openapi: 3.0.3
info:
  title: Subject Interface REST API (Operational)
  description: |
    Operational REST API for managing sessions, TLCs (Subjects), and related resources.
    
    This is a down scoped version of the full API, focused on operational roles and excluding platform administration capabilities.
    
    ## Authentication
    All endpoints require custom header authentication using X-Authorization header. Tokens are managed through the Authorization Token endpoints.
    
    ## Authorization Roles (Operational)
    - **TLC Admin/System/Analyst**: TLC management and analysis
    - **Broker Admin/System/Analyst**: Broker operations
    - **Monitor Admin/System**: Monitoring capabilities
  version: 1.0.0

security:
  - X-Authorization: []

tags:
  - name: Authorizations
    description: Role-based access control
  - name: Authorization Tokens
    description: Authentication token management
  - name: TLCs
    description: Traffic Light Controller management
  - name: Sessions
    description: Active session management
  - name: Session Logs
    description: Historical session data

paths:
  # Authorization endpoints
  /v1/authorizations:
    get:
      tags: [Authorizations]
      summary: List authorizations
      description: |
        Retrieve authorizations with optional filtering.
        
        Results are automatically filtered based on the domain and account associated with the API key's authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: listAuthorizations
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      responses:
        '200':
          description: List of authorizations retrieved successfully
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseAuthorization'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    
    post:
      tags: [Authorizations]
      summary: Create authorization
      description: |
        Create a new authorization.
        
        The domain and account are automatically set based on the API key's authorization context.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: createAuthorization
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestAuthorization'
      responses:
        '201':
          description: Authorization created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'

  /v1/authorizations/{uuid}:
    get:
      tags: [Authorizations]
      summary: Get authorization by UUID
      description: |
        Retrieve a specific authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: getAuthorization
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '200':
          description: Authorization retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorization'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    put:
      tags: [Authorizations]
      summary: Update authorization
      description: |
        Update an existing authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: updateAuthorization
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestAuthorization'
      responses:
        '200':
          description: Authorization updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorization'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    delete:
      tags: [Authorizations]
      summary: Delete authorization
      description: |
        Delete an authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: deleteAuthorization
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '204':
          description: Authorization deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'

  # Authorization Token endpoints
  /v1/authorizationtokens:
    get:
      tags: [Authorization Tokens]
      summary: List authorization tokens
      description: |
        Retrieve authorization tokens with optional filtering.
        
        Results are automatically filtered based on the domain and account associated with the API key's authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: listAuthorizationTokens
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - name: authorization
          in: query
          description: Filter by authorization UUID
          schema:
            type: string
      responses:
        '200':
          description: List of authorization tokens retrieved successfully
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseAuthorizationToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    
    post:
      tags: [Authorization Tokens]
      summary: Create authorization token
      description: |
        Generate a new authorization token.
        
        The token is automatically associated with the domain and account from the API key's authorization context.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: createAuthorizationToken
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestAuthorizationToken'
      responses:
        '201':
          description: Authorization token created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorizationToken'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'

  /v1/authorizationtokens/{uuid}:
    get:
      tags: [Authorization Tokens]
      summary: Get authorization token by UUID
      description: |
        Retrieve a specific authorization token.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: getAuthorizationToken
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '200':
          description: Authorization token retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorizationToken'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    put:
      tags: [Authorization Tokens]
      summary: Update authorization token
      description: |
        Update an existing authorization token.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: updateAuthorizationToken
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestAuthorizationToken'
      responses:
        '200':
          description: Authorization token updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuthorizationToken'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    delete:
      tags: [Authorization Tokens]
      summary: Delete authorization token
      description: |
        Revoke an authorization token.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: deleteAuthorizationToken
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '204':
          description: Authorization token deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'

  # TLC endpoints
  /v1/tlcs:
    get:
      tags: [TLCs]
      summary: List TLCs
      description: |
        Retrieve TLCs with optional filtering.
        
        Results are automatically filtered based on the domain and account associated with the API key's authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC Analyst
        - Broker Admin, Broker System, Broker Analyst
        - Monitor Admin, Monitor System
      operationId: listTlcs
      x-required-roles:
        - TLC_ADMIN
        - TLC_ANALYST
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - BROKER_ANALYST
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      responses:
        '200':
          description: List of TLCs retrieved successfully
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseTlc'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    
    post:
      tags: [TLCs]
      summary: Create TLC
      description: |
        Create a new Traffic Light Controller.
        
        The domain, account, and type are automatically set based on the API key's authorization context.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
      operationId: createTlc
      x-required-roles:
        - TLC_ADMIN
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestTlc'
      responses:
        '201':
          description: TLC created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseTlc'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'

  /v1/tlcs/{uuid}:
    get:
      tags: [TLCs]
      summary: Get TLC by UUID
      description: |
        Retrieve a specific TLC.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC Analyst
        - Broker Admin, Broker System, Broker Analyst
        - Monitor Admin, Monitor System
      operationId: getTlc
      x-required-roles:
        - TLC_ADMIN
        - TLC_ANALYST
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - BROKER_ANALYST
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '200':
          description: TLC retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseTlc'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    delete:
      tags: [TLCs]
      summary: Delete TLC
      description: |
        Delete a TLC.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
      operationId: deleteTlc
      x-required-roles:
        - TLC_ADMIN
      parameters:
        - $ref: '#/components/parameters/uuidPath'
      responses:
        '204':
          description: TLC deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'

  # Session endpoints
  /v1/sessions:
    get:
      tags: [Sessions]
      summary: List active sessions
      description: |
        Retrieve active sessions with optional filtering.
        
        Results are automatically filtered based on the domain associated with the API key's authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC System
        - Broker Admin, Broker System
        - Monitor Admin, Monitor System
      operationId: listSessions
      x-required-roles:
        - TLC_ADMIN
        - TLC_SYSTEM
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - name: type
          in: query
          description: Filter by session type
          schema:
            $ref: '#/components/schemas/SessionType'
        - name: protocol
          in: query
          description: Filter by session protocol
          schema:
            $ref: '#/components/schemas/SessionProtocol'
      responses:
        '200':
          description: List of sessions retrieved successfully
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseSession'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    
    post:
      tags: [Sessions]
      summary: Create session
      description: |
        Create a new streaming session.
        
        The domain in the request must match the domain associated with the API key's authorization.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC System
        - Broker Admin, Broker System
        - Monitor Admin, Monitor System
      operationId: createSession
      x-required-roles:
        - TLC_ADMIN
        - TLC_SYSTEM
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestSession'
      responses:
        '201':
          description: Session created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseSession'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'

  /v1/sessions/{token}:
    get:
      tags: [Sessions]
      summary: Get session by token
      description: |
        Retrieve a specific session.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC System
        - Broker Admin, Broker System
        - Monitor Admin, Monitor System
      operationId: getSession
      x-required-roles:
        - TLC_ADMIN
        - TLC_SYSTEM
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - name: token
          in: path
          required: true
          description: Session token
          schema:
            type: string
      responses:
        '200':
          description: Session retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseSession'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    put:
      tags: [Sessions]
      summary: Update session
      description: |
        Update session (TCP Streaming Multiplex only).
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC System
        - Broker Admin, Broker System
        - Monitor Admin, Monitor System
      operationId: updateSession
      x-required-roles:
        - TLC_ADMIN
        - TLC_SYSTEM
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - name: token
          in: path
          required: true
          description: Session token
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestTCPStreamingMultiplexSessionDetails'
      responses:
        '200':
          description: Session updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseSession'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    
    delete:
      tags: [Sessions]
      summary: End session
      description: |
        Terminate an active session.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin
        - Broker Admin
        - Monitor Admin
      operationId: deleteSession
      x-required-roles:
        - TLC_ADMIN
        - BROKER_ADMIN
        - MONITOR_ADMIN
      parameters:
        - name: token
          in: path
          required: true
          description: Session token
          schema:
            type: string
      responses:
        '204':
          description: Session ended successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'

  # Session Log endpoints
  /v1/sessionlogs:
    get:
      tags: [Session Logs]
      summary: List session logs
      description: |
        Retrieve session logs within a time range.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC Analyst
        - Broker Admin, Broker Analyst
        - Monitor Admin, Monitor System
      operationId: listSessionLogs
      x-required-roles:
        - TLC_ADMIN
        - TLC_ANALYST
        - BROKER_ADMIN
        - BROKER_ANALYST
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - name: from
          in: query
          required: true
          description: Start time (ISO8601 format)
          schema:
            type: string
            format: date-time
        - name: until
          in: query
          required: true
          description: End time (ISO8601 format)
          schema:
            type: string
            format: date-time
      responses:
        '200':
          description: List of session logs retrieved successfully
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseSessionLog'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'

  /v1/sessionlogs/{token}:
    get:
      tags: [Session Logs]
      summary: Get session log by token
      description: |
        Retrieve a specific session log.
        
        **Authorization:** Requires one of these roles:
        
        - TLC Admin, TLC Analyst
        - Broker Admin, Broker Analyst
        - Monitor Admin, Monitor System
      operationId: getSessionLog
      x-required-roles:
        - TLC_ADMIN
        - TLC_ANALYST
        - BROKER_ADMIN
        - BROKER_ANALYST
        - MONITOR_ADMIN
        - MONITOR_SYSTEM
      parameters:
        - name: token
          in: path
          required: true
          description: Session token
          schema:
            type: string
      responses:
        '200':
          description: Session log retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseSessionLog'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'

components:
  securitySchemes:
    X-Authorization:
      type: apiKey
      in: header
      name: X-Authorization
      description: Authorization token passed in X-Authorization header. Obtain tokens via Authorization Token endpoints.

  parameters:
    uuidPath:
      name: uuid
      in: path
      required: true
      description: Resource UUID
      schema:
        type: string
        format: uuid

  responses:
    BadRequest:
      description: Bad request - Invalid input
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    
    Unauthorized:
      description: Unauthorized - Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    
    Forbidden:
      description: Forbidden - Insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'

  schemas:
    # Error response
    ErrorResponse:
      type: object
      properties:
        message:
          type: string
          description: Error message (e.g., "HTTP 401 Unauthorized")
        status:
          type: integer
          description: HTTP status code

    # Enums (Down scoped - removed PLATFORM_ADMIN and DOMAIN_ADMIN)
    AuthorizationRole:
      type: string
      enum:
        - TLC_ADMIN
        - TLC_SYSTEM
        - TLC_ANALYST
        - BROKER_ADMIN
        - BROKER_SYSTEM
        - BROKER_ANALYST
        - MONITOR_ADMIN
        - MONITOR_SYSTEM

    SessionType:
      type: string
      enum:
        - TLC
        - Broker
        - Monitor

    SessionProtocol:
      type: string
      enum:
        - TCPStreaming_Singleplex
        - TCPStreaming_Multiplex

    SecurityMode:
      type: string
      enum:
        - NONE
        - TLSv1.2

    TlcType:
      type: string
      enum:
        - TCPStreaming

    Direction:
      type: string
      enum:
        - RECEIVE

    # Authorization schemas
    RequestAuthorization:
      type: object
      required:
        - role
      properties:
        role:
          $ref: '#/components/schemas/AuthorizationRole'
        tlcIdentifiers:
          type: array
          items:
            type: string
            pattern: '^[a-z0-9_-]{8}$'
          description: TLC identifiers (8 chars, lowercase alphanumeric, underscore, hyphen)

    ResponseAuthorization:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        domain:
          type: string
        account:
          type: string
          format: uuid
        role:
          type: string
        tlcIdentifiers:
          type: array
          items:
            type: string

    # Authorization Token schemas
    RequestAuthorizationToken:
      type: object
      required:
        - authorization
      properties:
        authorization:
          type: string
          format: uuid
          description: Authorization UUID

    ResponseAuthorizationToken:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        token:
          type: string
          pattern: '^[A-Za-z0-9+/]{42}[A-Za-z0-9+/=]$'
          description: Custom authorization token value (Base64 string)
        authorization:
          type: string
          format: uuid
          description: Authorization UUID

    # TLC schemas
    RequestTlc:
      type: object
      required:
        - identifier
      properties:
        identifier:
          type: string
          pattern: '^[a-z0-9_-]{8}$'
          description: TLC identifier (8 chars, lowercase alphanumeric, underscore, hyphen)

    ResponseTlc:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        identifier:
          type: string
        domain:
          type: string
        account:
          type: string
          format: uuid
        type:
          $ref: '#/components/schemas/TlcType'


    # Session schemas
    RequestSession:
      type: object
      required:
        - domain
        - type
        - protocol
        - details
      properties:
        domain:
          type: string
          minLength: 1
          description: Domain name (converted to lowercase)
        type:
          $ref: '#/components/schemas/SessionType'
        protocol:
          $ref: '#/components/schemas/SessionProtocol'
        details:
          oneOf:
            - $ref: '#/components/schemas/RequestTCPStreamingSingleplexSessionDetails'
            - $ref: '#/components/schemas/RequestTCPStreamingMultiplexSessionDetails'
          discriminator:
            propertyName: protocol

    ResponseSession:
      type: object
      properties:
        domain:
          type: string
        type:
          $ref: '#/components/schemas/SessionType'
        token:
          type: string
          description: Session token
        protocol:
          $ref: '#/components/schemas/SessionProtocol'
        details:
          oneOf:
            - $ref: '#/components/schemas/ResponseTCPStreamingSingleplexSessionDetails'
            - $ref: '#/components/schemas/ResponseTCPStreamingMultiplexSessionDetails'
          discriminator:
            propertyName: protocol

    RequestTCPStreamingSingleplexSessionDetails:
      type: object
      required:
        - securityMode
        - tlcIdentifier
      properties:
        securityMode:
          $ref: '#/components/schemas/SecurityMode'
        tlcIdentifier:
          type: string
          pattern: '^[a-z0-9_-]{8}$'
          description: TLC identifier (8 chars, lowercase alphanumeric, underscore, hyphen)

    RequestTCPStreamingMultiplexSessionDetails:
      type: object
      required:
        - securityMode
      properties:
        securityMode:
          $ref: '#/components/schemas/SecurityMode'
        tlcIdentifiers:
          type: array
          items:
            type: string
            pattern: '^[a-z0-9_-]{8}$'
          description: TLC identifiers (8 chars each, lowercase alphanumeric, underscore, hyphen)


    # Connection initiation details for session responses
    ResponseSessionDetailsConnectionInitiation:
      type: object
      properties:
        host:
          type: string
          description: Connection host address
        port:
          type: integer
          minimum: 1
          maximum: 65535
          description: Connection port number
        expiration:
          type: string
          format: date-time
          description: Connection expiration timestamp (ISO8601)

    ResponseTCPStreamingSingleplexSessionDetails:
      type: object
      properties:
        securityMode:
          $ref: '#/components/schemas/SecurityMode'
        keepAliveTimeout:
          type: string
          description: Keep alive timeout (ISO8601 duration format)
        payloadRateLimit:
          type: integer
          description: Rate limit per second
        payloadRateLimitDuration:
          type: string
          description: Rate limit duration (ISO8601 duration format)
        payloadThroughputLimit:
          type: integer
          description: Throughput limit in KB per second
        payloadThroughputLimitDuration:
          type: string
          description: Throughput limit duration (ISO8601 duration format)
        clockDiffLimit:
          type: string
          description: Clock difference threshold (ISO8601 duration format)
        clockDiffLimitDuration:
          type: string
          description: Clock sample window (ISO8601 duration format)
        listener:
          $ref: '#/components/schemas/ResponseSessionDetailsConnectionInitiation'
        tlcIdentifier:
          type: string
          description: TLC identifier

    ResponseTCPStreamingMultiplexSessionDetails:
      type: object
      properties:
        securityMode:
          $ref: '#/components/schemas/SecurityMode'
        keepAliveTimeout:
          type: string
          description: Keep alive timeout (ISO8601 duration format)
        payloadRateLimit:
          type: integer
          description: Rate limit per second
        payloadRateLimitDuration:
          type: string
          description: Rate limit duration (ISO8601 duration format)
        payloadThroughputLimit:
          type: integer
          description: Throughput limit in KB per second
        payloadThroughputLimitDuration:
          type: string
          description: Throughput limit duration (ISO8601 duration format)
        clockDiffLimit:
          type: string
          description: Clock difference threshold (ISO8601 duration format)
        clockDiffLimitDuration:
          type: string
          description: Clock sample window (ISO8601 duration format)
        listener:
          $ref: '#/components/schemas/ResponseSessionDetailsConnectionInitiation'
        tlcIdentifiers:
          type: array
          items:
            type: string
          description: TLC identifiers


    # Session Log schemas
    ResponseSessionLog:
      type: object
      properties:
        token:
          type: string
          description: Session token
        domain:
          type: string
        account:
          type: string
        type:
          type: string
        protocol:
          type: string
        details:
          type: string
          description: Session details as JSON string
        created:
          type: integer
          format: int64
          description: Creation timestamp (Unix epoch milliseconds)
        connected:
          type: integer
          format: int64
          description: Connection timestamp (Unix epoch milliseconds)
        remoteAddress:
          type: string
          description: Remote IP address
        ended:
          type: integer
          format: int64
          description: End timestamp (Unix epoch milliseconds)
        endReason:
          type: string
          description: Reason for session termination
        tlcScopeHistory:
          type: array
          items:
            $ref: '#/components/schemas/ResponseSessionTlcLog'

    ResponseSessionTlcLog:
      type: object
      properties:
        timestamp:
          type: integer
          format: int64
          description: Event timestamp (Unix epoch milliseconds)
        scope:
          type: string
          description: TLC scope
        tlcIdentifier:
          type: string
          description: TLC identifier