value is
            already lower, in which case it's preserved. RabbitMQ restart required.
        version_requirement:
          type: string
          description: Minimum RabbitMQ version required
        default:
          description: Default value
          example: 512
        min:
          type: number
          description: Minimum value (for numeric types)
          example: 16
        max:
          type: number
          description: Maximum value (for numeric types)
          example: 512
        value:
          description: Current value
          example: 67108864
        valid:
          type: boolean
          description: Whether the current value is valid
          example: true
        unit:
          type: string
          description: Unit of measurement for the value when present (e.g. MiB)
          example: MiB
        scale:
          type: number
          description: Multiplier applied to convert the raw value into `unit`
          example: 1048576
        required:
          type: boolean
          description: Whether the setting is required
          example: true

    OAuth2ConfigurationBase:
      type: object
      properties:
        resource_server_id:
          type: string
          description: Unique identifier for the resource server
          example: rabbitmq
        issuer:
          type: string
          format: uri
          description: OAuth 2.0 issuer URL (must be HTTPS)
          example: https://auth.example.com
        preferred_username_claims:
          type: array
          items:
            type: string
          description: JWT claim names to use for username
          example: [sub, email]
        additional_scopes_key:
          type: array
          items:
            type: string
          description: JWT claim keys containing additional scopes
          example: [roles, groups]
        scope_prefix:
          type: string
          description: Prefix to add to scopes
          example: "my-app:"
        scope_aliases:
          type: object
          additionalProperties:
            type: string
          description: Map scope aliases to actual scopes (RabbitMQ 4.1.0+)
          example:
            user: "user:read"
            admin: "admin:access"
        verify_aud:
          type: boolean
          description: Whether to verify audience claim in tokens
          example: true
        oauth_client_id:
          type: string
          description: Client ID for management interface
          example: oauth-client-id-456
        oauth_scopes:
          type: array
          items:
            type: string
          description: Scopes required for management interface
          example: ["manage:clients", "read:users"]
        audience:
          type: string
          description: OAuth 2.0 audience claim (required for Auth0 with RabbitMQ 4.1+). Typically matches resource_server_id
          example: rabbitmq
        oauth_disable_basic_auth:
          type: boolean
          description: Disable static username/password management interface access, allowing only OAuth 2.0 authentication
          example: true

    OAuth2Configuration:
      allOf:
        - $ref: '#/components/schemas/OAuth2ConfigurationBase'
        - type: object
          properties:
            id:
              type: string
              format: uuid
              description: Configuration ID
              example: 669b23ed-7dc9-451d-82c6-b65f49cb1a9a
            created_at:
              type: string
              format: date-time
              description: Configuration creation timestamp
              example: "2025-09-23T12:40:34Z"
            updated_at:
              type: string
              format: date-time
              description: Configuration last update timestamp
              example: "2025-09-23T12:40:34Z"

    TrustStoreConfigurationBase:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: Configuration ID
          example: "669b23ed-7dc9-451d-82c6-b65f49cb1a9a"
        provider:
          type: string
          enum: [http, file]
          description: Trust store provider type
          example: "http"
        refresh_interval:
          type: integer
          minimum: 1
          description: Interval in seconds to refresh the trust store (default 30)
          example: 60
        created_at:
          type: string
          format: date-time
          description: Configuration creation timestamp
          example: "2025-09-23T12:40:34Z"
        updated_at:
          type: string
          format: date-time
          description: Configuration last update timestamp
          example: "2025-09-23T12:40:34Z"

    TrustStoreConfigurationHttpCreate:
      type: object
      required:
        - url
      properties:
        provider:
          type: string
          enum: [http]
          description: Trust store provider type (defaults to 'http' if omitted)
          default: http
          example: "http"
        url:
          type: string
          format: uri
          description: URL to fetch certificates from (must be a valid URL with host)
          example: "https://trust-store.example.com/certs"
        refresh_interval:
          type: integer
          minimum: 1
          description: Interval in seconds to refresh the trust store (default 30)
          example: 60
        cacertfile:
          type: string
          description: Optional CA certificate to verify the HTTPS connection to the trust store URL
          example: "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAK...\n-----END CERTIFICATE-----"

    TrustStoreConfigurationHttpResponse:
      allOf:
        - $ref: '#/components/schemas/TrustStoreConfigurationBase'
        - type: object
          required:
            - url
          properties:
            url:
              type: string
              format: uri
              description: URL to fetch certificates from
              example: "https://trust-store.example.com/certs"
            cacertfile:
              type: string
              nullable: true
              description: CA certificate to verify the HTTPS connection
              example: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"

    TrustStoreConfigurationFileCreate:
      type: object
      required:
        - provider
        - certificates
      properties:
        provider:
          type: string
          enum: [file]
          description: Trust store provider type (must be 'file')
          example: "file"
        certificates:
          type: array
          minItems: 1
          maxItems: 100
          description: Array of certificates to upload (1-100 certificates)
          items:
            type: object
            required:
              - name
              - content
            properties:
              name:
                type: string
                maxLength: 100
                pattern: '^[^.][\w.-]+$'
                description: Certificate filename (alphanumeric, dots, hyphens, underscores; max 100 chars; cannot start with '.')
                example: "ca-cert-1.pem"
              content:
                type: string
                description: PEM-encoded X.509 certificate content
                example: "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAK...\n-----END CERTIFICATE-----"
        refresh_interval:
          type: integer
          minimum: 1
          description: Interval in seconds to refresh the trust store (default 30)
          example: 60

    TrustStoreConfigurationFileResponse:
      allOf:
        - $ref: '#/components/schemas/TrustStoreConfigurationBase'
        - type: object
          required:
            - certificates
          properties:
            certificates:
              type: array
              minItems: 1
              maxItems: 100
              description: Array of uploaded certificates
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: Certificate filename
                    example: "ca-cert-1.pem"
                  content:
                    type: string
                    description: PEM-encoded X.509 certificate content
                    example: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"

    UnknownParameterError:
      type: object
      properties:
        error:
          type: string
          description: Error message describing the unknown parameters
          example: "Unknown parameters: unknown_param, bad_parameter"
        error_code:
          type: string
          enum: [unknown_parameter_error]
          description: Error code identifier
          example: "unknown_parameter_error"
        unknown_parameters:
          type: array
          items:
            type: string
          description: List of parameter names that were not recognized
          example: ["unknown_param", "bad_parameter"]
        valid_parameters:
          type: array
          items:
            type: string
          description: List of valid parameter names for this endpoint
          example: ["provider", "url", "certificates", "refresh_interval", "cacertfile"]

    Jobs:
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier for the async operation
          example: "5c2f59e8-826e-452c-b28d-27ef1f8b32a3"
        account_id:
          type: string
          format: uuid
          description: ID of the account associated with this operation
          example: "04575e13-f306-4262-95df-703e720ce65f"
        resource_type:
          type: string
          description: Type of resource being operated on
          example: "oauth2_configuration"
        resource_id:
          type: string
          format: uuid
          description: ID of the resource being operated on
          example: "c3c19266-2998-444d-9a95-7403afbfe605"
        resource_action:
          type: string
          description: Action being performed on the resource
          enum:
            - create
            - update
            - delete
          example: "create"
        status:
          type: string
          description: Current status of the async operation
          enum:
            - pending
            - completed
            - failed
          example: "completed"
        created_at:
          type: string
          format: date-time
          description: Timestamp when the operation was created
          example: "2025-11-13T14:21:31Z"
        updated_at:
          type: string
          format: date-time
          description: Timestamp when the operation was last updated
          example: "2025-11-13T14:21:41Z"
        error_message:
          type: string
          nullable: true
          description: Error message if the operation failed, null otherwise
          example: null

    OAuth2ConfigurationCreate:
      allOf:
        - $ref: '#/components/schemas/OAuth2ConfigurationBase'
        - type: object
          required:
            - resource_server_id
            - issuer

    JobIdResponse:
      type: object
      properties:
        job_id:
          type: string
          format: uuid
          description: Job ID to track the asynchronous operation
          example: "5c2f59e8-826e-452c-b28d-27ef1f8b32a3"

    ValidationError:
      type: object
      properties:
        errors:
          type: array
          items:
            type: object
            additionalProperties:
              type: array
              items:
                type: string
          description: Array of validation error objects, each containing field names with their error messages
          example:
            - issuer: ["is not present", "must be a valid HTTPS URL", "must be a parseable URL"]
            - resource_server_id: ["is not present"]

    ContentTypeError:
      type: object
      properties:
        error:
          type: string
          description: Invalid Content-Type
          example: "Content-Type must be application/json"


paths:
  /account/rotate-password:
    post:
      summary: Rotate password
      description: Initiate rotation of the user password on your instance
      operationId: rotatePassword
      tags:
        - Account
      responses:
        "200":
          description: Password rotation initiated

  /account/rotate-apikey:
    post:
      summary: Rotate API key
      description: Rotate the Instance API key
      operationId: rotateApiKey
      tags:
        - Account
      responses:
        "200":
          description: API key rotation initiated

  /nodes:
    get:
      summary: List nodes
      description: Retrieves all nodes in the instance
      operationId: listNodes
      tags:
        - Nodes
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Node"

  /nodes/available-versions:
    get:
      summary: Get available versions
      description: Lists RabbitMQ and Erlang versions to which the instance can be upgraded
      operationId: getAvailableVersions
      tags:
        - Nodes
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  rabbitmq_versions:
                    type: array
                    items:
                      type: string
                    example: ["3.9.11", "3.9.9", "3.9.7"]
                  erlang_versions:
                    type: array
                    items:
                      type: string
                    example: ["24.0.4"]

  /plugins:
    get:
      summary: List plugins
      description: Retrieves all available RabbitMQ plugins
      operationId: listPlugins
      tags:
        - Plugins
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Plugin"

    post:
      summary: Enable plugin
      description: Enables a RabbitMQ plugin
      operationId: enablePlugin
      tags:
        - Plugins
      parameters:
        - name: async
          in: query
          description: Asynchronous API mode - request returns immediately and plugin is enabled in background
          schema:
            type: boolean
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - plugin_name
              properties:
                plugin_name:
                  type: string
                  description: The name of the plugin to enable
                  example: rabbitmq_top
      responses:
        "200":
          description: Plugin enabled successfully

  /plugins/{plugin_name}:
    parameters:
      - name: plugin_name
        in: path
        required: true
        description: The name of the plugin
        schema:
          type: string

    delete:
      summary: Disable plugin
      description: Disables a RabbitMQ plugin
      operationId: disablePlugin
      tags:
        - Plugins
      parameters:
        - name: async
          in: query
          description: Asynchronous API mode - request returns immediately and plugin is disabled in background
          schema:
            type: boolean
      responses:
        "200":
          description: Plugin disabled successfully

  /plugins/community:
    get:
      summary: List community plugins
      description: Retrieves all available RabbitMQ community plugins
      operationId: listCommunityPlugins
      tags:
        - Plugins
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                      example: rabbitmq_management_themes
                    description:
                      type: string
                      example: Adds the possibility to customize the management web UI look.
                    require:
                      type: string
                      description: Minimum RabbitMQ version required
                      example: 3.5.0

    post:
      summary: Enable community plugin
      description: Enables a RabbitMQ community plugin
      operationId: enableCommunityPlugin
      tags:
        - Plugins
      parameters:
        - name: async
          in: query
          description: Asynchronous API mode - request returns immediately and plugin is enabled in background
          schema:
            type: boolean
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - plugin_name
              properties:
                plugin_name:
                  type: string
                  description: The name of the community plugin to enable
                  example: rabbitmq_management_themes
      responses:
        "200":
          description: Community plugin enabled successfully

  /plugins/community/{plugin_name}:
    parameters:
      - name: plugin_name
        in: path
        required: true
        description: The name of the community plugin
        schema:
          type: string

    delete:
      summary: Disable community plugin
      description: Disables a RabbitMQ community plugin
      operationId: disableCommunityPlugin
      tags:
        - Plugins
      parameters:
        - name: async
          in: query
          description: Asynchronous API mode - request returns immediately and plugin is disabled in background
          schema:
            type: boolean
      responses:
        "200":
          description: Community plugin disabled successfully

  /custom-domain:
    get:
      summary: Get configured custom domain
      description: Shows the current custom domain the cluster is configured for, if any
      operationId: getCustomDomain
      tags:
        - Custom Domain
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CustomDomain"
              examples:
                configured:
                  summary: Custom certificate with multiple hostnames
                  value:
                    hostname: www.example.org
                    hostnames:
                      - www.example.org
                      - example.org
                    configured: true
                notConfigured:
                  summary: No custom domain or certificate
                  value:
                    hostname: null
                    hostnames: []
                    configured: false

    post:
      summary: Generate Let's Encrypt certificates
      description: |
        Generates and installs a Let's Encrypt certificate on the cluster as SNI with your custom domain.
        This requires that your provided SNI host points to the CloudAMQP instance hostname. Otherwise the generation and renewal of the certificate will fail.

        **Note:** When creating a custom domain, the listeners on your servers will be restarted in order to apply the changes. This will close your current connections.
      operationId: createCustomDomain
      tags:
        - Custom Domain
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - hostname
              properties:
                hostname:
                  type: string
                  description: |
                    The custom hostname. This must be a valid ASCII DNS hostname, and its DNS record must point to the CloudAMQP instance hostname.
                  example: myname.mydomain
      responses:
        "200":
          description: Custom domain configured successfully

    delete:
      summary: Restore default domain
      description: Restores current custom domain configuration. Also stops future renewal process of the certificate.
      operationId: deleteCustomDomain
      tags:
        - Custom Domain
      responses:
        "200":
          description: Custom domain removed successfully

  /custom-cert:
    post:
      summary: Upload your own certificate to the server.
      description: |
        Uploads the certificate to the servers in your cluster.

        **Note:** The listeners on your servers will be restarted in order to apply the changes. This will close your current connections.
      operationId: createCustomCertificate
      tags:
        - Custom Certificate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomCert'
            examples:
              multipleHostnames:
                summary: Multiple hostnames
                value:
                  sni_hosts:
                    - app.yourdomain.com
                    - mqtt.yourdomain.com
                  private_key: |
                    -----BEGIN PRIVATE KEY-----
                    MIICXAIBAK...
                    -----END PRIVATE KEY-----
                  cert: |
                    -----BEGIN CERTIFICATE-----
                    MIID5TCCAs2gAwIBAg...
                    -----END CERTIFICATE-----
                  ca: |
                    -----BEGIN CERTIFICATE-----
                    MIIDQzCCAiugAwIBAg...
                    -----END CERTIFICATE-----
      responses:
        "202":
          description: Certificate upload started.
          content:
            application/json:
              schema:
                type: object
                properties:
                  job_id:
                    type: string
                    format: uuid
                    description: Job ID to track the certificate upload.
                  message:
                    type: string
        "400":
          description: Error message
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error message if any

    delete:
      summary: Restore to default certificate
      description: Removes the custom certificate from the server and generates a new Let's encrypt cert.
      operationId: deleteCustomCertificate
      tags:
        - Custom Certificate
      responses:
        "202":
          description: Started restoring to default certificate.
          content:
            application/json:
              schema:
                type: object
                properties:
                  job_id:
                    type: string
                    format: uuid
                    description: Job ID to track the certificate restore.
                  message:
                    type: string
        "400":
          description: Error message
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error message if any


  /security/firewall:
    get:
      summary: Get firewall settings
      description: Retrieves current firewall rules
      operationId: getFirewallSettings
      tags:
        - Firewall
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/FirewallRule"

    post:
      summary: Configure firewall
      description: |
        Configures the firewall rules. This will reconfigure the firewall - make sure to include all rules in the body, not only the rules you want to add.

        Available services: AMQP (5672), AMQPS (5671), HTTPS (443), MQTT (8883), MQTTS (1883), STOMP (61614), STOMPS (61613), STREAM (5552), STREAM_SSL (5551)

        **Note:** This action is asynchronous. The request will return immediately, the process to configure the firewall runs in the background. Until completed, consequent requests will return 400 Bad Request.
      operationId: configureFirewall
      tags:
        - Firewall
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                required:
                  - ip
                properties:
                  ip:
                    type: string
                    description: A CIDR for which to open the ports for
                    example: 0.0.0.0/0
                  services:
                    type: array
                    items:
                      type: string
                      enum:
                        [
                          AMQP,
                          AMQPS,
                          HTTPS,
                          MQTT,
                          MQTTS,
                          STOMP,
                          STOMPS,
                          STREAM,
                          STREAM_SSL,
                        ]
                    description: Which services to open up for in the firewall
                  ports:
                    type: array
                    items:
                      type: integer
                    description: Which ports to open in the firewall
      responses:
        "200":
          description: Firewall configuration initiated
        "400":
          description: Request already in progress

    patch:
      summary: Update firewall rules
      description: |
        Updates firewall rules. Providing an already existing CIDR will overwrite the current rule. If provided CIDR does not yet exist, it is added upon the other rules. To delete a specific rule, provide the CIDR with empty services and ports.

        **Note:** This action is asynchronous. The request will return immediately, the process to configure the firewall runs in the background.
      operationId: updateFirewallRules
      tags:
        - Firewall
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                required:
                  - ip
                properties:
                  ip:
                    type: string
                    description: A CIDR for which to open the ports for
                  services:
                    type: array
                    items:
                      type: string
                      enum:
                        [
                          AMQP,
                          AMQPS,
                          HTTPS,
                          MQTT,
                          MQTTS,
                          STOMP,
                          STOMPS,
                          STREAM,
                          STREAM_SSL,
                        ]
                    description: Which services to open up for in the firewall
                  ports:
                    type: array
                    items:
                      type: integer
                    description: Which ports to open in the firewall
      responses:
        "200":
          description: Firewall rules update initiated
        "400":
          description: Request already in progress

  /actions/firehose:
    put:
      summary: Enable/disable Firehose
      description: Enable or disable RabbitMQ Firehose tracing (not recommended in production)
      operationId: toggleFirehose
      tags:
        - Actions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - enable
                - vhost
              properties:
                enable:
                  type: boolean
                  description: Whether to enable or disable Firehose
                vhost:
                  type: string
                  description: Virtual host to enable tracing on
      responses:
        "200":
          description: Firehose setting updated

  /actions/restart:
    post:
      summary: Restart
      description: Restart the broker on specified nodes or all nodes
      operationId: restartRabbitMQ
      tags:
        - Actions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                nodes:
                  type: array
                  items:
                    type: string
                  maxItems: 1
                  description: Optional list containing a single node name. In a multi-node cluster, only one node can be restarted at a time and all other nodes must be running.
      responses:
        "200":
          description: Restart initiated

  /actions/cluster-restart:
    post:
      summary: Restart cluster
      description: Restart the entire cluster
      operationId: restartCluster
      tags:
        - Actions
      responses:
        "200":
          description: Cluster restart initiated

  /actions/cluster-stop:
    post:
      summary: Stop cluster
      description: Stop the entire cluster
      operationId: stopCluster
      tags:
        - Actions
      responses:
        "200":
          description: Cluster stop initiated

  /actions/cluster-start:
    post:
      summary: Start cluster
      description: Start the entire cluster
      operationId: startCluster
      tags:
        - Actions
      responses:
        "200":
          description: Cluster start initiated

  /actions/mgmt-restart:
    post:
      summary: Restart management interface
      description: Restart the RabbitMQ management interface
      operationId: restartManagement
      tags:
        - Actions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                nodes:
                  type: array
                  items:
                    type: string
                  description: Optional list of node names
      responses:
        "200":
          description: Management restart initiated

  /actions/stop:
    post:
      summary: Stop instance
      description: Stop specified nodes or all nodes
      operationId: stopInstance
      tags:
        - Actions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                nodes:
                  type: array
                  items:
                    type: string
                  maxItems: 1
                  description: Optional list containing a single node name. In a multi-node cluster, only one node can be stopped at a time and all other nodes must be running.
      responses:
        "200":
          description: Stop initiated

  /actions/start:
    post:
      summary: Start instance
      description: Start specified nodes or all nodes
      operationId: startInstance
      tags:
        - Actions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                nodes:
                  type: array
                  items:
                    type: string
                  description: Optional list of node names
      responses:
        "200":
          description: Start initiated

  /actions/reboot:
    post:
      summary: Reboot instance
      description: Reboot specified nodes or all nodes
      operationId: rebootInstance
      tags:
        - Actions
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                nodes:
                  type: array
                  items:
                    type: string
                  description: Optional list of node names
      responses:
        "200":
          description: Reboot initiated

  /actions/upgrade-erlang:
    post:
      summary: Upgrade Erlang
      description: |
        Always updates to latest compatible version.

        **Note:** This action is asynchronous. The request will return immediately, the process runs in the background.
      operationId: upgradeErlang
      tags:
        - Actions
      responses:
        "200":
          description: Erlang upgrade initiated
        "400":
          description: Upgrade already in progress

  /actions/upgrade-rabbitmq:
    post:
      summary: Upgrade RabbitMQ
      description: |
        Upgrade RabbitMQ to specified version.

        **Note:** This action is asynchronous. The request will return immediately, the process runs in the background.
      operationId: upgradeRabbitMQ
      tags:
        - Actions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - version
              properties:
                version:
                  type: string
                  description: RabbitMQ version
                  example: 3.10.7
      responses:
        "200":
          description: RabbitMQ upgrade initiated
        "400":
          description: Upgrade already in progress

  /actions/upgrade-rabbitmq-erlang:
    post:
      summary: Upgrade RabbitMQ and Erlang
      description: |
        Always updates to latest possible version of both RabbitMQ and Erlang.

        **Note:** This action is asynchronous. The request will return immediately, the process runs in the background.
      operationId: upgradeRabbitMQErlang
      tags:
        - Actions
      responses:
        "200":
          description: Upgrade initiated
        "400":
          description: Upgrade already in progress

  /actions/new-rabbitmq-erlang-versions:
    get:
      summary: Fetch upgrade versions
      description: Returns what version of Erlang and RabbitMQ the cluster will update to
      operationId: getUpgradeVersions
      tags:
        - Actions
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  rabbitmq_version:
                    type: string
                  erlang_version:
                    type: string

  /alarms/recipients:
    get:
      summary: List recipients
      description: Retrieve all recipients for an instance that can receive notifications
      operationId: listRecipients
      tags:
        - Alarms
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Recipient"

    post:
      summary: Create recipient
      description: Create a new notification recipient
      operationId: createRecipient
      tags:
        - Alarms
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/RecipientCreate"
      responses:
        "200":
          description: Recipient created successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Recipient"

  /alarms/recipients/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The recipient ID
        schema:
          type: integer

    get:
      summary: Retrieve specific recipient
      description: Get a specific recipient by ID
      operationId: getRecipient
      tags:
        - Alarms
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Recipient"
        "404":
          description: Recipient not found

    put:
      summary: Update recipient
      description: Update a specific recipient with new information
      operationId: updateRecipient
      tags:
        - Alarms
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/RecipientCreate"
      responses:
        "200":
          description: Recipient updated successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Recipient"
        "404":
          description: Recipient not found

    delete:
      summary: Delete recipient
      description: |
        Remove a recipient. This action will remove the recipient from associated alarms.
        Any alarms where this recipient was the sole recipient will be disabled.
      operationId: deleteRecipient
      tags:
        - Alarms
      responses:
        "200":
          description: Recipient deleted successfully
        "404":
          description: Recipient not found

  /alarms:
    get:
      summary: List alarms
      description: Retrieve all alarms used for the instance
      operationId: listAlarms
      tags:
        - Alarms
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Alarm"

    post:
      summary: Create alarm
      description: Create a new alarm
      operationId: createAlarm
      tags:
        - Alarms
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/AlarmCreate"
      responses:
        "200":
          description: Alarm created successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Alarm"

  /alarms/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The alarm ID
        schema:
          type: integer

    get:
      summary: Retrieve specific alarm
      description: Get a specific alarm by ID
      operationId: getAlarm
      tags:
        - Alarms
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Alarm"
        "404":
          description: Alarm not found

    put:
      summary: Update alarm
      description: Update a specific alarm
      operationId: updateAlarm
      tags:
        - Alarms
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/AlarmUpdate"
      responses:
        "200":
          description: Alarm updated successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Alarm"
        "404":
          description: Alarm not found

    delete:
      summary: Delete alarm
      description: Remove a specific alarm
      operationId: deleteAlarm
      tags:
        - Alarms
      responses:
        "200":
          description: Alarm deleted successfully
        "404":
          description: Alarm not found

  /eventbridges:
    get:
      summary: List eventbridges
      description: |
        Retrieve all AWS EventBridge integrations.
        Status field is always null unless there is an error starting the AWS EventBridge.
      operationId: listEventBridges
      tags:
        - EventBridge
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/EventBridge"

    post:
      summary: Add eventbridge
      description: Adds an AWS EventBridge integration and returns its given identifier
      operationId: createEventBridge
      tags:
        - EventBridge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EventBridgeCreate"
      responses:
        "200":
          description: EventBridge created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                    example: 1

  /eventbridges/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The eventbridge ID
        schema:
          type: integer

    get:
      summary: Retrieve specific eventbridge
      description: |
        Get a specific AWS EventBridge integration.
        Status field is always null unless there is an error starting the AWS EventBridge.
      operationId: getEventBridge
      tags:
        - EventBridge
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EventBridge"
        "404":
          description: EventBridge not found

    delete:
      summary: Delete eventbridge
      description: Removes an AWS EventBridge integration
      operationId: deleteEventBridge
      tags:
        - EventBridge
      responses:
        "200":
          description: EventBridge deleted successfully
        "404":
          description: EventBridge not found

  /webhooks:
    get:
      summary: List webhooks
      description: Retrieve all webhooks
      operationId: listWebhooks
      tags:
        - Webhooks
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/Webhook"

    post:
      summary: Create webhook
      description: |
        Creates a webhook. A POST request will be made for each message in the queue to this endpoint.
        If the endpoint returns a HTTP status code in the 200 range the message will be acknowledged and removed from the queue, otherwise retried.

        **Signature Verification**: When a `signing_secret` is configured, webhook requests will include headers for signature verification:
        - `webhook-id`: Unique message identifier
        - `webhook-timestamp`: Unix timestamp (seconds)
        - `webhook-signature`: HMAC-SHA256 signature (format: `v1,<base64>`)

        The signature is computed over `{webhook-id}.{webhook-timestamp}.{body}`.

        **Key Rotation**: Multiple secrets can be specified (space-separated) for zero-downtime key rotation. When multiple secrets are configured, signatures are generated for all of them, allowing consumers to verify with any key during the transition period.
      operationId: createWebhook
      tags:
        - Webhooks
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/WebhookCreate"
            example:
              webhook_uri: "https://your-endpoint.com/webhook"
              queue: "your-queue"
              vhost: "your-vhost"
              concurrency: 10
              timeout: 30
              signing_secret: "my-secret-key-123"
      responses:
        "200":
          description: Webhook created successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Webhook"
              example:
                id: 1
                webhook_uri: "https://your-endpoint.com/webhook"
                queue: "your-queue"
                vhost: "your-vhost"
                concurrency: 10
                timeout: 30
                signing_secret: "my-secret-key-123"
                last_status: null

  /webhooks/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The webhook ID
        schema:
          type: integer

    get:
      summary: Get specific webhook
      description: Retrieve a specific webhook by ID
      operationId: getWebhook
      tags:
        - Webhooks
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Webhook"
        "404":
          description: Webhook not found

    put:
      summary: Update webhook
      description: Update a specific webhook
      operationId: updateWebhook
      tags:
        - Webhooks
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/WebhookCreate"
      responses:
        "200":
          description: Webhook updated successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Webhook"
        "404":
          description: Webhook not found

    delete:
      summary: Delete webhook
      description: Remove a specific webhook
      operationId: deleteWebhook
      tags:
        - Webhooks
      responses:
        "200":
          description: Webhook deleted successfully
        "404":
          description: Webhook not found

  /config:
    get:
      summary: List current configuration
      description: Retrieve the current RabbitMQ configuration settings
      operationId: getRabbitMQConfig
      tags:
        - RabbitMQ Config
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RabbitMQConfig"

    put:
      summary: Update settings
      description: Update one or more RabbitMQ configuration settings
      operationId: updateRabbitMQConfig
      tags:
        - RabbitMQ Config
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              example:
                rabbit.vm_memory_high_watermark: 0.5
      responses:
        "200":
          description: Configuration updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: string
                    example: RabbitMQ config has been updated

  /config/available_settings:
    get:
      summary: List available settings
      description: Retrieve a list of all RabbitMQ settings that are exposed to changes
      operationId: getAvailableSettings
      tags:
        - RabbitMQ Config
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/RabbitMQConfigSetting"

  /integrations/logs:
    get:
      summary: List log integrations
      description: Retrieve all log integrations
      operationId: listLogIntegrations
      tags:
        - Logs
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/grafana:
    post:
      summary: Add Grafana Cloud (Loki) log integration
      description: |
        Add a Grafana Cloud (Loki) log integration.

        Broker logs are exported via OTLP to your Grafana Cloud stack.

        To find your credentials, sign in to the Grafana Cloud Portal, open your stack, find the **OpenTelemetry** tile and click **Configure**.

        The endpoint must be the OTLP gateway URL in the format `https://otlp-gateway-prod-<region>.grafana.net/otlp`.
      operationId: addLogIntegrationGrafanaCloud
      tags:
        - Logs/Grafana Cloud
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - endpoint
                - instance_id
                - api_token
              properties:
                endpoint:
                  type: string
                  description: Grafana Cloud OTLP gateway URL
                  example: https://otlp-gateway-prod-us-central-0.grafana.net/otlp
                instance_id:
                  type: string
                  description: Your numeric Grafana Cloud instance ID
                  example: "123456"
                api_token:
                  type: string
                  description: Grafana Cloud API token with metrics push permissions
                  example: glc_eyJ...
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/uptrace:
    post:
      summary: Add Uptrace log integration
      description: |
        Add an Uptrace log integration via the OpenTelemetry protocol (OTLP/HTTP).

        Find your DSN in Uptrace under **Project → Data Source Name**.
        The DSN encodes both your project ID and API token in a single URL:

        ```
        https://<token>@otlp.uptrace.dev/<project_id>
        ```

        Works with both Uptrace Cloud (`otlp.uptrace.dev`) and self-hosted Uptrace instances.

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addLogIntegrationUptrace
      tags:
        - Logs/Uptrace
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - dsn
              properties:
                dsn:
                  type: string
                  description: Uptrace DSN — encodes your project ID and API token
                  example: https://token@otlp.uptrace.dev/123
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/azure_monitor:
    post:
      summary: Add Azure Monitor log integration
      description: |
        Add an Azure Monitor log integration.

        Use Azure portal to configure external access for Azure Monitor. [Tutorial to find/create all params](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal)
      operationId: addLogIntegrationAzureMonitor
      tags:
        - Logs/Azure Monitor
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - tenant_id
                - application_id
                - application_secret
                - dce_uri
                - table
                - dcr_id
              properties:
                tenant_id:
                  type: string
                  description: Directory (tenant) ID
                application_id:
                  type: string
                  description: Application (client) ID. [How to create](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-azure-ad-application)
                application_secret:
                  type: string
                  description: Application secret
                dce_uri:
                  type: string
                  description: Data Collection Endpoint URI. [How to create](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-data-collection-endpoint)
                table:
                  type: string
                  description: Table name. Must have columns TimeGenerated, Host, Event, Level, Message. [How to create](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-new-table-in-log-analytics-workspace)
                dcr_id:
                  type: string
                  description: ID of Data Collection Rule. [Find DCR ID](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#collect-information-from-the-dcr)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/cloudwatchlog:
    post:
      summary: Add CloudWatch Logs integration
      description: |
        Add a CloudWatch Logs integration.

        Need to create an IAM user with programmatic permissions: CreateLogGroup, CreateLogStream, DescribeLogGroups, DescribeLogStreams, PutLogEvents

        Optional permissions for retention and tags: PutRetentionPolicy, DeleteRetentionPolicy, TagResource
      operationId: addLogIntegrationCloudwatch
      tags:
        - Logs/CloudWatch
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - region
                - access_key_id
                - secret_access_key
              properties:
                region:
                  type: string
                  description: The AWS region to use
                  example: us-west-1
                access_key_id:
                  type: string
                  description: The access key id to use
                secret_access_key:
                  type: string
                  description: The secret that goes with the key id
                retention:
                  type: integer
                  description: (Optional) Number of days to retain log events. [See AWS docs](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html)
                tags:
                  type: string
                  description: (Optional) Enter tags like Project=A,Environment=Production. [See AWS docs](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagLogGroup.html)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/coralogix:
    post:
      summary: Add Coralogix log integration (syslog, deprecated)
      deprecated: true
      description: |
        **Deprecated.** Use [/integrations/logs/coralogix_v2](#tag/logscoralogix/POST/integrations/logs/coralogix_v2) instead.

        This integration delivers logs via syslog. The `private_key`, `application`, and `subsystem`
        values can be reused when migrating — replace `endpoint` with `domain` (e.g. `syslog.eu2.coralogix.com:6514` → `eu2.coralogix.com`).
      operationId: addLogIntegrationCoralogix
      tags:
        - Logs/Coralogix
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - private_key
                - endpoint
                - application
                - subsystem
              properties:
                private_key:
                  type: string
                  description: The API key used for authentication
                endpoint:
                  type: string
                  description: The [syslog destination](https://coralogix.com/docs/integrations/coralogix-endpoints/) to send logs
                  example: syslog.eu2.coralogix.com:6514
                application:
                  type: string
                  description: The Application Name. [See docs](https://coralogix.com/docs/application-and-subsystem-names/)
                subsystem:
                  type: string
                  description: The Subsystem Name. [See docs](https://coralogix.com/docs/application-and-subsystem-names/)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/coralogix_v2:
    post:
      summary: Add Coralogix log integration
      description: |
        Add a Coralogix log integration using the OpenTelemetry protocol (OTLP/HTTP).

        Logs are delivered as structured OTLP records — no syslog parsing required on the Coralogix side.

        Find your Send-Your-Data API key in the Coralogix console under **Data Flow → API Keys → Send Your Data**. [Coralogix documentation](https://coralogix.com/docs/send-your-data-api-key/)
      operationId: addLogIntegrationCoralogixV2
      tags:
        - Logs/Coralogix
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - private_key
                - domain
                - application
                - subsystem
              properties:
                private_key:
                  type: string
                  description: Send-Your-Data API key
                domain:
                  type: string
                  description: Coralogix region domain matching your account
                  example: eu1.coralogix.com
                  enum:
                    - eu1.coralogix.com
                    - ap1.coralogix.com
                    - us1.coralogix.com
                    - eu2.coralogix.com
                    - ap2.coralogix.com
                    - us2.coralogix.com
                    - ap3.coralogix.com
                application:
                  type: string
                  description: The Application Name. [See docs](https://coralogix.com/docs/application-and-subsystem-names/)
                subsystem:
                  type: string
                  description: The Subsystem Name. [See docs](https://coralogix.com/docs/application-and-subsystem-names/)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/datadog:
    post:
      summary: Add Datadog log integration
      description: |
        Add a Datadog log integration.

        Create a Datadog API key at [app.datadoghq.com](https://app.datadoghq.com)

        **Note:** If tags are used, the value part must start with a letter. [See Datadog tagging docs](https://docs.datadoghq.com/getting_started/tagging/#define-tags)
      operationId: addLogIntegrationDatadog
      tags:
        - Logs/Datadog
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
                - region
              properties:
                api_key:
                  type: string
                  description: The API key for authentication
                region:
                  type: string
                  description: The region to send logs
                  enum: [us1, us3, us5, eu, ap2]
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/logentries:
    post:
      summary: Add Logentries integration
      description: |
        Add a Logentries log integration.

        Create a Logentries token at [logentries add-log](https://logentries.com/app#/add-log/manual)
      operationId: addLogIntegrationLogentries
      tags:
        - Logs/Logentries
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
                  description: A TCP token for authentication
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/loggly:
    post:
      summary: Add Loggly integration
      description: |
        Add a Loggly log integration.

        Create a Loggly token at `https://{your-company}.loggly.com/tokens`
      operationId: addLogIntegrationLoggly
      tags:
        - Logs/Loggly
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
                  description: The token used for authentication
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/papertrail:
    post:
      summary: Add Papertrail integration
      description: |
        Add a Papertrail log integration.

        Create a Papertrail endpoint at [papertrail setup](https://papertrailapp.com/systems/setup)
      operationId: addLogIntegrationPapertrail
      tags:
        - Logs/Papertrail
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - url
              properties:
                url:
                  type: string
                  description: The URL to push the logs to
                  example: logs.papertrail.com:2123
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/scalyr:
    post:
      summary: Add DataSet (Scalyr) integration
      description: |
        Add a DataSet (Scalyr) log integration.

        Create a Log write token at [DataSet (Scalyr) keys](https://app.scalyr.com/keys)
      operationId: addLogIntegrationScalyr
      tags:
        - Logs/Scalyr
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
                - host
              properties:
                token:
                  type: string
                  description: The token used for authentication
                host:
                  type: string
                  description: Destination to send logs
                  enum: [app.scalyr.com, app.eu.scalyr.com]
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/splunk:
    post:
      summary: Add Splunk log integration
      description: |
        Add a Splunk log integration.

        Create a HTTP Event Collector token at `https://<your-splunk>.cloud.splunk.com/en-US/manager/search/http-eventcollector`
      operationId: addLogIntegrationSplunk
      tags:
        - Logs/Splunk
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
                - host_port
                - sourcetype
              properties:
                token:
                  type: string
                  description: The token used for authentication
                host_port:
                  type: string
                  description: Destination to send the logs
                  example: input-prd-p-rdq96mdbptj4.cloud.splunk.com:8080
                sourcetype:
                  type: string
                  description: Assigns source type to the data exported
                  example: generic_single_line
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/splunk_v2:
    post:
      summary: Add Splunk v2 log integration
      description: |
        Add a Splunk v2 log integration. Broker and system logs are shipped to your
        Splunk HTTP Event Collector (HEC) endpoint via the OpenTelemetry Collector
        running on the cluster.

        Create a HEC token at `https://<your-splunk>/en-US/manager/search/http-eventcollector`.
        Indexer acknowledgement must be disabled on the token.

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addLogIntegrationSplunkv2
      tags:
        - Logs/Splunk v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - endpoint
                - token
              properties:
                endpoint:
                  type: string
                  description: Full HEC endpoint URL for incoming events
                  example: https://your-instance-id.splunkcloud.com:443/services/collector
                token:
                  type: string
                  description: HEC token used for authentication
                sourcetype:
                  type: string
                  description: |
                    (Optional) Source type assigned to forwarded events. When omitted the
                    token's default source type is used. Allowed characters: letters,
                    digits, underscore, dash, colon and dot (max 128 characters).
                  example: cloudamqp
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogIntegration"

  /integrations/logs/{integration_id}:
    parameters:
      - name: integration_id
        in: path
        required: true
        description: The numeric integration ID
        schema:
          type: integer
          minimum: 1
        example: 123

    put:
      summary: Update log integration
      description: Update a log integration configuration.
      operationId: updateLogIntegration
      tags:
        - Logs
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                # Azure Monitor parameters
                tenant_id:
                  type: string
                  description: "(azure_monitor) Directory (tenant) ID"
                application_id:
                  type: string
                  description: "(azure_monitor) Application (client) ID"
                application_secret:
                  type: string
                  description: "(azure_monitor) Application secret"
                dce_uri:
                  type: string
                  description: "(azure_monitor) Data Collection Endpoint URI"
                table:
                  type: string
                  description: "(azure_monitor) Table name"
                dcr_id:
                  type: string
                  description: "(azure_monitor) Data Collection Rule ID"
                # CloudWatch parameters
                region:
                  type: string
                  description: "(cloudwatchlog) AWS region"
                access_key_id:
                  type: string
                  description: "(cloudwatchlog) AWS access key id"
                secret_access_key:
                  type: string
                  description: "(cloudwatchlog) AWS secret access key"
                retention:
                  type: integer
                  description: "(cloudwatchlog) Days to retain log events"
                # Uptrace parameters
                dsn:
                  type: string
                  description: "(uptrace) DSN encoding project ID and API token"
                # Coralogix parameters
                private_key:
                  type: string
                  description: "(coralogix, coralogix_v2) Send-Your-Data API key"
                endpoint:
                  type: string
                  description: "(coralogix, deprecated) Syslog destination e.g. syslog.eu2.coralogix.com:6514, (grafana) OTLP gateway URL, (splunk_v2) HEC endpoint URL "
                instance_id:
                  type: string
                  description: "(grafana) Numeric Grafana Cloud instance ID"
                api_token:
                  type: string
                  description: "(grafana) Grafana Cloud API token"
                domain:
                  type: string
                  description: "(coralogix_v2) Region domain e.g. eu2.coralogix.com"
                application:
                  type: string
                  description: "(coralogix, coralogix_v2) Application Name"
                subsystem:
                  type: string
                  description: "(coralogix, coralogix_v2) Subsystem Name"
                # Datadog parameters
                api_key:
                  type: string
                  description: "(datadog) API key"
                # Common parameters
                tags:
                  type: string
                  description: "(cloudwatchlog, datadog) Optional tags"
                token:
                  type: string
                  description: "(logentries, loggly, scalyr, splunk, splunk_v2) Authentication token"
                url:
                  type: string
                  description: "(papertrail) URL to push logs"
                host:
                  type: string
                  description: "(scalyr) Destination host"
                host_port:
                  type: string
                  description: "(splunk) Destination"
                sourcetype:
                  type: string
                  description: "(splunk, splunk_v2) Source type"
              additionalProperties: false
      responses:
        "204":
          description: Integration updated successfully

    delete:
      summary: Delete log integration
      description: Delete a log integration
      operationId: deleteLogIntegration
      tags:
        - Logs
      responses:
        "204":
          description: Integration deleted successfully

  /integrations/metrics:
    get:
      summary: List metrics integrations
      description: Retrieve all metrics integrations
      operationId: listMetricsIntegrations
      tags:
        - Metrics
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: integer
                    type:
                      type: string
                    config:
                      type: object
                    error:
                      type: string
                    account_id:
                      type: string

  /integrations/metrics/azure_monitor:
    post:
      summary: Add Azure Monitor metrics integration
      description: |
        Add an Azure Monitor metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationAzuremonitor
      tags:
        - Metrics/Azure Monitor
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - connection_string
              properties:
                connection_string:
                  type: string
                  description: Azure Application Insights Connection String
                  example: InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://ingestion.azuremonitor.com/
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/cloudwatch:
    post:
      summary: Add CloudWatch metrics integration
      description: |
        Add a CloudWatch metrics integration (legacy).

        Provide either access keys OR IAM role parameters, not both.
      operationId: addMetricsIntegrationCloudwatch
      tags:
        - Metrics/CloudWatch
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                region:
                  type: string
                  description: AWS region
                  example: us-west-1
                access_key_id:
                  type: string
                  description: AWS access key ID (needs PutMetricData permission)
                secret_access_key:
                  type: string
                  description: AWS secret access key
                iam_role:
                  type: string
                  description: AWS IAM role ARN with PutMetricData permission
                iam_external_id:
                  type: string
                  description: External identifier for IAM role (e.g., cloudamqp-abc123)
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/cloudwatch_v2:
    post:
      summary: Add CloudWatch v2 metrics integration
      description: |
        Add a CloudWatch v2 metrics integration (legacy).

        Provide either access keys OR IAM role parameters, not both.
      operationId: addMetricsIntegrationCloudwatchv2
      tags:
        - Metrics/CloudWatch v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                region:
                  type: string
                  description: AWS region
                  example: us-west-1
                access_key_id:
                  type: string
                  description: AWS access key ID (needs PutMetricData permission)
                secret_access_key:
                  type: string
                  description: AWS secret access key
                iam_role:
                  type: string
                  description: AWS IAM role ARN with PutMetricData permission
                iam_external_id:
                  type: string
                  description: External identifier for IAM role (e.g., cloudamqp-abc123)
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/cloudwatch_v3:
    post:
      summary: Add CloudWatch v3 metrics integration
      description: |
        Add a CloudWatch v3 metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationCloudwatchv3
      tags:
        - Metrics/CloudWatch v3
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - region
              properties:
                region:
                  type: string
                  description: AWS region
                  example: us-west-1
                iam_role:
                  type: string
                  description: AWS IAM role ARN with PutMetricData permission
                iam_external_id:
                  type: string
                  description: External identifier for IAM role (e.g., cloudamqp-abc123)
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/datadog:
    post:
      summary: Add Datadog metrics integration
      description: |
        Add a Datadog metrics integration (legacy).

        **Note:** If tags are used, the value part must start with a letter. [See Datadog tagging docs](https://docs.datadoghq.com/getting_started/tagging/#define-tags)
      operationId: addMetricsIntegrationDatadog
      tags:
        - Metrics/Datadog
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
                - region
              properties:
                api_key:
                  type: string
                  description: Datadog API key
                region:
                  type: string
                  description: Region to send metrics
                  enum: ['us1', 'us3', 'us5', 'eu']
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/datadog_v2:
    post:
      summary: Add Datadog v2 metrics integration
      description: |
        Add a Datadog v2 metrics integration (legacy).

        **Note:** If tags are used, the value part must start with a letter. [See Datadog tagging docs](https://docs.datadoghq.com/getting_started/tagging/#define-tags)
      operationId: addMetricsIntegrationDatadogv2
      tags:
        - Metrics/Datadog v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
                - region
              properties:
                api_key:
                  type: string
                  description: Datadog API key
                region:
                  type: string
                  description: Region to send metrics
                  enum: ['us1', 'us3', 'us5', 'eu']
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/datadog_v3:
    post:
      summary: Add Datadog v3 metrics integration
      description: |
        Add a Datadog v3 metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.

        **Note:** If tags are used, the value part must start with a letter. [See Datadog tagging docs](https://docs.datadoghq.com/getting_started/tagging/#define-tags)
      operationId: addMetricsIntegrationDatadogv3
      tags:
        - Metrics/Datadog v3
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
              properties:
                api_key:
                  type: string
                  description: Datadog API key
                region:
                  type: string
                  description: Region to send metrics
                  enum: ['us1', 'us3', 'us5', 'eu', 'ap2']
                rabbitmq_dashboard_metrics_format:
                  type: boolean
                  description: (Optional) Transform RabbitMQ metric names to match Datadog RabbitMQ dashboard format. [See docs](https://www.cloudamqp.com/docs/monitoring_metrics_datadog_v3.html#rabbitmq-dashboard-metrics-format)
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/dynatrace:
    post:
      summary: Add Dynatrace metrics integration
      description: |
        Add a Dynatrace metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationDynatrace
      tags:
        - Metrics/Dynatrace
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - environment_id
                - access_token
              properties:
                environment_id:
                  type: string
                  description: Environment ID for Dynatrace account
                access_token:
                  type: string
                  description: Access token with Ingest metrics permission
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/grafana:
    post:
      summary: Add Grafana Cloud (Mimir) metrics integration
      description: |
        Add a Grafana Cloud metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.

        Broker and server metrics are pushed to your Grafana Cloud stack with Prometheus remote write.

        To find your credentials, sign in to the Grafana Cloud Portal, open your stack, find the **Prometheus** tile and click **Send Metrics**. The API token needs the `metrics:write` scope.

        The endpoint must be the remote write URL in the format `https://prometheus-prod-<region>.grafana.net/api/prom/push`.
      operationId: addMetricsIntegrationGrafanaCloud
      tags:
        - Metrics/Grafana Cloud
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - endpoint
                - instance_id
                - api_token
              properties:
                endpoint:
                  type: string
                  description: Grafana Cloud Prometheus remote write URL
                  example: https://prometheus-prod-01-eu-west-0.grafana.net/api/prom/push
                instance_id:
                  type: string
                  description: Your numeric Grafana Cloud Prometheus instance ID, used as username
                  example: "123456"
                api_token:
                  type: string
                  description: Grafana Cloud API token with metrics push permissions
                  example: glc_eyJ...
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/librato:
    post:
      summary: Add Librato metrics integration
      description: |
        Add a Librato metrics integration (legacy).
      operationId: addMetricsIntegrationLibrato
      tags:
        - Metrics/Librato
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - email
                - api_key
              properties:
                email:
                  type: string
                  description: Email registered at Librato
                  example: user@example.com
                api_key:
                  type: string
                  description: Librato API key
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/newrelic_v2:
    post:
      summary: Add New Relic v2 metrics integration
      description: |
        Add a New Relic v2 metrics integration (legacy).
      operationId: addMetricsIntegrationNewrelicv2
      tags:
        - Metrics/New Relic v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
                - region
              properties:
                api_key:
                  type: string
                  description: New Relic API key
                region:
                  type: string
                  description: Region
                  enum: ['US', 'EU']
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/newrelic_v3:
    post:
      summary: Add New Relic v3 metrics integration
      description: |
        Add a New Relic v3 metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationNewrelicv3
      tags:
        - Metrics/New Relic v3
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - api_key
                - region
              properties:
                api_key:
                  type: string
                  description: New Relic API key
                region:
                  type: string
                  description: Region
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/splunk:
    post:
      summary: Add Splunk metrics integration
      description: |
        Add a Splunk metrics integration (legacy).

        Create a HTTP Event Collector token at `https://<your-splunk>.cloud.splunk.com/en-US/manager/search/http-eventcollector`
      operationId: addMetricsIntegrationSplunk
      tags:
        - Metrics/Splunk
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
                - host_port
                - sourcetype
              properties:
                token:
                  type: string
                  description: Authentication token
                host_port:
                  type: string
                  description: Destination to send metrics
                  example: input-prd-p-rdq96mdbptj4.cloud.splunk.com:8080
                sourcetype:
                  type: string

  /integrations/metrics/splunk_v2:
    post:
      summary: Add Splunk v2 metrics integration
      description: |
        Add a Splunk v2 metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationSplunkv2
      tags:
        - Metrics/Splunk v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - token
                - endpoint
              properties:
                token:
                  type: string
                  description: Authentication token
                endpoint:
                  type: string
                  description: HEC destination
                  example: input-prd-p-rdq96mdbptj4.cloud.splunk.com:8080
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/stackdriver:
    post:
      summary: Add Stackdriver metrics integration
      description: |
        Add a Stackdriver metrics integration (legacy).
      operationId: addMetricsIntegrationStackdriver
      tags:
        - Metrics/Stackdriver
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
                queue_regex:
                  type: string
                  description: (Optional) Allowlist to filter queues using regular expression
                vhost_regex:
                  type: string
                  description: (Optional) Allowlist to filter vhost using regular expression
                include_ad_queues:
                  type: boolean
                  description: (Optional) Include auto-delete queues (default false)
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/stackdriver_v2:
    post:
      summary: Add Stackdriver v2 metrics integration
      description: |
        Add a Stackdriver v2 metrics integration (Prometheus-based).

        Available on all LavinMQ clusters and RabbitMQ clusters running version 3.10.0 or later.
      operationId: addMetricsIntegrationStackdriverv2
      tags:
        - Metrics/Stackdriver v2
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                tags:
                  type: string
                  description: (Optional) Enter tags like env=prod,region=europe
              additionalProperties: false
      responses:
        "200":
          description: Integration added successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                  type:
                    type: string

  /integrations/metrics/{integration_id}:
    parameters:
      - name: integration_id
        in: path
        required: true
        description: The numeric integration ID
        schema:
          type: integer
          minimum: 1
        example: 123

    put:
      summary: Update metrics integration
      description: Update a metrics integration configuration.
      operationId: updateMetricsIntegration
      tags:
        - Metrics
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                # Azure Monitor parameters
                connection_string:
                  type: string
                  description: "(azure_monitor) Azure Application Insights Connection String"
                # CloudWatch parameters
                region:
                  type: string
                  description: "(cloudwatch, cloudwatch_v2, cloudwatch_v3, datadog, datadog_v2, newrelic_v2, newrelic_v3) Region"
                access_key_id:
                  type: string
                  description: "(cloudwatch, cloudwatch_v2) AWS access key id"
                secret_access_key:
                  type: string
                  description: "(cloudwatch, cloudwatch_v2) AWS secret access key"
                iam_role:
                  type: string
                  description: "(cloudwatch, cloudwatch_v2, cloudwatch_v3) AWS IAM role ARN"
                iam_external_id:
                  type: string
                  description: "(cloudwatch, cloudwatch_v2, cloudwatch_v3) External identifier for IAM role"
                # Datadog parameters
                api_key:
                  type: string
                  description: "(datadog, datadog_v2, datadog_v3, dynatrace, librato, newrelic_v2, newrelic_v3) API key"
                rabbitmq_dashboard_metrics_format:
                  type: boolean
                  description: "(datadog_v3) Transform RabbitMQ metric names"
                # Dynatrace parameters
                environment_id:
                  type: string
                  description: "(dynatrace) Environment ID"
                access_token:
                  type: string
                  description: "(dynatrace) Access token"
                # Grafana Cloud parameters
                instance_id:
                  type: string
                  description: "(grafana) Numeric Grafana Cloud Prometheus instance ID"
                api_token:
                  type: string
                  description: "(grafana) Grafana Cloud API token"
                # Librato parameters
                email:
                  type: string
                  description: "(librato) Email registered at Librato"
                # Splunk parameters
                token:
                  type: string
                  description: "(splunk, splunk_v2) Authentication token"
                host_port:
                  type: string
                  description: "(splunk) Destination"
                endpoint:
                  type: string
                  description: "(grafana) Prometheus remote write URL, (splunk_v2) HEC destination"
                sourcetype:
                  type: string
                  description: "(splunk) Source type"
                # Common optional parameters
                tags:
                  type: string
                  description: "(optional for all) Tags"
                queue_regex:
                  type: string
                  description: "(optional for legacy integrations) Queue filter regex"
                vhost_regex:
                  type: string
                  description: "(optional for legacy integrations) Vhost filter regex"
                include_ad_queues:
                  type: boolean
                  description: "(optional for legacy integrations) Include auto-delete queues"
              additionalProperties: false
      responses:
        "204":
          description: Integration updated successfully

    delete:
      summary: Delete metrics integration
      description: Delete a metrics integration
      operationId: deleteMetricsIntegration
      tags:
        - Metrics
      responses:
        "204":
          description: Integration deleted successfully

  /integrations/metrics/{integration_id}/metrics_filter:
    parameters:
      - name: integration_id
        in: path
        required: true
        description: The integration ID
        schema:
          type: integer

    get:
      summary: Get metrics filter for a Prometheus integration
      description: |
        Retrieve the metrics filter for a Prometheus integration.

        Valid metrics can be found in the [documentation of each integration type](https://www.cloudamqp.com/docs/cloudamqp-integrations.html#metrics).
      operationId: getPrometheusFilter
      tags:
        - Metrics
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  metrics_filter:
                    type: array
                    items:
                      type: string
                    description: List of metrics to include
                    example: ["lavinmq_connections", "lavinmq_channels"]

    put:
      summary: Update metrics filter for a Prometheus integration
      description: |
        Update the metrics filter for a Prometheus integration.

        Valid metrics can be found in the [documentation of each integration type](https://www.cloudamqp.com/docs/cloudamqp-integrations.html#metrics).
      operationId: updatePrometheusFilter
      tags:
        - Metrics
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - metrics_filter
              properties:
                metrics_filter:
                  type: array
                  items:
                    type: string
                  description: The wanted metrics
                  example: ["lavinmq_connections", "lavinmq_channels"]
      responses:
        "200":
          description: Filter updated successfully

  /maintenance:
    get:
      summary: List upcoming maintenance
      description: List scheduled maintenance operations
      operationId: listMaintenance
      tags:
        - Maintenance
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: integer
                    scheduled_by:
                      type: string
                    status:
                      type: string
                    required_by:
                      type: string
                    duration:
                      type: string
                    description:
                      type: string

  /maintenance/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The maintenance ID
        schema:
          type: integer

    put:
      summary: Reschedule maintenance
      description: Reschedule a maintenance operation
      operationId: rescheduleMaintenance
      tags:
        - Maintenance
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - scheduled_by
              properties:
                scheduled_by:
                  type: string
                  description: Date string
      responses:
        "200":
          description: Maintenance rescheduled successfully

  /maintenance/{id}/run:
    parameters:
      - name: id
        in: path
        required: true
        description: The maintenance ID
        schema:
          type: integer

    post:
      summary: Run maintenance now
      description: Execute maintenance operation immediately
      operationId: runMaintenance
      tags:
        - Maintenance
      responses:
        "200":
          description: Maintenance started successfully

  /maintenance/settings:
    get:
      summary: Get maintenance settings
      description: |
        Fetches the current maintenance settings for the cluster.

        See [Maintenance by the CloudAMQP team](https://www.cloudamqp.com/docs/cloudamqp-maintenance.html) for more information.
      operationId: getMaintenanceSettings
      tags:
        - Maintenance
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  preferred_maintenance_day:
                    type: string
                  preferred_maintenance_time:
                    type: string
                  automatic_updates:
                    type: boolean

    post:
      summary: Update maintenance settings
      description: |
        Updates the maintenance settings for the cluster.

        See [Maintenance by the CloudAMQP team](https://www.cloudamqp.com/docs/cloudamqp-maintenance.html) for more information.
      operationId: updateMaintenanceSettings
      tags:
        - Maintenance
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - preferred_maintenance_day
                - preferred_maintenance_time
              properties:
                preferred_maintenance_day:
                  type: string
                  description: Day of the week (e.g., Monday)
                preferred_maintenance_time:
                  type: string
                  description: UTC time (e.g., 00:00)
                automatic_updates:
                  type: boolean
                  description: Enable/disable automatic version upgrades
      responses:
        "200":
          description: Settings updated successfully

  /vpc-peering:
    get:
      summary: List VPC peering requests
      description: Retrieve all VPC peering connections
      operationId: listVPCPeering
      tags:
        - VPC
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  rows:
                    type: array
                    items:
                      type: object
                  vpc:
                    type: object

    post:
      summary: Create VPC peering request
      description: |
        Creates a peering request from the VPC hosting your cluster to the VPC you specify.

        **Note**: This action is asynchronous. Different parameters are required for AWS vs GCP.
      operationId: createVPCPeering
      tags:
        - VPC
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                peer_account_id:
                  type: string
                  description: AWS account ID
                peer_vpc_id:
                  type: string
                  description: AWS VPC ID
                peer_subnet:
                  type: string
                  description: Peer subnet (AWS)
                peer_network_uri:
                  type: string
                  description: GCP network URI
      responses:
        "200":
          description: Peering request created
        "400":
          description: Request already in progress

  /vpc-peering/{id}:
    parameters:
      - name: id
        in: path
        required: true
        description: The peering request or connection ID
        schema:
          type: integer

    put:
      summary: Accept VPC peering request
      description: |
        Accepts a pending peering request (AWS only).

        **Note**: This action is asynchronous.
      operationId: acceptVPCPeering
      tags:
        - VPC
      responses:
        "200":
          description: Peering request accepted
        "400":
          description: Request already in progress

    delete:
      summary: Delete VPC peering request
      description: Deletes a VPC peering connection
      operationId: deleteVPCPeering
      tags:
        - VPC
      responses:
        "200":
          description: Peering deleted successfully

  /vpc-connect:
    get:
      summary: Retrieve VPC Connect information
      description: Get PrivateLink/Private Service Connect information
      operationId: getVPCConnect
      tags:
        - VPC Connect
      responses:
        "200":
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  updated_at:
                    type: string
                  status:
                    type: string
                  service_name:
                    type: string
                    description: AWS service name
                  allowed_principals:
                    type: array
                    items:
                      type: string
                    description: AWS principals
                  server_name:
                    type: string
                    description: Azure/GCP server name
                  alias:
                    type: string
                    description: Azure alias
                  approved_subscriptions:
                    type: array
                    items:
                      type: string
                    description: Azure subscriptions
                  allowed_projects:
                    type: array
                    items:
                      type: string
                    description: GCP projects

    post:
      summary: Enable VPC Connect
      description: |
        Enables PrivateLink (AWS/Azure) or Private Service Connect (GCP).

        **Note**: Different parameters required per cloud provider:
        - **AWS**: `allowed_principals` - Array of AWS ARN principals. [See AWS PrivateLink documentation](https://www.cloudamqp.com/docs/cloudamqp-vpc-connect.html#aws-privatelink)
        - **Azure**: `approved_subscriptions` - Array of Azure subscription IDs. [See Azure PrivateLink documentation](https://www.cloudamqp.com/docs/cloudamqp-vpc-connect.html#azure-privatelink)
        - **GCP**: `allowed_projects` - Array of GCP project IDs. [See GCP Private Service Connect documentation](https://www.cloudamqp.com/docs/cloudamqp-vpc-connect.html#gcp-private-service-connect)
      operationId: enableVPCConnect
      tags:
        - VPC Connect
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                allowed_principals:
                  type: array
                  items:
                    type: string
                  description: AWS ARN principals (for AWS PrivateLink)
                approved_subscriptions:
                  type: array
                  items:
                    type: string
                  description: Azure subscription IDs (for Azure PrivateLink)
                allowed_projects:
                  type: array
                  items:
                    type: string
                  description: GCP project IDs (for GCP Private Service Connect)
      responses:
        "200":
          description: VPC Connect enabled successfully

    put:
      summary: Update VPC Connect allowlist
      description: Updates the allowlist for VPC Connect
      operationId: updateVPCConnect
      tags:
        - VPC Connect
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                allowed_principals:
                  type: array
                  items:
                    type: string
                approved_subscriptions:
                  type: array
                  items:
                    type: string
                allowed_projects:
                  type: array
                  items:
                    type: string
      responses:
        "200":
          description: Allowlist updated successfully

    delete:
      summary: Disable VPC Connect
      description: Disables PrivateLink/Private Service Connect
      operationId: disableVPCConnect
      tags:
        - VPC Connect
      responses:
        "200":
          description: VPC Connect disabled successfully

  /vpc-connect/connections:
    get:
      summary: List VPC endpoint connections
      description: |
        Lists the active VPC endpoint connections to your PrivateLink or Private Service Connect
        service. The response fields vary by cloud provider. The `custom_hostname` field is included
        if a custom hostname has been configured for the connection, otherwise it is `null`.
      operationId: listVPCConnections
      tags:
        - VPC Connect
      responses:
        "200":
          description: List of active VPC endpoint connections
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                      description: Endpoint connection ID
                    created:
                      type: string
                      format: date-time
                      description: Creation timestamp (AWS only)
                    owner:
                      type: string
                      description: Endpoint owner account (AWS only)
                    state:
                      type: string
                      description: Connection state (AWS/Azure)
                    dns:
                      type: array
                      items:
                        type: string
                      description: DNS names for the endpoint (AWS only)
                    project:
                      type: string
                      description: GCP project ID (GCP only)
                    name:
                      type: string
                      description: Endpoint name (GCP only)
                    status:
                      type: string
                      description: Connection status (GCP only)
                    custom_hostname:
                      type: string
                      nullable: true
                      description: Custom hostname configured for this connection, or null if not set
              examples:
                aws:
                  summary: AWS
                  value:
                    - id: "vpce-0123456789abcdef0"
                      created: "2025-01-15T10:30:00Z"
                      owner: "123456789012"
                      state: "available"
                      dns:
                        - "vpce-0123456789abcdef0-abc123.vpce-svc-xyz.us-east-1.vpce.amazonaws.com"
                      custom_hostname: "my-instance-vpce-0123456789abcdef0.in.cloudamqp.com"
                azure:
                  summary: Azure
                  value:
                    - id: "pe-my-endpoint"
                      state: "Approved"
                      custom_hostname: "my-instance-pe-my-endpoint.in.cloudamqp.com"
                gcp:
                  summary: GCP
                  value:
                    - id: "1234567890"
                      project: "my-project"
                      name: "my-endpoint"
                      status: "ACCEPTED"
                      custom_hostname: null

  /vpc-connect/custom-hostnames:
    get:
      summary: List custom hostnames
      description: |
        Lists all custom hostnames configured for the VPC Connect service. Custom hostnames
        provide a DNS record under cloudamqp.com that points to the private IP of the PrivateLink
        or Private Service Connect endpoint. The `active` field indicates whether the endpoint
        connection still exists. Inactive (orphaned) hostnames can be removed.
      operationId: listVPCCustomHostnames
      tags:
        - VPC Connect
      responses:
        "200":
          description: List of configured custom hostnames
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  required:
                    - endpoint_id
                    - hostname
                    - active
                  properties:
                    endpoint_id:
                      type: string
                      description: The VPC endpoint connection ID
                    hostname:
                      type: string
                      description: The custom hostname under cloudamqp.com
                    active:
                      type: boolean
                      description: Whether the endpoint connection still exists
              example:
                - endpoint_id: "vpce-0123456789abcdef0"
                  hostname: "my-instance-vpce-0123456789abcdef0.in.cloudamqp.com"
                  active: true

    post:
      summary: Set up custom hostname
      description: |
        Sets up a custom hostname for a VPC endpoint connection. The hostname is a DNS record
        under cloudamqp.com that matches the instance's TLS certificate, allowing secure
        connections through the private endpoint.

        - **AWS**: A CNAME record is created pointing to the endpoint's DNS name. No `endpoint_ip` required.
        - **Azure/GCP**: An A record is created pointing to the provided private IP address. `endpoint_ip` is required.
      operationId: setupVPCCustomHostname
      tags:
        - VPC Connect
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - endpoint_id
              properties:
                endpoint_id:
                  type: string
                  description: The VPC endpoint connection ID
                endpoint_ip:
                  type: string
                  description: Private IP address of the endpoint (required for Azure/GCP, must be RFC 1918)
            examples:
              aws:
                summary: AWS (no endpoint_ip needed)
                value:
                  endpoint_id: "vpce-0123456789abcdef0"
              azure_gcp:
                summary: Azure / GCP
                value:
                  endpoint_id: "pe-my-endpoint"
                  endpoint_ip: "10.0.0.5"
      responses:
        "204":
          description: Custom hostname setup initiated

    delete:
      summary: Remove custom hostname
      description: Removes a previously configured custom hostname for a VPC endpoint connection.
      operationId: removeVPCCustomHostname
      tags:
        - VPC Connect
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - endpoint_id
              properties:
                endpoint_id:
                  type: string
                  description: The VPC endpoint connection ID
      responses:
        "204":
          description: Custom hostname removed successfully

  /oauth2-configurations:
    get:
      summary: Get OAuth 2.0 configuration
      description: Retrieve the current OAuth 2.0 configuration for the instance
      operationId: getOAuth2Configuration
      tags:
        - OAuth 2.0
      responses:
        '200':
          description: Successfully retrieved OAuth 2.0 configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Configuration'
        "404":
          description: No OAuth 2.0 configuration found

    post:
      summary: Create OAuth 2.0 configuration
      description: |
        Create a new OAuth 2.0 configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        Note: Only one operation can run at a time per resource. When operation is completed, a restart of RabbitMQ is required for changes to be applied.
      operationId: createOAuth2Configuration
      tags:
        - OAuth 2.0
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OAuth2ConfigurationCreate"
      responses:
        "200":
          description: Configuration creation initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "400":
          description: Invalid Content-Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentTypeError'
        "422":
          description: Validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'

    put:
      summary: Update OAuth 2.0 configuration
      description: |
        Update the existing OAuth 2.0 configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        Note: Only one operation can run at a time per resource. When operation is completed, a restart of RabbitMQ is required for changes to be applied.
      operationId: updateOAuth2Configuration
      tags:
        - OAuth 2.0
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OAuth2ConfigurationCreate"
      responses:
        "200":
          description: Configuration update initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "400":
          description: Invalid Content-Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContentTypeError'
        "422":
          description: Validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'

    delete:
      summary: Delete OAuth 2.0 configuration
      description: |
        Delete the OAuth 2.0 configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        Note: Only one operation can run at a time per resource. When operation is completed, a restart of RabbitMQ is required for changes to be applied.
      operationId: deleteOAuth2Configuration
      tags:
        - OAuth 2.0
      responses:
        "200":
          description: Configuration deletion initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "400":
          description: A pending operation already exists for this resource

  /trust-store-configuration:
    get:
      summary: Get trust store configuration
      description: Retrieve the current trust store configuration for the instance
      operationId: getTrustStoreConfiguration
      tags:
        - Trust Store
      responses:
        '200':
          description: Successfully retrieved trust store configuration
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/TrustStoreConfigurationHttpResponse'
                  - $ref: '#/components/schemas/TrustStoreConfigurationFileResponse'
                discriminator:
                  propertyName: provider
                  mapping:
                    http: '#/components/schemas/TrustStoreConfigurationHttpResponse'
                    file: '#/components/schemas/TrustStoreConfigurationFileResponse'
        "404":
          description: No trust store configuration found

    post:
      summary: Create trust store configuration
      description: |
        Create a new trust store configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        The request body varies based on the `provider` field:
        - **http**: Fetch certificates from an HTTP/HTTPS URL
        - **file**: Upload certificates directly

        Note: Only one operation can run at a time per resource.
      operationId: createTrustStoreConfiguration
      tags:
        - Trust Store
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: "#/components/schemas/TrustStoreConfigurationHttpCreate"
                - $ref: "#/components/schemas/TrustStoreConfigurationFileCreate"
              discriminator:
                propertyName: provider
                mapping:
                  http: '#/components/schemas/TrustStoreConfigurationHttpCreate'
                  file: '#/components/schemas/TrustStoreConfigurationFileCreate'
            examples:
              httpProvider:
                summary: HTTP Provider Example
                value:
                  provider: http
                  url: "https://trust-store.example.com/certs"
                  refresh_interval: 60
                  cacertfile: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
              httpProviderMinimal:
                summary: HTTP Provider (minimal)
                description: Provider defaults to 'http' if omitted, refresh_interval defaults to 30 seconds
                value:
                  url: "https://trust-store.example.com/certs"
              fileProvider:
                summary: File Provider Example
                value:
                  provider: file
                  certificates:
                    - name: "ca-cert-1.pem"
                      content: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
                    - name: "ca-cert-2.pem"
                      content: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
                  refresh_interval: 90
      responses:
        "200":
          description: Configuration creation initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "400":
          description: Invalid Content-Type or unknown parameters
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/ContentTypeError'
                  - $ref: '#/components/schemas/UnknownParameterError'
        "422":
          description: Validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'

    put:
      summary: Update trust store configuration
      description: |
        Update the existing trust store configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        The request body varies based on the `provider` field:
        - **http**: Fetch certificates from an HTTP/HTTPS URL
        - **file**: Upload certificates directly

        You can switch between providers by including the provider field and the appropriate fields for the new provider type (and setting the old provider's fields to null/omitting them).

        Note: Only one operation can run at a time per resource.
      operationId: updateTrustStoreConfiguration
      tags:
        - Trust Store
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: "#/components/schemas/TrustStoreConfigurationHttpCreate"
                - $ref: "#/components/schemas/TrustStoreConfigurationFileCreate"
              discriminator:
                propertyName: provider
                mapping:
                  http: '#/components/schemas/TrustStoreConfigurationHttpCreate'
                  file: '#/components/schemas/TrustStoreConfigurationFileCreate'
            examples:
              httpProvider:
                summary: HTTP Provider Update
                value:
                  url: "https://updated.example.com/trust-store"
                  refresh_interval: 120
              fileProvider:
                summary: File Provider Update
                value:
                  provider: file
                  certificates:
                    - name: "updated-cert.pem"
                      content: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
      responses:
        "200":
          description: Configuration update initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "400":
          description: Invalid Content-Type or unknown parameters
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/ContentTypeError'
                  - $ref: '#/components/schemas/UnknownParameterError'
        "404":
          description: No trust store configuration found
        "422":
          description: Validation failed or pending job exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'

    delete:
      summary: Delete trust store configuration
      description: |
        Delete the trust store configuration. This is an asynchronous operation that returns a job_id immediately. Track progress using the Jobs API.

        Note: Only one operation can run at a time per resource.
      operationId: deleteTrustStoreConfiguration
      tags:
        - Trust Store
      responses:
        "200":
          description: Configuration deletion initiated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobIdResponse'
        "404":
          description: No trust store configuration found
        "422":
          description: A pending operation already exists for this resource

  /jobs/{id}:
    get:
      summary: Get Job
      description: Retrieve the current Job
      operationId: getJob
      parameters:
      - name: id
        required: true
        description: The job ID
        in: path
        schema:
          type: string

      tags:
        - Jobs
      responses:
        '200':
          description: Successfully retrieved Job
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Jobs"
        "404":
          description: No Job found
