openapi: 3.0.3
info:
  title: EvoFirewall API
  version: 0.1.0
  description: Centralized firewall control plane
paths:
  /health:
    get:
      summary: Liveness
      responses:
        '200':
          description: OK
  /api/v1/dashboard:
    get:
      summary: Dashboard KPI
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Stats
  /api/v1/agents:
    get:
      summary: List agents
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Agents
  /api/v1/lists:
    get:
      summary: List IP lists
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Lists
    post:
      summary: Create IP list
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Created
  /api/v1/rules:
    get:
      summary: List policy rules
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Rules
    post:
      summary: Create policy rule
      security: [{ bearerAuth: [] }]
      responses:
        '200':
          description: Created
  /api/v1/audit:
    get:
      summary: Local audit log (dual-write source fw)
      security: [{ bearerAuth: [] }]
      parameters:
        - name: action
          in: query
          schema: { type: string }
        - name: severity
          in: query
          schema: { type: string, enum: [info, warning, critical] }
        - name: limit
          in: query
          schema: { type: integer, default: 200 }
      responses:
        '200':
          description: Audit entries
  /v1/agent/enroll:
    post:
      summary: Enroll agent (public + seed)
      responses:
        '201':
          description: Pending agent
  /v1/agent/policy:
    get:
      summary: Evaluated policy for agent
      security: [{ agentToken: [] }]
      responses:
        '200':
          description: Policy
  /v1/agent/apply-report:
    post:
      summary: Apply report + packet stats
      security: [{ agentToken: [] }]
      responses:
        '200':
          description: OK
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
    agentToken:
      type: http
      scheme: bearer