{"openapi":"3.1.0","info":{"title":"PlatPhorm Investigate API","version":"1.0.0","description":"Bounded security-incident orchestration over Correlate, Evidence, and pinned MITRE ATT&CK data."},"servers":[{"url":"https://investigate.platphormnews.com"}],"components":{"securitySchemes":{"PlatPhormBearer":{"type":"http","scheme":"bearer","bearerFormat":"PLATPHORM_API_KEY","description":"Protected actions accept Authorization: Bearer $PLATPHORM_API_KEY."},"PlatPhormHeader":{"type":"apiKey","in":"header","name":"X-PlatPhorm-API-Key","description":"Protected actions also accept X-PlatPhorm-API-Key: $PLATPHORM_API_KEY."}}},"paths":{"/api/health":{"get":{"operationId":"getHealth","responses":{"200":{"description":"Liveness and dependency readiness"}}}},"/api/v1/health":{"get":{"operationId":"getHealthV1","responses":{"200":{"description":"Versioned health alias"}}}},"/api/v1/investigate":{"post":{"operationId":"runInvestigation","summary":"Stream a bounded investigation as NDJSON","security":[{"PlatPhormBearer":[]},{"PlatPhormHeader":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["question","datasetId"],"properties":{"question":{"type":"string","minLength":1,"maxLength":500},"datasetId":{"type":"string","minLength":1,"maxLength":128}}}}}},"responses":{"200":{"description":"NDJSON run stream"},"400":{"description":"Validation error"},"401":{"description":"Unauthorized"},"503":{"description":"Protected investigation is misconfigured"}}}},"/api/v1/datasets":{"get":{"operationId":"listEvidenceDatasets","responses":{"200":{"description":"Public-safe Evidence dataset summaries"},"502":{"description":"Evidence unavailable"}}}},"/api/v1/tools":{"get":{"operationId":"listTools","responses":{"200":{"description":"Tool registry"}}}},"/api/v1/tools/{name}":{"post":{"operationId":"callTool","parameters":[{"name":"name","in":"path","required":true,"schema":{"type":"string","enum":["correlate","enrich_indicators","map_attack","lookup_technique","search_techniques","build_timeline","verify_claim"]}}],"responses":{"200":{"description":"Tool execution"},"422":{"description":"Tool validation or execution failure"}}}},"/api/v1/cases/{caseId}/close":{"post":{"operationId":"closeCase","summary":"Archive a verified case to Files, persist its closure Trace, then close it in Evidence","security":[{"PlatPhormBearer":[]},{"PlatPhormHeader":[]}],"parameters":[{"name":"caseId","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["runId"],"properties":{"runId":{"type":"string"}}}}}},"responses":{"200":{"description":"Case closed with Files archive links"},"401":{"description":"Unauthorized"},"502":{"description":"A required persistence step failed; Evidence remains active"}}}},"/api/v1/reports/{filename}":{"get":{"operationId":"downloadInvestigationReportPdf","summary":"Render a capability-signed persisted Docs report as PDF","parameters":[{"name":"filename","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9._-]+\\.pdf$"}}],"responses":{"200":{"description":"PDF report"},"401":{"description":"Invalid report capability"},"502":{"description":"Persisted report unavailable"}}}},"/api/mcp":{"get":{"operationId":"getMcpMetadata","responses":{"200":{"description":"MCP metadata"}}},"post":{"operationId":"callMcp","responses":{"200":{"description":"JSON-RPC response"},"204":{"description":"JSON-RPC notification"}}}}}}