openapi: 3.1.0
info:
  title: PlatPhorm Investigate API
  version: 1.0.0
  description: Bounded security-incident orchestration over Correlate, Evidence, and pinned MITRE ATT&CK data.
servers:
  - url: https://investigate.platphormnews.com
components:
  securitySchemes:
    PlatPhormBearer:
      type: http
      scheme: bearer
      bearerFormat: PLATPHORM_API_KEY
      description: "Protected actions accept Authorization: Bearer $PLATPHORM_API_KEY."
    PlatPhormHeader:
      type: apiKey
      in: header
      name: X-PlatPhorm-API-Key
      description: "Protected actions also accept X-PlatPhorm-API-Key: $PLATPHORM_API_KEY."
paths:
  /api/health:
    get:
      operationId: getHealth
      responses:
        "200":
          description: Liveness and dependency readiness
  /api/v1/health:
    get:
      operationId: getHealthV1
      responses:
        "200":
          description: Versioned health alias
  /api/v1/investigate:
    post:
      operationId: runInvestigation
      security:
        - PlatPhormBearer: []
        - PlatPhormHeader: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [question, datasetId]
              properties:
                question:
                  type: string
                  minLength: 1
                  maxLength: 500
                datasetId:
                  type: string
                  minLength: 1
                  maxLength: 128
      responses:
        "200":
          description: NDJSON run stream
        "401":
          description: Unauthorized
  /api/v1/datasets:
    get:
      operationId: listEvidenceDatasets
      responses:
        "200":
          description: Public-safe Evidence dataset summaries
  /api/v1/tools:
    get:
      operationId: listTools
      responses:
        "200":
          description: Tool registry
  /api/mcp:
    get:
      operationId: getMcpMetadata
      responses:
        "200":
          description: MCP metadata
    post:
      operationId: callMcp
      responses:
        "200":
          description: JSON-RPC response
