{"openapi":"3.1.0","info":{"title":"DataChef Agent Discovery API","version":"0.1.0","description":"Public AI-agent discovery documents and authenticated DataChef MCP JSON-RPC endpoint."},"servers":[{"url":"https://chef.threatco.io"}],"tags":[{"name":"Agent discovery","description":"Public discovery documents for AI agents and MCP clients."},{"name":"Account","description":"Authenticated B2C account/session and self-management routes."},{"name":"User data","description":"Authenticated user-scoped settings, connectors, webhooks, and data inventory."},{"name":"Admin","description":"Super-admin-only user and production auth readiness routes."},{"name":"MCP","description":"Authenticated JSON-RPC MCP transport."}],"paths":{"/llms.txt":{"get":{"tags":["Agent discovery"],"summary":"Compact LLM-readable DataChef guide","responses":{"200":{"description":"Plain text guide","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/llms-full.txt":{"get":{"tags":["Agent discovery"],"summary":"Full LLM-readable DataChef guide","responses":{"200":{"description":"Plain text guide","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/openapi.json":{"get":{"tags":["Agent discovery"],"summary":"OpenAPI document for DataChef agent discovery","responses":{"200":{"description":"OpenAPI 3.1 document","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/.well-known/mcp.json":{"get":{"tags":["Agent discovery"],"summary":"MCP client discovery document","responses":{"200":{"description":"MCP discovery metadata","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/auth/login":{"get":{"tags":["Account"],"summary":"Start Azure AD B2C sign-in","parameters":[{"name":"callbackUrl","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"302":{"description":"Redirects to Azure AD B2C authorization endpoint."},"302-missing-config":{"description":"Redirects to /auth/error when required B2C configuration is missing."}}}},"/auth/callback":{"get":{"tags":["Account"],"summary":"Azure AD B2C authorization callback","responses":{"302":{"description":"Creates a signed DataChef session and redirects into the portal or error page."}}},"post":{"tags":["Account"],"summary":"Azure AD B2C form_post authorization callback","responses":{"302":{"description":"Creates a signed DataChef session and redirects into the portal or error page."}}}},"/logout":{"get":{"tags":["Account"],"summary":"Sign out from DataChef and B2C","responses":{"302":{"description":"Clears the DataChef session cookie and redirects to the B2C logout endpoint when configured."}}}},"/api/account":{"get":{"tags":["Account"],"summary":"Current authenticated account","security":[{"b2cSession":[]}],"responses":{"200":{"description":"Current stored user record with B2C/Graph identity fields.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountResponse"}}}},"401":{"description":"Authentication required"}}},"delete":{"tags":["Account"],"summary":"Delete current DataChef account data","description":"Deletes the current user record and local user-owned DataChef files. When production Graph deletion is enabled, also attempts to delete the Azure AD B2C directory user by Graph ID or B2C OID. The response includes logoutUrl; browser form deletion redirects through /logout so the B2C browser session is ended. Deleted local accounts are blocked from later stale-cookie or B2C callback reactivation.","security":[{"b2cSession":[]}],"parameters":[{"name":"confirmEmail","in":"query","required":false,"schema":{"type":"string"},"description":"Email confirmation. JSON or form request bodies may also provide confirmEmail or email."}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAccountRequest"},"examples":{"confirm":{"value":{"confirmEmail":"user@example.com"}}}},"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/DeleteAccountRequest"}}}},"responses":{"200":{"description":"Local user data deleted and B2C directory deletion result included.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAccountResponse"}}}},"400":{"description":"Confirmation email did not match"},"401":{"description":"Authentication required"},"403":{"description":"Account deleted or forbidden"}}}},"/api/account/export":{"get":{"tags":["Account"],"summary":"Export current account-owned DataChef files","security":[{"b2cSession":[]}],"responses":{"200":{"description":"JSON export of user-owned DataChef files.","content":{"application/json":{"schema":{"type":"object"}}}},"401":{"description":"Authentication required"},"403":{"description":"Account deleted"}}}},"/api/webhooks":{"get":{"tags":["User data"],"summary":"List current user webhook endpoints without exposing secrets","description":"Returns user-owned webhook endpoint URLs, auth method, event filter, replay protection flag, TTL, and linked dataset status. Secret values are never returned.","security":[{"b2cSession":[]}],"responses":{"200":{"description":"User-owned webhook connector summaries.","content":{"application/json":{"schema":{"type":"object","properties":{"webhooks":{"type":"array","items":{"$ref":"#/components/schemas/WebhookEndpointSummary"}}}}}}},"401":{"description":"Authentication required"}}}},"/api/ingest/webhook/{slug}":{"post":{"tags":["User data"],"summary":"Receive an inbound webhook event for the owning B2C user","description":"Public network route. DataChef resolves the owning B2C user by webhook slug plus bearer/secret/HMAC match, then writes accepted events into that user-scoped dataset store. Replay protection uses common event ID headers or payload IDs and returns 409 for duplicates within the connector TTL.","parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"security":[{"webhookSecret":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"text/plain":{"schema":{"type":"string"}}}},"responses":{"202":{"description":"Event accepted or ignored by filter.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookIngestResponse"}}}},"401":{"description":"Webhook secret or HMAC signature is invalid."},"404":{"description":"Webhook connector not found."},"409":{"description":"Webhook event replay detected."}}}},"/api/admin/users":{"get":{"tags":["Admin"],"summary":"List local DataChef users, redacted per-user workspace overview, and optional B2C directory users","security":[{"b2cSession":[]}],"parameters":[{"name":"includeGraph","in":"query","required":false,"schema":{"type":"boolean","default":true}}],"responses":{"200":{"description":"Local user overviews plus optional Microsoft Graph directory user listing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminUsersResponse"}}}},"401":{"description":"Authentication required"},"403":{"description":"Super admin required or account deleted"}}}},"/api/admin/auth-readiness":{"get":{"tags":["Admin"],"summary":"Production B2C, Graph, super-admin object ID, account deletion, and Inboxr readiness for super admins","security":[{"b2cSession":[]}],"responses":{"200":{"description":"Non-secret production auth readiness checks.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthReadiness"}}}},"401":{"description":"Authentication required"},"403":{"description":"Super admin required or account deleted"}}}},"/api/mcp":{"post":{"tags":["MCP"],"summary":"DataChef MCP JSON-RPC endpoint","security":[{"mcpBearer":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JsonRpcRequest"},"examples":{"listTools":{"value":{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}},"callTool":{"value":{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"datachef.sources.discover","arguments":{}}}}}}}},"responses":{"200":{"description":"JSON-RPC response","content":{"application/json":{"schema":{"type":"object"}}}},"401":{"description":"Missing or invalid MCP bearer token"},"403":{"description":"Token scope does not permit requested tool"}}}}},"components":{"securitySchemes":{"b2cSession":{"type":"apiKey","in":"cookie","name":"datachef_session","description":"Signed DataChef session cookie created after Azure AD B2C login."},"mcpBearer":{"type":"http","scheme":"bearer","description":"MCP token created in the authenticated DataChef /agents console."}},"schemas":{"AccountResponse":{"type":"object","properties":{"user":{"$ref":"#/components/schemas/StoredUser"},"data":{"$ref":"#/components/schemas/AccountDataInventory"}}},"AccountDataInventory":{"type":"object","properties":{"exists":{"type":"boolean"},"fileCount":{"type":"number"},"totalBytes":{"type":"number"},"updatedAt":{"type":["string","null"],"format":"date-time"},"categories":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"label":{"type":"string"},"fileCount":{"type":"number"},"totalBytes":{"type":"number"},"updatedAt":{"type":["string","null"],"format":"date-time"},"files":{"type":"array","items":{"type":"string"}}}}}}},"DeleteAccountRequest":{"type":"object","properties":{"confirmEmail":{"type":"string","description":"Must match the signed-in account email."},"email":{"type":"string","description":"Accepted alias for confirmEmail."}}},"DeleteAccountResponse":{"type":"object","properties":{"deleted":{"$ref":"#/components/schemas/StoredUser"},"logoutUrl":{"type":"string","description":"Relative URL to visit after API deletion so the browser clears DataChef cookies and, when configured, passes through the B2C logout endpoint."},"b2cDelete":{"type":"object","properties":{"attempted":{"type":"boolean"},"deleted":{"type":"boolean"},"objectId":{"type":"string"},"error":{"type":"string"}}}}},"WebhookEndpointSummary":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"endpoint":{"type":"string","format":"uri"},"slug":{"type":"string"},"status":{"type":"string","enum":["connected","disconnected"]},"authMethod":{"type":"string"},"eventFilter":{"type":"string"},"replayProtection":{"type":"boolean"},"ttl":{"type":"string"},"secretConfigured":{"type":"boolean","description":"True when a webhook secret exists; the secret value is never returned."},"datasets":{"type":"array","items":{"type":"string"}},"recordsRaw":{"type":"number"},"lastSyncAt":{"type":["number","null"]}}},"WebhookIngestResponse":{"type":"object","properties":{"accepted":{"type":"boolean"},"connectorId":{"type":"string"},"datasetId":{"type":"string"},"rows":{"type":"number"}}},"AuthReadiness":{"type":"object","properties":{"readyForProd":{"type":"boolean"},"superAdminGraphLookup":{"$ref":"#/components/schemas/SuperAdminGraphLookup"},"redirectUris":{"type":"object","properties":{"callback":{"type":"string","format":"uri"},"postLogout":{"type":"string","format":"uri"}}},"missing":{"type":"array","items":{"type":"string"}},"checks":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"label":{"type":"string"},"ok":{"type":"boolean"},"detail":{"type":"string"}}}},"config":{"type":"object","properties":{"authMode":{"type":"string"},"requireB2C":{"type":"boolean"},"prodExposureEnabled":{"type":"boolean"},"publicUrl":{"type":"string"},"graphAdminConfigured":{"type":"boolean"},"deleteB2CAccountEnabled":{"type":"boolean"},"inboxrApiConfigured":{"type":"boolean"},"superAdminEmail":{"type":"string"},"superAdminObjectIds":{"type":"array","items":{"type":"string"}}}}}},"StoredUser":{"type":"object","properties":{"id":{"type":"string"},"email":{"type":"string"},"role":{"type":"string","enum":["superadmin","user"]},"oid":{"type":["string","null"]},"graphId":{"type":["string","null"]},"userPrincipalName":{"type":["string","null"]},"identitySource":{"type":["string","null"],"enum":["id_token","graph_me","sub",null]}}},"AdminUsersResponse":{"type":"object","properties":{"users":{"type":"array","items":{"$ref":"#/components/schemas/AdminUserOverview"}},"graph":{"type":"object","properties":{"configured":{"type":"boolean"},"error":{"type":"string"},"users":{"type":"array","items":{"$ref":"#/components/schemas/B2CGraphUser"}}}},"superAdminGraphLookup":{"$ref":"#/components/schemas/SuperAdminGraphLookup"}}},"SuperAdminGraphLookup":{"type":"object","description":"Direct Microsoft Graph lookup result for the configured super-admin email. Use objectId as DATACHEF_SUPER_ADMIN_OIDS when Graph proves a different B2C object ID.","properties":{"email":{"type":"string"},"configured":{"type":"boolean"},"matched":{"type":"boolean"},"objectId":{"type":["string","null"]},"displayName":{"type":["string","null"]},"accountEnabled":{"type":["boolean","null"]},"error":{"type":"string"}}},"B2CGraphUser":{"type":"object","properties":{"id":{"type":"string"},"displayName":{"type":["string","null"]},"mail":{"type":["string","null"]},"otherMails":{"type":["array","null"],"items":{"type":"string"}},"userPrincipalName":{"type":["string","null"]},"identities":{"type":["array","null"],"items":{"type":"object","properties":{"signInType":{"type":["string","null"]},"issuer":{"type":["string","null"]},"issuerAssignedId":{"type":["string","null"]}}}},"accountEnabled":{"type":["boolean","null"]},"createdDateTime":{"type":["string","null"]}}},"AdminUserOverview":{"type":"object","properties":{"user":{"$ref":"#/components/schemas/StoredUser"},"graphMatch":{"type":"object","description":"Redacted correlation between the local DataChef user and Microsoft Graph B2C directory users, when Graph listing is configured.","properties":{"matched":{"type":"boolean"},"matchType":{"type":"string","enum":["objectId","email","none"]},"id":{"type":"string"},"displayName":{"type":["string","null"]},"email":{"type":["string","null"]},"accountEnabled":{"type":["boolean","null"]}}},"data":{"$ref":"#/components/schemas/AccountDataInventory"},"workspace":{"type":"object","properties":{"workspaceName":{"type":"string"},"companyName":{"type":"string"},"region":{"type":"string"},"timezone":{"type":"string"}}},"aiProvider":{"type":"object","properties":{"provider":{"type":"string"},"model":{"type":"string"},"baseUrl":{"type":"string"},"organizationIdConfigured":{"type":"boolean"},"apiKeyConfigured":{"type":"boolean","description":"True when a key exists; the secret value is never returned."}}},"apiKeys":{"type":"object","properties":{"ingestKeyConfigured":{"type":"boolean"},"queryKeyConfigured":{"type":"boolean"},"webhookSecretConfigured":{"type":"boolean"}}},"counts":{"type":"object","properties":{"datasets":{"type":"number"},"connectors":{"type":"number"},"webhooks":{"type":"number"},"mcpTokens":{"type":"number"}}},"webhooks":{"type":"array","items":{"$ref":"#/components/schemas/WebhookEndpointSummary"}}}},"JsonRpcRequest":{"type":"object","required":["jsonrpc","id","method"],"properties":{"jsonrpc":{"type":"string","const":"2.0"},"id":{"oneOf":[{"type":"string"},{"type":"number"}]},"method":{"type":"string","enum":["initialize","tools/list","tools/call","resources/list","resources/read","prompts/list","prompts/get"]},"params":{"type":"object","properties":{"name":{"type":"string","enum":["datachef.display.card","datachef.display.table","datachef.sources.discover","datachef.query.plan","datachef.query.run","datachef.query.profile","datachef.query.explain","datachef.query.save_recipe","datachef.forms.discover","datachef.forms.inspect_source","datachef.forms.generate","datachef.forms.validate","datachef.forms.check_drift","datachef.forms.regenerate","datachef.forms.publish","datachef.forms.run","datachef.operator.delete_dataset","datachef.operator.delete_connector","datachef.operator.delete_api_service"]},"uri":{"type":"string"},"arguments":{"type":"object"}}}}}}},"x-datachef-mcp":{"endpoint":"https://chef.threatco.io/api/mcp","transport":"streamable-http-json","scopes":["mcp:read","mcp:query","mcp:execute","mcp:mutate","mcp:admin"],"tools":[{"name":"datachef.display.card","title":"Build a display card","group":"display","risk":"read","scope":"mcp:read","inputSchema":{"type":"object","properties":{"kind":{"type":"string","enum":["summary","metrics","table"]},"title":{"type":"string"},"subtitle":{"type":"string"},"facts":{"type":"array"},"metrics":{"type":"array"},"columns":{"type":"array"},"rows":{"type":"array"},"maxRows":{"type":"number"}}}},{"name":"datachef.display.table","title":"Build a display table","group":"display","risk":"read","scope":"mcp:read","inputSchema":{"type":"object","required":["columns","rows"],"properties":{"title":{"type":"string"},"columns":{"type":"array"},"rows":{"type":"array"},"maxRows":{"type":"number"}}}},{"name":"datachef.sources.discover","title":"Discover queryable DataChef sources","group":"super-query","risk":"read","scope":"mcp:read","inputSchema":{"type":"object","properties":{}}},{"name":"datachef.query.plan","title":"Plan a bounded query","group":"super-query","risk":"read","scope":"mcp:query","inputSchema":{"type":"object","properties":{"objective":{"type":"string"},"selectedSources":{"type":"array"},"rowLimit":{"type":"number"},"lang":{"type":"string","enum":["sql","kql"]},"constraints":{"type":"array","items":{"type":"string"}}}}},{"name":"datachef.query.run","title":"Run a bounded super query","group":"super-query","risk":"execute","scope":"mcp:query","inputSchema":{"type":"object","required":["queryText"],"properties":{"lang":{"type":"string","enum":["sql","kql"]},"queryText":{"type":"string"},"recipeId":{"type":"string"},"sources":{"type":"array"},"variables":{"type":"object"},"timeWindow":{"type":"string"},"rowLimit":{"type":"number"}}}},{"name":"datachef.query.profile","title":"Profile query results","group":"super-query","risk":"execute","scope":"mcp:query","inputSchema":{"type":"object","properties":{"queryText":{"type":"string"},"sources":{"type":"array"},"rowLimit":{"type":"number"}}}},{"name":"datachef.query.explain","title":"Explain query execution","group":"super-query","risk":"execute","scope":"mcp:query","inputSchema":{"type":"object","properties":{"queryText":{"type":"string"},"sources":{"type":"array"},"recipeId":{"type":"string"}}}},{"name":"datachef.query.save_recipe","title":"Save query recipe","group":"super-query","risk":"mutate","scope":"mcp:mutate","inputSchema":{"type":"object","required":["queryText"],"properties":{"name":{"type":"string"},"description":{"type":"string"},"queryText":{"type":"string"},"sources":{"type":"array"},"variables":{"type":"array"}}}},{"name":"datachef.forms.discover","title":"Discover Smart Forms","group":"smart-forms","risk":"read","scope":"mcp:read","inputSchema":{"type":"object","properties":{}}},{"name":"datachef.forms.inspect_source","title":"Inspect a form source","group":"smart-forms","risk":"execute","scope":"mcp:query","inputSchema":{"type":"object","required":["sourceType","sourceId"],"properties":{"sourceType":{"type":"string","enum":["dataset","connector","api-service","recipe"]},"sourceId":{"type":"string"},"resource":{"type":"string"},"endpointPath":{"type":"string"},"method":{"type":"string"},"rowLimit":{"type":"number"}}}},{"name":"datachef.forms.generate","title":"Generate a Smart Form definition","group":"smart-forms","risk":"execute","scope":"mcp:query","inputSchema":{"type":"object","required":["sourceType","sourceId"],"properties":{"sourceType":{"type":"string"},"sourceId":{"type":"string"},"name":{"type":"string"},"mode":{"type":"string"}}}},{"name":"datachef.forms.validate","title":"Validate a Smart Form definition","group":"smart-forms","risk":"read","scope":"mcp:query","inputSchema":{"type":"object","required":["definition"],"properties":{"definition":{"type":"object"}}}},{"name":"datachef.forms.check_drift","title":"Check Smart Form source drift","group":"smart-forms","risk":"read","scope":"mcp:query","inputSchema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"},"persist":{"type":"boolean"}}}},{"name":"datachef.forms.regenerate","title":"Regenerate Smart Form draft","group":"smart-forms","risk":"mutate","scope":"mcp:mutate","inputSchema":{"type":"object","required":["id","confirm"],"properties":{"id":{"type":"string"},"confirm":{"type":"boolean"}}}},{"name":"datachef.forms.publish","title":"Publish a Smart Form","group":"smart-forms","risk":"mutate","scope":"mcp:mutate","inputSchema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"},"confirm":{"type":"boolean"}}}},{"name":"datachef.forms.run","title":"Run a Smart Form action","group":"smart-forms","risk":"execute","scope":"mcp:execute","inputSchema":{"type":"object","required":["id"],"properties":{"id":{"type":"string"},"actionId":{"type":"string"},"filters":{"type":"object"},"values":{"type":"object"},"confirm":{"type":"boolean"}}}},{"name":"datachef.operator.delete_dataset","title":"Delete dataset","group":"operator","risk":"destructive","scope":"mcp:mutate","inputSchema":{"type":"object","required":["id","confirm"],"properties":{"id":{"type":"string"},"confirm":{"type":"boolean"}}}},{"name":"datachef.operator.delete_connector","title":"Delete connector","group":"operator","risk":"destructive","scope":"mcp:mutate","inputSchema":{"type":"object","required":["id","confirm"],"properties":{"id":{"type":"string"},"confirm":{"type":"boolean"}}}},{"name":"datachef.operator.delete_api_service","title":"Delete API service","group":"operator","risk":"destructive","scope":"mcp:mutate","inputSchema":{"type":"object","required":["id","confirm"],"properties":{"id":{"type":"string"},"confirm":{"type":"boolean"}}}}]}}