definitions:
  auth.AuthResponse:
    properties:
      refresh_token:
        example: dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4=
        type: string
      token:
        example: eyJhbGciOiJIUzI1NiIs...
        type: string
      user:
        $ref: '#/definitions/auth.UserPublic'
    type: object
  auth.ErrorResponse:
    properties:
      error:
        example: invalid email or password
        type: string
    type: object
  auth.LoginRequest:
    properties:
      email:
        example: john@example.com
        type: string
      password:
        example: secret123
        type: string
    required:
    - email
    - password
    type: object
  auth.LogoutRequest:
    properties:
      refresh_token:
        example: dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4=
        type: string
    required:
    - refresh_token
    type: object
  auth.PasswordChangeRequest:
    properties:
      new_password:
        example: NewSecret456!
        minLength: 8
        type: string
      old_password:
        example: Secret123!
        type: string
    required:
    - new_password
    - old_password
    type: object
  auth.RefreshRequest:
    properties:
      refresh_token:
        example: dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4=
        type: string
    required:
    - refresh_token
    type: object
  auth.RegisterRequest:
    properties:
      email:
        example: john@example.com
        type: string
      password:
        example: Secret123!
        minLength: 8
        type: string
      username:
        example: john
        maxLength: 30
        minLength: 3
        type: string
    required:
    - email
    - password
    - username
    type: object
  auth.UpdateProfileRequest:
    properties:
      username:
        example: john_updated
        maxLength: 30
        minLength: 3
        type: string
    required:
    - username
    type: object
  auth.UserPublic:
    properties:
      created_at:
        type: string
      email:
        type: string
      id:
        type: string
      username:
        type: string
    type: object
  auth.UserResponse:
    properties:
      user:
        $ref: '#/definitions/auth.UserPublic'
    type: object
  org.CreateOrgRequest:
    properties:
      name:
        example: My Corp
        maxLength: 100
        minLength: 2
        type: string
      slug:
        example: my-corp
        maxLength: 50
        minLength: 2
        type: string
    required:
    - name
    - slug
    type: object
  org.ErrorResponse:
    properties:
      error:
        type: string
    type: object
  org.OrgListResponse:
    properties:
      organizations:
        items:
          $ref: '#/definitions/org.Organization'
        type: array
      total:
        type: integer
    type: object
  org.OrgResponse:
    properties:
      organization:
        $ref: '#/definitions/org.Organization'
    type: object
  org.Organization:
    properties:
      created_at:
        type: string
      id:
        type: string
      name:
        type: string
      slug:
        type: string
      updated_at:
        type: string
    type: object
  org.UpdateOrgRequest:
    properties:
      name:
        example: My Corp Updated
        maxLength: 100
        minLength: 2
        type: string
    required:
    - name
    type: object
info:
  contact: {}
  description: API for AegisGuard control plane
  title: AegisGuard API
  version: "1.0"
paths:
  /api/auth/login:
    post:
      consumes:
      - application/json
      description: Authenticate user with email and password, returns JWT token
      parameters:
      - description: Login credentials
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.LoginRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/auth.AuthResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      summary: Login
      tags:
      - auth
  /api/auth/logout:
    post:
      consumes:
      - application/json
      description: Invalidate a refresh token (logout)
      parameters:
      - description: Refresh token to invalidate
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.LogoutRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties:
              type: string
            type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      summary: Logout
      tags:
      - auth
  /api/auth/me:
    get:
      consumes:
      - application/json
      description: Get authenticated user's profile
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/auth.UserResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      security:
      - Bearer: []
      summary: Get current user
      tags:
      - auth
    put:
      consumes:
      - application/json
      description: Update current user's username
      parameters:
      - description: Profile update
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.UpdateProfileRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/auth.UserResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      security:
      - Bearer: []
      summary: Update profile
      tags:
      - auth
  /api/auth/password:
    put:
      consumes:
      - application/json
      description: Change current user's password
      parameters:
      - description: Password change details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.PasswordChangeRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties:
              type: string
            type: object
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      security:
      - Bearer: []
      summary: Change password
      tags:
      - auth
  /api/auth/refresh:
    post:
      consumes:
      - application/json
      description: Get a new access token using a refresh token
      parameters:
      - description: Refresh token
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.RefreshRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/auth.AuthResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      summary: Refresh token
      tags:
      - auth
  /api/auth/register:
    post:
      consumes:
      - application/json
      description: Create user account with username, email, password
      parameters:
      - description: Registration details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/auth.RegisterRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/auth.AuthResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/auth.ErrorResponse'
      summary: Register
      tags:
      - auth
  /api/organizations:
    get:
      consumes:
      - application/json
      description: Get all organizations
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/org.OrgListResponse'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/org.ErrorResponse'
      security:
      - Bearer: []
      summary: List organizations
      tags:
      - organizations
    post:
      consumes:
      - application/json
      description: Create a new organization
      parameters:
      - description: Organization details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/org.CreateOrgRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/org.OrgResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/org.ErrorResponse'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/org.ErrorResponse'
      security:
      - Bearer: []
      summary: Create organization
      tags:
      - organizations
  /api/organizations/{id}:
    delete:
      consumes:
      - application/json
      description: Delete an organization
      parameters:
      - description: Organization ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            additionalProperties:
              type: string
            type: object
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/org.ErrorResponse'
      security:
      - Bearer: []
      summary: Delete organization
      tags:
      - organizations
    get:
      consumes:
      - application/json
      description: Get organization details
      parameters:
      - description: Organization ID
        in: path
        name: id
        required: true
        type: string
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/org.OrgResponse'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/org.ErrorResponse'
      security:
      - Bearer: []
      summary: Get organization by ID
      tags:
      - organizations
    put:
      consumes:
      - application/json
      description: Update organization name
      parameters:
      - description: Organization ID
        in: path
        name: id
        required: true
        type: string
      - description: New organization details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/org.UpdateOrgRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/org.OrgResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/org.ErrorResponse'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/org.ErrorResponse'
      security:
      - Bearer: []
      summary: Update organization
      tags:
      - organizations
schemes:
- http
securityDefinitions:
  Bearer:
    description: Type "Bearer" followed by a space and the JWT token.
    in: header
    name: Authorization
    type: apiKey
swagger: "2.0"