{
  "openapi": "3.0.0",
  "info": {
    "title": "CVD Portal Compliance API",
    "version": "1.0.0",
    "description": "REST API (v1) for automated EU Cyber Resilience Act compliance checks and coordinated vulnerability disclosure. Authenticate with a Bearer API key (sent as `Authorization: Bearer <key>`); keys are issued from the dashboard and API access requires the Enterprise plan. Base URL: https://cvdportal.com/api/v1.",
    "contact": {
      "name": "CVD Portal",
      "url": "https://cvdportal.com/docs"
    }
  },
  "servers": [
    {
      "url": "https://cvdportal.com/api/v1"
    }
  ],
  "components": {
    "securitySchemes": {
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer"
      }
    }
  },
  "security": [
    {
      "BearerAuth": []
    }
  ],
  "paths": {
    "/compliance/status": {
      "get": {
        "summary": "Get organization compliance status",
        "responses": {
          "200": {
            "description": "Compliance report in JSON format."
          }
        }
      }
    },
    "/vulnerabilities": {
      "post": {
        "summary": "Submit a new vulnerability deterministic report",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "productName": {
                    "type": "string"
                  },
                  "vulnerabilityType": {
                    "type": "string"
                  },
                  "description": {
                    "type": "string"
                  }
                },
                "required": [
                  "description"
                ]
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Vulnerability successfully ingested."
          }
        }
      }
    },
    "/vulnerabilities/export": {
      "get": {
        "summary": "Export an organization's vulnerability feed",
        "responses": {
          "200": {
            "description": "Returns a list of submissions."
          }
        }
      }
    },
    "/webhooks/register": {
      "post": {
        "summary": "Register a webhook for real-time reporting",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  },
                  "event": {
                    "type": "string"
                  },
                  "secret": {
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ]
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Webhook registered."
          }
        }
      }
    },
    "/products": {
      "get": {
        "summary": "List registered products (hardware components)",
        "responses": {
          "200": {
            "description": "Array of the company's registered products."
          },
          "401": {
            "description": "Missing/invalid API key or plan below Enterprise."
          }
        }
      },
      "post": {
        "summary": "Register or update a product (upsert by identifier)",
        "description": "Idempotent upsert keyed on `identifier`. Registered products appear as options in the public portal's affected-product dropdown.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "maxLength": 255
                  },
                  "identifier": {
                    "type": "string",
                    "maxLength": 255,
                    "description": "Stable external ID, e.g. the CRA tool's productId."
                  },
                  "producer": {
                    "type": "string",
                    "maxLength": 255
                  },
                  "firmwareVersion": {
                    "type": "string",
                    "maxLength": 255
                  }
                },
                "required": [
                  "name",
                  "identifier"
                ]
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Product registered."
          },
          "200": {
            "description": "Existing product updated."
          },
          "400": {
            "description": "Validation error."
          },
          "401": {
            "description": "Missing/invalid API key or plan below Enterprise."
          }
        }
      }
    }
  }
}