{"openapi":"3.0.3","info":{"title":"Scantelio synthetic staging API","version":"1.0.0"},"servers":[{"url":"https://testapi.devertasov.ru"}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}}},"paths":{"/health":{"get":{"summary":"Health and source revision","security":[],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/auth/login":{"post":{"summary":"JSON login: username and password, returns access_token","security":[],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"type":"string"},"password":{"type":"string","format":"password"}}}}}}}},"/api/me":{"get":{"summary":"Authenticated user and synthetic marker","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/api/documents/{id}":{"get":{"summary":"Owner-only document: doc-a or doc-b","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","enum":["doc-a","doc-b"]}}]}},"/lab/bola/documents/{id}":{"get":{"summary":"Deliberately missing owner check; synthetic BOLA positive control","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","enum":["doc-a","doc-b"]}}]}},"/api/admin/report":{"get":{"summary":"Admin-only report","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/lab/role/report":{"get":{"summary":"Synthetic missing role check positive control","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/api/profile":{"get":{"summary":"Fixed profile: protected role cannot be changed","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}},"patch":{"summary":"Fixed profile: protected role cannot be changed","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/lab/mass-assignment/profile":{"get":{"summary":"Synthetic mutable role; restore original after test","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}},"patch":{"summary":"Synthetic mutable role; restore original after test","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}},"/auth/fixtures":{"get":{"summary":"Previously valid signed expired token for JWT testing","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Success"},"401":{"description":"Authentication required"},"403":{"description":"Forbidden"}}}}}}