Generated file — do not edit by hand. Produced by tooling/gen-graphql-ref.py from the OSYRA edge GraphQL SDL.

Input Types

99 input type(s).

AcceptOrgOwnershipTransferInput

Accept a pending org-ownership transfer using the unguessable single-use token from the pending record.

| Field | Type | Description | | --- | --- | --- | | transferToken | String! | |

AddPaymentMethodInput

| Field | Type | Description | | --- | --- | --- | | organizationId | ID! | | | setAsDefault | Boolean | Whether to set as default | | token | String! | Stripe payment method token or similar |

ApproveContentBoundEnablementInput

CHECKER approval input. The checker identity is server-derived (NOT here). stepUpToken MUST be an APPROVE_CONTENT_BOUND_ENABLEMENT step-up bound to enablementId (operationBinding); IAM verifies + consumes it (single-use, replay-fenced). The edge forwards it verbatim and never pre-consumes.

| Field | Type | Description | | --- | --- | --- | | enablementId | String! | The PENDING enablement to approve. | | stepUpToken | String! | The APPROVE_CONTENT_BOUND_ENABLEMENT step-up token, bound to enablementId. REQUIRED. |

AuditExportInput

Filter inputs for an export / litigation-hold range. The workspace is NEVER an input — it is derived from the JWT. category / outcome / actor / action / resourceOrn are optional narrowing predicates (AND together; absent = wildcard).

| Field | Type | Description | | --- | --- | --- | | action | String | | | actor | String | | | category | AuditCategory | | | outcome | AuditOutcome | | | resourceOrn | String | | | since | DateTime! | Inclusive lower bound, ISO-8601 (mapped to epoch-ms). Required. | | until | DateTime | Exclusive upper bound, ISO-8601 (mapped to epoch-ms). Null = to now. |

CancelEmailChangeInput

Input for cancelling an in-flight email change (ENG-2729). The single-use revoke token from the OLD-address "wasn't me" email.

| Field | Type | Description | | --- | --- | --- | | revokeToken | String! | |

ChangePasswordInput

| Field | Type | Description | | --- | --- | --- | | currentPassword | String! | | | newPassword | String! | |

ChatCompletionInput

============================================================================ Chat Completion Types

| Field | Type | Description | | --- | --- | --- | | maxTokens | Int | Maximum tokens to generate (optional, uses model default) | | messages | [ChatMessageInput!]! | The messages in the conversation | | model | String! | The model to use (e.g., "gpt-4", "claude-3-opus", "gemini-pro") | | options | ChatCompletionOptions | Additional model-specific parameters | | stop | [String!] | Stop sequences (optional) | | stream | Boolean | Whether to stream the response (for future subscription support) | | temperature | Float | Temperature for randomness (0.0 - 2.0, default 1.0) | | topP | Float | Top-p sampling (0.0 - 1.0, default 1.0) | | workspaceId | ID! | Workspace context for billing and policy enforcement |

ChatCompletionOptions

| Field | Type | Description | | --- | --- | --- | | frequencyPenalty | Float | Frequency penalty (-2.0 to 2.0) | | presencePenalty | Float | Presence penalty (-2.0 to 2.0) | | responseFormat | String | Response format (e.g., "json_object") | | seed | Int | Seed for deterministic outputs | | toolChoice | String | Tool choice behavior | | tools | String | Tool/function definitions (JSON string) |

ChatCompletionStreamInput

Input for streaming chat completion

| Field | Type | Description | | --- | --- | --- | | maxTokens | Int | Maximum tokens to generate (optional, uses model default) | | messages | [ChatMessageInput!]! | The messages in the conversation | | model | String! | The model to use (e.g., "gpt-4", "claude-3-opus", "gemini-pro") | | options | ChatCompletionOptions | Additional model-specific parameters | | stop | [String!] | Stop sequences (optional) | | temperature | Float | Temperature for randomness (0.0 - 2.0, default 1.0) | | topP | Float | Top-p sampling (0.0 - 1.0, default 1.0) | | workspaceId | ID! | Workspace context for billing and policy enforcement |

ChatMessageInput

| Field | Type | Description | | --- | --- | --- | | content | String! | Message content | | name | String | Optional name for multi-agent scenarios | | role | ChatRole! | Role: "system", "user", "assistant" |

ChatSegmentInput

An ordered chat-role segment (role in system|user|assistant|tool). Segment order is signature-covered.

| Field | Type | Description | | --- | --- | --- | | body | String! | | | role | String! | |

ClearOcarTrustConfigInput

| Field | Type | Description | | --- | --- | --- | | expectedVersion | String! | CAS anchor. Decimal int64 string. | | stepUpToken | String! | A CONFIGURE_OCAR_TRUST_MODE step-up token bound to the re-derived CLEAR operationBinding. VESTIGIAL (ENG-2930): read from the X-Osyra-Step-Up-Token header, NOT this field. See the note above. |

CommitApiKeyBulkRevocationInput

| Field | Type | Description | | --- | --- | --- | | confirmationText | String! | | | expectedAffectedCount | Int! | | | operationBinding | String! | | | scope | ApiKeyBulkRevokeScope! | | | targetOwnerUserId | ID | |

ConfirmEmailChangeInput

Input for confirming an email change (ENG-2729). The single-use token from the NEW-address verification email IS the credential.

| Field | Type | Description | | --- | --- | --- | | token | String! | |

ConnectProviderInput

───────────────────────────────────────────────────────────────────── Self-service BYOK connect-provider ingest (ADR-361 §2.2 — the OSYRA_MANAGED custody tier; ENG-3036 → IAM ENG-3032 ConnectProvider). A DELIBERATELY MINIMAL two-field paste flow (the activation loop, ENG-3034): pick a provider + paste your key. UNLIKE issueVirtualKey (the enterprise SecretRef pointer form), this carries the RAW provider secret — so the raw key crosses the edge→IAM wire as bytes and IAM's data-plane managed-vault KMS-envelope-encrypts it; the row still holds NO raw secret. The VK spec knobs (scope / budget / rate-limit / model-allow-list) are NOT on this input — IAM defaults them for the OSYRA_MANAGED activation VK.

rawKey is [SECRET] / WRITE-ONLY: it is never persisted, never re-revealed, and NEVER logged. The edge does not log GraphQL variables (operation capture records the operation + root field names only), the connectProvider resolver + IAM client wrapper log the provider_id ONLY, and the edge copy of the key is best-effort zeroized after the call. Audit records vkid + provider only. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | modelAllowList | [ID!] | ENG-3056 — the models this managed key may call. Entries are the broker's wire model strings (the ids returned by the models query / the signed provider catalog). This is the fix for the dead-key bug: a connect that minted an EMPTY allow-list produced a deny-all (unusable) key. DEFAULT RULE (nullable ⇒ three cases): * OMITTED / null ⇒ the EDGE enumerates the provider's FULL signed catalog (broker GetProviderCatalog(providerId)) and sends THAT enumerated list to IAM — NEVER a wildcard, never empty. This is the activation-loop default. * a NON-EMPTY list ⇒ scoped exactly to those models (passed through verbatim). * an EXPLICIT [] ⇒ REJECTED (OSY-VALID) — an empty allow-list would mint a deny-all key; omit the field to grant the full catalog instead. The list is ENUMERATED + signed into the VK grant by IAM (issue()); a later catalog change never retroactively widens an existing grant. | | providerId | String! | The provider this key authenticates to (proto provider_id) — e.g. openai / anthropic. | | rawKey | String! | [SECRET] WRITE-ONLY. The raw provider API key the user pasted. Never persisted, re-revealed, or logged; forwarded to IAM as bytes and vaulted (OSYRA_MANAGED), then zeroized at the edge. |

ConsoleFeedFilter

Console feed filter — shared server-side filter input (ENG-2842 / E6.4, epic ENG-2672).

The Console's log/trace/receipt/drift feeds already accept since / until (inclusive record-time bounds) and honor them END-TO-END today. This shared input adds the Portkey-grade dashboard filter dimensions the Console filter bar exposes — model / status / cost / latency (ENG-2842) + custom-metadata chips (ENG-2843 / E6.5) — as a SINGLE reusable filter argument so one frontend filter-bar component maps to every feed uniformly (attestedLogTrajectory / driftTrajectory / agentRunReceipts).

─────────────────────────────────────────────────────────────────────── HONEST SCOPE — real filtering, FAIL-CLOSED (NO STUBS). Load-bearing:

since / until (the dedicated time args on each feed) are honored NOW: they are forwarded to the upstream AP00012 / AP00016 / AP00017 read RPCs, which genuinely bound the returned window. Time filtering is live end-to-end.

The dimensions in THIS input (model / status / cost / latency / metadata) are NOT yet honorable server-side: the upstream trajectory/receipt request messages (osyrastream GetAttlogTrajectoryRequest / GetTrajectoryRequest, agentruntime ListReceiptsRequest, vir ListReceiptsRequest) do not yet carry these dimensions, and the projected records do not carry a per-run model / status / cost / observed latency / custom-metadata the edge could filter on. Rather than silently return UNFILTERED rows as if they were server-filtered — the exact "client-side fake filtering of unfiltered data presented as server filtering" the ENG-2842 AC forbids — a resolver that receives ANY of these dimensions FAILS CLOSED with OSY-CONSOLE-FILTER-NOT-WIRED (the Console renders the calm "Preview" banner, never fabricated or mis-filtered rows). An all-empty filter (or a null argument) is a no-op: the query proceeds on the time window alone.

GRADUATION (forward-compatible; zero frontend change): when the upstream read RPCs add these filter fields AND the edge forwards them (tracked with the live E2E stack — PLA-142 / ENG-2844), the resolver's fail-closed guard is removed and each dimension is forwarded for genuine server-side filtering. The GraphQL contract (this input + the filter args) and the frontend filter bar do not change across that flip.

─────────────────────────────────────────────────────────────────────── All fields are OPTIONAL. Omitting a field (or passing an all-null filter) does not constrain that dimension. Numeric bounds are INCLUSIVE. Cost is expressed in integer micro-USD (µUSD; 1 USD = 1_000_000) and latency in integer milliseconds to avoid float rounding on the wire. A min greater than its paired max is a validation error (OSY-VALID), not an empty result.

| Field | Type | Description | | --- | --- | --- | | maxCostMicros | Int | Inclusive upper bound on request cost, in micro-USD (µUSD). Must be >= 0 and >= minCostMicros when both are set. | | maxLatencyMs | Int | Inclusive upper bound on end-to-end latency, in milliseconds. Must be >= 0 and >= minLatencyMs when both are set. | | metadata | [ConsoleMetadataFilter!] | Custom-metadata match chips (ENG-2843 / E6.5). Each entry constrains one metadata key to an exact value (AND-combined: a row must match EVERY entry). This is the fifth Portkey-grade dimension — the free-form key/value annotations a caller attaches to a request. Empty list / absent = no metadata constraint. Like model/status/cost/latency it is NOT yet honorable server-side (no upstream feed projects custom-metadata — see attestedlog.graphql AttestedLogRecord.metadata), so a non-empty metadata FAILS CLOSED with OSY-CONSOLE-FILTER-NOT-WIRED rather than returning unfiltered rows as if server-filtered (NO STUBS). Graduates with the same PLA-142 flip. | | minCostMicros | Int | Inclusive lower bound on request cost, in micro-USD (µUSD). Must be >= 0. | | minLatencyMs | Int | Inclusive lower bound on end-to-end latency, in milliseconds. Must be >= 0. | | model | String | Provider/model identifier to filter to (e.g. "openai/gpt-4o"). Server-side exact/prefix match once graduated; fail-closed until then. | | status | String | Request outcome/status label to filter to (e.g. "success" / "error"). Free string exact-match once graduated; fail-closed until then. |

ConsoleMetadataFilter

One custom-metadata match chip (ENG-2843 / E6.5): constrain metadata[key] to exactly value. Both are required + non-empty + length-bounded (validated OSY-VALID before the fail-closed / future forward path). The pair is the wire shape of a single Console filter chip.

| Field | Type | Description | | --- | --- | --- | | key | String! | The custom-metadata key to match (e.g. "team", "env", "customer_id"). | | value | String! | The exact value that key must equal. |

CoverageWindowInput

| Field | Type | Description | | --- | --- | --- | | endUnix | String! | Window end (Unix seconds, exclusive). | | startUnix | String! | Window start (Unix seconds, inclusive). |

CreateApiKeyInput

| Field | Type | Description | | --- | --- | --- | | expiresInSeconds | Int | Optional. When unset and scope=SANDBOX, the IAM service applies a 24h TTL. When unset and scope!=SANDBOX, the key never expires. | | name | String! | | | noStore | Boolean | PLA-94 (Wave-C): set this key's no_store privacy OVERRIDE at mint time. NULLABLE / tri-state: omitting it INHERITS the workspace baseline (the common case); true forces no_store=true (never persist bodies); false forces no_store=false (persistence permitted, even if the workspace baseline is true). Threaded VERBATIM to IAM CreateApiKeyRequest.no_store (field 7); authorization is the SAME self-only key-owner path that already gates minting the key — no weaker path. | | scope | ApiKeyScope! | |

CreateCheckoutSessionInput

Input for createCheckoutSession (ENG-2659). org_id is JWT-derived, never here.

| Field | Type | Description | | --- | --- | --- | | cancelUrl | String! | Where Stripe redirects if the user cancels. Host-allowlist validated. | | planCode | String! | The plan to upgrade to (e.g. "PRO"). Maps to a Stripe Price via AP00003 config — not a pricing decision at the edge. | | successUrl | String! | Where Stripe redirects after a successful payment. Host-allowlist validated. |

CreateEventSubscriptionInput

| Field | Type | Description | | --- | --- | --- | | destinationUrl | String! | | | eventTypes | [String!]! | Non-empty subset of the closed wire set; validated by billing. | | transport | EventTransport! | |

CreateOrganizationInput

Input types for organization mutations

| Field | Type | Description | | --- | --- | --- | | description | String | ENG-2969: optional free-text description + logo URL, persisted to the real IAM columns via CreateOrganization. Omitting them persists null (no fabrication). | | logoUrl | String | | | name | String! | | | slug | String | |

CreateWarehouseDestinationInput

Input for createWarehouseDestination. Exactly the config arm matching sinkKind must be supplied; the org / workspace are JWT-derived server-side (never a body field). enabled defaults false so an operator reviews the minted ExternalId + trust-policy wiring before evidence egresses.

| Field | Type | Description | | --- | --- | --- | | bigquery | WarehouseBigQueryConfigInput | | | clickhouse | WarehouseClickHouseConfigInput | | | displayName | String! | | | enabled | Boolean | | | s3 | WarehouseS3ConfigInput | | | sinkKind | WarehouseSinkKind! | |

CreateWorkspaceInput

Input types for workspace mutations

| Field | Type | Description | | --- | --- | --- | | description | String | | | logoUrl | String | ENG-2969: optional logo URL, persisted to the real IAM column via CreateWorkspace. | | name | String! | | | organizationId | ID! | | | slug | String | ENG-3234 (ADR-368 §2.2): RE-ADDED now that IAM's CreateWorkspace accepts a caller-chosen slug (the ENG-2971 removal note is resolved). OPTIONAL: omitting it ⇒ IAM name-derives a confusable-free, collision-proof default; a value is routed through IAM's R1-R3 gate + PER-ORG uniqueness (a BLOCK/GATE skeleton or collision is rejected). Workspace.slug (output) is unchanged. |

DsarFilter

Optional status/kind filter for the DSAR intake queue (both null ⇒ no filter).

| Field | Type | Description | | --- | --- | --- | | kind | DsarKind | | | status | DsarStatus | |

EmbeddingInput

============================================================================ Embedding Types

| Field | Type | Description | | --- | --- | --- | | dimensions | Int | Optional: reduce dimensions (for models that support it) | | encodingFormat | EmbeddingEncodingFormat | Encoding format (default: float) | | input | [String!]! | Text(s) to embed | | model | String! | The model to use (e.g., "text-embedding-3-small", "text-embedding-ada-002") | | workspaceId | ID! | Workspace context for billing and policy enforcement |

EnableMfaInput

| Field | Type | Description | | --- | --- | --- | | password | String! | |

EstimateCostInput

EstimateCostInput describes the prospective completion request to price (ENG-3042). It mirrors the completion request shape minus execution-only knobs — the broker tokenizes the messages and applies the model's pricing.

| Field | Type | Description | | --- | --- | --- | | maxTokens | Int | Optional generation cap — bounds the OUTPUT-token estimate. | | messages | [ChatMessageInput!]! | The prospective conversation. At least one message is required. | | model | String! | Model identifier to price against (e.g. "gpt-4o-mini"). | | systemPrompt | String | Optional system prompt (counted into input tokens). |

EvalRunItemInput

EvalRunItemInput is one submitted run contribution, index-aligned with the committed suite item at the SAME index. It carries ONLY the model OUTPUT + the IO transcript — NO gold answer and NO score.

| Field | Type | Description | | --- | --- | --- | | output | String! | | | toolCalls | [EvalToolCallInput!] | |

EvalSuiteItemInput

Re-decidable eval receipt — submit a run/trajectory + re-decide the verdict (ENG-2614 / EPIC ENG-2390).

The transport for the ENG-2611 eval-product surface, backing the AP00010 Console re-decidable eval-receipt viewer (ENG-2614). TWO legs over the AP00016 verifier-of-record:

• submitEvalRun (AP00016 SubmitEvalRun): submit a run (per-item outputs over a COMMITTED eval suite) → AP00016 runs the HONEST issuer path (re-scores each output under the SUITE'S pinned scorer; derives the committed roots from the SUITE, never the run — the anti-cherry-pick control) and MINTS a signed, re-decidable oev.v1 EAT eval receipt. Returns the signed envelope + the detached re-decide carrier + the bound suite digest + the grader's headline + the claim-fence text.
• verifyEvalReceipt (AP00016 VerifyEnvelope): offline-re-decide a minted eval receipt under the suite's pinned scorer + the disclosed witnesses — reproduces the GREEN verdict, and renders a tampered / suite-swapped receipt as the fail-closed RED state distinctly.

TENANCY: the workspace is ALWAYS JWT-derived server-side (NEVER from input). The edge stamps it onto the outbound req.Ws; AP00016 binds it into the signed body (oev.v1 key 11) + the envelope OI-1 ws claim and re-checks it on verify (cross-tenant → REJECT). A workspace mints + re-decides only for itself.

CLAIM-DISCIPLINE (ENG-1741 / EXE-6 — the LOAD-BEARING fence): the receipt re-decides the SCORE/GATE CONFORMANCE against the customer's committed suite. It does NOT attest that the model is "better", more capable, or truthful, and it does NOT prove which weights ran (the honest-scope residual). claimFence carries the externally-safe attestation text verbatim — the console renders it, never synthesizes a capability claim.

FAIL-CLOSED (NO STUBS): an arity mismatch / missing model / empty suite / unwired OEV anchor carries a coded reason and signs NOTHING. An unreachable verifier / unwired surface is an OSY-EVAL-NOT-WIRED error (REJECT), never a fabricated receipt or verdict. EvalSuiteItemInput is one committed eval item: a content-addressed id + the question + the GOLD answer. The dataset is committed as an RFC-6962 root over THESE in THIS order (leaf order significant). The gold answer is the grader's reference — it is NEVER scored by the submitter.

| Field | Type | Description | | --- | --- | --- | | answer | String! | | | id | String! | | | question | String! | |

EvalToolCallInput

EvalToolCallInput is one external search/tool call issued mid-inference + what it returned (the noLeak evidence; the OEV leg recomputes the io_transcript_root over these AND scans them for benchmark leakage).

| Field | Type | Description | | --- | --- | --- | | query | String! | | | retrieved | String! | |

ExecuteErasureInput

Input for executeErasure. The CHECKER identity is server-derived (never a client field). approvalEnvelope (ENG-2998) is the base64-encoded AP00009-minted osyra-admin-approval-v1 COSE_Sign1 envelope from the admin dual-control ceremony — the edge passes the OPAQUE bytes through; AP00005 is the verifying authority (platform signature, op-binding to THIS org+dsarId via target_scope, checker∈approvers ∧ maker∉approvers, offline step-up re-derivation, freshness). Omitted / malformed / mis-bound / stale → the backend fails closed with a client-actionable validation error (never a client-faked approval, never a phantom erasure).

| Field | Type | Description | | --- | --- | --- | | approvalEnvelope | String | Base64 (std) of the AP00009 osyra-admin-approval-v1 COSE_Sign1 envelope. Null → the backend refuses fail-closed (OSY-AUDIT-7300 — dual-control is mandatory for the destructive Art-17 fan-out). | | dsarId | ID! | |

ExportMemoryArchiveInput

───────────────────────────────────────────────────────────────────── Inputs (NEVER carry a workspaceId — workspace is JWT-derived) ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | modelFamily | String! | | | retentionPolicyDid | String | Optional retention-policy DID stamped into the archive header (governance binding). ≤512 chars. | | vendor | String! | The archive-header provenance the exporter stamps (the SOURCE vendor/model the memory is exported AS). 1..256 chars (enforced edge-side + server-side). |

GatedCapabilityGrantInput

Attested-Memory-Gate WRITE/READ producer mutations (ENG-2547 S6 / ADR-284 D1+D8).

The OSYRA SDK memory-I/O producer routes an agent's memory reads/writes through the AttestedMemoryGate (AP00011-ome OMEService.GatedMemoryRead / GatedMemoryWrite, ENG-2544 S3). The SDK CANNOT reach the gate directly — the gate RPCs require the edge's mTLS service identity (EdgeIdentityKey) + the workspace resolved SERVER-AUTHORITATIVELY from the caller's JWT (the OS-Workspace-ID header / RLS GUC), NEVER from request input. The edge holds that identity, so the SDK calls these mutations and the edge proxies to OME (mirrors the shipped amgateDecisions read path, ENG-2514). Each op records an amgate_decisions row the attested-memory-I/O dashboard renders via amgateDecisions.

HONEST-SCOPE (ADR-177 D5, NON-NEGOTIABLE; /osyra-legal ENG-1741): these are CHANNEL-ENFORCEMENT operations on the memory I/O channel — which reads are admitted (input-provenance) + which writes are committed (output-receipt). NOT cognition control, and NOT a claim that the model only reasons over attested memory. One delegated-capability grant: the agent may perform {action} on {key} (the §3 L1 cap leg). In V1 the capability is the request-asserted agent capability; the workspace policy + attestation + the server-authoritative workspace RLS are the binding enforcement.

| Field | Type | Description | | --- | --- | --- | | action | String! | "read" | "write". | | key | String! | The memory key the grant covers. |

GatedMemoryReadInput

| Field | Type | Description | | --- | --- | --- | | capability | [GatedCapabilityGrantInput!]! | | | key | String! | The ATTESTED_CLAIM_REF key being read. | | sourceKind | String | Source kind — default ATTESTED_CLAIM_REF; a non-attested kind (RAW_PATH / INLINE_BLOB / URL) DENIES at source-admissibility. The confused-deputy request-supplied verification key/epoch probe is DELIBERATELY NOT exposed — anchors resolve solely from the workspace binding. |

GatedMemoryWriteInput

| Field | Type | Description | | --- | --- | --- | | capability | [GatedCapabilityGrantInput!]! | The agent's delegated capability (the L1 leg). | | key | String! | The attested-memory key being committed. | | valueB64 | String! | The value bytes, base64-encoded (the edge decodes; the gate signs + JMT-inserts). |

ImportMemoryArchiveInput

| Field | Type | Description | | --- | --- | --- | | archiveB64 | String! | The signed OMP archive to verify-admit, STANDARD base64 (decodes to 1 B..16 MiB). |

InferenceMessageInput

One OpenAI-shaped chat turn for an inference request.

| Field | Type | Description | | --- | --- | --- | | content | String! | Message content. | | role | ChatRole! | Role: "system" / "user" / "assistant" / "tool". |

InferenceReceiptInput

| Field | Type | Description | | --- | --- | --- | | oirB64 | String! | The base64-standard-encoded standalone OIR COSE_Sign1 ("osyra-oir-v1") to re-decide. |

InferenceStreamInput

Input for a streaming inference execution. NOTE the deliberate ABSENCE of any tenant identity field (workspaceId / orgId / principal) — see the confused-deputy invariant above.

| Field | Type | Description | | --- | --- | --- | | maxTokens | Int | Maximum tokens to generate (optional, uses model default). | | messages | [InferenceMessageInput!] | OpenAI-shaped chat turns. Exactly one of messages OR prompt must be set. | | model | String! | The model to execute (e.g., "gpt-4o", "claude-sonnet-4-6"). The broker's routing decision is resolved downstream; the edge proxy binds this as the routed model_id for V1. | | prompt | String | Raw-prompt alternative to messages. | | stop | [String!] | Stop sequences (optional). | | temperature | Float | Sampling temperature (optional). Explicit presence: 0.0 is greedy decoding, distinct from unset. | | topP | Float | Top-p nucleus sampling (optional). |

InitiateEmailChangeInput

(ChangeBillingEmailInput / LinkSocialInput / UnlinkSocialInput removed with their placeholder mutations — round-table 2026-06-27. See the Mutation block note above.)

Email change (Wave 3 — ENG-2729 / ADR-314 §2)

Input for beginning an email change (ENG-2729). Only the NEW address — the acting user is the JWT principal, NEVER input (ENG-1937).

| Field | Type | Description | | --- | --- | --- | | newEmail | String! | |

InviteMemberInput

| Field | Type | Description | | --- | --- | --- | | email | String! | | | organizationId | ID! | | | role | MemberRole! | |

IssueContentBoundEnablementInput

───────────────────────────────────────────────────────────────────── Inputs. NONE carry a workspace (JWT-derived) or a maker/checker identity (IAM server-derives). ───────────────────────────────────────────────────────────────────── MAKER provisioning input. The six gate references the maker supplies; residency_region is an INVARIANT (immutable once set — REVOKE+re-provision to change an Art-44 boundary). Workspace is JWT-derived (NOT an input).

| Field | Type | Description | | --- | --- | --- | | dlpProfileId | String! | Gate 6: the DLP profile id. | | dpaReference | String! | Gate 3: the DPA document reference. | | kmsKeyArn | String! | Gate 2 (request-only): the per-tenant evidence-store CMK ARN in residencyRegion. | | legalSignoffRef | String! | Gate 4: the /osyra-legal sign-off record id. | | residencyRegion | String! | Gate 1 (INVARIANT): the pinned residency region (e.g. "eu-west-1"). |

IssueStepUpTokenInput

| Field | Type | Description | | --- | --- | --- | | credential | StepUpCredentialInput! | | | operationBinding | String | ADR-145 — OPTIONAL operation-instance binding. When set, the minted token is bound to a specific operation instance (e.g. an ownership-transfer recipient user-id) so a captured token cannot be replayed onto a different target. Absent = today's scope-only binding (backward-compatible). | | scope | StepUpScope! | |

IssueVirtualKeyInput

| Field | Type | Description | | --- | --- | --- | | budget | VirtualKeyBudgetInput! | | | modelAllowList | [String!]! | Empty => deny-all (never a wildcard). | | providerId | String! | | | rateLimit | VirtualKeyRateLimitInput! | | | scope | String! | | | secretRef | SecretRefInput! | |

LitigationHoldInput

| Field | Type | Description | | --- | --- | --- | | caseRef | String! | Documented counsel / case reference (recorded; required by AP00005 to place). | | since | DateTime! | Inclusive range lower bound, ISO-8601. Required (range-based hold). | | until | DateTime | Exclusive range upper bound, ISO-8601. Null = to now. |

LitigationHoldReleaseInput

| Field | Type | Description | | --- | --- | --- | | counselRef | String! | Documented counsel release reference (recorded; required by AP00005 to release). | | holdId | ID! | The hold receipt id to lift (from a prior attachLitigationHold). Required. |

MergeMemoryArchivesInput

| Field | Type | Description | | --- | --- | --- | | inputArchivesB64 | [String!]! | ≥2 signed OMP archives to merge, STANDARD base64 (order-tolerant; ≤64 inputs; each decodes to 1 B..16 MiB). | | mergerModelFamily | String! | | | mergerVendor | String! | The merger's archive-header provenance for the merged OMP output. 1..256 chars. |

MlBomDownloadInput

Input to downloadMlBom: the signed OADR EAT envelope (base64-standard) + the detached eat-disclosure-v1 Class-B carrier (base64-standard) carrying the per-parent OriginAttestation records (REQUIRED — oadr.v1 is Class-B; AP00016 fails closed without it). There is intentionally NO workspace field — the workspace is JWT-derived (the tenant-isolation invariant); AP00016 re-checks it == the SIGNED OI-1 ws claim (cross-tenant → fail-closed, never a green BOM).

| Field | Type | Description | | --- | --- | --- | | disclosureB64 | String! | The detached UNSIGNED disclosure carrier (eat-disclosure-v1) carrying the per-parent OriginAttestation records, base64-standard-encoded. REQUIRED — oadr.v1 is a Class-B kind; AP00016 fails closed (EAT_DISCLOSURE_REQUIRED) without it (it will not project a body it cannot re-decide). | | envelopeB64 | String! | The signed COSE_Sign1 EAT envelope (dsTag "osyra-eat-v1") whose receipt_kind is "oadr.v1", base64-standard-encoded. REQUIRED; 1B..16MiB after decode (the verifier's encoded_cbor cap). |

OadrAdmissionInput

───────────────────────────────────────────────────────────────────── Inputs ───────────────────────────────────────────────────────────────────── Input to verifyOadrAdmission. The signed OADR EAT envelope bytes (base64-standard) plus the OPTIONAL detached eat-disclosure-v1 Class-B carrier (base64-standard) carrying the per-parent OriginAttestation records. There is intentionally NO workspace field — the workspace is JWT-derived (the tenant-isolation invariant).

| Field | Type | Description | | --- | --- | --- | | disclosureB64 | String | OPTIONAL detached UNSIGNED disclosure carrier (eat-disclosure-v1; carrier key 1 == "oadr.v1") carrying the per-parent OriginAttestation records, base64-standard-encoded. Required only when the signed body commits witness roots the verifier must re-derive (CONTENT_BOUND, or any parent disclosure). Omit for a body-only verify; the verifier fails closed if disclosure was actually required (EAT_DISCLOSURE_REQUIRED). | | envelopeB64 | String! | The signed COSE_Sign1 EAT envelope (dsTag "osyra-eat-v1") whose receipt_kind is "oadr.v1", base64-standard-encoded. REQUIRED; 1B..16MiB after decode (the verifier's encoded_cbor cap). |

OcarPinnedReceiverInput

───────────────────────────────────────────────────────────────────── Inputs (no ws — the workspace is JWT-derived; stepUpToken is the CONFIGURE_OCAR_TRUST_MODE step-up the edge verifies+consumes, its operationBinding re-derived from THIS input)

VESTIGIAL FIELD (ENG-2930 / Gate-5 informational): stepUpToken: String! on all three inputs is NON-NULL for the request contract ONLY — the resolver does NOT read it. The edge reads the actual step-up token from the X-Osyra-Step-Up-Token request header (plumbed into ctx by StepUpTokenMiddleware; consumed in resolver.RequireStepUpWithBinding), so a value the client puts in the field is ignored. It is retained (not removed) to avoid a breaking schema change; kept non-null so a client is reminded a step-up is mandatory. Do NOT wire the resolver to read it — that would let a client bypass the header path. Remove only in a coordinated FE+edge change. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | publicKeyHex | String! | The counterparty's Ed25519 public key as 64-char lowercase hex (32 bytes). Rejected fail-closed at the edge if not valid 32-byte lowercase hex. | | receiverId | String! | |

OcarVerificationInput

───────────────────────────────────────────────────────────────────── Input ───────────────────────────────────────────────────────────────────── Input to verifyOcarTrustMode: the signed host EAT envelope bytes (base64-standard) plus the detached ocar-cosign-v1 co-sign bundle (base64-standard) carrying the per-counterparty co-signatures. There is intentionally NO workspace field — the workspace is JWT-derived (the tenant-isolation invariant).

| Field | Type | Description | | --- | --- | --- | | envelopeB64 | String! | The signed COSE_Sign1 host EAT envelope (dsTag "osyra-eat-v1"), base64-standard-encoded. REQUIRED; 1B..16MiB after decode (the verifier's encoded_cbor cap). | | ocarCosignBundleB64 | String! | The detached UNSIGNED OCAR co-sign bundle (ocar-cosign-v1) carrying the per-counterparty co-signatures over the host action root, base64-standard-encoded. REQUIRED — OCAR trust-mode has no co-sign surface without it. |

OpenDsarInput

Input for openDsarRequest. The MAKER identity is server-derived from the JWT subject (never here).

| Field | Type | Description | | --- | --- | --- | | ccpaDoNotSell | Boolean | | | kind | DsarKind! | | | subjectRef | String! | |

OtccVerifyInput

───────────────────────────────────────────────────────────────────── Inputs ───────────────────────────────────────────────────────────────────── Input to verifyTokenCapital. The signed OTCC EAT certificate bytes (base64-standard). NO workspace field — JWT-derived (tenant-isolation invariant).

| Field | Type | Description | | --- | --- | --- | | certificateB64 | String! | The signed COSE_Sign1 EAT certificate (receipt_kind "otcc.v1"), base64-standard-encoded. REQUIRED. |

PreviewApiKeyBulkRevocationInput

| Field | Type | Description | | --- | --- | --- | | scope | ApiKeyBulkRevokeScope! | | | targetOwnerUserId | ID | |

PromoteOcarTrustConfigInput

| Field | Type | Description | | --- | --- | --- | | stepUpToken | String! | A CONFIGURE_OCAR_TRUST_MODE step-up token bound to the re-derived PROMOTE operationBinding. The approver (JWT-derived) MUST differ from the maker (AP00016 enforces 7727). VESTIGIAL (ENG-2930): read from the X-Osyra-Step-Up-Token header, NOT this field. See the note above. | | version | String! | The PENDING op's version to approve (ADR-337 §D7). Decimal int64 string. |

PromptPartialInput

A partial/include reference for signing — {{> handle}} resolves to another template version's 32-byte render-preimage content hash.

| Field | Type | Description | | --- | --- | --- | | handle | String! | Handle used in the source ({{> handle}}), 1..64 chars, unique per template. | | templateCid | String! | 64 lowercase hex chars — the referenced template's render-preimage CID. |

PromptVarInput

────────────────────────────────────────────────────────────────────────── WRITE surface (ENG-2805; design §4.1) — sign a new template version / publish / rollback a deployment pointer.

Tenant isolation (load-bearing): the mutations take NO workspace argument. The workspace is ALWAYS the JWT-derived uc.WorkspaceID, stamped onto the signed Claim.workspace_id AND the outbound OME os-workspace-id header — a caller can NEVER write into another workspace (orgidvet / IDOR defense).

Fail-closed posture + NO-STUBS honesty: a mutation returns the REAL inserted claim projection mapped over the body the edge constructed — or an error. Never fabricated state; a transport/OME error is surfaced (sanitized), never swallowed. Until OME is wired the mutations return OSY-PROMPT-NOT-WIRED.

Server-side pins (never caller inputs):

• engine is PINNED to "osyra.render.mustache-lite.v1" (the frozen render dialect) — there is deliberately no engine input field;
• intent is PINNED per mutation: publishDeployment → "publish", rollbackDeployment → "rollback" (the canary intent is out of V1 scope; the signed body carries an explicit CBOR-null canary). ────────────────────────────────────────────────────────────────────────── A declared template variable for signing. default MUST be present iff required == false (the signed body is strictly validated server-side).

| Field | Type | Description | | --- | --- | --- | | default | String | The declared default as text ("true"/"false" for bool). Present iff required == false. | | name | String! | Variable name — [a-zA-Z_][a-zA-Z0-9_]*, <= 64 chars. | | required | Boolean! | | | type | String! | "string" | "number" | "bool" | "json" (the frozen template-var vocabulary). |

PublishDeploymentInput

Input for publishDeployment — signs a prompt.deployment.v1 pointer claim with intent PINNED to "publish".

| Field | Type | Description | | --- | --- | --- | | effectiveTs | String | Unix ms the pointer becomes authoritative, as a String (BigInt-safe). Omitted → server now. | | environment | String! | prod | staging | canary | x-[a-z0-9][a-z0-9-]{0,62} | | issuerDid | String! | | | parents | [ID!] | Lineage: the PRIOR deployment claim id(s) for this (slug, environment) pointer (32 hex chars each); empty ONLY for the first deployment. | | priorCid | String | 64 hex chars — the CID this pointer replaces; omit for the FIRST deployment of the environment (signed as an explicit CBOR null). | | signerKeyRef | String! | | | slug | String! | The family slug (denormalized onto the body for query convenience). | | targetCid | String! | 64 hex chars — the render-preimage CID of the version to activate. | | targetSemver | String! | The author semver of targetCid (denormalized; 1..32 chars). | | templateId | ID! | The template FAMILY id being pointed into (32 hex chars). |

RecordDsarVerificationInput

Input for recordDsarVerification (ENG-3041 — record the subject identity-proofing that UNBLOCKS the Art-15 access export / Art-17 erasure completion). The verifier identity is server-derived from the JWT subject (never a client field). method is the proofing method actually used; proofRef is an OPAQUE ref/CID to the proofing artifact (e.g. a WORM object CID) — the edge forwards it verbatim and it MUST carry NO PII inline (the artifact lives out-of-band; only its pointer rides the wire).

| Field | Type | Description | | --- | --- | --- | | dsarId | ID! | | | method | DsarVerificationMethod! | | | proofRef | String! | |

RegisterPrivateEndpointInput

───────────────────────────────────────────────────────────────────── Inputs (design §5.1). The workspace/org are ALWAYS JWT-derived at the edge — deliberately ABSENT here (a request-body tenant is a rejected concept on this surface). protocol, caCertFingerprint and authSecretRef are REQUIRED by the backend contract (design §5.1) — the edge supplies NO defaults (NO STUBS): authSecretRef may be omitted ONLY with authKind == NONE, caCertFingerprint ONLY for kind == SAGEMAKER (cloud-native TLS); AP00006 re-validates server-side. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | authKind | PrivateEndpointAuthKind! | | | authSecretRef | String | Opaque POINTER into the tenant's secret manager — NEVER the secret. Omit iff authKind == NONE. | | baseUrl | String! | | | caCertFingerprint | String | SHA-256(SPKI) pin as hex (64 hex chars); omit only for kind == SAGEMAKER. | | displayName | String! | | | kind | PrivateEndpointKind! | | | modelIds | [String!]! | | | networkBindingRef | String! | | | protocol | PrivateEndpointProtocol! | | | residencyRegion | String! | |

RequestDomainVerificationInput

| Field | Type | Description | | --- | --- | --- | | domain | String! | Any name under the target registrable domain; reduced to eTLD+1 by IAM. | | emailRole | String | Required for EMAIL: "admin" | "postmaster" | "security". | | method | String! | "DNS_TXT" | "EMAIL" (SSO is an accelerator, not directly requestable). |

RequestImpersonationInput

───────────────────────────────────────────────────────────────────── Inputs. NONE carry an operator/approver/CISO identity (AP00009 server-derives) and NONE carry a stepUpToken or any quorum material (the 4-eyes WebAuthn ceremony is AP00009-only — NOT edge-mintable). ───────────────────────────────────────────────────────────────────── Kick off an impersonation request. This does NOT mint a grant — it opens an AP00009 op that then requires the distinct-CISO WebAuthn quorum + execute-time FIDO2 to become ACTIVE (all at AP00009).

| Field | Type | Description | | --- | --- | --- | | accessMode | ImpersonationAccessMode! | READ_ONLY (2-of-N quorum) or READ_WRITE (3-of-N quorum). | | justification | String! | The business justification (REQUIRED; audit-bound at AP00009). | | targetOrgId | String! | The customer org to impersonate into. | | targetWorkspaceId | String | Optional workspace scope within the target org (omit for org-wide). |

ResendVerificationEmailInput

Input for resending a verification email (ENG-664)

| Field | Type | Description | | --- | --- | --- | | email | String! | The email address to (re)send the verification link to. |

RevokeContentBoundEnablementInput

REVOKE input.

| Field | Type | Description | | --- | --- | --- | | enablementId | String! | The enablement to revoke (ACTIVE/PENDING -> REVOKED). |

RevokeImpersonationInput

Revoke an in-flight or active impersonation op.

| Field | Type | Description | | --- | --- | --- | | opId | String! | The op to revoke. |

RevokeOcnpLeaseInput

───────────────────────────────────────────────────────────────────── Inputs ───────────────────────────────────────────────────────────────────── Input to revokeOcnpLease. There is intentionally NO workspace field — the workspace is JWT-derived (the tenant-isolation invariant) and stamped onto the RevokeEvent server-side.

| Field | Type | Description | | --- | --- | --- | | leaseIds | [ID!]! | The lease_ids to revoke (kernel C.3 SHA-256 hex). REQUIRED, non-empty. An empty list is rejected (a workspace-wide bust is a distinct privileged operation, not exposed here). |

RollbackDeploymentInput

Input for rollbackDeployment — signs a prompt.deployment.v1 pointer claim with intent PINNED to "rollback". "Rollback" is FORWARD motion to a re-pointed pointer (a NEW signed claim), never an in-place mutation. priorCid is REQUIRED — you cannot roll back from nothing.

| Field | Type | Description | | --- | --- | --- | | effectiveTs | String | Unix ms, as a String (BigInt-safe). Omitted → server now. | | environment | String! | | | issuerDid | String! | | | parents | [ID!] | | | priorCid | String! | 64 hex chars — the CID being rolled back FROM. REQUIRED. | | signerKeyRef | String! | | | slug | String! | | | targetCid | String! | 64 hex chars — the (prior) version CID being rolled back TO. | | targetSemver | String! | | | templateId | ID! | |

RotateVirtualKeyInput

| Field | Type | Description | | --- | --- | --- | | newSecretRefVersion | String | Optional secret-version rotation (the common case; vkid + alias stable). | | rotateAlias | Boolean! | true => re-mint the alias (leaked-alias case), plaintext-once again. | | vkid | ID! | |

ScopeInput

───────────────────────────────────────────────────────────────────── Inputs ───────────────────────────────────────────────────────────────────── A target scope. ONLY the cascade level is accepted — the scope id is derived from the JWT (org id for ORG, workspace id for WORKSPACE). There is no scopeId field by design (tenant-isolation invariant).

| Field | Type | Description | | --- | --- | --- | | level | CascadeLevel! | |

SecretRefInput

POINTER into the customer's external secret manager — NEVER the secret (proto SecretRefInput).

| Field | Type | Description | | --- | --- | --- | | backend | SecretRefBackend! | | | uri | String! | | | version | String! | |

SetOcarTrustConfigInput

| Field | Type | Description | | --- | --- | --- | | expectedVersion | String! | CAS anchor: the version the caller believes is current. "0" creates (rejected 7723 if history exists). Decimal int64 string. | | receivers | [OcarPinnedReceiverInput!]! | >=1 receiver; duplicate receiverId rejected by AP00016 (7725). | | stepUpToken | String! | A CONFIGURE_OCAR_TRUST_MODE step-up token bound to the re-derived SET operationBinding. VESTIGIAL (ENG-2930): read from the X-Osyra-Step-Up-Token header, NOT this field. See the note above. | | threshold | Int! | 1 <= threshold <= distinct receivers (AP00016 enforces 7722). |

SignPromptVersionInput

Input for signPromptVersion. The edge LF-normalizes source, computes the render-preimage hash (the version's content identity), assembles the prompt.template.v1 Form B body, and submits it through the fused atomic OME SignAndInsert.

| Field | Type | Description | | --- | --- | --- | | issuerDid | String! | The issuer (signer) DID URI stamped onto the claim. | | notes | String | Free-text notes, <= 4096 chars; omitted → empty. | | parents | [ID!] | Lineage edge(s): prior template-version claim id(s) (32 hex chars each). Empty/omitted → the family genesis (Claim kind ASSERTION); non-empty → DERIVATION. | | partials | [PromptPartialInput!]! | | | roleLayout | [ChatSegmentInput!] | Optional ordered chat-role segmentation; omitted → an empty layout. | | semver | String! | Author-asserted "MAJOR.MINOR.PATCH" label, 1..32 chars (provenance only — the cryptographic identity is the render-preimage hash). | | signerKeyRef | String! | The workspace signing-key reference (forwarded as the SignAndInsert key_source kms_key_id). | | slug | String! | Workspace-unique human handle — [a-z0-9._-], 1..128. | | source | String! | Raw template source text (<= 262144 bytes after LF normalization). | | templateId | ID | The template FAMILY id (32 hex chars / 16 bytes). Absent → the edge mints a fresh UUIDv7 family id (a NEW template family). | | variables | [PromptVarInput!]! | |

SignUpInput

============================================================================ Input Types

| Field | Type | Description | | --- | --- | --- | | acceptTerms | Boolean! | Terms acceptance (required) | | email | String! | User credentials | | firstName | String! | User profile | | lastName | String! | | | organizationName | String | Optional organization name (defaults to email domain) | | password | String! | | | planTier | PlanTier | Plan tier the workspace is created at (ENG-746). Defaults to FREE. Today only FREE flows through signUp; STARTER/PRO/ ENTERPRISE come in via /api/v1/billing/checkout (Stripe Checkout). |

SsoGroupMappingInput

| Field | Type | Description | | --- | --- | --- | | idpGroup | String! | | | role | String! | |

StepUpCredentialInput

Exactly one of password / totp must be provided; both populated or both blank is rejected with OSY-AUTH-1042 step_up_failed (no enumeration).

| Field | Type | Description | | --- | --- | --- | | password | String | | | totp | String | |

SubmitContactSalesRequestInput

| Field | Type | Description | | --- | --- | --- | | gate | ContactSalesGate | Originating plan/feature gate and console surface. These closed enums are analytics labels, not authorization inputs; unknown values fail at the GraphQL boundary instead of silently fragmenting the funnel catalog. | | intent | ContactSalesIntent! | | | message | String | Optional requester context only. Edge rejects values over 2,000 bytes; IAM applies the same semantic cap as defense in depth. | | requestId | ID! | Canonical lowercase UUIDv7 generated ONCE by the BFF and reused unchanged for retries. Edge validates it and propagates it to IAM as x-idempotency-key; it is never used as tenant identity. | | surface | ContactSalesSurface | |

SubmitEvalRunInput

| Field | Type | Description | | --- | --- | --- | | benchmarkId | String! | The suite's human identifier (committed in the body + part of the suite_cid). | | epoch | String | The run's currency stamp (rejected at re-decide if < minEpoch). | | minEpoch | String | The gate's currency floor (the relying-party epoch floor; 0 = no floor). | | modelId | String! | ── the SUBMITTED run over that suite ── The model that produced the run (vendor-neutral; ANY non-empty provider/model id). Empty ⇒ fail closed. | | runItems | [EvalRunItemInput!]! | The per-item run contributions, index-aligned with suiteItems (len MUST equal len(suiteItems)). | | scorerId | String! | The pinned, content-addressed deterministic grader id (e.g. "exact-match/v1"). Its digest pins it. | | suiteItems | [EvalSuiteItemInput!]! | ── the COMMITTED eval suite (dataset + pinned grader + gate) ── The ordered committed items (>=1). The run must answer EXACTLY these, index-aligned (arity). | | transcriptPresent | Boolean! | Whether an IO transcript is present. false ⇒ the noLeak leg fails closed at re-decide (honest). |

SubmitTraceFeedbackInput

| Field | Type | Description | | --- | --- | --- | | comment | String | Optional free-text comment. The server REDACTS + HASHES it (comment_digest on the signed body); the plaintext is NEVER signed (it rides the Class-B disclosure carrier, D5). If redaction is unavailable the comment is dropped to null and the categorical feedback still mints. | | rating | Int | Optional bounded ordinal, 1..5; the server rejects out-of-range. Absent ⇒ 0 (no star rating). | | subjectCid | ID! | The annotated trace/receipt/span CID — lowercase hex of a 32-byte content id. | | subjectKind | TraceSubjectKind! | | | verdict | TraceFeedbackVerdict! | |

TransferOrgOwnershipInput

Initiate an org-ownership transfer. stepUpToken MUST be a TRANSFER_ORG_OWNERSHIP token bound to newOwnerId (ADR-145).

| Field | Type | Description | | --- | --- | --- | | newOwnerId | ID! | | | stepUpToken | String! | |

TransferWorkspaceOwnershipInput

Initiate a workspace-ownership transfer. stepUpToken MUST be a TRANSFER_WORKSPACE_OWNERSHIP token bound to newOwnerId (ADR-145).

| Field | Type | Description | | --- | --- | --- | | newOwnerId | ID! | | | stepUpToken | String! | | | workspaceId | ID! | |

UpdateMemberRoleInput

| Field | Type | Description | | --- | --- | --- | | organizationId | ID! | | | role | MemberRole! | | | userId | ID! | |

UpdateOrganizationInput

| Field | Type | Description | | --- | --- | --- | | description | String | ENG-2969: NULLABLE partial-update fields — omitting one leaves the persisted value UNCHANGED (threaded to IAM only when present); an explicit "" clears it. | | logoUrl | String | | | name | String | | | slug | String | ENG-3234 (ADR-368 §2.4): plain self-service org rename (surfaces the ENG-3115 handle editor's non-vanity path). NULLABLE partial-update: omitting it leaves the slug UNCHANGED; a value is routed to IAM's dedicated updateSlug gate (R1-R3 + GLOBAL uniqueness + slug_history RENAME + 301 window). A GATE/bare-brand skeleton is rejected there — those are earned via claimVanitySlug after domain verification. The server stays authoritative; the edge only surfaces + forwards. |

UpdatePaymentMethodInput

Input types

| Field | Type | Description | | --- | --- | --- | | organizationId | ID! | Organization to update payment method for | | paymentMethodId | ID! | Payment method to set as default |

UpdatePrivateEndpointInput

| Field | Type | Description | | --- | --- | --- | | authKind | PrivateEndpointAuthKind! | | | authSecretRef | String | | | baseUrl | String! | | | caCertFingerprint | String | | | displayName | String! | | | id | ID! | | | kind | PrivateEndpointKind! | kind is IMMUTABLE — resent so the descriptor validates identically to register; the stored kind is never mutated (proto invariant). | | modelIds | [String!]! | | | networkBindingRef | String! | | | protocol | PrivateEndpointProtocol! | | | residencyRegion | String! | |

UpdateProfileInput

Input types for user mutations

| Field | Type | Description | | --- | --- | --- | | firstName | String | | | lastName | String | |

UpdateSignupProfileInput

Each field is INDEPENDENTLY optional (both taps are skippable). Omit a field the user skipped; at least one must be present or IAM rejects the write.

| Field | Type | Description | | --- | --- | --- | | companySize | CompanySize | | | useCase | SignupUseCase | |

UpdateSubscriptionInput

| Field | Type | Description | | --- | --- | --- | | organizationId | ID! | | | planId | ID! | New plan ID |

UpdateWorkspaceInput

| Field | Type | Description | | --- | --- | --- | | description | String | | | logoUrl | String | ENG-2969: NULLABLE partial-update logo URL — omitting it leaves the persisted value UNCHANGED (threaded to IAM only when present); an explicit "" clears it. | | name | String | | | noStore | Boolean | NOTE (ENG-2971): settings (WorkspaceSettingsInput) was removed. The settings projection is not wired to IAM on the write path, so it was accepted and silently dropped (a NO-STUBS violation). Workspace.settings (read) stays and honestly returns null. Re-add a write path when IAM persists workspace settings. PLA-94 (Wave-C): set the workspace-level no_store privacy baseline (the WRITE path for Workspace.no_store, surfaced read-only on WorkspaceResponse.no_store in B2). NULLABLE on purpose: omitting it leaves the persisted baseline UNCHANGED (partial update) — semantically distinct from an explicit false, which clears an opted-in baseline back to "persistence permitted". Threaded VERBATIM to IAM UpdateWorkspaceRequest.no_store (field 5); authorization is the SAME workspaces:write (+ tenant guard) that gates every other field on this mutation — no weaker path. | | slug | String | ENG-3234 (ADR-368 §2.4): plain workspace rename (surfaces the ENG-3115 workspace handle editor). NULLABLE partial-update: omitting it leaves the slug UNCHANGED; a value is routed to IAM's updateSlug gate (R1-R3 + PER-ORG uniqueness + slug_history RENAME + 301 window). A GATE/BLOCK skeleton is rejected there. The server stays authoritative; the edge only surfaces + forwards. |

VerifyEvalReceiptInput

| Field | Type | Description | | --- | --- | --- | | carrierB64 | String! | The base64-standard-encoded detached eat-disclosure-v1 carrier (the per-request disclosed witnesses). The OEV re-decider RECOMPUTES each committed root from these — a tampered/swapped carrier fails closed (RED). | | eatWireB64 | String! | The base64-standard-encoded signed oev.v1 EAT envelope ("osyra-eat-v1") to re-decide. |

VerifyMergeReceiptInput

| Field | Type | Description | | --- | --- | --- | | inputArchivesB64 | [String!]! | The input OMP archives the receipt binds, STANDARD base64 (order-tolerant; ≤64). Re-decision recomputes the merge over these and forces claim == recompute. | | mergeReceiptB64 | String! | The EAT-hosted Merge Receipt (COSE_Sign1) to re-decide, STANDARD base64. | | signerPubB64 | String! | The relying-party-pinned merger Ed25519 public key, STANDARD base64 (decodes to exactly 32 bytes). The relying party pins the trust anchor; the signer is NOT read from the envelope. |

VerifyMfaInput

| Field | Type | Description | | --- | --- | --- | | code | String! | |

VerifyRetrievalInput

Retrieval-provenance (osyidx) GraphQL Schema — ENG-2513 (epic ENG-1999 / ARC-19)

Customer-facing console mutation that fronts the AP00011-ome VerifyRetrieval re-decider (ENG-2470). The SERVER-ANCHORED arm of the osyidx two-mode dispatch: the relying party submits the signed osyidx.v1 receipt + its detached disclosure witnesses + the pinned index public key + its own freshness high-water-mark, and the OME service re-decides against the live root history, returning the structured verdict.

The verdict is DATA, not a GraphQL error: a rejected rollback, a forged manifest, or a per-hit leg failure reaches the view cleanly as data (manifestAccepted=false, per-hit OSY-OSYIDX-84xx codes) and is rendered faithfully — NEVER reclassified as a banner. A TOP-LEVEL fault (auth, not-wired, malformed base64) is a GraphQL error and renders the FallbackBanner. Until OME_ENABLED / an OMEClient is wired the resolver returns OSY-VERIFY-RETRIEVAL-NOT-WIRED via UnwiredVerifyRetrievalService (fail-closed; NO STUBS — never fabricated provenance).

─────────────────────────────────────────────────────────────────────── Tenant isolation (LOAD-BEARING): the workspace is ALWAYS derived from the JWT server-side — there is deliberately NO workspaceId input field (mirrors verified-memory / receipts / drift / portable-memory; defense-in-depth per ENG-777 SEC-H1). OME additionally binds the workspace from the OS-Workspace-ID gRPC header server-side (server-authoritative tenancy). The index public key and the high-water-mark are caller-supplied out-of-band PINNED inputs — never receipt-supplied.

─────────────────────────────────────────────────────────────────────── 64-bit precision: the index sequence counters (hwm / hwmBefore / hwmAfter) and the manifest version (manifestVer) are 64-bit and carried as String to avoid JS Number precision loss — matching the hand-authored frontend op (AP00010-frontend/lib/graphql/operations/retrieval-provenance.ts). manifestRoot is lowercase-hex of the radix-16 index root; indexId is the authenticated index identifier. ───────────────────────────────────────────────────────────────────── Input ───────────────────────────────────────────────────────────────────── The pinned, out-of-band relying-party inputs for a server-anchored re-decision. The workspace is NEVER an input (JWT-derived server-side).

| Field | Type | Description | | --- | --- | --- | | hwm | String! | The caller's freshness high-water-mark over the index sequence — a 64-bit counter carried as a string to avoid JS number-precision loss. | | indexPublicKeyB64 | String! | The pinned workspace index public key (base64 Ed25519, 32 bytes) — never receipt-supplied; the manifestSig is verified under THIS key. | | receiptB64 | String! | The signed osyidx.v1 receipt envelope, base64 (standard encoding). | | witnessesB64 | String! | The detached osyidx-disclosure-witnesses, base64 (standard encoding). |

VirtualKeyBudgetInput

───────────────────────────────────────────────────────────────────── Inputs. The Issue input carries NO workspace/org (JWT-derived, proto invariant). limitMicros is an exact int64-micros decimal String (no float). modelAllowList empty => deny-all. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | hard | Boolean! | | | limitMicros | String! | | | period | String! | |

VirtualKeyRateLimitInput

| Field | Type | Description | | --- | --- | --- | | rpm | Int! | | | tpm | Int! | |

WarehouseBigQueryConfigInput

| Field | Type | Description | | --- | --- | --- | | dataset | String! | | | projectId | String! | | | table | String! | |

WarehouseClickHouseConfigInput

| Field | Type | Description | | --- | --- | --- | | database | String! | | | endpoint | String! | | | secretRef | String | A pointer to the customer's password in the secret store; NEVER a raw secret. | | table | String! | | | username | String! | |

WarehouseS3ConfigInput

── inputs ─────────────────────────────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | bucket | String! | | | endpoint | String | | | prefix | String | | | region | String! | | | roleArn | String | |

WorkflowApprovalDecisionInput

| Field | Type | Description | | --- | --- | --- | | approvalId | ID! | | | comment | String | Optional reviewer comment carried in the approval signal payload. | | decision | WorkflowApprovalDecision! | | | runId | ID | Optional — the latest run if absent (matches SignalWorkflow run_id semantics). | | workflowId | ID! | |