swagger: '2.0'
info:
  title: TATER MCP HTTP Endpoint
  description: |
    MCP HTTP endpoint for TATER. Exposes 42 compliance tools as JSON-RPC 2.0 over HTTP.
    Auth: Bearer token (audience api://45afb90d-c5de-439d-8b09-8fbfed28b321) issued via the
    user's Entra OAuth flow. The first tools/call MUST be get_org_context.

    NOTE: This file is the Swagger 2.0 variant required by Microsoft 365 Copilot Studio's
    "Import an OpenAPI file" wizard. For OpenAPI 3.0 consumers (Postman, generic SDK
    generators) use openapi.yaml in the same directory.
  version: '1.0.0'
  contact:
    name: TATER Security
    email: support@tatersecurity.com
    url: https://www.tatersecurity.com
host: api.tatersecurity.com
basePath: /
schemes:
  - https
paths:
  /api/mcp:
    post:
      operationId: mcp_invoke
      summary: Invoke any TATER MCP tool via JSON-RPC 2.0
      description: |
        Standard MCP server endpoint. Send a JSON-RPC 2.0 request with method=tools/list
        (no params) to discover tools, or method=tools/call with params={name, arguments}
        to invoke one. The first call of every conversation should be:
          tools/call with {name: "get_org_context", arguments: {}}
        to confirm the active organization.
      consumes:
        - application/json
      produces:
        - application/json
      security:
        - tater_oauth: []
      parameters:
        - in: body
          name: body
          required: true
          schema:
            type: object
            required: [jsonrpc, method]
            properties:
              jsonrpc:
                type: string
                enum: ['2.0']
              id:
                type: string
              method:
                type: string
                enum: [tools/list, tools/call, ping]
              params:
                type: object
                properties:
                  name:
                    type: string
                    description: Tool name (required for tools/call)
                  arguments:
                    type: object
                    description: Tool-specific arguments (required for tools/call)
      responses:
        '200':
          description: JSON-RPC 2.0 response (success or error envelope)
          schema:
            type: object
            properties:
              jsonrpc:
                type: string
              id:
                type: string
              result:
                type: object
              error:
                type: object
                properties:
                  code:
                    type: integer
                  message:
                    type: string
        '401':
          description: Unauthorized — missing or invalid token
        '429':
          description: Rate limit exceeded
securityDefinitions:
  tater_oauth:
    type: oauth2
    flow: accessCode
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
    tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
    scopes:
      api://45afb90d-c5de-439d-8b09-8fbfed28b321/access: Access TATER on behalf of the signed-in user
