Authority OpenAPI documents

• v1.json is the generated application surface from the folded Authority host’s /openapi/v1.json: 90 paths and 112 operations at the 2026-10-04 source capture (ecdfa783bb, PCD-273), 92 paths and 114 operations after the 2026-10-14 release-gate operation authentication routes. The isolated real PostgreSQL host uses the existing fold-on/bootstrap-off documentation profile. ../api-reference.mdis generated from this document.
• 2026-10-18 (PCD-867, console-admin tenant boundary): 13 /console/admin operations now declare the HTTP 403 problem response and their success code (and rotate its 400 and 404). Those 13 operation objects were taken from the default test-host capture (AuthorityGeneratedOpenApiDocumentTests, STELLAOPS_AUTHORITY_GENERATED_OPENAPI_EXPORT_PATH, bootstrap-on/fold-off). Before the replacement, every operation the two profiles share (92) and every shared component schema were compared: the 13 were the only differences. The profiles differ only in the /internal/* bootstrap routes and the folded /issuer-directory/* routes, neither of which this change touches.
• 2026-10-19 (PCD-876, token and audit tenant binding): GET /console/admin/tokens, POST /console/admin/tokens/revoke and GET /console/admin/audit gain a description of the tenant binding and declare 200 and 400 (audit also its 502 problem response). Taken from the same default test-host capture after the same comparison: the three were the only differing operations and no shared schema differed.
• 2026-10-19 (PCD-868, tenant header required): GET /api/v1/tenants/{tenantId}/compliance-profile and /submission-authorizations gain a description of the header binding and declare 200/400/403/404, taken from the same capture after the same comparison (the two were the only differing operations; no shared schema differed).
• authentication.json preserves the separate authentication contract served by /.well-known/openapi: 11 paths at the 2026-09-27 capture (/token, /revoke, /introspect, /jwks and seven /console/admin/identity-providers paths). Its source is the single hand-kept file src/Api/StellaOps.Api.OpenApi/authority/openapi.yaml, which the service build copies and serves. The /oauth/token, /oauth/revoke and /oauth/introspect aliases were removed on 2026-09-27. The earlier 2026-09-09 capture came from a deployed host that served a second, since-deleted copy under src/Authority/StellaOps.Api.OpenApi/: it lacked the identity-provider paths, and an unquoted $ref: #... made YAML read the rest of a line as a comment, which also dropped /jwks. OpenIddict handles these protocol routes in middleware, so they are absent from the generated application document. Replacing the old application reference must not erase their published contract.

The preceding v1.json capture came from the healthy folded host built at 5b485c6c97308ac4f30f79e5004eceaad272bfdf. The source route registrations were compared with repository 57f7dd35b9; no route path or HTTP method changed in the intervening Authority runtime edits. The deployed query metadata still marks includeGlobal required on the issuer keys and trust reads. AUTH-27 makes those parameters optional with default true in source; that change is not present in the earlier captured runtime. The current source capture includes AUTH-27’s optional/default-true query metadata and PCD-273’s audience request/summary contract. All 112 operation paths/methods remain; no internal bootstrap surface is added. The servers entry describes the local capture host. This refresh does not claim a shared-estate deployment or replace the separate authentication document.

PCD-273 retains both the default fixture capture (100 operations, bootstrap-on/ fold-off) and the final configured capture under ignored tmp/scratch/pcd-273/. The latter reuses AuthorityDoctorPostgresFixture and DoctorAuthorityFactory, including the actual startup migrations; its explicit MVC content-root pointer lets the isolated capture helper locate the real deployable from task scratch. The default fixture profile is not used to overwrite the configured application surface. Re-run the preserved capture-host helper, then the canonical generator with -AggregatePath tmp/scratch/pcd-273/configured-authority-aggregate.json -Service authority.

Refresh each document from its own endpoint. authentication.json was captured on 2026-09-27 from the in-process test host rather than a deployment, so its x-stella-build-version names the test build:

W="$(pwd -W 2>/dev/null || pwd)"   # repository root, absolute
STELLAOPS_OPENAPI_EXPORT_PATH="$W/tmp/scratch/authentication-capture.json" \
STELLAOPS_TEST_REPOSITORY_ROOT="$W" \
pwsh ./tools/scripts/test-targeted-xunit.ps1 \
  -Project src/Authority/StellaOps.Authority/StellaOps.Authority.Tests/StellaOps.Authority.Tests.csproj \
  -Method "*ReturnsJsonSpecificationByDefault*"
python -c "import json;d=json.load(open('tmp/scratch/authentication-capture.json',encoding='utf-8'));open('docs/modules/authority/openapi/authentication.json','w',encoding='utf-8',newline='\n').write(json.dumps(d,indent=2,ensure_ascii=False)+'\n')"
``` Regenerate the application reference
with `tools/scripts/docs/regen-from-openapi.ps1 -AggregatePath <capture> -Service authority`.