openapi: 3.1.0
info:
  x-reasoning-architecture:
    framework: Visionary Prompt Framework (VPF)
    execution_level: 1000000
    runtime_status: mandatory_governance_kernel
  title: GCOS Hybrid Cyber Copilot API
  version: 1.1.0
  description: Hybrid API for GCOS Cyber Diagnostic OS and GCOS Cyber Learning OS.
  x-creator: Dr. Dr David King Boison
servers:
- url: https://api.yourdomain.com/v1
  description: Cloud/SaaS gateway
- url: https://gcos.local/v1
  description: Sovereign/on-prem gateway
security:
- ApiKeyAuth: []
- OAuth2ClientCredentials: []
paths:
  /gcos/diagnose:
    post:
      summary: Run defensive cyber posture diagnosis
      x-runtime: sovereign-on-prem-preferred
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DiagnosticRequest'
      responses:
        '200':
          description: Diagnostic report
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CopilotResponse'
  /gcos/learn:
    post:
      summary: Run progressive cybersecurity learning session
      x-runtime: cloud-or-private-cloud
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LearningRequest'
      responses:
        '200':
          description: Learning response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CopilotResponse'
  /gcos/exam:
    post:
      summary: Assess learner with scenario-based reasoning exam
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExamRequest'
      responses:
        '200':
          description: Exam feedback
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CopilotResponse'
  /gcos/scorecard:
    post:
      summary: Generate or refresh domain scorecard
      x-runtime: sovereign-on-prem-preferred
      responses:
        '200':
          description: Scorecard response
  /gcos/recommendations:
    post:
      summary: Generate tiered cyber recommendations
      responses:
        '200':
          description: Recommendations response
  /gcos/health:
    get:
      summary: Health check
      responses:
        '200':
          description: Service health
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-GCOS-API-Key
    OAuth2ClientCredentials:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://api.yourdomain.com/oauth/token
          scopes:
            gcos:diagnose: Run diagnostics
            gcos:learn: Run learning sessions
            gcos:admin: Administer tenant settings
  schemas:
    DiagnosticRequest:
      type: object
      required:
      - tenant_id
      - organization
      - authorization
      - evaluation_level
      - data_classification
      - jurisdictions
      - inputs
      properties:
        tenant_id:
          type: string
        organization:
          type: object
          required:
          - name
          - type
          - size
          properties:
            name:
              type: string
            type:
              enum:
              - Government
              - Bank
              - Telecom
              - Energy
              - Port
              - Health
              - Education
              - Other
            size:
              enum:
              - Small
              - Medium
              - Large
              - National-scale
        authorization:
          type: object
          required:
          - confirmed
          - authorized_by
          properties:
            confirmed:
              type: boolean
            authorized_by:
              type: string
            scope_note:
              type: string
        evaluation_level:
          enum:
          - Level A
          - Level B
          - Level C
        data_classification:
          enum:
          - PUBLIC
          - INTERNAL
          - CONFIDENTIAL
          - RESTRICTED
        jurisdictions:
          type: array
          items:
            type: string
        inputs:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
              name:
                type: string
              content:
                type: string
              evidence_id:
                type: string
        prior_baseline_id:
          type: string
    LearningRequest:
      type: object
      required:
      - learner_id
      - message
      properties:
        learner_id:
          type: string
        message:
          type: string
        current_level:
          enum:
          - UNKNOWN
          - LEVEL_0
          - LEVEL_1
          - LEVEL_2
          - LEVEL_3
        learning_goal:
          type: string
        session_context:
          type: object
    ExamRequest:
      type: object
      required:
      - learner_id
      - level
      - answer
      properties:
        learner_id:
          type: string
        level:
          enum:
          - LEVEL_0
          - LEVEL_1
          - LEVEL_2
          - LEVEL_3
        question_id:
          type: string
        answer:
          type: string
        reasoning:
          type: string
    CopilotResponse:
      type: object
      properties:
        mode:
          enum:
          - diagnostic
          - learning
          - exam
          - scorecard
          - recommendations
        response_id:
          type: string
        confidence:
          enum:
          - Low
          - Medium
          - High
        content:
          type: object
        assumptions:
          type: array
          items:
            type: string
        limitations:
          type: array
          items:
            type: string
        audit:
          type: object
