Schemas
Reference
Generated source hash: sha256:3ddae3c6b3a53bdb102c60b226583b895eaad14123935478619a8d52fa83e007.
Use the schema matching the document you are creating or validating. The table lists required-field counts and representative enum values to help you find the right contract. Open the linked JSON file for the complete constraints.
Validate the actual document against that schema. A summary table cannot check nested fields or conditional requirements.
Schema inventory
Section titled “Schema inventory”72schema files are scanned.- Required-field and property counts are generated from each JSON file.
- Representative enum values are shown to orient the reader; the source file remains authoritative.
| Source | Title | Type | Required fields | Top-level properties | Representative enums |
|---|---|---|---|---|---|
contracts/jsonschema/activation-publication.schema.json | Activation publication | object | 0 | 0 | validating, blocked, committed, preflight, promotion, runtime, pending, ready |
contracts/jsonschema/activation-verification.schema.json | Activation Verification | object | 0 | 0 | call, deny, pending, verified, denied, failed |
contracts/jsonschema/agent.schema.json | AgentManifest | object | 4 | 4 | low, medium, high, critical, service_account, user_delegated, agent_scoped, workload_mapped |
contracts/jsonschema/auth-context.schema.json | AuthContextContract | object | 5 | 5 | jwt, service_identity, workload_identity, saml, RS256, RS384, RS512, PS256 |
contracts/jsonschema/authorization-server-profile.schema.json | AuthorizationServerProfileContract | object | 0 | 0 | RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 |
contracts/jsonschema/catalog-lite.schema.json | CatalogHttpContract | object | 6 | 6 | hidden, listed, connectable, low, medium, high, critical, submitted |
contracts/jsonschema/connector.schema.json | ConnectorManifest | object | 4 | 4 | submitted, under_review, approved, disabled, revoked, archived, rejected, https |
contracts/jsonschema/consumer-oauth-admin.schema.json | ConsumerOAuthAdminContract | object | 0 | 0 | mcp_server, virtual_server, token_exchange, authorization_code, client_credentials, draft, validating, active |
contracts/jsonschema/consumer-oauth-jwks-refresh-signal.schema.json | ConsumerOAuthJwksRefreshSignalBatch | object | 6 | 6 | |
contracts/jsonschema/consumer-oauth-migration-status.schema.json | ConsumerOAuthMigrationStatus | object | 0 | 0 | mcp_server, virtual_server, before_deadline, deadline_reached |
contracts/jsonschema/consumer-oauth-revocation-ack.schema.json | ConsumerOAuthRevocationAcknowledgementBatch | object | 7 | 7 | |
contracts/jsonschema/consumer-oauth-workspace-default.schema.json | ConsumerOAuthWorkspaceDefault | object | 0 | 0 | unconfigured, ready, unavailable |
contracts/jsonschema/credential-binding.schema.json | CredentialBindingManifest | object | 4 | 4 | service_account, user_delegated, agent_scoped, workload_mapped, vault, aws, azure, gcp |
contracts/jsonschema/credential-broker.schema.json | CredentialBrokerResolutionContract | object | 2 | 2 | none, service_account, user_delegated, agent_scoped, workload_mapped, tool_call, api_adapter_call, health_probe |
contracts/jsonschema/engineering-invocation-request.schema.json | Engineering Invocation Request | object | 2 | 2 | |
contracts/jsonschema/engineering-invocation-result.schema.json | Engineering Invocation Result | object | 6 | 6 | queued, running, completed, uncertain, cancelled |
contracts/jsonschema/engineering-operation.schema.json | Engineering Operation | object | 4 | 4 | engineering_github, engineering_model, support_mail, engineering_receipt |
contracts/jsonschema/engineering-receipt.schema.json | Engineering Receipt | object | 21 | 21 | engineering_github, engineering_model, support_mail, mcp, operation_api, rest, incomplete, succeeded |
contracts/jsonschema/gateway-siem-event-v1.schema.json | Gateway SIEM Event V1 | object | 3 | 3 | live, replay, test, tool_call.requested, tool_call.completed, tool_call.denied, policy_decision, credential_mode |
contracts/jsonschema/hosted-audit-capture.schema.json | HostedAuditPayloadCaptureContract | object | 6 | 6 | active, expired, suspended, purged, suspend_capture, restore_capture, mark_abuse_review, hosted_payload_capture_active |
contracts/jsonschema/hosted-domain-membership.schema.json | HostedDomainMembershipContract | object | 6 | 6 | create_trial_with_provisional_domain, request_existing_org_access, public_domain_no_grouping, provisional, dac_exception, hosted_provisional_domain_association, hosted_same_domain_join_required, hosted_public_domain_no_grouping |
contracts/jsonschema/hosted-email.schema.json | HostedEmailUserManagementContract | object | 5 | 5 | email_verification, invite, join_request_notification, join_approved, join_rejected, trial_expiry, hard_lock, upgrade_request |
contracts/jsonschema/hosted-org.schema.json | HostedOrgLifecycleContract | object | 4 | 4 | trial_active, trial_expired, active, locked, hosted_free_trial, hosted_team, hosted_business, hosted_enterprise |
contracts/jsonschema/hosted-runtime.schema.json | HostedRuntimeAllowlistedEndpointContract | object | 4 | 4 | https_api, https_mcp, pending_reachability, ready, denied, disabled, hosted_runtime_ready, hosted_runtime_reachable |
contracts/jsonschema/hosted-social-auth.schema.json | HostedSocialAuthContract | object | 5 | 5 | google, microsoft, github, signup, login, active, membership_pending, hosted_social_provider_ready |
contracts/jsonschema/license.schema.json | LicenseStatusContract | object | 1 | 3 | valid, expired, missing, offline_grace, license_valid, license_expired, license_missing, license_offline_grace |
contracts/jsonschema/management-audited-operation.schema.json | Management Audited Operation | object | 4 | 4 | engineering_github, engineering_model, support_mail, engineering_receipt |
contracts/jsonschema/management-auth.schema.json | Management Auth0 configuration | object | 4 | 7 | |
contracts/jsonschema/management-operation.schema.json | Management operation result | object | 3 | 3 | |
contracts/jsonschema/management-receipt-error.schema.json | Management Receipt Error | object | 1 | 1 | management_receipt_not_found, management_receipt_id_invalid, management_audit_unavailable |
contracts/jsonschema/management-receipt.schema.json | Management Receipt | object | 20 | 20 | mcp, operation_api, rest, incomplete, succeeded, denied, failed, null |
contracts/jsonschema/mcp-compatibility-profile.schema.json | MCPCompatibilityProfile | object | 0 | 0 | 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25, 2026-07-28, legacy_initialized, modern_stateless, streamable_http |
contracts/jsonschema/mcp-resource-auth-binding.schema.json | McpResourceAuthBindingContract | object | 0 | 0 | mcp_server, virtual_server, static_only, mixed, oauth_only, public, compatible, approved_only |
contracts/jsonschema/mcp-server.schema.json | MCPServerManifest | object | 4 | 4 | low, medium, high, critical, registered, disabled, deprecated, service_account |
contracts/jsonschema/mcp-upstream-connection.schema.json | MCP upstream connection | object | 0 | 0 | pending_authorization, active, expired, disconnected, revoked, refresh_required, not_required, configuration_required |
contracts/jsonschema/native-oauth-key-ring.schema.json | Native OAuth public signing-key ring | object | 1 | 1 | |
contracts/jsonschema/outbound-delivery-admin.schema.json | OutboundDeliveryAdmin | object | 0 | 0 | accepted, indexed, pending_test, active, disabled, archived, siem_audit, product_webhook |
contracts/jsonschema/outbound-delivery-stage7.schema.json | Outbound delivery Stage 7 administration contracts | object | 0 | 0 | read, create, update, test, enable, force_enable, disable, read_deliveries |
contracts/jsonschema/policy-simulation.schema.json | PolicySimulationContract | object | 2 | 2 | none, service_account, user_delegated, agent_scoped, workload_mapped, allow, deny |
contracts/jsonschema/policy.schema.json | PolicyManifest | object | 4 | 4 | draft, published, superseded, disabled, allow, deny, DiscoverTool, CallTool |
contracts/jsonschema/private-route-decision.schema.json | PrivateRouteDecisionContract | object | 2 | 2 | direct_private_endpoint, outbound_connector, denied, allow, deny, mtls, spiffe, equivalent |
contracts/jsonschema/release-candidate-evidence.schema.json | M9 Release Candidate Evidence | object | 5 | 5 | linked, pass, justified |
contracts/jsonschema/release-evidence-bundle.schema.json | M8 Release Evidence Bundle | object | 5 | 5 | cosign, sbom, release_evidence_bundle, helm_chart, oci_image, spdx-json, cyclonedx-json |
contracts/jsonschema/revocation-event-v2.schema.json | ConsumerOAuthRevocationEventContract | object | 10 | 10 | authentication, policy, discovery, upstream_credentials |
contracts/jsonschema/revocation-event.schema.json | RevocationEventContract | object | 12 | 13 | agent_disabled, credential_revoked, connector_disabled, policy_superseded, client_surface_disabled, client_surface_revoked, server_disabled, tool_disabled |
contracts/jsonschema/runtime-audit-export-v3.schema.json | ConsumerOAuthRuntimeAuditExportContract | object | 6 | 6 | succeeded, upstream_http_error, upstream_failure, deadline_exceeded, outcome_unknown, null, received, authentication |
contracts/jsonschema/runtime-audit-export-v4.schema.json | ConsumerOAuthRuntimeAuditExportV4Contract | object | 6 | 6 | succeeded, upstream_http_error, upstream_failure, deadline_exceeded, outcome_unknown, null, received, authentication |
contracts/jsonschema/runtime-discovery.schema.json | RuntimeDiscoveryContract | object | 2 | 2 | low, medium, high, critical, none, service_account, user_delegated, agent_scoped |
contracts/jsonschema/runtime-projection.schema.json | RuntimeProjectionContract | object | 0 | 0 | disabled, observe, enforce, gateway.runtime.audit-export/v3, gateway.runtime.audit-export/v4, gateway.consumer-oauth.runtime/v7, gateway.consumer-oauth.runtime/v8, gateway.consumer-oauth.runtime/v9 |
contracts/jsonschema/runtime-tool-call.schema.json | RuntimeToolCallContract | object | 2 | 2 | not_logged, redacted, none, policy_denied, manifest_denied_candidate, schema_invalid, unregistered_server, unknown_tool |
contracts/jsonschema/session-lifecycle-v2.schema.json | ConsumerOAuthSessionLifecycleContract | object | 13 | 13 | pending, active, reconnecting, draining, terminated, revoked, expired, failed |
contracts/jsonschema/session-lifecycle-v3.schema.json | ConsumerOAuthSessionLifecycleV3Contract | object | 13 | 13 | pending, active, reconnecting, draining, terminated, revoked, expired, failed |
contracts/jsonschema/session-lifecycle.schema.json | SessionLifecycleContract | object | 5 | 5 | pending, active, reconnecting, draining, terminated, revoked, expired, failed |
contracts/jsonschema/super-admin.schema.json | Super admin workspace lifecycle command | object | 3 | 3 | lock, unlock |
contracts/jsonschema/support-mail-result.schema.json | Support Mail Result | object | 6 | 6 | queued, running, accepted, uncertain, cancelled |
contracts/jsonschema/telemetry-siem-config.schema.json | TelemetryAndSiemConfig | object | 0 | 0 | read, create, update, test, enable, force_enable, disable, read_deliveries |
contracts/jsonschema/upstream-connection.schema.json | Upstream connection and explicit client use authorization | object | 0 | 0 | mcp_server, virtual_mcp_server, active, disconnected, revoked |
contracts/jsonschema/webhook-client-surface-disabled-v1.schema.json | Client surface disabled webhook data V1 | object | 5 | 5 | |
contracts/jsonschema/webhook-connector-disabled-v1.schema.json | Connector disabled webhook data V1 | object | 5 | 5 | |
contracts/jsonschema/webhook-connector-revoked-v1.schema.json | Connector revoked webhook data V1 | object | 5 | 5 | |
contracts/jsonschema/webhook-credential-binding-disabled-v1.schema.json | Credential binding disabled webhook data V1 | object | 6 | 6 | |
contracts/jsonschema/webhook-credential-binding-revoked-v1.schema.json | Credential binding revoked webhook data V1 | object | 6 | 6 | |
contracts/jsonschema/webhook-deployment-status-changed-v1.schema.json | Deployment status changed webhook data V1 | object | 5 | 5 | active, draining, drained, decommissioned, unknown |
contracts/jsonschema/webhook-policy-version-archived-v1.schema.json | Policy version archived webhook data V1 | object | 4 | 4 | |
contracts/jsonschema/webhook-policy-version-archived-v2.schema.json | Policy version archived webhook data V2 | object | 6 | 6 | |
contracts/jsonschema/webhook-policy-version-published-v1.schema.json | Policy version published webhook data V1 | object | 5 | 5 | user, service, workload |
contracts/jsonschema/webhook-registry-item-approved-v1.schema.json | Registry item approved webhook data V1 | object | 5 | 5 | mcp_server, api_source |
contracts/jsonschema/webhook-registry-item-archived-v1.schema.json | Registry item archived webhook data V1 | object | 6 | 6 | mcp_server, api_source |
contracts/jsonschema/webhook-registry-item-disabled-v1.schema.json | Registry item disabled webhook data V1 | object | 6 | 6 | mcp_server, api_source |
contracts/jsonschema/webhook-test-v1.schema.json | Webhook test data V1 | object | 5 | 6 | |
contracts/jsonschema/workspace-external-identity.schema.json | Explicit workspace external identity link | object | 7 | 7 | |
contracts/jsonschema/workspace-runtime-provisioning.schema.json | Hosted workspace runtime provisioning | object | 9 | 9 | queued, provisioning, failed, ready, not_eligible, deployment_required |
Usage notes
Section titled “Usage notes”Counts and enum samples are navigation aids. The linked schema remains authoritative for validation. Regenerate this page when contracts change.
Source truth
Section titled “Source truth”- Read Audit Events for the generated audit-event schema summary.
- Read Admin API for control-plane routes.
- Read Evals for fixture contract expectations.
Amelfi documentation · Space Grotesk / Geist Mono