snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

api/v4/source/access_control.yaml

@@ -0,0 +1,718 @@
+  /api/v4/access_control_policies:
+    put:
+      tags:
+        - access control
+      summary: Create an access control policy
+      description: |
+        Creates a new access control policy.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: CreateAccessControlPolicy
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AccessControlPolicy"
+      responses:
+        "200":
+          description: Access control policy created successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlPolicy"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/check:
+    post:
+      tags:
+        - access control
+      summary: Check an access control policy expression
+      description: |
+        Checks the syntax and validity of an access control policy expression.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: CheckAccessControlPolicyExpression
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                expression:
+                  type: string
+                  description: The expression to check.
+      responses:
+        "200":
+          description: Expression check result.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ExpressionError"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/validate_requester:
+    post:
+      tags:
+        - access control
+      summary: Validate if the current user matches a CEL expression
+      description: |
+        Validates whether the current authenticated user matches the given CEL expression.
+        This is used to determine if a channel admin can test expressions they match.
+        ##### Permissions
+        Must have `manage_system` permission OR be a channel admin for the specified channel (channelId required for channel admins).
+      operationId: ValidateExpressionAgainstRequester
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                expression:
+                  type: string
+                  description: The CEL expression to validate against the current user.
+                channelId:
+                  type: string
+                  description: The channel ID for channel-specific permission checks (required for channel admins).
+              required:
+                - expression
+      responses:
+        "200":
+          description: Validation result returned successfully.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  requester_matches:
+                    type: boolean
+                    description: Whether the current user matches the expression.
+                required:
+                  - requester_matches
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/test:
+    post:
+      tags:
+        - access control
+      summary: Test an access control policy expression
+      description: |
+        Tests an access control policy expression against users to see who would be affected.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: TestAccessControlPolicyExpression
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/QueryExpressionParams"
+      responses:
+        "200":
+          description: Expression test result.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlPolicyTestResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/simulate_users:
+    post:
+      tags:
+        - access control
+      summary: Simulate an access control policy decision for an explicit user list
+      description: |
+        Runs the dual-lane PDP simulation against a draft (unsaved) access
+        control policy for an explicit set of users (with optional per-user
+        session-attribute overrides). The server compiles the draft
+        in-memory, layers on persisted higher-scoped permission policies,
+        and returns per-user, per-action ALLOW/DENY decisions plus blame
+        attribution for any deny.
+
+        Backs the picker-driven "Simulate access" UX in the System Console
+        and Channel Settings so authors can see how a draft interacts with
+        persisted higher-scoped policies before saving.
+
+        Gated by the `PermissionPolicies` feature flag and the Enterprise
+        Advanced license. Returns 501 (Not Implemented) when either is
+        missing.
+
+        ##### Permissions
+        Must have the `manage_system` permission, OR be a team admin with
+        `manage_team_access_rules` on the request's `team_id` (when any
+        provided `channel_id` resolves to a channel in that team), OR be a
+        channel admin with `manage_channel_access_rules` on the request's
+        `channel_id`.
+      operationId: SimulateAccessControlPolicyForUsers
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PolicySimulationByUsersParams"
+      responses:
+        "200":
+          description: Per-user, per-action simulation results.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PolicySimulationResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/access_control_policies/search:
+    post:
+      tags:
+        - access control
+      summary: Search access control policies
+      description: |
+        Searches for access control policies based on given criteria.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: SearchAccessControlPolicies
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AccessControlPolicySearch"
+      responses:
+        "200":
+          description: Search results for access control policies.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlPoliciesWithCount"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/autocomplete/fields:
+    get:
+      tags:
+        - access control
+      summary: Get autocomplete fields for access control policies
+      description: |
+        Provides a list of fields that can be used for autocompletion when creating/editing access control policy expressions.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: GetAccessControlPolicyAutocompleteFields
+      parameters:
+        - name: after
+          in: query
+          description: The field ID to start after for pagination.
+          required: false
+          schema:
+            type: string
+        - name: limit
+          in: query
+          description: The maximum number of fields to return.
+          required: true
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Autocomplete fields retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlFieldsAutocompleteResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}":
+    get:
+      tags:
+        - access control
+      summary: Get an access control policy
+      description: |
+        Gets a specific access control policy by its ID.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: GetAccessControlPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Access control policy retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlPolicy"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+    delete:
+      tags:
+        - access control
+      summary: Delete an access control policy
+      description: |
+        Deletes an access control policy by its ID.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: DeleteAccessControlPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Access control policy deleted successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}/activate":
+    get:
+      deprecated: true
+      tags:
+        - access control
+      summary: Activate or deactivate an access control policy
+      description: |
+        Updates the active status of an access control policy.
+
+        **Deprecated:** This endpoint will be removed in a future release. Use the dedicated access control policy update endpoint instead.
+        Link: </api/v4/access_control_policies/activate>; rel="successor-version"
+
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: UpdateAccessControlPolicyActiveStatus
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      - name: active
+        in: query
+        description: Set to "true" to activate, "false" to deactivate.
+        required: true
+        schema:
+          type: boolean
+      responses:
+        "200":
+          description: Policy active status updated successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}/assign":
+    post:
+      tags:
+        - access control
+      summary: Assign an access control policy to channels or teams
+      description: |
+        Assigns an access control policy to a list of channels and/or teams.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: AssignAccessControlPolicyToChannels
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                channel_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: The IDs of the channels to assign the policy to.
+                team_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: >
+                    The IDs of the teams to assign the policy to. Requires the
+                    `manage_system` permission. Any unknown team ID is rejected
+                    with a 400.
+      responses:
+        "200":
+          description: Policy assigned to the channels and/or teams successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}/unassign":
+    delete:
+      tags:
+        - access control
+      summary: Unassign an access control policy from channels or teams
+      description: |
+        Unassigns an access control policy from a list of channels and/or teams.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: UnassignAccessControlPolicyFromChannels
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                channel_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: The IDs of the channels to unassign the policy from.
+                team_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: >
+                    The IDs of the teams to unassign the policy from. Requires the
+                    `manage_system` permission. Any unknown team ID is rejected
+                    with a 400.
+      responses:
+        "200":
+          description: Policy unassigned from the channels and/or teams successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}/resources/channels":
+    get:
+      tags:
+        - access control
+      summary: Get channels for an access control policy
+      description: |
+        Retrieves a paginated list of channels to which a specific access control policy is applied.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: GetChannelsForAccessControlPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      - name: after
+        in: query
+        description: The channel ID to start after for pagination.
+        required: false
+        schema:
+          type: string
+      - name: limit
+        in: query
+        description: The maximum number of channels to return.
+        required: true
+        schema:
+          type: integer
+          default: 60
+      responses:
+        "200":
+          description: Channels retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelsWithCount"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/access_control_policies/{policy_id}/resources/channels/search":
+    post:
+      tags:
+        - access control
+      summary: Search channels for an access control policy
+      description: |
+        Searches for channels associated with a specific access control policy based on search criteria.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: SearchChannelsForAccessControlPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the access control policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ChannelSearch"
+      responses:
+        "200":
+          description: Channel search results retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelsWithCount"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/channels/{channel_id}/access_control/attributes":
+    get:
+      tags:
+        - access control
+        - channels
+      summary: Get access control attributes for a channel
+      description: |
+        Retrieves the effective access control policy attributes for a specific channel.
+        This can be used to understand what attributes are currently being applied to the channel by the access control system.
+        ##### Permissions
+        Must have `read_channel` permission for the specified channel.
+      operationId: GetChannelAccessControlAttributes
+      parameters:
+        - name: channel_id
+          in: path
+          description: The ID of the channel.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Access control attributes retrieved successfully.
+          content:
+            application/json:
+              schema:
+                type: object # Placeholder - define more specifically if the structure is known
+                additionalProperties: true
+                description: A map of attribute names to their values as applied to the channel.
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/cel/visual_ast:
+    post:
+      tags:
+        - access control
+      summary: Get the visual AST for a CEL expression
+      description: |
+        Retrieves the visual AST for a CEL expression.
+        ##### Permissions
+        Must have the `manage_system` permission.
+      operationId: GetCELVisualAST
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CELExpression"
+      responses:
+        "200":
+          description: Visual AST retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/VisualExpression" 
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/access_control_policies/activate:
+    put:
+      tags:
+        - access control
+      summary: Activate or deactivate access control policies
+      description: |
+        Updates the active status of access control policies.
+
+        ##### Permissions
+        Must have the `manage_system` permission. OR be a channel admin with manage_channel_access_rules permission for the specified channels.
+      operationId: UpdateAccessControlPoliciesActive
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AccessControlPolicyActiveUpdateRequest"
+      responses:
+        "200":
+          description: Access control policies active status updated successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AccessControlPolicy"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/access_control/decisions/actions/search:
+    post:
+      tags:
+        - access control
+      summary: Search allowed actions for the current user (render-time decision)
+      description: |
+        Returns non-authoritative, render-time ABAC decisions for the current
+        session user on a given resource and set of actions. Use these decisions
+        to decide whether to show or hide UI controls before the user attempts
+        an action.
+
+        The subject is always the authenticated session user; there is no way to
+        probe another user's decisions. Server-side enforcement always re-evaluates
+        the full policy on the actual request and remains the source of truth.
+
+        Gated by the `PermissionPolicies` feature flag and an Enterprise license.
+        When ABAC is inactive for the resource, every action is returned as
+        `allowed: true, evaluated: true`.
+
+        ##### Permissions
+        Must be authenticated (any logged-in user).
+      operationId: SearchAccessControlDecisionActions
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ActionSearchRequest"
+      responses:
+        "200":
+          description: Render-time action decisions returned successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ActionSearchResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/actions.yaml

@@ -0,0 +1,374 @@
+  /api/v4/actions/dialogs/open:
+    post:
+      tags:
+        - integration_actions
+      summary: Open a dialog
+      description: >
+        Open an interactive dialog using a trigger ID provided by a slash
+        command, or some other action payload. See
+        https://docs.mattermost.com/developer/interactive-dialogs.html for more
+        information on interactive dialogs.
+
+
+        Up to 3 interactive dialogs may be open at once (minimum server version
+        11.10). Additional `open_dialog` events beyond this limit are silently
+        ignored by the client.
+
+        __Minimum server version: 5.6__
+      operationId: OpenInteractiveDialog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - trigger_id
+                - url
+                - dialog
+              properties:
+                trigger_id:
+                  type: string
+                  description: Trigger ID provided by other action
+                url:
+                  type: string
+                  description: The URL to send the submitted dialog payload to
+                dialog:
+                  type: object
+                  required:
+                    - title
+                    - elements
+                  description: Post object to create
+                  properties:
+                    callback_id:
+                      type: string
+                      description: Set an ID that will be included when the dialog is
+                        submitted
+                    title:
+                      type: string
+                      description: Title of the dialog
+                    introduction_text:
+                      type: string
+                      description: Markdown formatted introductory paragraph
+                    elements:
+                      type: array
+                      description: >
+                        Input elements, see
+                        https://docs.mattermost.com/developer/interactive-dialogs.html#elements.
+                        Supported element types include `text`, `textarea`, `select`,
+                        `radio`, `bool`, `checkbox_group`, `checkbox_matrix`, and
+                        `action_button`.
+
+
+                        An `action_button` element (minimum server version 11.10) renders a
+                        clickable button — fields: `name`, `display_name`, `type` set to
+                        "action_button", and an `action_button` object with a required `url`
+                        (must be a valid lookup URL) and optional `context` (string map).
+                        Clicking it calls `POST /api/v4/actions/dialogs/execute`.
+                        `action_button` elements are not included in the dialog submission
+                        payload.
+
+
+                        A `checkbox_group` element (minimum server version 11.10) renders a
+                        multi-select list of checkboxes. It uses `options` (array of `{text,
+                        value}`, up to 50) and an optional `default` of comma-separated option
+                        values. It must not set `data_source` or `placeholder`. The submitted
+                        value is an array of the selected option values.
+
+
+                        A `checkbox_matrix` element (minimum server version 11.10) renders a
+                        grid of checkboxes. Instead of `options` it uses a `matrix_config`
+                        object with `rows` and `columns` (each an array of `{text, value}`;
+                        up to 30 rows and 10 columns) and an optional `row_selection` of
+                        `"multiple"` (default) or `"single"` (at most one column selectable
+                        per row). The optional `default` is a `;`-separated list of
+                        `"rowValue:col1,col2"` entries. It must not set `options`,
+                        `data_source`, or `placeholder`. The submitted value is an array of
+                        the same `"rowValue:col1,col2"` entries. Row and column values must
+                        not contain `:`, `,`, or `;`.
+
+
+                        `checkbox_group`, `radio`, and `bool` elements accept an optional
+                        `label_position` of `"before"` or `"after"` (default `"after"`)
+                        controlling whether the option label renders before or after its
+                        input.
+                      items:
+                        type: object
+                    submit_label:
+                      type: string
+                      description: Label on the submit button
+                    notify_on_cancel:
+                      type: boolean
+                      description: Set true to receive payloads when user cancels a dialog
+                    state:
+                      type: string
+                      description: Set some state to be echoed back with the dialog
+                        submission
+        description: Metadata for the dialog to be opened
+        required: true
+      responses:
+        "200":
+          description: Dialog open successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+  /api/v4/actions/dialogs/submit:
+    post:
+      tags:
+        - integration_actions
+      summary: Submit a dialog
+      description: >
+        Endpoint used by the Mattermost clients to submit a dialog. See
+        https://docs.mattermost.com/developer/interactive-dialogs.html for more
+        information on interactive dialogs.
+
+        __Minimum server version: 5.6__
+      operationId: SubmitInteractiveDialog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - url
+                - submission
+                - channel_id
+              properties:
+                url:
+                  type: string
+                  description: The URL to send the submitted dialog payload to
+                channel_id:
+                  type: string
+                  description: Channel ID the user submitted the dialog from
+                team_id:
+                  type: string
+                  description: >
+                    Optional. The server resolves the authoritative team from the
+                    channel, so a client-supplied value is ignored. Empty for DM/GM
+                    channels (which have no team).
+                submission:
+                  type: object
+                  description: String map where keys are element names and values are the
+                    element input values
+                callback_id:
+                  type: string
+                  description: Callback ID sent when the dialog was opened
+                state:
+                  type: string
+                  description: State sent when the dialog was opened
+                cancelled:
+                  type: boolean
+                  description: Set to true if the dialog was cancelled
+                file_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: >
+                    List of file IDs uploaded as part of the dialog submission.
+                    Each file must have been uploaded by the submitting user. A
+                    maximum of 10 file IDs may be submitted.
+        description: Dialog submission data
+        required: true
+      responses:
+        "200":
+          description: Dialog submission successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "429":
+          description: The upstream integration rate-limited the request. The
+            original status code is preserved so clients can honor retry
+            semantics.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+        "502":
+          description: The upstream integration returned a 5xx (other than 503).
+            Surfaced as Bad Gateway because the failure is upstream of Mattermost.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+        "503":
+          description: The upstream integration is unavailable. The original
+            status code is preserved so clients can honor retry semantics.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+  /api/v4/actions/dialogs/lookup:
+    post:
+      tags:
+        - integration_actions
+      summary: Lookup dialog elements
+      description: >
+        Endpoint used by the Mattermost clients to lookup dynamic dialog
+        elements. See https://docs.mattermost.com/developer/interactive-dialogs.html
+        for more information on interactive dialogs.
+
+        __Minimum server version: 11.0__
+      operationId: LookupInteractiveDialog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - url
+                - submission
+                - channel_id
+              properties:
+                url:
+                  type: string
+                  description: The URL to send the lookup request to
+                channel_id:
+                  type: string
+                  description: Channel ID the user is performing the lookup from
+                team_id:
+                  type: string
+                  description: >
+                    Optional. The server resolves the authoritative team from the
+                    channel, so a client-supplied value is ignored. Empty for DM/GM
+                    channels (which have no team).
+                submission:
+                  type: object
+                  description: String map where keys are element names and values are the
+                    element input values
+                callback_id:
+                  type: string
+                  description: Callback ID sent when the dialog was opened
+                state:
+                  type: string
+                  description: State sent when the dialog was opened
+        description: Dialog lookup request data
+        required: true
+      responses:
+        "200":
+          description: Dialog lookup successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  options:
+                    type: array
+                    description: List of options returned from the lookup
+                    items:
+                      type: object
+                      properties:
+                        text:
+                          type: string
+                          description: Display text for the option
+                        value:
+                          type: string
+                          description: Value for the option
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "429":
+          description: The upstream integration rate-limited the request. The
+            original status code is preserved so clients can honor retry
+            semantics.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+        "502":
+          description: The upstream integration returned a 5xx (other than 503).
+            Surfaced as Bad Gateway because the failure is upstream of Mattermost.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+        "503":
+          description: The upstream integration is unavailable. The original
+            status code is preserved so clients can honor retry semantics.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+  /api/v4/actions/dialogs/execute:
+    post:
+      tags:
+        - integration_actions
+      summary: Execute a dialog action button
+      description: >
+        Endpoint used by the Mattermost clients when a user clicks an
+        `action_button` element inside an interactive dialog. The server
+        generates a new trigger ID and forwards the button's context to the
+        integration URL; the integration can then open a child (stacked) dialog
+        with that trigger ID. See
+        https://docs.mattermost.com/developer/interactive-dialogs.html for more
+        information on interactive dialogs.
+
+
+        This request is always processed server-side. The client caps the number
+        of simultaneously open interactive dialogs at 3, so if the resulting
+        `open_dialog` event would exceed that limit the client silently skips
+        rendering the additional dialog.
+
+
+        __Minimum server version: 11.10__
+      operationId: ExecuteDialogAction
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - url
+                - channel_id
+              properties:
+                url:
+                  type: string
+                  description: The action button URL to send the action payload to.
+                    Must be a valid lookup URL.
+                context:
+                  type: object
+                  description: String map of context values configured on the action
+                    button, forwarded to the integration
+                channel_id:
+                  type: string
+                  description: Channel ID the user clicked the action button from
+                team_id:
+                  type: string
+                  description: >
+                    Optional. The server resolves the authoritative team from the
+                    channel, so a client-supplied value is ignored. Empty for DM/GM
+                    channels (which have no team).
+        description: Dialog action button execution data
+        required: true
+      responses:
+        "200":
+          description: Dialog action executed successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    description: Status of the request ("OK")
+                  trigger_id:
+                    type: string
+                    description: New trigger ID the integration can use to open a child
+                      dialog
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/agents.yaml

@@ -0,0 +1,80 @@
+  /api/v4/agents:
+    get:
+      tags:
+        - agents
+      summary: Get available agents
+      description: >
+        Retrieve all available agents from the plugin's bridge API.
+        If a user ID is provided, only agents accessible to that user are returned.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetAgents
+      responses:
+        "200":
+          description: Agents retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AgentsResponse"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/agents/status:
+    get:
+      tags:
+        - agents
+      summary: Get agents bridge status
+      description: >
+        Retrieve the status of the AI plugin bridge.
+        Returns availability boolean and a reason code if unavailable.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetAgentsStatus
+      responses:
+        "200":
+          description: Status retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AgentsIntegrityResponse"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/llmservices:
+    get:
+      tags:
+        - agents
+      summary: Get available LLM services
+      description: >
+        Retrieve all available LLM services from the plugin's bridge API.
+        If a user ID is provided, only services accessible to that user
+        (via their permitted bots) are returned.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetLLMServices
+      responses:
+        "200":
+          description: LLM services retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ServicesResponse"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+

api/v4/source/audit_logging.yaml

@@ -0,0 +1,68 @@
+  /api/v4/audit_logs/certificate:
+    post:
+      tags:
+        - audit_logs
+      summary: Upload audit log certificate
+      description: |
+        Upload the certificate to be used for TLS verification with the audit log service.
+
+        ##### Permissions
+        Must have `sysconsole_write_experimental_features` permission.
+
+        __Minimum server version__: 10.9
+      operationId: AddAuditLogCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The certificate file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: Certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+
+    delete:
+      tags:
+        - audit_logs
+      summary: Remove audit log certificate
+      description: |
+        Delete the current certificate being used with the audit log service.
+
+        ##### Permissions
+        Must have `sysconsole_write_experimental_features` permission.
+
+        __Minimum server version__: 9.5
+      operationId: RemoveAuditLogCertificate
+      responses:
+        "200":
+          description: Certificate deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/boards.yaml

@@ -0,0 +1,73 @@
+  "/api/v4/boards":
+    post:
+      tags:
+        - boards
+      summary: Create a board channel
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Create a new board channel. Boards are channels with a kanban view backed
+        by linked properties (status and assignee by default), and live alongside
+        regular channels but cannot be created or modified through the
+        `/api/v4/channels` endpoints.
+
+        The request body is a `Channel` object whose `type` must be `BO`
+        (open board) or `BP` (private board). `team_id` and `display_name` are
+        required.
+
+        This endpoint is gated behind the `IntegratedBoards` feature flag. When
+        the flag is off, the route is not registered and requests return `404`.
+
+        ##### Permissions
+        Must have `create_public_channel` for type `BO`, or
+        `create_private_channel` for type `BP`, on the target team.
+      operationId: CreateBoard
+      requestBody:
+        required: true
+        description: Board channel to be created
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - team_id
+                - type
+                - display_name
+              properties:
+                team_id:
+                  type: string
+                  description: The team ID the board belongs to
+                type:
+                  type: string
+                  enum: [BO, BP]
+                  description: |
+                    The board channel type.
+                    * `BO` - open board (visible to all team members)
+                    * `BP` - private board (visible to invited members)
+                display_name:
+                  type: string
+                  description: Human-readable name shown in the UI. Must not be empty.
+                name:
+                  type: string
+                  description: URL-safe channel name. Auto-generated if omitted.
+                header:
+                  type: string
+                purpose:
+                  type: string
+      responses:
+        "201":
+          description: Board channel creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Channel"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/bookmarks.yaml

@@ -0,0 +1,291 @@
+  /api/v4/channels/{channel_id}/bookmarks:
+    get:
+      tags:
+        - bookmarks
+      summary: Get channel bookmarks for Channel
+      description: |
+        __Minimum server version__: 9.5
+      operationId: ListChannelBookmarksForChannel
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: bookmarks_since
+          in: query
+          description: |
+            Timestamp to filter the bookmarks with. If set, the
+            endpoint returns bookmarks that have been added, updated
+            or deleted since its value
+          required: false
+          schema:
+            type: number
+            format: int64
+      responses:
+        "200":
+          description: Channel Bookmarks retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ChannelBookmarkWithFileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+    post:
+      tags:
+        - bookmarks
+      summary: Create channel bookmark
+      description: |
+        Creates a new channel bookmark for this channel.
+
+        __Minimum server version__: 9.5
+
+        ##### Permissions
+        Must have the `add_bookmark_public_channel` or
+        `add_bookmark_private_channel` depending on the channel
+        type. If the channel is a DM or GM, must be a non-guest
+        member.
+      operationId: CreateChannelBookmark
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+      body:
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - display_name
+                - type
+              properties:
+                file_id:
+                  type: string
+                  description: The ID of the file associated with the channel bookmark. Required for bookmarks of type 'file'
+                display_name:
+                  type: string
+                  description: The name of the channel bookmark
+                link_url:
+                  type: string
+                  description: The URL associated with the channel bookmark. Required for bookmarks of type 'link'
+                image_url:
+                  type: string
+                  description: The URL of the image associated with the channel bookmark. Optional, only applies for bookmarks of type 'link'
+                emoji:
+                  type: string
+                  description: The emoji of the channel bookmark
+                type:
+                  type: string
+                  enum: [link, file]
+                  description: |
+                    * `link` for channel bookmarks that reference a link. `link_url` is required
+                    * `file` for channel bookmarks that reference a file. `file_id` is required
+        description: Channel Bookmark object to be created
+        required: true
+      responses:
+        "201":
+          description: Channel Bookmark creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelBookmarkWithFileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  /api/v4/channels/{channel_id}/bookmarks/{bookmark_id}:
+    patch:
+      tags:
+        - bookmarks
+      summary: Update channel bookmark
+      description: |
+        Partially update a channel bookmark by providing only the
+        fields you want to update. Ommited fields will not be
+        updated. The fields that can be updated are defined in the
+        request body, all other provided fields will be ignored.
+
+        __Minimum server version__: 9.5
+
+        ##### Permissions
+        Must have the `edit_bookmark_public_channel` or
+        `edit_bookmark_private_channel` depending on the channel
+        type. If the channel is a DM or GM, must be a non-guest
+        member.
+      operationId: UpdateChannelBookmark
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: bookmark_id
+          in: path
+          description: Bookmark GUID
+          required: true
+          schema:
+            type: string
+      body:
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                file_id:
+                  type: string
+                  description: The ID of the file associated with the channel bookmark. Required for bookmarks of type 'file'
+                display_name:
+                  type: string
+                  description: The name of the channel bookmark
+                sort_order:
+                  type: integer
+                  format: int64
+                  description: The order of the channel bookmark
+                link_url:
+                  type: string
+                  description: The URL associated with the channel bookmark. Required for type bookmarks of type 'link'
+                image_url:
+                  type: string
+                  description: The URL of the image associated with the channel bookmark
+                emoji:
+                  type: string
+                  description: The emoji of the channel bookmark
+                type:
+                  type: string
+                  enum: [link, file]
+                  description: |
+                    * `link` for channel bookmarks that reference a link. `link_url` is required
+                    * `file` for channel bookmarks that reference a file. `file_id` is required
+        description: Channel Bookmark object to be updated
+        required: true
+      responses:
+        "200":
+          description: Channel Bookmark update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UpdateChannelBookmarkResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+    delete:
+      tags:
+        - bookmarks
+      summary: Delete channel bookmark
+      description: |
+        Archives a channel bookmark. This will set the `deleteAt` to
+        the current timestamp in the database.
+
+        __Minimum server version__: 9.5
+
+        ##### Permissions
+        Must have the `delete_bookmark_public_channel` or
+        `delete_bookmark_private_channel` depending on the channel
+        type. If the channel is a DM or GM, must be a non-guest
+        member.
+      operationId: DeleteChannelBookmark
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: bookmark_id
+          in: path
+          description: Bookmark GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Channel Bookmark deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelBookmarkWithFileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+  /api/v4/channels/{channel_id}/bookmarks/{bookmark_id}/sort_order:
+    post:
+      tags:
+        - bookmarks
+      summary: Update channel bookmark's order
+      description: |
+        Updates the order of a channel bookmark, setting its new order
+        from the parameters and updating the rest of the bookmarks of
+        the channel to accomodate for this change.
+
+        __Minimum server version__: 9.5
+
+        ##### Permissions
+        Must have the `order_bookmark_public_channel` or
+        `order_bookmark_private_channel` depending on the channel
+        type. If the channel is a DM or GM, must be a non-guest
+        member.
+      operationId: UpdateChannelBookmarkSortOrder
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: bookmark_id
+          in: path
+          description: Bookmark GUID
+          required: true
+          schema:
+            type: string
+      body:
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: number
+              format: int64
+              description: The new sort order for the Channel Bookmark
+      responses:
+        "200":
+          description: Channel Bookmark Sort Order update successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ChannelBookmarkWithFileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/bots.yaml

@@ -0,0 +1,351 @@
+  /api/v4/bots:
+    post:
+      tags:
+        - bots
+      summary: Create a bot
+      description: |
+        Create a new bot account on the system. Username is required.
+        ##### Permissions
+        Must have `create_bot` permission.
+        __Minimum server version__: 5.10
+      operationId: CreateBot
+      requestBody:
+          description: Bot to be created
+          required: true
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - username
+                properties:
+                  username:
+                    type: string
+                  display_name:
+                    type: string
+                  description:
+                    type: string
+      responses:
+        "201":
+          description: Bot creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    get:
+      tags:
+        - bots
+      summary: Get bots
+      description: >
+        Get a page of a list of bots.
+
+        ##### Permissions
+
+        Must have `read_bots` permission for bots you are managing, and `read_others_bots` permission for bots others are managing.
+
+        __Minimum server version__: 5.10
+      operationId: GetBots
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of users per page.
+          schema:
+            type: integer
+            default: 60
+        - name: include_deleted
+          in: query
+          description: If deleted bots should be returned.
+          schema:
+            type: boolean
+        - name: only_orphaned
+          in: query
+          description: When true, only orphaned bots will be returned. A bot is considered
+            orphaned if its owner has been deactivated.
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Bot page retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/bots/{bot_user_id}":
+    put:
+      tags:
+        - bots
+      summary: Patch a bot
+      description: >
+        Partially update a bot by providing only the fields you want to update.
+        Omitted fields will not be updated. The fields that can be updated are
+        defined in the request body, all other provided fields will be ignored.
+
+        ##### Permissions
+
+        Must have `manage_bots` permission. 
+
+        __Minimum server version__: 5.10
+      operationId: PatchBot
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+          description: Bot to be created
+          required: true
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - username
+                properties:
+                  username:
+                    type: string
+                  display_name:
+                    type: string
+                  description:
+                    type: string
+      responses:
+        "200":
+          description: Bot patch successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    get:
+      tags:
+        - bots
+      summary: Get a bot
+      description: >
+        Get a bot specified by its bot id.
+
+        ##### Permissions
+
+        Must have `read_bots` permission for bots you are managing, and `read_others_bots` permission for bots others are managing.
+
+        __Minimum server version__: 5.10
+      operationId: GetBot
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+        - name: include_deleted
+          in: query
+          description: If deleted bots should be returned.
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Bot successfully retrieved.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/bots/{bot_user_id}/disable":
+    post:
+      tags:
+        - bots
+      summary: Disable a bot
+      description: |
+        Disable a bot.
+        ##### Permissions
+        Must have `manage_bots` permission. 
+        __Minimum server version__: 5.10
+      operationId: DisableBot
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Bot successfully disabled.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/bots/{bot_user_id}/enable":
+    post:
+      tags:
+        - bots
+      summary: Enable a bot
+      description: |
+        Enable a bot.
+        ##### Permissions
+        Must have `manage_bots` permission. 
+        __Minimum server version__: 5.10
+      operationId: EnableBot
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Bot successfully enabled.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/bots/{bot_user_id}/assign/{user_id}":
+    post:
+      tags:
+        - bots
+      summary: Assign a bot to a user
+      description: |
+        Assign a bot to a specified user.
+        ##### Permissions
+        Must have `manage_bots` permission. 
+        __Minimum server version__: 5.10
+      operationId: AssignBot
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+        - name: user_id
+          in: path
+          description: The user ID to assign the bot to.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Bot successfully assigned.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Bot"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/bots/{bot_user_id}/convert_to_user":
+    post:
+      tags:
+        - bots
+        - users
+      summary: Convert a bot into a user
+      description: |
+        Convert a bot into a user.
+
+        __Minimum server version__: 5.26
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: ConvertBotToUser
+      parameters:
+        - name: bot_user_id
+          in: path
+          description: Bot user ID
+          required: true
+          schema:
+            type: string
+        - name: set_system_admin
+          in: query
+          description: Whether to give the user the system admin role.
+          schema:
+            type: boolean
+            default: false
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                email:
+                  type: string
+                username:
+                  type: string
+                password:
+                  type: string
+                first_name:
+                  type: string
+                last_name:
+                  type: string
+                nickname:
+                  type: string
+                locale:
+                  type: string
+                position:
+                  type: string
+                props:
+                  type: object
+                notify_props:
+                  $ref: "#/components/schemas/UserNotifyProps"
+        description: Data to be used in the user creation
+        required: true
+      responses:
+        "200":
+          description: Bot successfully converted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/brand.yaml

@@ -0,0 +1,89 @@
+  /api/v4/brand/image:
+    get:
+      tags:
+        - brand
+      summary: Get brand image
+      description: >
+        Get the previously uploaded brand image. Returns 404 if no brand image
+        has been uploaded.
+
+        ##### Permissions
+
+        No permission required.
+      operationId: GetBrandImage
+      responses:
+        "200":
+          description: Brand image retrieval successful
+          content:
+            application/json:
+              schema:
+                type: string
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - brand
+      summary: Upload brand image
+      description: |
+        Uploads a brand image.
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: UploadBrandImage
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                image:
+                  description: The image to be uploaded
+                  type: string
+                  format: binary
+              required:
+                - image
+      responses:
+        "201":
+          description: Brand image upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - brand
+      summary: Delete current brand image
+      description: >
+        Deletes the previously uploaded brand image. Returns 404 if no brand
+        image has been uploaded.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+        __Minimum server version: 5.6__
+      operationId: DeleteBrandImage
+      responses:
+        "200":
+          description: Brand image succesfully deleted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/cloud.yaml

@@ -0,0 +1,466 @@
+  /api/v4/cloud/limits:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud workspace limits
+      description: >
+        Retrieve any cloud workspace limits applicable to this instance.
+
+        ##### Permissions
+
+        Must be authenticated and be licensed for Cloud.
+
+        __Minimum server version__: 7.0
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetCloudLimits
+      responses:
+        "200":
+          description: Cloud workspace limits returned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ProductLimits"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/products:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud products
+      description: >
+        Retrieve a list of all products that are offered for Mattermost Cloud.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.28
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetCloudProducts
+      responses:
+        "200":
+          description: Cloud products returned successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Product"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/customer:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud customer
+      description: >
+        Retrieves the customer information for the Mattermost Cloud customer bound to this installation.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.28
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetCloudCustomer
+      responses:
+        "200":
+          description: Cloud customer returned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CloudCustomer"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    put:
+      tags:
+        - cloud
+      summary: Update cloud customer
+      description: >
+        Updates the customer information for the Mattermost Cloud customer bound to this installation.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.29
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: UpdateCloudCustomer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                email:
+                  type: string
+                contact_first_name:
+                  type: string
+                contact_last_name:
+                  type: string
+                num_employees:
+                  type: string
+        description: Customer patch including information to update
+        required: true
+      responses:
+        "200":
+          description: Cloud customer updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CloudCustomer"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/customer/address:
+    put:
+      tags:
+        - cloud
+      summary: Update cloud customer address
+      description: >
+        Updates the company address for the Mattermost Cloud customer bound to this installation.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.29
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: UpdateCloudCustomerAddress
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Address"
+        description: Company address information to update
+        required: true
+      responses:
+        "200":
+          description: Cloud customer address updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CloudCustomer"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/validate-business-email:
+    post:
+      tags:
+        - cloud
+      summary: Validate business email
+      description: >
+        Validate whether an email address is considered a business email by the cloud service.
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: ValidateBusinessEmail
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - email
+              properties:
+                email:
+                  type: string
+      responses:
+        "200":
+          description: Email validation successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  is_valid:
+                    type: boolean
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/validate-workspace-business-email:
+    post:
+      tags:
+        - cloud
+      summary: Validate workspace business email
+      description: >
+        Validate the current workspace customer/admin email as a business email.
+
+        ##### Permissions
+        Must have `sysconsole_write_billing` permission and be licensed for Cloud.
+      operationId: ValidateWorkspaceBusinessEmail
+      responses:
+        "200":
+          description: Workspace email validation successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  is_valid:
+                    type: boolean
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/subscription:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud subscription
+      description: >
+        Retrieves the subscription information for the Mattermost Cloud customer bound to this installation.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.28
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetSubscription
+      responses:
+        "200":
+          description: Cloud subscription returned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Subscription"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/installation:
+    get:
+      tags:
+        - cloud
+      summary: GET endpoint for Installation information
+      description: >
+        An endpoint for fetching the installation information.
+
+        ##### Permissions
+
+        Must have `sysconsole_read_site_ip_filters` permission and be licensed for Cloud.
+
+        __Minimum server version__: 9.1
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetEndpointForInstallationInformation
+      responses:
+        "200":
+          description: Installation returned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Installation"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/subscription/invoices:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud subscription invoices
+      description: >
+        Retrieves the invoices for the subscription bound to this installation.
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.30
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetInvoicesForSubscription
+      responses:
+        "200":
+          description: Subscription invoices returned successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Invoice"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/subscription/invoices/{invoice_id}/pdf:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud invoice PDF
+      description: >
+        Retrieves the PDF for the invoice passed as parameter
+
+        ##### Permissions
+
+        Must have `manage_system` permission and be licensed for Cloud.
+
+        __Minimum server version__: 5.30
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetInvoiceForSubscriptionAsPdf
+      parameters:
+        - name: invoice_id
+          in: path
+          description: Invoice ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/hosted_customer/signup_available:
+    get:
+      tags:
+        - cloud
+      summary: Check hosted signup availability
+      description: >
+        Checks whether hosted signup is available for self-hosted workspaces.
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: HostedCustomerSignupAvailable
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/check-cws-connection:
+    get:
+      tags:
+        - cloud
+      summary: Check CWS connection
+      description: >
+        Checks whether the Customer Web Server (CWS) is reachable from this instance.
+        Used to detect if the deployment is air-gapped.
+
+        ##### Permissions
+
+        No permissions required.
+
+        __Minimum server version__: 5.28
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: CheckCWSConnection
+      responses:
+        "200":
+          description: CWS connection status returned successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    description: Connection status - "available" if CWS is reachable, "unavailable" if not
+                    enum:
+                      - available
+                      - unavailable
+  /api/v4/cloud/webhook:
+    post:
+      tags:
+        - cloud
+      summary: POST endpoint for CWS Webhooks
+      description: >
+        An endpoint for processing webhooks from the Customer Portal
+
+        ##### Permissions
+
+        This endpoint should only be accessed by CWS, in a Mattermost Cloud instance
+
+        __Minimum server version__: 5.30
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: PostEndpointForCwsWebhooks
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/cloud/preview/modal_data:
+    get:
+      tags:
+        - cloud
+      summary: Get cloud preview modal data
+      description: >
+        Retrieves modal content data from the configured S3 bucket for displaying cloud product preview modals.
+
+        ##### Permissions
+
+        Must be authenticated.
+        Must be in a Cloud Preview environment.
+
+        __Minimum server version__: 10.0
+        __Note:__ This is intended for internal use and is subject to change.
+      operationId: GetPreviewModalData
+      responses:
+        "200":
+          description: Preview modal data returned successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PreviewModalContentData"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+

api/v4/source/cluster.yaml

@@ -0,0 +1,25 @@
+  /api/v4/cluster/status:
+    get:
+      tags:
+        - cluster
+      summary: Get cluster status
+      description: >
+        Get a list of all healthy nodes, including local information and
+        status of each one. If a node is not present, it means it is not
+        healthy.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: GetClusterStatus
+      responses:
+        "200":
+          description: Cluster status retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ClusterInfo"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/commands.yaml

@@ -0,0 +1,394 @@
+  /api/v4/commands:
+    post:
+      tags:
+        - commands
+      summary: Create a command
+      description: |
+        Create a command for a team.
+        ##### Permissions
+        `manage_slash_commands` for the team the command is in.
+      operationId: CreateCommand
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - team_id
+                - method
+                - trigger
+                - url
+              properties:
+                team_id:
+                  type: string
+                  description: Team ID to where the command should be created
+                method:
+                  type: string
+                  description: "`'P'` for post request, `'G'` for get request"
+                trigger:
+                  type: string
+                  description: Activation word to trigger the command
+                url:
+                  type: string
+                  description: The URL that the command will make the request
+        description: command to be created
+        required: true
+      responses:
+        "201":
+          description: Command creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Command"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - commands
+      summary: List commands for a team
+      description: |
+        List commands for a team.
+        ##### Permissions
+        `manage_slash_commands` if need list custom commands.
+      operationId: ListCommands
+      parameters:
+        - name: team_id
+          in: query
+          description: The team id.
+          schema:
+            type: string
+        - name: custom_only
+          in: query
+          description: >
+            To get only the custom commands. If set to false will get the custom
+
+            if the user have access plus the system commands, otherwise just the system commands.
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: List Commands retrieve successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Command"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/teams/{team_id}/commands/autocomplete":
+    get:
+      tags:
+        - commands
+      summary: List autocomplete commands
+      description: |
+        List autocomplete commands in the team.
+        ##### Permissions
+        `view_team` for the team.
+      operationId: ListAutocompleteCommands
+      parameters:
+        - name: team_id
+          in: path
+          description: Team GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Autocomplete commands retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Command"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/teams/{team_id}/commands/autocomplete_suggestions":
+    get:
+      tags:
+        - commands
+      summary: List commands' autocomplete data
+      description: |
+        List commands' autocomplete data for the team.
+        ##### Permissions
+        `view_team` for the team.
+        __Minimum server version__: 5.24
+      operationId: ListCommandAutocompleteSuggestions
+      parameters:
+        - name: team_id
+          in: path
+          description: Team GUID
+          required: true
+          schema:
+            type: string
+        - name: user_input
+          in: query
+          description: String inputted by the user.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Commands' autocomplete data retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AutocompleteSuggestion"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/commands/{command_id}":
+    get:
+      tags:
+        - commands
+      summary: Get a command
+      description: >
+        Get a command definition based on command id string.
+
+        ##### Permissions
+
+        Must have `manage_slash_commands` permission for the team the command is in.
+
+
+        __Minimum server version__: 5.22
+      operationId: GetCommandById
+      parameters:
+        - in: path
+          name: command_id
+          description: ID of the command to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Command get successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Command"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    put:
+      tags:
+        - commands
+      summary: Update a command
+      description: >
+        Update a single command based on command id string and Command struct.
+
+        ##### Permissions
+
+        Must have `manage_slash_commands` permission for the team the command is in.
+      operationId: UpdateCommand
+      parameters:
+        - in: path
+          name: command_id
+          description: ID of the command to update
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Command"
+        required: true
+      responses:
+        "200":
+          description: Command updated successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Command"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    delete:
+      tags:
+        - commands
+      summary: Delete a command
+      description: >
+        Delete a command based on command id string.
+
+        ##### Permissions
+
+        Must have `manage_slash_commands` permission for the team the command is in.
+      operationId: DeleteCommand
+      parameters:
+        - in: path
+          name: command_id
+          description: ID of the command to delete
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Command deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/commands/{command_id}/move":
+    put:
+      tags:
+        - commands
+      summary: Move a command
+      description: >
+        Move a command to a different team based on command id string.
+
+        ##### Permissions
+
+        Must have `manage_slash_commands` permission for the team the command is currently in and the destination team.
+
+
+        __Minimum server version__: 5.22
+      operationId: MoveCommand
+      parameters:
+        - in: path
+          name: command_id
+          description: ID of the command to move
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                team_id:
+                  type: string
+                  description: Destination teamId
+        required: true
+      responses:
+        "200":
+          description: Command move successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/commands/{command_id}/regen_token":
+    put:
+      tags:
+        - commands
+      summary: Generate a new token
+      description: >
+        Generate a new token for the command based on command id string.
+
+        ##### Permissions
+
+        Must have `manage_slash_commands` permission for the team the command is in.
+      operationId: RegenCommandToken
+      parameters:
+        - in: path
+          name: command_id
+          description: ID of the command to generate the new token
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Token generation successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  token:
+                    description: The new token
+                    type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  /api/v4/commands/execute:
+    post:
+      tags:
+        - commands
+      summary: Execute a command
+      description: >
+        Execute a command on a team.
+
+        ##### Permissions
+
+        Must have `use_slash_commands` permission for the team the command is in.
+      operationId: ExecuteCommand
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_id
+                - command
+              properties:
+                channel_id:
+                  type: string
+                  description: Channel Id where the command will execute
+                command:
+                  type: string
+                  description: "The slash command to execute, including parameters. Eg, `'/echo bounces around the room'`"
+        description: command to be executed
+        required: true
+      responses:
+        "200":
+          description: Command execution successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CommandResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/compliance.yaml

@@ -0,0 +1,127 @@
+  /api/v4/compliance/reports:
+    post:
+      tags:
+        - compliance
+      summary: Create report
+      description: |
+        Create and save a compliance report.
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: CreateComplianceReport
+      responses:
+        "201":
+          description: Compliance report creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Compliance"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - compliance
+      summary: Get reports
+      description: >
+        Get a list of compliance reports previously created by page, selected
+        with `page` and `per_page` query parameters.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: GetComplianceReports
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of reports per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Compliance reports retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Compliance"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/compliance/reports/{report_id}":
+    get:
+      tags:
+        - compliance
+      summary: Get a report
+      description: |
+        Get a compliance reports previously created.
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: GetComplianceReport
+      parameters:
+        - name: report_id
+          in: path
+          description: Compliance report GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Compliance report retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Compliance"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/compliance/reports/{report_id}/download":
+    get:
+      tags:
+        - compliance
+      summary: Download a report
+      description: |
+        Download the full contents of a report as a file.
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: DownloadComplianceReport
+      parameters:
+        - name: report_id
+          in: path
+          description: Compliance report GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: The compliance report file
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/content_flagging.yaml

@@ -0,0 +1,484 @@
+  /api/v4/content_flagging/flag/config:
+    get:
+      summary: Get content flagging configuration
+      description: |
+        Returns the configuration for content flagging, including the list of available reasons for flagging content. This data is used to gather details from the user when they flag content.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      operationId: GetCFFlagConfig
+      responses:
+        '200':
+          description: Configuration retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  reasons:
+                    type: array
+                    items:
+                      type: string
+                    description: List of reasons for flagging content
+                  reporter_comment_required:
+                    type: boolean
+                    description: Indicates if a comment from the reporter is required when flagging content
+        '404':
+          description: Feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/team/{team_id}/status:
+    get:
+      summary: Get content flagging status for a team
+      description: |
+        Returns the content flagging status for a specific team, indicating whether content flagging is enabled on the specified team or not.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: team_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the team to retrieve the content flagging status for
+      operationId: GetCFTeamStatus
+      responses:
+        '200':
+          description: Content flagging status retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enabled:
+                    type: boolean
+                    description: Indicates if content flagging is enabled for the team
+        '403':
+          description: Forbidden - User does not have permission to access this team.
+        '404':
+          description: The specified team was not found or the feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/flag:
+    post:
+      summary: Flag a post
+      description: |
+        Flags a post with a reason and a comment. The user must have access to the channel to which the post belongs to.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the post to be flagged
+      operationId: PostCFPostFlag
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                reason:
+                  type: string
+                  description: The reason for flagging the post. This must be one of the configured reasons available for selection.
+                comment:
+                  type: string
+                  description: Comment from the user flagging the post.
+      responses:
+        "200":
+          description: Post flagged successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        '400':
+          description: Bad request - Invalid input data or missing required fields.
+        '403':
+          description: Forbidden - User does not have permission to flag this post.
+        '404':
+          description: Post not found or feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/fields:
+    get:
+      summary: Get content flagging property fields
+      description: |
+        Returns the list of property fields that can be associated with content flagging reports. These fields are used for storing metadata about a post's flag.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      operationId: GetCFFields
+      responses:
+        '200':
+          description: Custom fields retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                description: A map of property field names to their definitions
+                additionalProperties:
+                  $ref: "#/components/schemas/PropertyField"
+        '404':
+          description: Feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/field_values:
+    get:
+      summary: Get content flagging property field values for a post
+      description: |
+        Returns the property field values associated with content flagging reports for a specific post. These values provide additional context about the flags on the post.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the post to retrieve property field values for
+      operationId: GetCFPostFieldValues
+      responses:
+        '200':
+          description: Property field values retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyValue"
+                description: An array of property field values associated with the post
+        '403':
+          description: Forbidden - User does not have permission to access this post.
+        '404':
+          description: Post not found or feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}:
+    get:
+        summary: Get a flagged post with all its content.
+        description: |
+            Returns the flagged post with all its data, even if it is soft-deleted. This endpoint is only accessible by content reviewers. A content reviewer can only fetch flagged posts from this API if the post is indeed flagged and they are a content reviewer of the post's team.
+            An enterprise advanced license is required.
+        tags:
+            - Content Flagging
+        parameters:
+            - in: path
+              name: post_id
+              required: true
+              schema:
+                  type: string
+              description: The ID of the post to retrieve
+        operationId: GetCFPost
+        responses:
+            '200':
+              description: The flagged post is fetched correctly
+              content:
+                  application/json:
+                    schema:
+                      $ref: "#/components/schemas/Post"
+            '403':
+              description: Forbidden - User does not have permission to access this post, or is not a reviewer of the post's team.
+            '404':
+              description: Post not found or feature is disabled via the feature flag.
+            '500':
+              description: Internal server error.
+            '501':
+              description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/remove:
+    put:
+        summary: Remove a flagged post
+        description: |
+            Permanently removes a flagged post and all its associated contents from the system. This action is typically performed by content reviewers after they have reviewed the flagged content. This action is irreversible.
+            The user must be a content reviewer of the team to which the post belongs to.
+            An enterprise advanced license is required.
+        tags:
+            - Content Flagging
+        parameters:
+            - in: path
+              name: post_id
+              required: true
+              schema:
+                  type: string
+              description: The ID of the post to be removed
+        operationId: RemoveCFPost
+        responses:
+            '200':
+              description: Post removed successfully
+              content:
+                application/json:
+                  schema:
+                    $ref: "#/components/schemas/StatusOK"
+            '403':
+              description: Forbidden - User does not have permission to remove this post.
+            '404':
+              description: Post not found or feature is disabled via the feature flag.
+            '500':
+              description: Internal server error.
+            '501':
+              description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/keep:
+    put:
+      summary: Keep a flagged post
+      description: |
+        Marks a flagged post as reviewed and keeps it in the system without any changes. This action is typically performed by content reviewers after they have reviewed the flagged content and determined that it does not violate any guidelines.
+        The user must be a content reviewer of the team to which the post belongs to.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the post to be kept
+      operationId: KeepCFPost
+      responses:
+        '200':
+          description: Post marked to be kept successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        '403':
+          description: Forbidden - User does not have permission to keep this post.
+        '404':
+          description: Post not found or feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/config:
+    get:
+      summary: Get the system content flagging configuration
+      description: |
+        Returns the system configuration for content flagging, including settings related to notifications, flagging configurations, etc..
+        Only system admins can access this endpoint.
+      tags:
+        - Content Flagging
+      operationId: GetCFConfig
+      responses:
+        '200':
+          description: Configuration retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentFlaggingConfig"
+        '404':
+          description: Feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '403':
+          description: User does not have permission to manage system configuration.
+    put:
+        summary: Update the system content flagging configuration
+        description: |
+            Updates the system configuration for content flagging, including settings related to notifications, flagging configurations, etc..
+            Only system admins can access this endpoint.
+        tags:
+            - Content Flagging
+        operationId: UpdateCFConfig
+        requestBody:
+          required: true
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ContentFlaggingConfig"
+        responses:
+            '200':
+              description: Configuration updated successfully
+            '400':
+              description: Bad request - Invalid input data or missing required fields.
+            '404':
+              description: Feature is disabled via the feature flag.
+            '500':
+              description: Internal server error.
+            '403':
+              description: User does not have permission to manage system configuration.
+  /api/v4/content_flagging/team/{team_id}/reviewers/search:
+    get:
+      summary: Search content reviewers in a team
+      description: |
+        Searches for content reviewers of a specific team based on a provided term. Only a content reviewer can access this endpoint.
+
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: team_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the team to search for content reviewers for
+        - in: query
+          name: term
+          required: true
+          schema:
+            type: string
+          description: The search term to filter content reviewers by
+      operationId: SearchCFTeamReviewers
+      responses:
+        '200':
+          description: Content reviewers retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/User"
+                description: An array of user objects representing the content reviewers that match the search criteria
+        '403':
+          description: Forbidden - User does not have permission to access this team.
+        '404':
+          description: The specified team was not found or the feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/assign/{content_reviewer_id}:
+    post:
+      summary: Assign a content reviewer to a flagged post
+      description: |
+        Assigns a content reviewer to a specific flagged post for review. The user must be a content reviewer of the team to which the post belongs to.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the post to assign a content reviewer to
+        - in: path
+          name: content_reviewer_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the user to be assigned as the content reviewer for the post
+      operationId: PostCFPostReviewer
+      responses:
+        '200':
+          description: Content reviewer assigned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        '400':
+          description: Bad request - Invalid input data or missing required fields.
+        '403':
+          description: Forbidden - User does not have permission to assign a reviewer to this post.
+        '404':
+          description: Post or user not found, or feature is disabled via the feature flag.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+  /api/v4/content_flagging/post/{post_id}/report:
+    post:
+      summary: Generate and download a flagged post report
+      description: |
+        Generates a ZIP archive containing the flagged post, its edit history, content review details, post metadata, and any associated file attachments, then streams the archive back to the caller as a download. All other content reviewers of the post's team are notified that a report has been generated.
+        The user must be a content reviewer of the team to which the post belongs to, and the post must be flagged.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the flagged post to generate the report for
+      operationId: GenerateCFPostReport
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                comment:
+                  type: string
+                  description: Optional comment from the reviewer to be included in the generated report.
+      responses:
+        '200':
+          description: Report generated successfully. The response body is a ZIP archive containing the flagged post report.
+          headers:
+            Content-Disposition:
+              schema:
+                type: string
+              description: Specifies the suggested filename for the downloaded archive (e.g. `attachment; filename="flagged-post-{post_id}-{timestamp}.zip"`).
+          content:
+            application/zip:
+              schema:
+                type: string
+                format: binary
+        '400':
+          description: Bad request - Invalid post ID.
+        '403':
+          description: Forbidden - User does not have permission to access this post, or is not a reviewer of the post's team.
+        '404':
+          description: Post not found or post is not flagged.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.
+
+  /api/v4/content_flagging/post/{post_id}/exposure_report:
+    post:
+      summary: Generate and download a post exposure report
+      description: |
+        Generates a CSV report listing the users who may have been exposed to a flagged post, derived from the channel membership history between the post's creation and it being flagged, and from each member's channel read state. All other content reviewers of the post's team are notified that an exposure report has been generated.
+        The user must be a content reviewer of the team to which the post belongs to, and the post must be flagged. The report remains available after the review is closed, in any status.
+        Exposure reports are not available for direct or group message channels.
+        An enterprise advanced license is required.
+      tags:
+        - Content Flagging
+      parameters:
+        - in: path
+          name: post_id
+          required: true
+          schema:
+            type: string
+          description: The ID of the flagged post to generate the exposure report for
+      operationId: GenerateCFPostExposureReport
+      responses:
+        '200':
+          description: Report generated successfully. The response body is a CSV file. Metadata and the reporting window are emitted as `#`-prefixed comment lines above the header row.
+          headers:
+            Content-Disposition:
+              schema:
+                type: string
+              description: Specifies the suggested filename for the downloaded file (e.g. `attachment; filename="post-exposure-{post_id}-{timestamp}.csv"`).
+          content:
+            text/csv:
+              schema:
+                type: string
+        '400':
+          description: Bad request - Invalid post ID, or the post is in a direct or group message channel.
+        '403':
+          description: Forbidden - User does not have permission to access this post, or is not a reviewer of the post's team.
+        '404':
+          description: Post not found or post is not flagged.
+        '500':
+          description: Internal server error.
+        '501':
+          description: Feature is disabled either via config or an Enterprise Advanced license is not available.

api/v4/source/custom_profile_attributes.yaml

@@ -0,0 +1,471 @@
+  "/api/v4/custom_profile_attributes/fields":
+    get:
+      tags:
+        - custom profile attributes
+      summary: List all the Custom Profile Attributes fields
+      description: |
+        List all the Custom Profile Attributes fields.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: ListAllCPAFields
+      responses:
+        "200":
+          description: Custom Profile Attributes fetch successful. Result may be empty.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyField"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+    post:
+      tags:
+        - custom profile attributes
+      summary: Create a Custom Profile Attribute field
+      description: |
+        Create a new Custom Profile Attribute field on the system.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: CreateCPAField
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - name
+                - type
+              properties:
+                name:
+                  type: string
+                  description: >
+                    The internal identifier for this attribute. Must match
+                    `^[A-Za-z_][A-Za-z0-9_]*$` and must not be a CEL reserved
+                    word (true, false, null, in, as, break, const, continue, else,
+                    for, function, if, import, let, loop, package, namespace,
+                    return, var, void, while). This name is used in ABAC policy
+                    expressions as `user.attributes.<name>`.
+                type:
+                  type: string
+                attrs:
+                  type: object
+                  properties:
+                    visibility:
+                      type: string
+                      description: "Visibility of the attribute"
+                      enum: ["hidden", "when_set", "always"]
+                      default: "when_set"
+                    sort_order:
+                      type: number
+                      description: "Sort order for displaying this attribute"
+                    options:
+                      type: array
+                      description: "Options for select/multiselect fields"
+                      items:
+                        type: object
+                        properties:
+                          name:
+                            type: string
+                          color:
+                            type: string
+                    value_type:
+                      type: string
+                      description: "Type of text value"
+                      enum: ["email", "url", "phone"]
+                    ldap:
+                      type: string
+                      description: "LDAP attribute for syncing"
+                    saml:
+                      type: string
+                      description: "SAML attribute for syncing"
+                    protected:
+                      type: boolean
+                      description: "If true, the field is read-only and cannot be modified."
+                    source_plugin_id:
+                      type: string
+                      description: "The ID of the plugin that created this field. This attribute cannot be changed."
+                    access_mode:
+                      type: string
+                      description: "Access mode of the field"
+                      enum: ["", "source_only", "shared_only"]
+                      default: ""
+                    display_name:
+                      type: string
+                      description: >
+                        Human-readable label shown in the UI. Defaults to the field
+                        `name` when omitted or empty. Maximum 255 characters.
+      responses:
+        "201":
+          description: Custom Profile Attribute field creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "422":
+          description: >
+            Validation error. Returned when `name` does not match the
+            required identifier pattern, is a CEL reserved word, or when
+            `attrs.display_name` exceeds 255 characters.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+
+  "/api/v4/custom_profile_attributes/fields/{field_id}":
+    patch:
+      tags:
+        - custom profile attributes
+      summary: Patch a Custom Profile Attribute field
+      description: |
+        Partially update a Custom Profile Attribute field by providing
+        only the fields you want to update. Omitted fields will not be
+        updated. The fields that can be updated are defined in the
+        request body, all other provided fields will be ignored.
+
+        **Note:** Fields with `attrs.protected = true` cannot be
+        modified and will return an error.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: PatchCPAField
+      parameters:
+        - name: field_id
+          in: path
+          description: Custom Profile Attribute field GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Custom Profile Attribute field that is to be updated
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                  description: >
+                    New name for the attribute. When changed, must match
+                    `^[A-Za-z_][A-Za-z0-9_]*$` and must not be a CEL reserved
+                    word. Pre-existing fields with non-conforming names remain
+                    patchable on all other attributes; the validation only fires
+                    when `name` actually changes.
+                type:
+                  type: string
+                attrs:
+                  type: object
+                  properties:
+                    visibility:
+                      type: string
+                      description: "Visibility of the attribute"
+                      enum: ["hidden", "when_set", "always"]
+                      default: "when_set"
+                    sort_order:
+                      type: number
+                      description: "Sort order for displaying this attribute"
+                    options:
+                      type: array
+                      description: "Options for select/multiselect fields"
+                      items:
+                        type: object
+                        properties:
+                          id:
+                            type: string
+                          name:
+                            type: string
+                          color:
+                            type: string
+                    value_type:
+                      type: string
+                      description: "Type of text value"
+                      enum: ["email", "url", "phone"]
+                    ldap:
+                      type: string
+                      description: "LDAP attribute for syncing"
+                    saml:
+                      type: string
+                      description: "SAML attribute for syncing"
+                    protected:
+                      type: boolean
+                      description: "If true, the field is read-only and cannot be modified."
+                    source_plugin_id:
+                      type: string
+                      description: "The ID of the plugin that created this field. This attribute cannot be changed."
+                    access_mode:
+                      type: string
+                      description: "Access mode of the field"
+                      enum: ["", "source_only", "shared_only"]
+                      default: ""
+                    display_name:
+                      type: string
+                      description: >
+                        Human-readable label shown in the UI. Maximum 255 characters.
+      responses:
+        "200":
+          description: Custom Profile Attribute field patch successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "422":
+          description: >
+            Validation error. Returned when a `name` change does not match
+            the required identifier pattern, is a CEL reserved word, or
+            when `attrs.display_name` exceeds 255 characters.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+
+    delete:
+      tags:
+        - custom profile attributes
+      summary: Delete a Custom Profile Attribute field
+      description: |
+        Marks a Custom Profile Attribute field and all its values as
+        deleted.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: DeleteCPAField
+      parameters:
+        - name: field_id
+          in: path
+          description: Custom Profile Attribute field GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Custom Profile Attribute field deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/custom_profile_attributes/values":
+    patch:
+      tags:
+        - custom profile attributes
+      summary: Patch Custom Profile Attribute values
+      description: |
+        Partially update a set of values on the requester's Custom
+        Profile Attribute fields by providing only the information you
+        want to update. Omitted fields will not be updated. The fields
+        that can be updated are defined in the request body, all other
+        provided fields will be ignored.
+
+        **Note:** Values for fields with `attrs.protected = true` cannot be
+        updated and will return an error.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: PatchCPAValues
+      requestBody:
+        description: Custom Profile Attribute values that are to be updated
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                properties:
+                  id:
+                    type: string
+                  value:
+                    oneOf:
+                      - type: string
+                      - type: array
+                        items:
+                          type: string
+      responses:
+        "200":
+          description: Custom Profile Attribute values patch successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    id:
+                      type: string
+                    value:
+                      oneOf:
+                        - type: string
+                        - type: array
+                          items:
+                            type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/custom_profile_attributes/group":
+    get:
+      tags:
+        - custom profile attributes
+      summary: Get Custom Profile Attribute property group data
+      description: |
+        Get the property group used for Custom Profile Attributes.
+
+        __Minimum server version__: 10.8
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetCPAGroup
+      responses:
+        "200":
+          description: Group fetch successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  id:
+                    type: string
+                    description: The ID of the custom profile attributes group
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/users/{user_id}/custom_profile_attributes":
+    get:
+      tags:
+        - custom profile attributes
+      summary: List Custom Profile Attribute values
+      description: |
+        List all the Custom Profile Attributes values for specified user.
+
+        __Minimum server version__: 10.5
+
+        ##### Permissions
+        Must have `view members` permission.
+      operationId: ListCPAValues
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Custom Profile Attribute values fetch successful. Result may be empty.
+          content:
+            application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                properties:
+                  field_id:
+                    type: string
+                  value:
+                    type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    patch:
+      tags:
+        - custom profile attributes
+      summary: Update custom profile attribute values for a user
+      description: |
+        Update Custom Profile Attribute field values for a specific user.
+
+        **Note:** Values for fields with `attrs.protected = true` cannot be
+        updated and will return an error.
+
+        __Minimum server version__: 11
+
+        ##### Permissions
+        Must have permission to edit the user. Users can only edit their own CPA values unless they are system administrators.
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+      operationId: PatchCPAValuesForUser
+      requestBody:
+        description: Custom Profile Attribute values that are to be updated
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                properties:
+                  id:
+                    type: string
+                  value:
+                    oneOf:
+                      - type: string
+                      - type: array
+                        items:
+                          type: string
+      responses:
+        '200':
+          description: Custom profile attribute values updated successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    id:
+                      type: string
+                    value:
+                      oneOf:
+                        - type: string
+                        - type: array
+                          items:
+                            type: string
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'

api/v4/source/dataretention.yaml

@@ -0,0 +1,676 @@
+  /api/v4/data_retention/policy:
+    get:
+      tags:
+        - data retention
+      summary: Get the global data retention policy
+      description: |
+        Gets the current global data retention policy details from the server,
+        including what data should be purged and the cutoff times for each data
+        type that should be purged.
+        
+        __Minimum server version__: 4.3
+        
+        ##### Permissions
+        Requires an active session but no other permissions.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetDataRetentionPolicy
+      responses:
+        "200":
+          description: Global data retention policy details retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GlobalDataRetentionPolicy"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/data_retention/policies_count:
+    get:
+      tags:
+        - data retention
+      summary: Get the number of granular data retention policies
+      description: |
+        Gets the number of granular (i.e. team or channel-specific) data retention
+        policies from the server.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetDataRetentionPoliciesCount
+      responses:
+        "200":
+          description: Number of retention policies retrieved successfully.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  total_count:
+                    type: integer
+                    description: The number of granular retention policies.
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/data_retention/policies:
+    get:
+      tags:
+        - data retention
+      summary: Get the granular data retention policies
+      description: |
+        Gets details about the granular (i.e. team or channel-specific) data retention
+        policies from the server.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetDataRetentionPolicies
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of policies per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Retention policies' details retrieved successfully.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/DataRetentionPolicyWithTeamAndChannelCounts"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - data retention
+      summary: Create a new granular data retention policy
+      description: |
+        Creates a new granular data retention policy with the specified display
+        name and post duration.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: CreateDataRetentionPolicy
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataRetentionPolicyCreate"
+      responses:
+        "201":
+          description: Retention policy successfully created.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataRetentionPolicyWithTeamAndChannelCounts"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/data_retention/policies/{policy_id}":
+    get:
+      tags:
+        - data retention
+      summary: Get a granular data retention policy
+      description: |
+        Gets details about a granular data retention policies by ID.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetDataRetentionPolicyByID
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Retention policy's details retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataRetentionPolicyWithTeamAndChannelCounts"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    patch:
+      tags:
+        - data retention
+      summary: Patch a granular data retention policy
+      description: |
+        Patches (i.e. replaces the fields of) a granular data retention policy.
+        If any fields are omitted, they will not be changed.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: PatchDataRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataRetentionPolicyWithTeamAndChannelIds"
+      responses:
+        "200":
+          description: Retention policy successfully patched.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataRetentionPolicyWithTeamAndChannelCounts"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - data retention
+      summary: Delete a granular data retention policy
+      description: |
+        Deletes a granular data retention policy.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: DeleteDataRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Retention policy successfully deleted.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"  
+  "/api/v4/data_retention/policies/{policy_id}/teams":
+    get:
+      tags:
+        - data retention
+      summary: Get the teams for a granular data retention policy
+      description: |
+        Gets the teams to which a granular data retention policy is applied.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetTeamsForRetentionPolicy
+      parameters:
+        - name: policy_id
+          in: path
+          description: The ID of the granular retention policy.
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of teams per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Teams for retention policy successfully retrieved.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Team"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - data retention
+      summary: Add teams to a granular data retention policy
+      description: |
+        Adds teams to a granular data retention policy.
+        
+         __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: AddTeamsToRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+                description: The IDs of the teams to add to the policy.
+      responses:
+        "200":
+          description: Teams successfully added to retention policy.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - data retention
+      summary: Delete teams from a granular data retention policy
+      description: |
+        Delete teams from a granular data retention policy.
+        
+         __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: RemoveTeamsFromRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+                description: The IDs of the teams to remove from the policy.
+      responses:
+        "200":
+          description: Teams successfully deleted from retention policy.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/data_retention/policies/{policy_id}/teams/search":
+    post:
+      tags:
+        - data retention
+      summary: Search for the teams in a granular data retention policy
+      description: |
+        Searches for the teams to which a granular data retention policy is applied.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: SearchTeamsForRetentionPolicy
+      parameters:
+        - name: policy_id
+          in: path
+          description: The ID of the granular retention policy.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                term:
+                  type: string
+                  description: The search term to match against the name or display name of teams
+      responses:
+        "200":
+          description: Teams for retention policy successfully retrieved.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Team"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/data_retention/policies/{policy_id}/channels":
+    get:
+      tags:
+        - data retention
+      summary: Get the channels for a granular data retention policy
+      description: |
+        Gets the channels to which a granular data retention policy is applied.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: GetChannelsForRetentionPolicy
+      parameters:
+        - name: policy_id
+          in: path
+          description: The ID of the granular retention policy.
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of channels per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Channels for retention policy successfully retrieved.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelListWithTeamData"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - data retention
+      summary: Add channels to a granular data retention policy
+      description: |
+        Adds channels to a granular data retention policy.
+        
+         __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: AddChannelsToRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+                description: The IDs of the channels to add to the policy.
+      responses:
+        "200":
+          description: Channels successfully added to retention policy.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - data retention
+      summary: Delete channels from a granular data retention policy
+      description: |
+        Delete channels from a granular data retention policy.
+        
+         __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_write_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: RemoveChannelsFromRetentionPolicy
+      parameters:
+      - name: policy_id
+        in: path
+        description: The ID of the granular retention policy.
+        required: true
+        schema:
+          type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+                description: The IDs of the channels to add to the policy.
+      responses:
+        "200":
+          description: Channels successfully deleted from retention policy.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/data_retention/policies/{policy_id}/channels/search":
+    post:
+      tags:
+        - data retention
+      summary: Search for the channels in a granular data retention policy
+      description: |
+        Searches for the channels to which a granular data retention policy is applied.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+        Must have the `sysconsole_read_compliance_data_retention` permission.
+
+        ##### License
+        Requires an E20 license.
+      operationId: SearchChannelsForRetentionPolicy
+      parameters:
+        - name: policy_id
+          in: path
+          description: The ID of the granular retention policy.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                term:
+                  type: string
+                  description: The string to search in the channel name, display name, and purpose.
+                team_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: >
+                    Filters results to channels belonging to the given team ids
+                public:
+                  type: boolean
+                  description: >
+                    Filters results to only return Public / Open channels, can be used in conjunction
+                    with `private` to return both `public` and `private` channels
+                private:
+                  type: boolean
+                  description: >
+                    Filters results to only return Private channels, can be used in conjunction
+                    with `public` to return both `private` and `public` channels
+                deleted:
+                  type: boolean
+                  description: >
+                    Filters results to only return deleted / archived channels
+      responses:
+        "200":
+          description: Channels for retention policy successfully retrieved.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ChannelListWithTeamData"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/delivery_tracking.yaml

@@ -0,0 +1,67 @@
+  /api/v4/delivery_tracking/config:
+    get:
+      summary: Get the post delivery audit logging configuration
+      description: |
+        Returns the post delivery audit logging configuration: whether the feature is enabled, whether it applies to
+        all channels, and the ids of the channels deliveries are recorded in.
+
+        Requires an Enterprise Advanced license and the `PostDeliveryTracking` feature flag. Only system admins can
+        access this endpoint.
+      tags:
+        - Delivery Tracking
+      operationId: GetDeliveryTrackingConfig
+      responses:
+        '200':
+          description: Configuration retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DeliveryTrackingConfig"
+        '403':
+          description: User does not have permission to manage system configuration.
+        '500':
+          description: Internal server error.
+        '404':
+          description: |
+            The endpoint is not registered because the `PostDeliveryTracking` feature flag was disabled at server start. Enabling the flag requires a server restart.
+        '501':
+          description: An Enterprise Advanced license is not available, or the `PostDeliveryTracking` feature flag was disabled after the server started.
+    put:
+      summary: Update the post delivery audit logging configuration
+      description: |
+        Updates the post delivery audit logging configuration.
+
+        `ChannelIds` fully replaces the stored list. Omit the field to leave the stored list unchanged; send an empty
+        array to clear it. An empty array is only accepted when the resulting configuration is still valid, which means
+        `EnableForAllChannels` must be true. Turning `Enable` off does not clear the list.
+
+        Direct and group message channels can never be recorded. The request is rejected in full if any submitted
+        channel is a DM or GM, or does not exist.
+
+        Requires an Enterprise Advanced license and the `PostDeliveryTracking` feature flag. Only system admins can
+        access this endpoint.
+      tags:
+        - Delivery Tracking
+      operationId: UpdateDeliveryTrackingConfig
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeliveryTrackingConfig"
+      responses:
+        '200':
+          description: Configuration updated successfully
+        '400':
+          description: |
+            Bad request. Returned when `EnableForAllChannels` is false and no channels are selected, when a channel id
+            is malformed, when a submitted channel does not exist, or when a submitted channel is a DM or GM.
+        '403':
+          description: User does not have permission to manage system configuration.
+        '500':
+          description: Internal server error.
+        '404':
+          description: |
+            The endpoint is not registered because the `PostDeliveryTracking` feature flag was disabled at server start. Enabling the flag requires a server restart.
+        '501':
+          description: An Enterprise Advanced license is not available, or the `PostDeliveryTracking` feature flag was disabled after the server started.

api/v4/source/elasticsearch.yaml

@@ -0,0 +1,61 @@
+  /api/v4/elasticsearch/test:
+    post:
+      tags:
+        - elasticsearch
+      summary: Test Elasticsearch configuration
+      description: >
+        Test the current Elasticsearch configuration to see if the Elasticsearch
+        server can be contacted successfully.
+
+        Optionally provide a configuration in the request body to test. If no valid configuration is present in the
+
+        request body the current server configuration will be tested.
+
+
+        __Minimum server version__: 4.1
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: TestElasticsearch
+      responses:
+        "200":
+          description: Elasticsearch test successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/elasticsearch/purge_indexes:
+    post:
+      tags:
+        - elasticsearch
+      summary: Purge all Elasticsearch indexes
+      description: >
+        Deletes all Elasticsearch indexes and their contents. After calling this
+        endpoint, it is
+
+        necessary to schedule a new Elasticsearch indexing job to repopulate the indexes.
+
+        __Minimum server version__: 4.1
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: PurgeElasticsearchIndexes
+      responses:
+        "200":
+          description: Indexes purged successfully.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/emoji.yaml

@@ -0,0 +1,347 @@
+  /api/v4/emoji:
+    post:
+      tags:
+        - emoji
+      summary: Create a custom emoji
+      description: |
+        Create a custom emoji for the team.
+        ##### Permissions
+        Must be authenticated.
+      operationId: CreateEmoji
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                image:
+                  description: A file to be uploaded
+                  type: string
+                  format: binary
+                emoji:
+                  description: A JSON object containing a `name` field with the name of the
+                    emoji and a `creator_id` field with the id of the
+                    authenticated user.
+                  type: string
+              required:
+                - image
+                - emoji
+      responses:
+        "201":
+          description: Emoji creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - emoji
+      summary: Get a list of custom emoji
+      description: >
+        Get a page of metadata for custom emoji on the system. Since server
+        version 4.7, sort using the `sort` query parameter.
+
+        ##### Permissions
+
+        Must be authenticated.
+      operationId: GetEmojiList
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of emojis per page.
+          schema:
+            type: integer
+            default: 60
+        - name: sort
+          in: query
+          description: Either blank for no sorting or "name" to sort by emoji names.
+            Minimum server version for sorting is 4.7.
+          schema:
+            type: string
+            default: ""
+      responses:
+        "200":
+          description: Emoji list retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/emoji/{emoji_id}":
+    get:
+      tags:
+        - emoji
+      summary: Get a custom emoji
+      description: |
+        Get some metadata for a custom emoji.
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetEmoji
+      parameters:
+        - name: emoji_id
+          in: path
+          description: Emoji GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Emoji retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - emoji
+      summary: Delete a custom emoji
+      description: >
+        Delete a custom emoji.
+
+        ##### Permissions
+
+        Must have the `manage_team` or `manage_system` permissions or be the user who created the emoji.
+      operationId: DeleteEmoji
+      parameters:
+        - name: emoji_id
+          in: path
+          description: Emoji GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Emoji delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/emoji/name/{emoji_name}":
+    get:
+      tags:
+        - emoji
+      summary: Get a custom emoji by name
+      description: |
+        Get some metadata for a custom emoji using its name.
+        ##### Permissions
+        Must be authenticated.
+
+        __Minimum server version__: 4.7
+      operationId: GetEmojiByName
+      parameters:
+        - name: emoji_name
+          in: path
+          description: Emoji name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Emoji retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/emoji/{emoji_id}/image":
+    get:
+      tags:
+        - emoji
+      summary: Get custom emoji image
+      description: |
+        Get the image for a custom emoji.
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetEmojiImage
+      parameters:
+        - name: emoji_id
+          in: path
+          description: Emoji GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Emoji image retrieval successful
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/emoji/search:
+    post:
+      tags:
+        - emoji
+      summary: Search custom emoji
+      description: >
+        Search for custom emoji by name based on search criteria provided in the
+        request body. A maximum of 200 results are returned.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+
+        __Minimum server version__: 4.7
+      operationId: SearchEmoji
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - term
+              properties:
+                term:
+                  description: The term to match against the emoji name.
+                  type: string
+                prefix_only:
+                  description: Set to only search for names starting with the search term.
+                  type: string
+        description: Search criteria
+        required: true
+      responses:
+        "200":
+          description: Emoji list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/emoji/autocomplete:
+    get:
+      tags:
+        - emoji
+      summary: Autocomplete custom emoji
+      description: >
+        Get a list of custom emoji with names starting with or matching the
+        provided name. Returns a maximum of 100 results.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+
+        __Minimum server version__: 4.7
+      operationId: AutocompleteEmoji
+      parameters:
+        - name: name
+          in: query
+          description: The emoji name to search.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Emoji list retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Emoji"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/emoji/names:
+    post:
+      tags:
+        - emoji
+      summary: Get custom emojis by name
+      description: >
+        Get a list of custom emoji based on a provided list of emoji names. A maximum of
+        200 results are returned.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 9.2
+      operationId: GetEmojisByNames
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+        description: List of emoji names
+        required: true
+      responses:
+        "200":
+          description: Emoji list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/User"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/ephemeral_mode.yaml

@@ -0,0 +1,206 @@
+  /api/v4/ephemeral_mode/cleanup:
+    post:
+      tags:
+        - ephemeral mode
+      summary: Log an ephemeral mode cleanup run
+      description: >
+        Records the outcome of a client-side ephemeral mode auto cache cleanup run as an
+        audit event.
+
+        __Minimum server version__: 11.10
+
+        ##### Permissions
+
+        Must be logged in.
+
+        ##### License
+
+        Requires an Enterprise Advanced license.
+      operationId: LogCleanup
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                posts_deleted:
+                  description: >
+                    The number of posts deleted by the cleanup run. Required unless
+                    error_reason is provided, since a successful run with no counts
+                    records no evidence of what was deleted. If omitted, no posts_deleted
+                    value is recorded on the audit event.
+                  type: integer
+                  format: int64
+                  nullable: true
+                playbook_runs_deleted:
+                  description: >
+                    The number of playbook runs deleted by the cleanup run. Required
+                    unless error_reason is provided. If omitted, no playbook_runs_deleted
+                    value is recorded on the audit event.
+                  type: integer
+                  format: int64
+                  nullable: true
+                cleanup_at:
+                  description: >
+                    The time in milliseconds the cleanup run completed. Always optional;
+                    it does not satisfy the requirement for the deleted record counts. If
+                    omitted, no cleanup_at value is recorded on the audit event; the
+                    server-observed time is always recorded separately as server_ts.
+                  type: integer
+                  format: int64
+                  nullable: true
+                error_reason:
+                  description: >
+                    A reason describing why the cleanup run failed. Its presence alone
+                    marks the audit event as a failure, so clients must omit this field
+                    entirely (or send null) when the run succeeded; sending an empty
+                    string records a failure with no description attached. Reasons
+                    longer than 400 characters are truncated to 400 with a trailing
+                    ellipsis rather than rejected.
+                  type: string
+                  nullable: true
+        required: true
+      responses:
+        "200":
+          description: Cleanup logged successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ephemeral_mode/purge:
+    post:
+      tags:
+        - ephemeral mode
+      summary: Log an ephemeral mode offline purge
+      description: >
+        Records the outcome of a client-side ephemeral mode offline purge as
+        an audit event.
+
+        __Minimum server version__: 11.10
+
+        ##### Permissions
+
+        Must be logged in.
+
+        ##### License
+
+        Requires an Enterprise Advanced license.
+      operationId: LogOfflinePurge
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                offline_time_minutes:
+                  description: >
+                    The number of minutes the client was offline before the purge.
+                    Required unless error_reason is provided, since a successful purge
+                    with no offline time records no evidence of why it ran. If omitted,
+                    no offline_time_minutes value is recorded on the audit event.
+                  type: integer
+                  format: int64
+                  nullable: true
+                purge_at:
+                  description: >
+                    The time in milliseconds the purge completed. Always optional; it
+                    does not satisfy the requirement for offline_time_minutes. If
+                    omitted, no purge_at value is recorded on the audit event; the
+                    server-observed time is always recorded separately as server_ts.
+                  type: integer
+                  format: int64
+                  nullable: true
+                error_reason:
+                  description: >
+                    A reason describing why the offline purge failed. Its presence alone
+                    marks the audit event as a failure, so clients must omit this field
+                    entirely (or send null) when the purge succeeded; sending an empty
+                    string records a failure with no description attached. Reasons
+                    longer than 400 characters are truncated to 400 with a trailing
+                    ellipsis rather than rejected.
+                  type: string
+                  nullable: true
+        required: true
+      responses:
+        "200":
+          description: Offline purge logged successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ephemeral_mode/wipe:
+    post:
+      tags:
+        - ephemeral mode
+      summary: Log an ephemeral mode session wipe
+      description: >
+        Records a client-side ephemeral mode wipe confirming that a session
+        revoked by the server has completed its local wipe. Sent without a
+        session, since the session being confirmed is already revoked by the
+        time the client can report it.
+
+        __Minimum server version__: 11.10
+
+        ##### License
+
+        Requires an Enterprise Advanced license.
+      operationId: LogSessionWipe
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                signature:
+                  description: >
+                    The `signature` field of the session wipe push notification that
+                    triggered this wipe, echoed back verbatim. The server verifies it and
+                    takes the actor, device and ack id of the audit event from its claims.
+                    Always required, including on failure reports: this endpoint accepts
+                    unauthenticated requests, so an unattributable audit record is not
+                    accepted.
+                  type: string
+                wipe_at:
+                  description: >
+                    The time in milliseconds the wipe completed. Optional. If omitted, no
+                    wipe_at value is recorded on the audit event; the server-observed time
+                    is always recorded separately as server_ts.
+                  type: integer
+                  format: int64
+                  nullable: true
+                error_reason:
+                  description: >
+                    A reason describing why the session wipe failed. Its presence alone
+                    marks the audit event as a failure, so clients must omit this field
+                    entirely (or send null) when the wipe succeeded; sending an empty
+                    string records a failure with no description attached. Reasons
+                    longer than 400 characters are truncated to 400 with a trailing
+                    ellipsis rather than rejected.
+                  type: string
+                  nullable: true
+              required:
+                - signature
+        required: true
+      responses:
+        "200":
+          description: Session wipe logged successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/exports.yaml

@@ -0,0 +1,126 @@
+  "/api/v4/exports":
+    get:
+      tags:
+        - exports
+      summary: List export files
+      description: >
+        Lists all available export files.
+
+        __Minimum server version__: 5.33
+
+        ##### Permissions
+
+        Must have `manage_system` permissions.
+      operationId: ListExports
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/exports/{export_name}":
+    get:
+      tags:
+        - exports
+      summary: Download an export file
+      description: |
+        Downloads an export file.
+
+
+        __Minimum server version__: 5.33
+
+        ##### Permissions
+
+        Must have `manage_system` permissions.
+      operationId: DownloadExport
+      parameters:
+        - name: export_name
+          in: path
+          description: The name of the export file to download
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+    delete:
+      tags:
+        - exports
+      summary: Delete an export file
+      description: |
+        Deletes an export file.
+
+
+        __Minimum server version__: 5.33
+
+        ##### Permissions
+
+        Must have `manage_system` permissions.
+      operationId: DeleteExport
+      parameters:
+        - name: export_name
+          in: path
+          description: The name of the export file to delete
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  "/api/v4/exports/{export_name}/presign-url":
+    post:
+      tags:
+        - exports
+      summary: Create a presigned URL for export download
+      description: |
+        Creates a presigned URL for downloading an export file.
+
+        __Minimum server version__: 5.33
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: PresignExport
+      parameters:
+        - name: export_name
+          in: path
+          description: The name of the export file
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Presigned URL created successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  url:
+                    type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/files.yaml

@@ -0,0 +1,588 @@
+  /api/v4/files:
+    post:
+      tags:
+        - files
+      summary: Upload a file
+      description: >
+        Uploads a file that can later be attached to a post.
+
+
+        This request can either be a multipart/form-data request with a channel_id, files and optional
+
+        client_ids defined in the FormData, or it can be a request with the channel_id and filename
+
+        defined as query parameters with the contents of a single file in the body of the request.
+
+
+        Only multipart/form-data requests are supported by server versions up to and including 4.7.
+
+        Server versions 4.8 and higher support both types of requests.
+
+
+        __Minimum server version__: 9.4
+
+        Starting with server version 9.4 when uploading a file for a channel bookmark, the bookmark=true query
+        parameter should be included in the query string
+
+
+        ##### Permissions
+
+        Must have `upload_file` permission.
+      operationId: UploadFile
+      parameters:
+        - name: channel_id
+          in: query
+          description: The ID of the channel that this file will be uploaded to
+          required: false
+          schema:
+            type: string
+        - name: filename
+          in: query
+          description: The name of the file to be uploaded
+          required: false
+          schema:
+            type: string
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                files:
+                  description: A file to be uploaded
+                  type: string
+                  format: binary
+                channel_id:
+                  description: The ID of the channel that this file will be uploaded to
+                  type: string
+                client_ids:
+                  description: A unique identifier for the file that will be returned in
+                    the response
+                  type: string
+      responses:
+        "201":
+          description: Corresponding lists of the provided client_ids and the metadata that
+            has been stored in the database for each one
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  file_infos:
+                    description: A list of file metadata that has been stored in the
+                      database
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/FileInfo"
+                  client_ids:
+                    description: A list of the client_ids that were provided in the request
+                    type: array
+                    items:
+                      type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/files/{file_id}":
+    get:
+      tags:
+        - files
+      summary: Get a file
+      description: |
+        Gets a file that has been uploaded previously.
+        ##### Permissions
+        Must have `read_channel` permission or be uploader of the file.
+      operationId: GetFile
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    head:
+      tags:
+        - files
+      summary: Get file metadata headers
+      description: |
+        Performs the same permission and existence checks as getting a file, but returns headers only.
+      operationId: HeadFile
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/files/{file_id}/thumbnail":
+    get:
+      tags:
+        - files
+      summary: Get a file's thumbnail
+      description: |
+        Gets a file's thumbnail.
+        ##### Permissions
+        Must have `read_channel` permission or be uploader of the file.
+      operationId: GetFileThumbnail
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    head:
+      tags:
+        - files
+      summary: Get thumbnail metadata headers
+      description: |
+        Performs the same permission and existence checks as getting a thumbnail, but returns headers only.
+      operationId: HeadFileThumbnail
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/files/{file_id}/preview":
+    get:
+      tags:
+        - files
+      summary: Get a file's preview
+      description: |
+        Gets a file's preview.
+        ##### Permissions
+        Must have `read_channel` permission or be uploader of the file.
+      operationId: GetFilePreview
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    head:
+      tags:
+        - files
+      summary: Get preview metadata headers
+      description: |
+        Performs the same permission and existence checks as getting a preview, but returns headers only.
+      operationId: HeadFilePreview
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/files/{file_id}/link":
+    get:
+      tags:
+        - files
+      summary: Get a public file link
+      description: >
+        Gets a public link for a file that can be accessed without logging into
+        Mattermost.
+
+        ##### Permissions
+
+        Must have `read_channel` permission or be uploader of the file.
+      operationId: GetFileLink
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get a link for
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: A publicly accessible link to the given file
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  link:
+                    type: string
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/files/{file_id}/info":
+    get:
+      tags:
+        - files
+      summary: Get metadata for a file
+      description: |
+        Gets a file's info.
+        ##### Permissions
+        Must have `read_channel` permission or be uploader of the file.
+      operationId: GetFileInfo
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file info to get
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: The stored metadata for the given file
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FileInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/files/{file_id}/public":
+    get:
+      tags:
+        - files
+      summary: Get a public file
+      description: |
+        ##### Permissions
+        No permissions required.
+      operationId: GetFilePublic
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+        - name: h
+          in: query
+          description: File hash
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          description: Do not have appropriate permissions
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+          headers:
+            First-Inaccessible-File-Time:
+              schema:
+                type: integer
+              description: This header is included with the value "1" if the file is past the cloud's plan limit.
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    head:
+      tags:
+        - files
+      summary: Get public file metadata headers
+      description: |
+        Performs the same validation checks as getting a public file, but returns headers only.
+      operationId: HeadFilePublic
+      parameters:
+        - name: file_id
+          in: path
+          description: The ID of the file to get
+          required: true
+          schema:
+            type: string
+        - name: h
+          in: query
+          description: File hash
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+
+  "/api/v4/teams/{team_id}/files/search":
+    post:
+      tags:
+        - teams
+        - files
+        - search
+      summary: Search files in a team
+      description: >
+        Search for files in a team based on file name, extention and file
+        content (if file content extraction is enabled and supported for the
+        files).
+
+        __Minimum server version__: 5.34
+
+        ##### Permissions
+
+        Must be authenticated and have the `view_team` permission.
+      operationId: SearchFiles
+      parameters:
+        - name: team_id
+          in: path
+          description: Team GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required:
+                - terms
+                - is_or_search
+              properties:
+                terms:
+                  type: string
+                  description: The search terms as inputed by the user. To search for files
+                    from a user include `from:someusername`, using a user's
+                    username. To search in a specific channel include
+                    `in:somechannel`, using the channel name (not the display
+                    name). To search for specific extensions include `ext:extension`.
+                is_or_search:
+                  type: boolean
+                  description: Set to true if an Or search should be performed vs an And
+                    search.
+                time_zone_offset:
+                  type: integer
+                  default: 0
+                  description: Offset from UTC of user timezone for date searches.
+                include_deleted_channels:
+                  type: boolean
+                  description: Set to true if deleted channels should be included in the
+                    search. (archived channels)
+                page:
+                  type: integer
+                  default: 0
+                  description: The page to select. (Only works with Elasticsearch)
+                per_page:
+                  type: integer
+                  default: 60
+                  description: The number of posts per page. (Only works with Elasticsearch)
+        description: The search terms and logic to use in the search.
+        required: true
+      responses:
+        "200":
+          description: Files list retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FileInfoList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/files/search":
+    post:
+      tags:
+        - files
+        - search
+      summary: Search files across the teams of the current user
+      description: >
+        Search for files in the teams of the current user based on file name,
+        extention and file content (if file content extraction is enabled and
+        supported for the files).
+
+        __Minimum server version__: 10.2
+
+        ##### Permissions
+
+        Must be authenticated and have the `view_team` permission.
+      operationId: SearchFiles
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required:
+                - terms
+                - is_or_search
+              properties:
+                terms:
+                  type: string
+                  description: The search terms as entered by the user. To search for files
+                    from a user include `from:someusername`, using a user's
+                    username. To search in a specific channel include
+                    `in:somechannel`, using the channel name (not the display
+                    name). To search for specific extensions include `ext:extension`.
+                is_or_search:
+                  type: boolean
+                  description: Set to true if an Or search should be performed vs an And
+                    search.
+                time_zone_offset:
+                  type: integer
+                  default: 0
+                  description: Offset from UTC of user timezone for date searches.
+                include_deleted_channels:
+                  type: boolean
+                  description: Set to true if deleted channels should be included in the
+                    search. (archived channels)
+                page:
+                  type: integer
+                  default: 0
+                  description: The page to select. (Only works with Elasticsearch)
+                per_page:
+                  type: integer
+                  default: 60
+                  description: The number of posts per page. (Only works with Elasticsearch)
+        description: The search terms and logic to use in the search.
+        required: true
+      responses:
+        "200":
+          description: Files list retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FileInfoList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+

api/v4/source/imports.yaml

@@ -0,0 +1,55 @@
+  "/api/v4/imports":
+    get:
+      tags:
+        - imports
+      summary: List import files
+      description: >
+        Lists all available import files.
+
+
+        __Minimum server version__: 5.31
+
+        ##### Permissions
+
+        Must have `manage_system` permissions.
+      operationId: ListImports
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/imports/{import_name}":
+    delete:
+      tags:
+        - imports
+      summary: Delete an import file
+      description: |
+        Deletes an import file.
+
+
+        __Minimum server version__: 5.31
+
+        ##### Permissions
+
+        Must have `manage_system` permissions.
+      operationId: DeleteImport
+      parameters:
+        - name: import_name
+          in: path
+          description: The name of the import file to delete
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/introduction.yaml

@@ -0,0 +1,489 @@
+openapi: 3.0.0
+info:
+  description: >
+    The Mattermost Web Services API enables Mattermost clients and third-party applications
+    to interact with Mattermost servers.
+
+
+    [Official JavaScript and Golang drivers](#/#official-drivers)
+    are available to simplify API integration.
+
+
+    By using this API, you agree to our [terms of service](https://about.mattermost.com/default-terms/).
+
+
+    [Find out more about Mattermost](https://about.mattermost.com/)
+
+    ## Contents
+
+    ### Core Concepts
+
+    * [Schema & Conventions](#/#schema--conventions)
+
+    * [Authentication](#/#authentication)
+
+    * [Rate Limiting](#/#rate-limiting)
+
+    * [Error Handling](#/#error-handling)
+
+    * [WebSocket](#/#websocket)
+
+      * [Authentication](#/#authentication-1)
+
+      * [WebSocket Events](#/#websocket-events)
+
+      * [WebSocket API](#/#websocket-api)
+
+    ### Drivers
+
+    * [Official Drivers](#/#official-drivers)
+
+    * [Community-built Drivers](#/#community-built-drivers)
+
+    ### Community
+
+    * [Support](#/#support)
+
+    * [Contributing](#/#contributing)
+
+
+    ## Schema & Conventions
+
+    - All API access is through HTTP(S) requests at `your-mattermost-url/api/v4`.
+
+    - All request and response bodies are `application/json`.
+
+    - When using endpoints that require a user id, the string `me` can be used in place
+    of the user id to indicate the action is to be taken for the logged in user.
+
+    - For all endpoints that implement pagination via the `per_page` parameter:
+
+      - Maximum items per page: 200 (requests exceeding this will be silently truncated)
+
+      - Default value if a paged API requires a `per_page` parameter and it is not provided: 60
+
+    ## Authentication
+
+      There are multiple ways to authenticate against the Mattermost API.
+
+      All examples assume there is a Mattermost instance running at http://localhost:8065.
+
+      ### Session Token
+
+      Make an HTTP POST to `your-mattermost-url/api/v4/users/login` with a JSON
+      body indicating the user's `login_id`, `password` and optionally the MFA
+      `token`. The `login_id` can be an email, username or an AD/LDAP ID
+      depending on the system's configuration.
+
+      ```bash
+      curl -i -d '{"login_id":"someone@nowhere.com","password":"thisisabadpassword"}' http://localhost:8065/api/v4/users/login
+      ```
+
+      NOTE: If you're running cURL on windows, you will have to change the single quotes to double quotes, and escape the inner double quotes with backslash, like below:
+
+
+      ```bash
+      curl -i -d "{\"login_id\":\"someone@nowhere.com\",\"password\":\"thisisabadpassword\"}" http://localhost:8065/api/v4/users/login
+      ```
+
+      If successful, the response will contain a `Token` header and a user object in the body.
+
+      ```http
+      HTTP/1.1 200 OK
+      Content-Type: application/json
+      Permissions-Policy:
+      Referrer-Policy: no-referrer
+      Token: ckh3t4knu3fzujt76o57f5jo4w
+      Vary: Origin
+      Vary: Accept-Encoding
+      X-Content-Type-Options: nosniff
+      X-Request-Id: bk3uzm335jr9tnoh4mcsybmmjr
+      X-Version-Id: 10.6.0.13685270376.215f100adf6ccda09afcaaa84ac4bfbd.true
+      Date: Fri, 28 Mar 2025 09:33:22 GMT
+      Content-Length: 796
+
+      {{user object as json}}
+      ```
+
+      Include the `Token` as part of the `Authorization` header on your future API requests with the `Bearer` method.
+
+      ```bash
+      curl -i -H 'Authorization: Bearer ckh3t4knu3fzujt76o57f5jo4w' http://localhost:8065/api/v4/users/me
+      ```
+      Alternatively, include the `Token` as your `MMAUTHTOKEN` cookie value on your future API requests:
+
+      ```bash
+      curl -i -H 'Cookie: MMAUTHTOKEN=ckh3t4knu3fzujt76o57f5jo4w' http://localhost:8065/api/v4/users/me
+      ```
+
+
+      You should now be able to access the API as the user you logged in as.
+
+
+      ### Personal Access Tokens
+
+      Using [personal access tokens](https://developers.mattermost.com/integrate/reference/personal-access-token/) is very similar to using a session token. The only real difference is that session tokens will expire, while personal access tokens will live until they are manually revoked by the user or an admin.
+
+      Just like session tokens, include the personal access token as part of the `Authorization` header in your requests using the `Bearer` method. Assuming our personal access token is `9xuqwrwgstrb3mzrxb83nb357a`, we could use it as shown below.
+
+      ```bash
+      curl -i -H 'Authorization: Bearer 9xuqwrwgstrb3mzrxb83nb357a' http://localhost:8065/api/v4/users/me
+      ```
+
+    ## Rate Limiting
+      Whenever you make an HTTP request to the Mattermost API you might notice
+      the following headers included in the response:
+
+      ```http
+      X-Ratelimit-Limit: 10
+      X-Ratelimit-Remaining: 9
+      X-Ratelimit-Reset: 1441983590
+      ```
+
+
+      These headers are telling you your current rate limit status.
+
+
+      | Header                  | Description                                                        |
+      |:-----------------------|:-------------------------------------------------------------------|
+      | X-Ratelimit-Limit      | The maximum number of requests you can make per second.            |
+      | X-Ratelimit-Remaining  | The number of requests remaining in the current window.            |
+      | X-Ratelimit-Reset      | The remaining UTC epoch seconds before the rate limit resets.      |
+
+      If you exceed your rate limit for a window you will receive the following error in the body of the response:
+
+      ```http
+      HTTP/1.1 429 Too Many Requests
+      Date: Tue, 10 Sep 2015 11:20:28 GMT
+      X-RateLimit-Limit: 10
+      X-RateLimit-Remaining: 0
+      X-RateLimit-Reset: 1
+
+      limit exceeded
+      ```
+
+    ## Error Handling
+
+      All errors will return an appropriate HTTP response code along with the
+      following JSON body:
+
+      ```json
+      {
+          "id": "the.error.id",
+          "message": "Something went wrong", // the reason for the error
+          "request_id": "", // the ID of the request
+          "status_code": 0, // the HTTP status code
+          "is_oauth": false // whether the error is OAuth specific
+      }
+
+      ```
+
+    ## WebSocket
+     In addition to the HTTP RESTful web service, Mattermost also offers a WebSocket event delivery system and some API functionality.
+
+     To connect to the WebSocket follow the standard opening handshake as [defined by the RFC specification](https://tools.ietf.org/html/rfc6455#section-1.3) to the `/api/v4/websocket` endpoint of Mattermost.
+
+
+    ### Authentication
+
+      The Mattermost WebSocket can be authenticated using [the standard API authentication methods](/#/#authentication) (by a cookie or with an explicit Authorization header) or through an authentication challenge. If you're authenticating from a browser and have logged in with the Mattermost API, your authentication cookie should already be set. This is how the Mattermost webapp authenticates with the WebSocket.
+
+      To authenticate with an authentication challenge, first connect the WebSocket and then send the following JSON over the connection:
+
+
+      ```json
+      {
+        "seq": 1,
+        "action": "authentication_challenge",
+        "data": {
+          "token": "mattermosttokengoeshere"
+        }
+      }
+      ```
+
+      If successful, you will receive a standard OK response over the WebSocket connection:
+
+
+      ```json
+      {
+        "status": "OK",
+        "seq_reply": 1
+      }
+      ```
+
+      Once successfully authenticated, the server will pass a `hello` WebSocket event containing server version over the connection.
+
+    ### WebSocket Events
+
+      WebSocket events are primarily used to alert the client to changes in Mattermost, such as delivering new posts or alerting the client that another user is typing in a channel.
+
+      Events on the WebSocket will have the form:
+
+      ```json
+      {
+        "event": "hello",
+        "data": {
+          "server_version": "3.6.0.1451.1c38da627ebb4e3635677db6939e9195"
+        },
+        "broadcast":{
+          "omit_users": null,
+          "user_id": "ay5sq51sebfh58ktrce5ijtcwy",
+          "channel_id": "",
+          "team_id": ""
+        },
+        "seq": 0
+      }
+      ```
+
+      The `event` field indicates the event type, `data` contains any data relevant to the event and `broadcast` contains information about who the event was sent to. For example, the above example has `user_id` set to "ay5sq51sebfh58ktrce5ijtcwy" meaning that only the user with that ID received this event broadcast. The `omit_users` field can contain an array of user IDs that were specifically omitted from receiving the event.
+
+      The list of Mattermost WebSocket events are:
+
+      - added_to_team
+      - authentication_challenge
+      - channel_converted
+      - channel_created
+      - channel_deleted
+      - channel_member_updated
+      - channel_updated
+      - channel_viewed
+      - config_changed
+      - delete_team
+      - direct_added
+      - emoji_added
+      - ephemeral_message
+      - group_added
+      - hello
+      - leave_team
+      - license_changed
+      - memberrole_updated
+      - new_user
+      - plugin_disabled
+      - plugin_enabled
+      - plugin_statuses_changed
+      - post_deleted
+      - post_edited
+      - post_unread
+      - posted
+      - preference_changed
+      - preferences_changed
+      - preferences_deleted
+      - reaction_added
+      - reaction_removed
+      - response
+      - role_updated
+      - shared_channel_remote_updated
+      - status_change
+      - typing
+      - update_team
+      - user_added
+      - user_removed
+      - user_role_updated
+      - user_updated
+      - dialog_opened
+      - thread_updated
+      - thread_follow_changed
+      - thread_read_changed
+      - property_field_created
+      - property_field_updated
+      - property_field_deleted
+      - property_values_updated
+
+    ### WebSocket API
+
+      Mattermost has some basic support for WebSocket APIs. A connected WebSocket can make requests by sending the following over the connection:
+
+      ```json
+      {
+        "action": "user_typing",
+        "seq": 2,
+        "data": {
+          "channel_id": "nhze199c4j87ped4wannrjdt9c",
+          "parent_id": ""
+        }
+      }
+      ```
+
+      This is an example of making a `user_typing` request, with the purpose of alerting the server that the connected client has begun typing in a channel or thread. The `action` field indicates what is being requested, and performs a similar duty as the route in a HTTP API. The `data` field is used to add any additional data along with the request. The server supports binary websocket messages as well in case the client has such a requirement.
+
+      The `seq` or sequence number is set by the client and should be incremented with every use. It is used to distinguish responses to requests that come down the WebSocket. For example, a standard response to the above request would be:
+
+
+      ```json
+      {
+        "status": "OK",
+        "seq_reply": 2
+      }
+      ```
+
+      Notice `seq_reply` is 2, matching the `seq` of the original request. Using this a client can distinguish which request the response is meant for.
+
+      If there was any information to respond with, it would be encapsulated in a `data` field.
+
+      In the case of an error, the response would be:
+
+
+      ```json
+      {
+        "status": "FAIL",
+        "seq_reply": 2,
+        "error": {
+          "id": "some.error.id.here",
+          "message": "Some error message here"
+        }
+      }
+      ```
+
+
+      The list of WebSocket API actions is:
+
+      - user_typing
+      - get_statuses
+      - get_statuses_by_ids
+
+
+      To see how these actions work, please refer to either the [Golang WebSocket driver](https://github.com/mattermost/mattermost/blob/master/server/public/model/websocket_client.go) or our [JavaScript WebSocket driver](https://github.com/mattermost/mattermost/blob/master/webapp/platform/client/src/websocket.ts).
+
+    ## Drivers
+      The easiest way to interact with the Mattermost Web Service API is through
+      a language specific driver.
+
+      ### Official Drivers
+
+      * Mattermost JavaScript/TypeScript Driver
+        * [NPM](https://www.npmjs.com/package/@mattermost/client)
+        * [Source](https://github.com/mattermost/mattermost/tree/master/webapp/platform/client)
+
+      * [Mattermost Golang Driver](https://pkg.go.dev/github.com/mattermost/mattermost/server/public/model#Client4)
+
+      ### Community-built Drivers
+
+      For community-built drivers and API wrappers, see [our app directory](https://mattermost.com/marketplace-category/mattermost-developers-tools/).
+
+    ## Support
+
+    Mattermost core committers work with the community to keep the API documentation up-to-date.
+
+    If you have questions on API routes not listed in this reference, you can:
+
+    - [Join the Mattermost community server](https://community.mattermost.com) to ask questions in the Developers channel
+
+    - Contact us at feedback@mattermost.com
+
+
+    [Bug reports](https://github.com/mattermost/mattermost/issues) in the documentation or the API are also welcome, as are pull requests to fix the issues.
+
+
+    ## Contributing
+
+    When you have answers to API questions not addressed in our documentation we ask you to consider making a pull request to improve our reference. Small and large changes are all welcome.
+
+
+    We also have [Help Wanted tickets](https://github.com/mattermost/mattermost/issues?q=is%3Aopen+is%3Aissue+label%3AArea%2FAPI) available for community members who would like to help others more easily use the APIs. We acknowledge everyone's contribution in the [release notes of our next version](https://docs.mattermost.com/administration/changelog.html#contributors).
+
+
+    The source code for this API reference is hosted at https://github.com/mattermost/mattermost/tree/master/api.
+
+  version: 4.0.0
+  title: Mattermost API
+tags:
+  - name: users
+    description: >
+      Endpoints for creating, getting and interacting with users.
+
+      When using endpoints that require a user id, the string `me` can be used in place of the user id to indicate the action is to be taken for the logged in user.
+  - name: bots
+    description: Endpoints for creating, getting and updating bot users.
+  - name: teams
+    description: Endpoints for creating, getting and interacting with teams.
+  - name: channels
+    description: Endpoints for creating, getting and interacting with channels.
+  - name: posts
+    description: Endpoints for creating, getting and interacting with posts.
+  - name: files
+    description: Endpoints for uploading and interacting with files.
+  - name: uploads
+    description: Endpoints for creating and performing file uploads.
+  - name: bookmarks
+    description: Endpoints for creating, getting and interacting with channel bookmarks.
+  - name: views
+    description: Endpoints for creating, getting and interacting with channel views.
+  - name: boards
+    description: Endpoints for creating and managing board channels (kanban-backed channels with linked properties). Gated behind the `IntegratedBoards` feature flag.
+  - name: preferences
+    description: Endpoints for saving and modifying user preferences.
+  - name: status
+    description: Endpoints for getting and updating user statuses.
+  - name: emoji
+    description: Endpoints for creating, getting and interacting with emojis.
+  - name: reactions
+    description: Endpoints for creating, getting and removing emoji reactions.
+  - name: webhooks
+    description: Endpoints for creating, getting and updating webhooks.
+  - name: commands
+    description: Endpoints for creating, getting and updating slash commands.
+  - name: system
+    description: General endpoints for interacting with the server, such as configuration and logging.
+  - name: brand
+    description:
+      Endpoints related to custom branding and white-labeling. See [our branding
+      documentation](https://docs.mattermost.com/administration/branding.html)
+      for more information.
+  - name: OAuth
+    description:
+      Endpoints for configuring and interacting with Mattermost as an OAuth 2.0
+      service provider.
+  - name: SAML
+    description: Endpoints for configuring and interacting with SAML.
+  - name: LDAP
+    description: Endpoints for configuring and interacting with LDAP.
+  - name: groups
+    description: Endpoints related to groups, including LDAP-synced and custom groups.
+  - name: compliance
+    description: Endpoints for creating, getting and downloading compliance reports.
+  - name: cluster
+    description: Endpoints for configuring and interacting with high availability clusters.
+  - name: elasticsearch
+    description: Endpoints for configuring and interacting with Elasticsearch.
+  - name: data retention
+    description: Endpoint for getting data retention policy settings.
+  - name: jobs
+    description:
+      Endpoints related to various background jobs that can be run by the server
+      or separately by job servers.
+  - name: plugins
+    description: Endpoints related to uploading and managing plugins.
+  - name: roles
+    description: Endpoints for creating, getting and updating roles.
+  - name: schemes
+    description: Endpoints for creating, getting and updating and deleting schemes.
+  - name: integration_actions
+    description: Endpoints for interactive actions for use by integrations.
+  - name: shared channels
+    description: Endpoints for getting information about shared channels.
+  - name: terms of service
+    description: Endpoints for getting and updating custom terms of service.
+  - name: imports
+    description: Endpoints related to import files.
+  - name: exports
+    description: Endpoints related to export files.
+  - name: metrics
+    description: Endpoints related to metrics, including the Client Performance Monitoring feature.
+  - name: audit_logs
+    description: Endpoints for managing audit log certificates and configuration.
+  - name: ephemeral mode
+    description: Endpoints for logging client-side ephemeral mode audit events.
+  - name: recaps
+    description: Endpoints for creating and managing AI-powered channel recaps that summarize unread messages.
+  - name: scheduled recaps
+    description: Endpoints for creating and managing scheduled recaps that run automatically on a configured schedule.
+  - name: agents
+    description: Endpoints for interacting with AI agents and LLM services.
+  - name: Delivery Tracking
+    description: Endpoints for configuring post delivery audit logging.
+servers:
+  - url: "{your-mattermost-url}"
+    variables:
+      your-mattermost-url:
+        default: http://localhost:8065
+paths:

api/v4/source/ip_filters.yaml

@@ -0,0 +1,92 @@
+  /api/v4/ip_filtering:
+    get:
+      tags:
+        - ip
+        - filtering
+      summary: Get all IP filters
+      description: >
+        Retrieve a list of IP filters applied to the workspace
+
+        __Minimum server version__: 9.1
+        __Note:__ This is intended for internal use and only applicable to Cloud workspaces
+      operationId: GetIPFilters
+      responses:
+        "200":
+          description: IP Filters returned successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items: 
+                  $ref: "#/components/schemas/AllowedIPRange"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - ip
+        - filtering
+      summary: Get all IP filters
+      description: >
+        Adjust IP Filters applied to the workspace
+
+        __Minimum server version__: 9.1
+        __Note:__ This is intended for internal use and only applicable to Cloud workspaces
+      operationId: ApplyIPFilters
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items: 
+                $ref: "#/components/schemas/AllowedIPRange"
+        description: IP Filters to apply
+        required: true
+      responses:
+        "200":
+          description: IP Filters returned successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items: 
+                  $ref: "#/components/schemas/AllowedIPRange"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ip_filtering/my_ip:
+    get:
+      tags:
+        - ip
+        - filtering
+      summary: Get all IP filters
+      description: >
+        Retrieve your current IP address as seen by the workspace
+
+        __Minimum server version__: 9.1
+        __Note:__ This is intended for internal use and only applicable to Cloud workspaces
+      operationId: MyIP
+      responses:
+        "200":
+          description: IP address returned successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  ip:
+                    type: string
+                    description: Your current IP address
+                    example: "192.168.0.1"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/jobs.yaml

@@ -0,0 +1,345 @@
+  /api/v4/jobs:
+    get:
+      tags:
+        - jobs
+      summary: Get the jobs.
+      description: |
+        Get a page of jobs. Use the query parameters to modify the behaviour of
+        this endpoint.
+
+        __Minimum server version: 4.1__
+
+        ##### Permissions
+        Must have permission to read at least one job type returned by this call.
+        When no `job_type` query parameter is set, the server only includes job types your session may read; required permission depends on the job type:
+
+        - `read_data_retention_job` — `data_retention`
+        - `read_compliance_export_job` — `message_export`
+        - `read_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `read_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `read_ldap_sync_job` — `ldap_sync`
+        - `read_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `mobile_session_metadata`, `extract_content`
+        - `manage_system` — `access_control_sync`
+
+        When `job_type` is set, you must have the permission that matches that type (same mapping as above).
+
+        This endpoint does not accept `team_id`. To list `access_control_sync` jobs scoped to a team without `manage_system`, use `GET /api/v4/jobs/type/access_control_sync` with query parameter `team_id` set to the team GUID (requires `manage_team_access_rules` on that team).
+      operationId: GetJobs
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of jobs per page.
+          schema:
+            type: integer
+            default: 5
+        - name: job_type
+          in: query
+          description: The type of jobs to fetch.
+          schema:
+            type: string
+        - name: status
+          in: query
+          description: The status of jobs to fetch.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Job list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Job"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    post:
+      tags:
+        - jobs
+      summary: Create a new job.
+      description: |
+        Create a new job.
+        __Minimum server version: 4.1__
+        ##### Permissions
+        Must have permission to create the requested job type. Required permission depends on `type`:
+
+        - `create_data_retention_job` — `data_retention`
+        - `create_compliance_export_job` — `message_export`
+        - `create_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `create_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `create_ldap_sync_job` — `ldap_sync`
+        - `manage_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `extract_content`
+        - `access_control_sync` — `manage_system`, or `manage_channel_access_rules` on the channel given in job `data`, or `manage_team_access_rules` on the team in job `data` (see server logic for scoped sync jobs)
+      operationId: CreateJob
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - type
+              properties:
+                type:
+                  type: string
+                  description: The type of job to create
+                data:
+                  type: object
+                  description: An object containing any additional data required for this
+                    job type
+        description: Job object to be created
+        required: true
+      responses:
+        "201":
+          description: Job creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Job"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/jobs/{job_id}":
+    get:
+      tags:
+        - jobs
+      summary: Get a job.
+      description: |
+        Gets a single job.
+        __Minimum server version: 4.1__
+        ##### Permissions
+        Must have permission to read the job's type:
+
+        - `read_data_retention_job` — `data_retention`
+        - `read_compliance_export_job` — `message_export`
+        - `read_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `read_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `read_ldap_sync_job` — `ldap_sync`
+        - `read_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `mobile_session_metadata`, `extract_content`
+        - `manage_system` — `access_control_sync`
+      operationId: GetJob
+      parameters:
+        - name: job_id
+          in: path
+          description: Job GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Job retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Job"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/jobs/{job_id}/download":
+    get:
+      tags:
+        - jobs
+      summary: Download the results of a job.
+      description: |
+        Download the result of a single job.
+        __Minimum server version: 5.28__
+        ##### Permissions
+        Must have `download_compliance_export_result` permission for message export jobs.
+      operationId: DownloadJob
+      parameters:
+        - name: job_id
+          in: path
+          description: Job GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/jobs/{job_id}/cancel":
+    post:
+      tags:
+        - jobs
+      summary: Cancel a job.
+      description: |
+        Cancel a job.
+        __Minimum server version: 4.1__
+        ##### Permissions
+        Same as creating that job type (cancel uses the create permission check):
+
+        - `create_data_retention_job` — `data_retention`
+        - `create_compliance_export_job` — `message_export`
+        - `create_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `create_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `create_ldap_sync_job` — `ldap_sync`
+        - `manage_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `extract_content`
+        - `access_control_sync` — `manage_system`, or `manage_channel_access_rules` / `manage_team_access_rules` for scoped jobs as when creating
+      operationId: CancelJob
+      parameters:
+        - name: job_id
+          in: path
+          description: Job GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Job canceled successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/jobs/type/{job_type}":
+    get:
+      tags:
+        - jobs
+      summary: Get the jobs of the given type.
+      description: |
+        Get a page of jobs of the given type. Use the query parameters to modify
+        the behaviour of this endpoint.
+
+        __Minimum server version: 4.1__
+
+        ##### Permissions
+        Must have permission to read the path `job_type`, using the same mapping as `GET /api/v4/jobs`:
+
+        - `read_data_retention_job` — `data_retention`
+        - `read_compliance_export_job` — `message_export`
+        - `read_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `read_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `read_ldap_sync_job` — `ldap_sync`
+        - `read_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `mobile_session_metadata`, `extract_content`
+        - `manage_system` — `access_control_sync`
+
+        When `job_type` is `access_control_sync` and query parameter `team_id` is set to a valid team GUID, team admins with `manage_team_access_rules` on that team may list jobs scoped to that team without `manage_system`. When `team_id` is set, results include only jobs whose stored data matches that team for the requested type.
+      operationId: GetJobsByType
+      parameters:
+        - name: job_type
+          in: path
+          description: Job type
+          required: true
+          schema:
+            type: string
+        - name: team_id
+          in: query
+          description: |
+            Optional team GUID. When set, the server returns jobs of the given `job_type` whose job data includes this `team_id` (see server filtering). For `access_control_sync`, team admins with `manage_team_access_rules` on this team may use this parameter to read team-scoped jobs without `manage_system`.
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of jobs per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Job list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Job"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/jobs/{job_id}/status":
+    patch:
+      tags:
+        - jobs
+      summary: Update the status of a job
+      description: |
+        Update the status of a job. Valid status updates:
+        - 'in_progress' -> 'pending'
+        - 'in_progress' | 'pending' -> 'cancel_requested'
+        - 'cancel_requested' -> 'canceled'
+
+        Add force to the body of the PATCH request to bypass the given rules, the only statuses you can go to are: pending, cancel_requested and canceled. This can have unexpected consequences and should be used with caution.
+
+        ##### Permissions
+        Must have permission to manage the job's type:
+
+        - `manage_data_retention_job` — `data_retention`
+        - `manage_compliance_export_job` — `message_export`
+        - `manage_elasticsearch_post_indexing_job` — `elasticsearch_post_indexing`
+        - `manage_elasticsearch_post_aggregation_job` — `elasticsearch_post_aggregation`
+        - `manage_ldap_sync_job` — `ldap_sync`
+        - `manage_jobs` — `migrations`, `plugins`, `product_notices`, `expiry_notify`, `active_users`, `import_process`, `import_delete`, `export_process`, `export_delete`, `cloud`, `extract_content`
+        - `manage_system` — `access_control_sync`
+      operationId: UpdateJobStatus
+      parameters:
+        - name: job_id
+          in: path
+          description: Job GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - status
+              properties:
+                status:
+                  type: string
+                  description: The status you want to set
+                force:
+                  type: boolean
+                  description: Set this to true to bypass status restrictions
+      responses:
+        "200":
+          description: Status successfully set.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/ldap.yaml

@@ -0,0 +1,451 @@
+  /api/v4/ldap/sync:
+    post:
+      tags:
+        - LDAP
+      summary: Sync with LDAP
+      description: >
+        Synchronize any user attribute changes in the configured AD/LDAP server
+        with Mattermost.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: SyncLdap
+      responses:
+        "200":
+          description: LDAP sync successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/test:
+    post:
+      tags:
+        - LDAP
+      summary: Test LDAP configuration
+      description: >
+        Test the current AD/LDAP configuration to see if the AD/LDAP server can
+        be contacted successfully.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: TestLdap
+      responses:
+        "200":
+          description: LDAP test successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/test_connection:
+    post:
+      tags:
+        - LDAP
+      summary: Test LDAP connection with specific settings
+      description: >
+        Test the LDAP connection using the provided settings without modifying
+        the current server configuration.
+
+        ##### Permissions
+
+        Must have `sysconsole_read_authentication_ldap` or `manage_system` permission.
+      operationId: TestLdapConnection
+      requestBody:
+        description: LDAP settings to test
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/LdapSettings"
+      responses:
+        "200":
+          description: LDAP connection test successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/test_diagnostics:
+    post:
+      tags:
+        - LDAP
+      summary: Test LDAP diagnostics with specific settings
+      description: >
+        Test LDAP diagnostics using the provided settings to validate configuration
+        and see sample results without modifying the current server configuration.
+        Use the `test` query parameter to specify which diagnostic to run.
+
+        ##### Permissions
+
+        Must have `sysconsole_read_authentication_ldap` or `manage_system` permission.
+      operationId: TestLdapDiagnostics
+      parameters:
+        - in: query
+          name: test
+          required: true
+          description: Type of LDAP diagnostic test to run
+          schema:
+            type: string
+            enum:
+              - filters
+              - attributes
+              - group_attributes
+            example: filters
+      requestBody:
+        description: LDAP settings to test diagnostics with
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/LdapSettings"
+      responses:
+        "200":
+          description: LDAP diagnostic test results
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/LdapDiagnosticResult"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/groups:
+    get:
+      tags:
+        - LDAP
+      summary: Returns a list of LDAP groups
+      description: >
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.11
+      operationId: GetLdapGroups
+      parameters:
+        - name: q
+          in: query
+          description: Search term
+          required: false
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of users per page.
+            per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: LDAP group page retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/LDAPGroupsPaged"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  /api/v4/ldap/groups/{remote_id}/link:
+    post:
+      tags:
+        - LDAP
+      summary: Link a LDAP group
+      description: >
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.11
+      operationId: LinkLdapGroup
+      parameters:
+        - name: remote_id
+          in: path
+          description: Group GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "201":
+          description: LDAP group successfully linked
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    delete:
+      tags:
+        - groups
+      summary: Delete a link for LDAP group
+      description: >
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.11
+      operationId: UnlinkLdapGroup
+      parameters:
+        - name: remote_id
+          in: path
+          description: Group GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successfully deleted ldap group link
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  /api/v4/ldap/migrateid:
+    post:
+      tags:
+        - LDAP
+      summary: Migrate Id LDAP
+      description: >
+        Migrate LDAP IdAttribute to new value.
+  
+        ##### Permissions
+  
+        Must have `manage_system` permission.
+  
+        __Minimum server version__: 5.26
+      operationId: MigrateIdLdap
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - toAttribute
+              properties:
+                toAttribute:
+                  description: New IdAttribute value
+                  type: string
+        required: true
+      responses:
+        "200":
+          description: Migration successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/certificate/public:
+    post:
+      tags:
+        - LDAP
+      summary: Upload public certificate
+      description: >
+        Upload the public certificate to be used for TLS verification. The server will pick a hard-coded filename for the
+        PublicCertificateFile setting in your `config.json`.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: UploadLdapPublicCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The public certificate file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: LDAP certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - LDAP
+      summary: Remove public certificate
+      description: >
+        Delete the current public certificate being used for TLS verification.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: DeleteLdapPublicCertificate
+      responses:
+        "200":
+          description: LDAP certificate delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/certificate/private:
+    post:
+      tags:
+        - LDAP
+      summary: Upload private key
+      description: >
+        Upload the private key to be used for TLS verification. The server will pick a hard-coded filename for the
+        PrivateKeyFile setting in your `config.json`.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: UploadLdapPrivateCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The private key file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: LDAP certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - LDAP
+      summary: Remove private key
+      description: >
+        Delete the current private key being used with your TLS verification.
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: DeleteLdapPrivateCertificate
+      responses:
+        "200":
+          description: LDAP certificate delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/ldap/users/{user_id}/group_sync_memberships:
+    post:
+      tags:
+        - LDAP
+      summary: Create memberships for LDAP configured channels and teams for this user
+      description: >
+        Add the user to each channel and team configured for each LDAP group of whicht the user is
+        a member.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_user_management_groups` permission.
+      operationId: AddUserToGroupSyncables
+      parameters:
+        - name: user_id
+          in: path
+          description: User Id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Channel and team memberships created as needed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/limits.yaml

@@ -0,0 +1,30 @@
+  /api/v4/limits/server:
+    get:
+      tags:
+        - users
+      summary: Gets the server limits for the server
+      description: >
+        Gets the server limits for the server
+
+        ##### Permissions
+
+        Requires `sysconsole_read_user_management_users`.
+
+      operationId: GetServerLimits
+      responses:
+        "200":
+          description: App limits for server
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ServerLimits"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/logs.yaml

@@ -0,0 +1,18 @@
+  /api/v4/logs/download:
+    get:
+      tags:
+        - logs
+      summary: Download system logs
+      description: >
+        Downloads the system logs as a text file.
+      operationId: DownloadSystemLogs
+      responses:
+        "200":
+          description: System logs downloaded successfully.
+          content:
+            text/plain:
+              schema:
+                type: string
+                format: binary
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/metrics.yaml

@@ -0,0 +1,104 @@
+  /api/v4/client_perf:
+    post:
+      tags:
+        - metrics
+      summary: Report client performance metrics
+      description: >
+        Uploads client performance measurements to the server as part of the Client Performance Monitoring feature.
+
+        __Minimum server version__: 9.9.0
+      operationId: SubmitPerformanceReport
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - version
+                - start
+                - end
+              properties:
+                version:
+                  type: string
+                  description: An identifier for the schema of the data being submitted which currently must be "0.1.0"
+                client_id:
+                  type: string
+                  description: Not currently used
+                labels:
+                  type: array
+                  items:
+                    type: string
+                  description: Labels to be applied to all metrics when recorded by the metrics backend
+                start:
+                  type: integer
+                  format: int64
+                  description: The time in milliseconds of the first metric in this report
+                end:
+                  type: integer
+                  format: int64
+                  description: The time in milliseconds of the last metric in this report
+                counters:
+                  type: array
+                  items:
+                    type: object
+                    required:
+                      - metric
+                      - value
+                    properties:
+                      metric:
+                        type: string
+                        description: The name of the counter
+                      value:
+                        type: number
+                        format: double
+                        description: The value to increment the counter by
+                      timestamp:
+                        type: integer
+                        format: int64
+                        description: The time that the counter was incremented
+                      labels:
+                        type: array
+                        items:
+                          type: string
+                        description: Labels to be applied to this metric when recorded by the metrics backend
+                  description: An array of counter metrics to be reported
+                histograms:
+                  type: array
+                  items:
+                    type: object
+                    required:
+                      - metric
+                      - value
+                    properties:
+                      metric:
+                        type: string
+                        description: The name of the measurement
+                      value:
+                        type: number
+                        format: double
+                        description: The value of the measurement
+                      timestamp:
+                        type: integer
+                        format: int64
+                        description: The time that the measurement was taken
+                      labels:
+                        type: array
+                        items:
+                          type: string
+                        description: Labels to be applied to this metric when recorded by the metrics backend
+                  description: An array of histogram measurements to be reported
+      responses:
+        "200":
+          description: Measurements reported successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/oauth.yaml

@@ -0,0 +1,445 @@
+  /api/v4/oauth/apps:
+    post:
+      tags:
+        - OAuth
+      summary: Register OAuth app
+      description: >
+        Register an OAuth 2.0 client application with Mattermost as the service
+        provider.
+
+        ##### Permissions
+
+        Must have `manage_oauth` permission.
+      operationId: CreateOAuthApp
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - name
+                - description
+                - callback_urls
+                - homepage
+              properties:
+                name:
+                  type: string
+                  description: The name of the client application
+                description:
+                  type: string
+                  description: A short description of the application
+                icon_url:
+                  type: string
+                  description: A URL to an icon to display with the application
+                callback_urls:
+                  type: array
+                  items:
+                    type: string
+                  description: A list of callback URLs for the appliation
+                homepage:
+                  type: string
+                  description: A link to the website of the application
+                is_trusted:
+                  type: boolean
+                  description: Set this to `true` to skip asking users for permission
+                is_public:
+                  type: boolean
+                  description: Set this to `true` to create a public client (no client secret). Public clients must use PKCE for authorization.
+        description: OAuth application to register
+        required: true
+      responses:
+        "201":
+          description: App registration successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - OAuth
+      summary: Get OAuth apps
+      description: >
+        Get a page of OAuth 2.0 client applications registered with Mattermost.
+
+        ##### Permissions
+
+        With `manage_oauth` permission, the apps registered by the logged in user are returned. With `manage_system_wide_oauth` permission, all apps regardless of creator are returned.
+      operationId: GetOAuthApps
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of apps per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: OAuthApp list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/oauth/apps/{app_id}":
+    get:
+      tags:
+        - OAuth
+      summary: Get an OAuth app
+      description: >
+        Get an OAuth 2.0 client application registered with Mattermost.
+
+        ##### Permissions
+
+        If app creator, must have `mange_oauth` permission otherwise `manage_system_wide_oauth` permission is required.
+      operationId: GetOAuthApp
+      parameters:
+        - name: app_id
+          in: path
+          description: Application client id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: App retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    put:
+      tags:
+        - OAuth
+      summary: Update an OAuth app
+      description: >
+        Update an OAuth 2.0 client application based on OAuth struct.
+
+        ##### Permissions
+
+        If app creator, must have `mange_oauth` permission otherwise `manage_system_wide_oauth` permission is required.
+      operationId: UpdateOAuthApp
+      parameters:
+        - name: app_id
+          in: path
+          description: Application client id
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - id
+                - name
+                - description
+                - callback_urls
+                - homepage
+              properties:
+                id:
+                  type: string
+                  description: The id of the client application
+                name:
+                  type: string
+                  description: The name of the client application
+                description:
+                  type: string
+                  description: A short description of the application
+                icon_url:
+                  type: string
+                  description: A URL to an icon to display with the application
+                callback_urls:
+                  type: array
+                  items:
+                    type: string
+                  description: A list of callback URLs for the appliation
+                homepage:
+                  type: string
+                  description: A link to the website of the application
+                is_trusted:
+                  type: boolean
+                  description: Set this to `true` to skip asking users for permission. It
+                    will be set to false if value is not provided.
+        description: OAuth application to update
+        required: true
+      responses:
+        "200":
+          description: App update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - OAuth
+      summary: Delete an OAuth app
+      description: >
+        Delete and unregister an OAuth 2.0 client application 
+
+        ##### Permissions
+
+        If app creator, must have `mange_oauth` permission otherwise `manage_system_wide_oauth` permission is required.
+      operationId: DeleteOAuthApp
+      parameters:
+        - name: app_id
+          in: path
+          description: Application client id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: App deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/oauth/apps/{app_id}/regen_secret":
+    post:
+      tags:
+        - OAuth
+      summary: Regenerate OAuth app secret
+      description: >
+        Regenerate the client secret for an OAuth 2.0 client application
+        registered with Mattermost.
+
+        ##### Permissions
+
+        If app creator, must have `mange_oauth` permission otherwise `manage_system_wide_oauth` permission is required.
+      operationId: RegenerateOAuthAppSecret
+      parameters:
+        - name: app_id
+          in: path
+          description: Application client id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Secret regeneration successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/oauth/apps/{app_id}/info":
+    get:
+      tags:
+        - OAuth
+      summary: Get info on an OAuth app
+      description: >
+        Get public information about an OAuth 2.0 client application registered
+        with Mattermost. The application's client secret will be blanked out.
+
+        ##### Permissions
+
+        Must be authenticated.
+      operationId: GetOAuthAppInfo
+      parameters:
+        - name: app_id
+          in: path
+          description: Application client id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: App retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /.well-known/oauth-authorization-server:
+    get:
+      tags:
+        - OAuth
+      summary: Get OAuth 2.0 Authorization Server Metadata
+      description: >
+        Get the OAuth 2.0 Authorization Server Metadata as defined in RFC 8414.
+        This endpoint provides metadata about the OAuth 2.0 authorization server's
+        configuration, including supported endpoints, grant types, response types,
+        and authentication methods.
+
+        ##### Permissions
+
+        No authentication required. This endpoint is publicly accessible to allow
+        OAuth clients to discover the authorization server's configuration.
+
+        ##### Notes
+
+        - This endpoint implements RFC 8414 (OAuth 2.0 Authorization Server Metadata)
+        - The metadata is dynamically generated based on the server's configuration
+        - OAuth Service Provider must be enabled in system settings for this endpoint to be available
+      operationId: GetAuthorizationServerMetadata
+      responses:
+        "200":
+          description: Metadata retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthorizationServerMetadata"
+        "501":
+          description: OAuth Service Provider is not enabled
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppError"
+  /api/v4/oauth/apps/register:
+    post:
+      tags:
+        - OAuth
+      summary: Register OAuth client using Dynamic Client Registration
+      description: >
+        Register an OAuth 2.0 client application using Dynamic Client Registration (DCR)
+        as defined in RFC 7591. This endpoint allows clients to register without requiring
+        administrative approval.
+
+        ##### Permissions
+
+        No authentication required. This endpoint implements the OAuth 2.0 Dynamic Client
+        Registration Protocol and can be called by unauthenticated clients.
+
+        ##### Notes
+
+        - This endpoint follows RFC 7591 (OAuth 2.0 Dynamic Client Registration Protocol)
+        - The `client_uri` field, when provided, will be mapped to the OAuth app's homepage
+        - All registered clients are marked as dynamically registered
+        - Dynamic client registration must be enabled in system settings
+      operationId: RegisterOAuthClient
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ClientRegistrationRequest"
+        description: OAuth client registration request
+        required: true
+      responses:
+        "201":
+          description: Client registration successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ClientRegistrationResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/users/{user_id}/oauth/apps/authorized":
+    get:
+      tags:
+        - OAuth
+      summary: Get authorized OAuth apps
+      description: >
+        Get a page of OAuth 2.0 client applications authorized to access a
+        user's account.
+
+        ##### Permissions
+
+        Must be authenticated as the user or have `edit_other_users` permission.
+      operationId: GetAuthorizedOAuthAppsForUser
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of apps per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: OAuthApp list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/OAuthApp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/outgoing_oauth_connections.yaml

@@ -0,0 +1,235 @@
+  /api/v4/oauth/outgoing_connections:
+    get:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: List all connections
+      description: >
+        List all outgoing OAuth connections.
+
+        __Minimum server version__: 9.6
+      operationId: ListOutgoingOAuthConnections
+      parameters:
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successfully fetched outgoing OAuth connections
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/OutgoingOAuthConnectionGetItem"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: Create a connection
+      description: >
+        Create an outgoing OAuth connection.
+
+        __Minimum server version__: 9.6
+      operationId: CreateOutgoingOAuthConnection
+      parameters:
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Outgoing OAuth connection to create
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OutgoingOAuthConnectionPostItem"
+      responses:
+        "201":
+          description: Successfully created outgoing OAuth connection
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingOAuthConnectionGetItem"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/oauth/outgoing_connections/{outgoing_oauth_connection_id}:
+    get:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: Get a connection
+      description: >
+        Retrieve an outgoing OAuth connection.
+
+        __Minimum server version__: 9.6
+      operationId: GetOutgoingOAuthConnection
+      parameters:
+        - name: outgoing_oauth_connection_id
+          in: path
+          description: Outgoing OAuth connection ID
+          required: true
+          schema:
+            type: string
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successfully fetched outgoing OAuth connection
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingOAuthConnectionGetItem"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    put:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: Update a connection
+      description: >
+        Update an outgoing OAuth connection.
+
+        __Minimum server version__: 9.6
+      operationId: UpdateOutgoingOAuthConnection
+      parameters:
+        - name: outgoing_oauth_connection_id
+          in: path
+          description: Outgoing OAuth connection ID
+          required: true
+          schema:
+            type: string
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Outgoing OAuth connection to update
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OutgoingOAuthConnectionPostItem"
+      responses:
+        "200":
+          description: Successfully updated outgoing OAuth connection
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingOAuthConnectionGetItem"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: Delete a connection
+      description: >
+        Delete an outgoing OAuth connection.
+
+        __Minimum server version__: 9.6
+      operationId: DeleteOutgoingOAuthConnection
+      parameters:
+        - name: outgoing_oauth_connection_id
+          in: path
+          description: Outgoing OAuth connection ID
+          required: true
+          schema:
+            type: string
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Successfully deleted outgoing OAuth connection
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/oauth/outgoing_connections/validate:
+    post:
+      tags:
+        - oauth
+        - outgoing_connections
+        - outgoing_oauth_connections
+      summary: Validate a connection configuration
+      description: >
+        Validate an outgoing OAuth connection. If an id is provided in the payload, and no client secret is provided, then the stored client secret is implicitly used for the validation.
+
+        __Minimum server version__: 9.6
+      operationId: ValidateOutgoingOAuthConnection
+      parameters:
+        - name: team_id
+          in: query
+          description: Current Team ID in integrations backstage
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: Outgoing OAuth connection to validate
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OutgoingOAuthConnectionPostItem"
+      responses:
+        "200":
+          description: The connection configuration is valid.
+        "400":
+          description: The connection configuration is invalid.
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+        "502":
+          description: The connection configuration may be valid, but the server is unable to validate it upstream.
+          $ref: "#/components/responses/BadGateway"

api/v4/source/permissions.yaml

@@ -0,0 +1,30 @@
+  /api/v4/permissions/ancillary:
+    post:
+      tags:
+        - permissions
+      summary: Return all system console subsection ancillary permissions
+      description: >
+        Returns all the ancillary permissions for the corresponding system console
+        subsection permissions appended to the requested permission subsections.
+        __Minimum server version__: 9.10
+      operationId: GetAncillaryPermissionsPost
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+        description: List of subsection permissions
+        required: true
+      responses:
+        "200":
+          description: Successfully returned all ancillary and requested permissions
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: string
+        "400":
+          $ref: '#/components/responses/BadRequest'

api/v4/source/plugins.yaml

@@ -0,0 +1,525 @@
+  /api/v4/plugins:
+    post:
+      tags:
+        - plugins
+      summary: Upload plugin
+      description: >
+        Upload a plugin that is contained within a compressed .tar.gz file.
+        Plugins and plugin uploads must be enabled in the server's config
+        settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 4.4
+      operationId: UploadPlugin
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                plugin:
+                  description: The plugin image to be uploaded
+                  type: string
+                  format: binary
+                force:
+                  description: Set to 'true' to overwrite a previously installed plugin
+                    with the same ID, if any
+                  type: string
+              required:
+                - plugin
+      responses:
+        "201":
+          description: Plugin upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - plugins
+      summary: Get plugins
+      description: >
+        Get a list of inactive and a list of active plugin manifests. Plugins
+        must be enabled in the server's config settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 4.4
+      operationId: GetPlugins
+      responses:
+        "200":
+          description: Plugins retrieval successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  active:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/PluginManifest"
+                  inactive:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/PluginManifest"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/plugins/install_from_url:
+    post:
+      tags:
+        - plugins
+      summary: Install plugin from url
+      description: >
+        Supply a URL to a plugin compressed in a .tar.gz file. Plugins must be
+        enabled in the server's config settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 5.14
+      operationId: InstallPluginFromUrl
+      parameters:
+        - name: plugin_download_url
+          in: query
+          description: URL used to download the plugin
+          required: true
+          schema:
+            type: string
+        - name: force
+          in: query
+          description: Set to 'true' to overwrite a previously installed plugin with the
+            same ID, if any
+          required: false
+          schema:
+            type: string
+      responses:
+        "201":
+          description: Plugin install successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/plugins/{plugin_id}":
+    delete:
+      tags:
+        - plugins
+      summary: Remove plugin
+      description: >
+        Remove the plugin with the provided ID from the server. All plugin files
+        are deleted. Plugins must be enabled in the server's config settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 4.4
+      operationId: RemovePlugin
+      parameters:
+        - name: plugin_id
+          description: Id of the plugin to be removed
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin removed successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/plugins/{plugin_id}/enable":
+    post:
+      tags:
+        - plugins
+      summary: Enable plugin
+      description: >
+        Enable a previously uploaded plugin. Plugins must be enabled in the
+        server's config settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 4.4
+      operationId: EnablePlugin
+      parameters:
+        - name: plugin_id
+          description: Id of the plugin to be enabled
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin enabled successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/plugins/{plugin_id}/disable":
+    post:
+      tags:
+        - plugins
+      summary: Disable plugin
+      description: >
+        Disable a previously enabled plugin. Plugins must be enabled in the
+        server's config settings.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 4.4
+      operationId: DisablePlugin
+      parameters:
+        - name: plugin_id
+          description: Id of the plugin to be disabled
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin disabled successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/plugins/webapp:
+    get:
+      tags:
+        - plugins
+      summary: Get webapp plugins
+      description: |
+        Get a list of web app plugins installed and activated on the server.
+
+        ##### Permissions
+        No permissions required.
+
+        __Minimum server version__: 4.4
+      operationId: GetWebappPlugins
+      responses:
+        "200":
+          description: Plugin deactivated successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PluginManifestWebapp"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/plugins/statuses:
+    get:
+      tags:
+        - plugins
+      summary: Get plugins status
+      description: |
+        Returns the status for plugins installed anywhere in the cluster
+
+        ##### Permissions
+        No permissions required.
+
+        __Minimum server version__: 4.4
+      operationId: GetPluginStatuses
+      responses:
+        "200":
+          description: Plugin status retreived successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PluginStatus"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/plugins/marketplace:
+    post:
+      tags:
+        - plugins
+      summary: Installs a marketplace plugin
+      description: |
+        Installs a plugin listed in the marketplace server.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.16
+      operationId: InstallMarketplacePlugin
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/InstallMarketplacePluginRequest"
+        description: The metadata identifying the plugin to install.
+        required: true
+      responses:
+        "200":
+          description: Plugin installed successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PluginManifest"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - plugins
+      summary: Gets all the marketplace plugins
+      description: >
+        Gets all plugins from the marketplace server, merging data from locally
+        installed plugins as well as prepackaged plugins shipped with the
+        server.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 5.16
+      operationId: GetMarketplacePlugins
+      parameters:
+        - name: page
+          in: query
+          description: Page number to be fetched. (not yet implemented)
+          required: false
+          schema:
+            type: integer
+        - name: per_page
+          in: query
+          description: Number of item per page. (not yet implemented)
+          required: false
+          schema:
+            type: integer
+        - name: filter
+          in: query
+          description: Set to filter plugins by ID, name, or description.
+          required: false
+          schema:
+            type: string
+        - name: server_version
+          in: query
+          description: Set to filter minimum plugin server version. (not yet implemented)
+          required: false
+          schema:
+            type: string
+        - name: local_only
+          in: query
+          description: Set true to only retrieve local plugins.
+          required: false
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Plugins retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/MarketplacePlugin"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/plugins/marketplace/first_admin_visit:
+    get:
+      tags:
+        - plugins
+      summary: Get if the Plugin Marketplace has been visited by at least an admin.
+      description: |
+        Retrieves the status that specifies that at least one System Admin has visited the in-product Plugin Marketplace.
+        __Minimum server version: 5.33__
+        ##### Permissions
+        Must have `manage_system` permissions.
+      operationId: GetMarketplaceVisitedByAdmin
+      responses:
+        "200":
+          description: Retrieves the system-level status
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/System"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+    post:
+      tags:
+        - system
+      summary: Stores that the Plugin Marketplace has been visited by at least an admin.
+      description: |
+        Stores the system-level status that specifies that at least an admin has visited the in-product Plugin Marketplace.
+        __Minimum server version: 5.33__
+        ##### Permissions
+        Must have `manage_system` permissions.
+      operationId: UpdateMarketplaceVisitedByAdmin
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/System"
+        required: true
+      responses:
+        "200":
+          description: setting has been successfully set
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/plugins/reattach:
+    post:
+      tags:
+        - plugins
+      summary: Reattach a plugin process
+      description: |
+        Reattaches the server to an already running plugin process.
+        This endpoint is only exposed over a local socket.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: ReattachPlugin
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PluginReattachRequest"
+      responses:
+        "200":
+          description: Plugin reattached successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/plugins/{plugin_id}/detach":
+    post:
+      tags:
+        - plugins
+      summary: Detach a reattached plugin process
+      description: |
+        Detaches a previously reattached plugin from the server.
+        This endpoint is only exposed over a local socket.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: DetachPlugin
+      parameters:
+        - name: plugin_id
+          in: path
+          description: The ID of the plugin to detach.
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Plugin detached successfully
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/preferences.yaml

@@ -0,0 +1,206 @@
+  "/api/v4/users/{user_id}/preferences":
+    get:
+      tags:
+        - preferences
+      summary: Get the user's preferences
+      description: >
+        Get a list of the user's preferences.
+
+        ##### Permissions
+
+        Must be logged in as the user being updated or have the `edit_other_users` permission.
+      operationId: GetPreferences
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User preferences retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Preference"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    put:
+      tags:
+        - preferences
+      summary: Save the user's preferences
+      description: >
+        Save a list of the user's preferences.
+
+        ##### Permissions
+
+        Must be logged in as the user being updated or have the `edit_other_users` permission.
+      operationId: UpdatePreferences
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: List of preference objects
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/Preference'
+              minItems: 1
+              maxItems: 100
+      responses:
+        "200":
+          description: User preferences saved successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/users/{user_id}/preferences/delete":
+    post:
+      tags:
+        - preferences
+      summary: Delete user's preferences
+      description: >
+        Delete a list of the user's preferences.
+
+        ##### Permissions
+
+        Must be logged in as the user being updated or have the `edit_other_users` permission.
+      operationId: DeletePreferences
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: List of preference objects
+        required: true
+        content:
+          application/json:
+            schema:            
+              type: array
+              items:
+                $ref: '#/components/schemas/Preference'
+              minItems: 1
+              maxItems: 100
+      responses:
+        "200":
+          description: User preferences saved successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/users/{user_id}/preferences/{category}":
+    get:
+      tags:
+        - preferences
+      summary: List a user's preferences by category
+      description: >
+        Lists the current user's stored preferences in the given category.
+
+        ##### Permissions
+
+        Must be logged in as the user being updated or have the `edit_other_users` permission.
+      operationId: GetPreferencesByCategory
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+        - name: category
+          in: path
+          description: The category of a group of preferences
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: A list of all of the current user's preferences in the given category
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Preference"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/users/{user_id}/preferences/{category}/name/{preference_name}":
+    get:
+      tags:
+        - preferences
+      summary: Get a specific user preference
+      description: >
+        Gets a single preference for the current user with the given category
+        and name.
+
+        ##### Permissions
+
+        Must be logged in as the user being updated or have the `edit_other_users` permission.
+      operationId: GetPreferencesByCategoryByName
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+        - name: category
+          in: path
+          description: The category of a group of preferences
+          required: true
+          schema:
+            type: string
+        - name: preference_name
+          in: path
+          description: The name of the preference
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: >
+            A single preference for the current user in the current categorylist
+            of all of the current user's preferences in the given category.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Preference"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"

api/v4/source/properties.yaml

@@ -0,0 +1,757 @@
+  "/api/v4/properties/groups/{group_name}/{object_type}/fields":
+    post:
+      tags:
+        - properties
+      summary: Create a property field
+      description: >
+        Create a new property field for a specific group and object type.
+      operationId: CreatePropertyField
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object this property field applies to
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - name
+                - type
+                - target_type
+              properties:
+                name:
+                  type: string
+                  description: The name of the property field
+                type:
+                  type: string
+                  description: The type of property field
+                  enum: [text, select, multiselect, date, user, multiuser]
+                attrs:
+                  type: object
+                  description: Additional attributes for the property field
+                target_type:
+                  type: string
+                  description: The scope level of the property
+                target_id:
+                  type: string
+                  description: The ID of the target
+                permission_field:
+                  type: string
+                  enum: [none, sysadmin, member, admin]
+                  description: >
+                    Permission level for editing the field definition.
+                    Only system admins can set this; ignored for non-admin users.
+                  default: member
+                permission_values:
+                  type: string
+                  enum: [none, sysadmin, member, admin]
+                  description: >
+                    Permission level for setting values on objects.
+                    Only system admins can set this; ignored for non-admin users.
+                  default: member
+                permission_options:
+                  type: string
+                  enum: [none, sysadmin, member, admin]
+                  description: >
+                    Permission level for managing options on select/multiselect fields.
+                    Only system admins can set this; ignored for non-admin users.
+                  default: member
+                linked_field_id:
+                  type: string
+                  description: >
+                    The ID of a template field to link to. The source must be a
+                    template field in the same group, must not itself be linked, and must
+                    not be deleted. When set, the created field inherits the source's type,
+                    options, and security attributes; the `type` field in the request body
+                    is ignored. Can only be set at creation time.
+        description: Property field object to create
+        required: true
+      responses:
+        "201":
+          description: Property field creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "409":
+          description: >
+            A property field with the same name already exists at the same or a
+            conflicting hierarchy level.
+          $ref: "#/components/responses/Conflict"
+    get:
+      tags:
+        - properties
+      summary: Get property fields
+      description: >
+        Get a list of property fields for a specific group and object type. Uses cursor-based pagination.
+
+
+        **Scope modes (mutually exclusive):**
+
+
+        - **Hierarchical scope** (`channel_id` and/or `team_id`): returns fields scoped to the named resource *and every ancestor scope above it*. System-level rows are always included; team-level rows are included when `team_id` is set; channel-level rows are included only when `channel_id` is set. When `channel_id` is provided, the channel's team is resolved server-side, so any `team_id` the caller passes is ignored. For DM and GM channels there is no parent team, so the hierarchy collapses to `system → channel` and no team-scoped rows are returned. Requires the caller to have `read_channel` for the channel and/or `view_team` for the team.
+
+
+        - **Single-target scope** (`target_type` + `target_id`): returns fields scoped to exactly one resource. `target_type` must be `system`, `team`, or `channel`; `target_id` is required for `team` and `channel`.
+
+
+        Mixing the two modes (any of `channel_id`/`team_id` together with any of `target_type`/`target_id`) returns 400. Omitting both modes also returns 400, except for the system case below.
+
+
+        **System-object:** when `object_type` is `system`, the endpoint always resolves to `target_type=system` and ignores any `channel_id`, `team_id`, `target_type`, or `target_id` the caller may have passed. System-object fields can only live at the system scope by invariant, so any other scope is a semantic no-op rather than an error.
+
+
+        **Delta sync via `since`:** When `since > 0`, the endpoint returns rows whose `update_at` is **greater than or equal to** the cutoff, *including* tombstoned rows (`delete_at > 0`). The inclusive boundary lets clients safely re-use the highest `update_at` seen on a previous page as the next `since` value without missing rows that happened to share that millisecond. Rows within a delta page are ordered by `(update_at, id)` and the cursor disambiguates same-millisecond rows across pages.
+
+
+        **Cursor source:** the client owns the cursor. The initial delta-sync request omits `since` (or sends `since=0`). For subsequent requests the client persists the `update_at` and `id` of the last row in the response and passes them back as `cursor_update_at` and `cursor_id` alongside the same `since` value. This mirrors the cursor convention used by the shared-channel post-sync API.
+
+
+        **Cursor key must match the active ordering:** in delta mode (`since > 0`) the endpoint orders by `update_at` and pagination requires `cursor_update_at`; otherwise it orders by `create_at` and pagination requires `cursor_create_at`. Passing the wrong key for the active mode returns 400.
+      operationId: GetPropertyFields
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object to retrieve property fields for
+          required: true
+          schema:
+            type: string
+        - name: channel_id
+          in: query
+          description: >
+            Hierarchical scope. When set, the response includes system-level
+            rows, team-level rows for the channel's team, and channel-level
+            rows for this channel. Mutually exclusive with `target_type` and
+            `target_id`. Requires `read_channel` on the channel.
+          schema:
+            type: string
+        - name: team_id
+          in: query
+          description: >
+            Hierarchical scope. When set without `channel_id`, the response
+            includes system-level and team-level rows for this team. When
+            `channel_id` is also set, this value is ignored — the channel's
+            team is resolved server-side and used instead. Mutually exclusive
+            with `target_type` and `target_id`. Requires `view_team` on the
+            team.
+          schema:
+            type: string
+        - name: target_type
+          in: query
+          description: >
+            Single-target scope. One of `system`, `team`, or `channel`.
+            Required in single-target mode. Mutually exclusive with `channel_id`
+            and `team_id`.
+          schema:
+            type: string
+            enum:
+              - system
+              - team
+              - channel
+        - name: target_id
+          in: query
+          description: >
+            Single-target scope. Required when `target_type` is `channel` or
+            `team`. Mutually exclusive with `channel_id` and `team_id`.
+          schema:
+            type: string
+        - name: since
+          in: query
+          description: >
+            Unix timestamp in milliseconds. When greater than 0, returns
+            fields with `update_at` greater than or equal to this value,
+            including tombstones.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_id
+          in: query
+          description: The ID of the last property field from the previous page, for cursor-based pagination.
+          schema:
+            type: string
+        - name: cursor_create_at
+          in: query
+          description: >
+            The `create_at` timestamp of the last property field from the
+            previous page. Required alongside `cursor_id` when `since` is
+            absent. Mutually exclusive with `cursor_update_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_update_at
+          in: query
+          description: >
+            The `update_at` timestamp of the last property field from the
+            previous page. Required alongside `cursor_id` when `since` is
+            present. Mutually exclusive with `cursor_create_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: per_page
+          in: query
+          description: The number of property fields per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Property fields retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/properties/groups/{group_name}/fields/search":
+    post:
+      tags:
+        - properties
+      summary: Search property fields across multiple object types
+      description: >
+        Returns matching fields across every requested object type in one
+        response. The request body is a `PropertyFieldSearch` object whose
+        `object_types` field lists the object types to include.
+
+        Scope, `since`, cursor, and permission semantics are identical to the
+        get property fields endpoint, including the system-object collapse:
+        when `object_types` is exactly `["system"]`, any scope or target
+        params in the body are ignored and the endpoint resolves to
+        `target_type=system`. Any other combination without an explicit
+        scope returns 400.
+
+        Requesting a single value in `object_types` is equivalent to calling
+        the singular endpoint and is supported for client uniformity.
+      operationId: SearchPropertyFields
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - object_types
+              properties:
+                object_types:
+                  type: array
+                  minItems: 1
+                  description: >
+                    One or more object types to include in the response. At
+                    least one value is required; unknown values return 400.
+                  items:
+                    type: string
+                    enum:
+                      - post
+                      - channel
+                      - user
+                      - template
+                      - system
+                channel_id:
+                  type: string
+                  description: >
+                    Hierarchical scope. When set, the response includes
+                    system-level rows, team-level rows for the channel's
+                    team, and channel-level rows for this channel across
+                    every requested `object_types`. Mutually exclusive with
+                    `target_type`/`target_id`. Requires `read_channel` on
+                    the channel.
+                team_id:
+                  type: string
+                  description: >
+                    Hierarchical scope. When set without `channel_id`, the
+                    response includes system-level and team-level rows for
+                    this team across every requested `object_types`. When
+                    `channel_id` is also set, this value is ignored — the
+                    channel's team is resolved server-side and used instead.
+                    Mutually exclusive with `target_type`/`target_id`.
+                    Requires `view_team` on the team.
+                target_type:
+                  type: string
+                  enum:
+                    - system
+                    - team
+                    - channel
+                  description: >
+                    Single-target scope. Mutually exclusive with `channel_id`
+                    and `team_id`. Required if no hierarchical scope is
+                    given, except when `object_types` is exactly `["system"]`
+                    — in that case any scope or target params are ignored
+                    and the endpoint resolves to `target_type=system`.
+                target_id:
+                  type: string
+                  description: >
+                    Single-target scope. Required when `target_type` is
+                    `channel` or `team`. Mutually exclusive with `channel_id`
+                    and `team_id`.
+                since:
+                  type: integer
+                  format: int64
+                  description: >
+                    Unix timestamp in milliseconds. When greater than 0,
+                    returns fields with `update_at` greater than or equal
+                    to this value, including tombstones.
+                cursor_id:
+                  type: string
+                  description: The ID of the last property field from the previous page, for cursor-based pagination.
+                cursor_create_at:
+                  type: integer
+                  format: int64
+                  description: >
+                    The `create_at` timestamp of the last property field
+                    from the previous page. Required alongside `cursor_id`
+                    when `since` is absent. Mutually exclusive with
+                    `cursor_update_at`.
+                cursor_update_at:
+                  type: integer
+                  format: int64
+                  description: >
+                    The `update_at` timestamp of the last property field
+                    from the previous page. Required alongside `cursor_id`
+                    when `since` is present. Mutually exclusive with
+                    `cursor_create_at`.
+                per_page:
+                  type: integer
+                  default: 60
+                  description: The number of property fields per page.
+      responses:
+        "200":
+          description: Property fields retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/properties/groups/{group_name}/{object_type}/fields/{field_id}":
+    patch:
+      tags:
+        - properties
+      summary: Update a property field
+      description: >
+        Partially update a property field by providing only the fields you want to update. Omitted fields will not be updated.
+        The `attrs` object uses merge semantics: only the keys present in the patch are updated; omitted keys are preserved. Setting a key to `null` removes it from attrs.
+
+
+        **Immutable fields:** `target_type`, `target_id`, and `object_type` cannot be changed after creation and are ignored if included in the patch.
+
+
+        **Linked fields:** Fields with a `linked_field_id` cannot have their `type` or `attrs.options` modified (returns 400).
+        The `linked_field_id` can only be cleared (set to empty string `""`) to unlink the field; it cannot be changed to a different value.
+        For non-linked fields, `linked_field_id` cannot be set to a new value (linking is only allowed at creation time).
+
+
+        **Propagation:** When a template field's options are updated, the changes propagate atomically to all fields that link to it.
+      operationId: UpdatePropertyField
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object this property field applies to
+          required: true
+          schema:
+            type: string
+        - name: field_id
+          in: path
+          description: Property field ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PropertyFieldPatch"
+        description: Property field patch object
+        required: true
+      responses:
+        "200":
+          description: Property field update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PropertyField"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "409":
+          description: >
+            Name conflict with an existing field, or cannot change type of a
+            field that has active linked dependents.
+          $ref: "#/components/responses/Conflict"
+    delete:
+      tags:
+        - properties
+      summary: Delete a property field
+      description: >
+        Deletes a property field and all its associated values.
+        Returns 409 Conflict if the field has active linked dependents;
+        unlink or delete dependent fields first.
+      operationId: DeletePropertyField
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object this property field applies to
+          required: true
+          schema:
+            type: string
+        - name: field_id
+          in: path
+          description: Property field ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Property field deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "409":
+          description: >
+            The field has active linked dependents. Unlink or delete dependent
+            fields before deleting the source.
+          $ref: "#/components/responses/Conflict"
+  "/api/v4/properties/groups/{group_name}/{object_type}/values/{target_id}":
+    get:
+      tags:
+        - properties
+      summary: Get property values for a target
+      description: >
+        Get all property values for a specific target within a group. Uses cursor-based pagination.
+        The `template` object type cannot have values and will return 400.
+        The `system` object type must use the dedicated `/api/v4/properties/groups/{group_name}/system/values` endpoint and will return 400 on this route.
+
+
+        **Delta sync via `since`:** When `since > 0`, the endpoint returns only rows whose `update_at` is greater than the cutoff, *including* tombstoned rows.
+
+
+        **Cursor key must match the active ordering:** in delta mode (`since > 0`) the endpoint orders by `update_at` and pagination requires `cursor_update_at`; otherwise it orders by `create_at` and pagination requires `cursor_create_at`.
+      operationId: GetPropertyValues
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object
+          required: true
+          schema:
+            type: string
+        - name: target_id
+          in: path
+          description: The ID of the target object
+          required: true
+          schema:
+            type: string
+        - name: since
+          in: query
+          description: >
+            Unix timestamp in milliseconds. When greater than 0, returns
+            values with `update_at` greater than or equal to this value,
+            including tombstones.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_id
+          in: query
+          description: The ID of the last property value from the previous page, for cursor-based pagination.
+          schema:
+            type: string
+        - name: cursor_create_at
+          in: query
+          description: >
+            The `create_at` timestamp of the last property value from the
+            previous page. Required alongside `cursor_id` when `since` is
+            absent. Mutually exclusive with `cursor_update_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_update_at
+          in: query
+          description: >
+            The `update_at` timestamp of the last property value from the
+            previous page. Required alongside `cursor_id` when `since` is
+            present. Mutually exclusive with `cursor_create_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: per_page
+          in: query
+          description: The number of property values per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Property values retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyValue"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    patch:
+      tags:
+        - properties
+      summary: Update property values for a target
+      description: >
+        Update one or more property values for a specific target within a group. Uses upsert semantics: creates the value if it doesn't exist, updates it if it does. All field IDs must belong to the specified group.
+        The `template` object type cannot have values and will return 400.
+        The `system` object type must use the dedicated `/api/v4/properties/groups/{group_name}/system/values` endpoint and will return 400 on this route.
+      operationId: UpdatePropertyValues
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: object_type
+          in: path
+          description: The type of object
+          required: true
+          schema:
+            type: string
+        - name: target_id
+          in: path
+          description: The ID of the target object
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                required:
+                  - field_id
+                  - value
+                properties:
+                  field_id:
+                    type: string
+                    description: The ID of the property field
+                  value:
+                    description: The value to set for this property. Can be any JSON type.
+        description: Array of property values to update
+        required: true
+      responses:
+        "200":
+          description: Property values update successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyValue"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/properties/groups/{group_name}/system/values":
+    get:
+      tags:
+        - properties
+      summary: Get property values for the system
+      description: >
+        Get all property values attached to the Mattermost instance itself
+        within a group. System-scoped values are readable by any authenticated
+        user. This endpoint is the dedicated route for `system` object type;
+        the `{object_type}/values/{target_id}` route returns 400 for `system`.
+
+
+        **Delta sync via `since`:** When `since > 0`, the endpoint returns only rows whose `update_at` is greater than the cutoff, *including* tombstones.
+
+
+        **Cursor key must match the active ordering:** in delta mode (`since > 0`) the endpoint orders by `update_at` and pagination requires `cursor_update_at`; otherwise it orders by `create_at` and pagination requires `cursor_create_at`.
+      operationId: GetSystemPropertyValues
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+        - name: since
+          in: query
+          description: >
+            Unix timestamp in milliseconds. When greater than 0, returns
+            values with `update_at` greater than or equal to this value,
+            including tombstones.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_id
+          in: query
+          description: The ID of the last property value from the previous page, for cursor-based pagination.
+          schema:
+            type: string
+        - name: cursor_create_at
+          in: query
+          description: >
+            The `create_at` timestamp of the last property value from the
+            previous page. Required alongside `cursor_id` when `since` is
+            absent. Mutually exclusive with `cursor_update_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: cursor_update_at
+          in: query
+          description: >
+            The `update_at` timestamp of the last property value from the
+            previous page. Required alongside `cursor_id` when `since` is
+            present. Mutually exclusive with `cursor_create_at`.
+          schema:
+            type: integer
+            format: int64
+        - name: per_page
+          in: query
+          description: The number of property values per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: System property values retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyValue"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+    patch:
+      tags:
+        - properties
+      summary: Update property values for the system
+      description: >
+        Update one or more property values attached to the Mattermost instance
+        itself. Uses upsert semantics: creates the value if it doesn't exist,
+        updates it if it does. Requires system administrator access. All field
+        IDs must reference `system` object-type fields in the specified group;
+        template field IDs are rejected with 400.
+      operationId: UpdateSystemPropertyValues
+      parameters:
+        - name: group_name
+          in: path
+          description: The name of the property group
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: object
+                required:
+                  - field_id
+                  - value
+                properties:
+                  field_id:
+                    type: string
+                    description: The ID of the property field
+                  value:
+                    description: The value to set for this property. Can be any JSON type.
+        description: Array of property values to update
+        required: true
+      responses:
+        "200":
+          description: System property values update successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/PropertyValue"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/reactions.yaml

@@ -0,0 +1,103 @@
+  /api/v4/reactions:
+    post:
+      tags:
+        - reactions
+      summary: Create a reaction
+      description: |
+        Create a reaction.
+        ##### Permissions
+        Must have `read_channel` permission for the channel the post is in.
+      operationId: SaveReaction
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/Reaction"
+        description: The user's reaction with its post_id, user_id, and emoji_name fields
+          set
+        required: true
+      responses:
+        "201":
+          description: Reaction creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Reaction"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/posts/{post_id}/reactions":
+    get:
+      tags:
+        - reactions
+      summary: Get a list of reactions to a post
+      description: |
+        Get a list of reactions made by all users to a given post.
+        ##### Permissions
+        Must have `read_channel` permission for the channel the post is in.
+      operationId: GetReactions
+      parameters:
+        - name: post_id
+          in: path
+          description: ID of a post
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: List reactions retrieve successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Reaction"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/users/{user_id}/posts/{post_id}/reactions/{emoji_name}":
+    delete:
+      tags:
+        - reactions
+      summary: Remove a reaction from a post
+      description: |
+        Deletes a reaction made by a user from the given post.
+        ##### Permissions
+        Must be user or have `manage_system` permission.
+      operationId: DeleteReaction
+      parameters:
+        - name: user_id
+          in: path
+          description: ID of the user
+          required: true
+          schema:
+            type: string
+        - name: post_id
+          in: path
+          description: ID of the post
+          required: true
+          schema:
+            type: string
+        - name: emoji_name
+          in: path
+          description: emoji name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Reaction deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"

api/v4/source/recaps.yaml

@@ -0,0 +1,307 @@
+  "/api/v4/recaps":
+    post:
+      tags:
+        - recaps
+        - ai
+      summary: Create a channel recap
+      description: >
+        Create a new AI-powered recap for the specified channels. The recap will
+        summarize unread messages in the selected channels, extracting highlights
+        and action items. This creates a background job that processes the recap
+        asynchronously. The recap is created for the authenticated user.
+
+        ##### Permissions
+
+        Must be authenticated. User must be a member of all specified channels.
+
+        __Minimum server version__: 11.2
+      operationId: CreateRecap
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_ids
+                - title
+                - agent_id
+              properties:
+                title:
+                  type: string
+                  description: Title for the recap
+                channel_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: List of channel IDs to include in the recap
+                  minItems: 1
+                agent_id:
+                  type: string
+                  description: ID of the AI agent to use for generating the recap
+        description: Recap creation request
+        required: true
+      responses:
+        "201":
+          description: Recap creation successful. The recap will be processed asynchronously.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Recap"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    get:
+      tags:
+        - recaps
+        - ai
+      summary: Get current user's recaps
+      description: >
+        Get a paginated list of recaps created by the authenticated user.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetRecapsForUser
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of recaps per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Recaps retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Recap"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  "/api/v4/recaps/limit_status":
+    get:
+      tags:
+        - recaps
+        - ai
+      summary: Get recap limit status for the current user
+      description: >
+        Get the current user's recap usage limits and status, including daily
+        usage, effective limits, and cooldown information.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetRecapLimitStatus
+      responses:
+        "200":
+          description: Recap limit status retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RecapLimitStatus"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          description: Recaps feature is not enabled
+  "/api/v4/recaps/mark_viewed":
+    post:
+      tags:
+        - recaps
+        - ai
+      summary: Mark all of the authenticated user's finished recaps as viewed
+      description: >
+        Mark every not-yet-viewed completed or failed recap belonging to the
+        authenticated user as viewed at the current time. Pending and
+        processing recaps are not affected. Returns the IDs of the recaps
+        that were updated. The server broadcasts a `recap_updated` WebSocket
+        event for each affected recap.
+
+        Typically called once when the recaps page is opened so the sidebar
+        unread badge can be cleared in bulk.
+
+        ##### Permissions
+
+        Must be authenticated. Operates only on the authenticated user's
+        own recaps.
+
+        __Minimum server version__: 11.2
+      operationId: MarkRecapsAsViewed
+      responses:
+        "200":
+          description: Recaps marked as viewed successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  recap_ids:
+                    type: array
+                    items:
+                      type: string
+                    description: IDs of the recaps that were updated
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          description: AI Recaps feature flag is disabled
+  "/api/v4/recaps/{recap_id}":
+    get:
+      tags:
+        - recaps
+        - ai
+      summary: Get a specific recap
+      description: >
+        Get a recap by its ID, including all channel summaries. Only the authenticated
+        user who created the recap can retrieve it.
+
+        ##### Permissions
+
+        Must be authenticated. Can only retrieve recaps created by the current user.
+
+        __Minimum server version__: 11.2
+      operationId: GetRecap
+      parameters:
+        - name: recap_id
+          in: path
+          description: Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Recap retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Recap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    delete:
+      tags:
+        - recaps
+        - ai
+      summary: Delete a recap
+      description: >
+        Delete a recap by its ID. Only the authenticated user who created the recap
+        can delete it.
+
+        ##### Permissions
+
+        Must be authenticated. Can only delete recaps created by the current user.
+
+        __Minimum server version__: 11.2
+      operationId: DeleteRecap
+      parameters:
+        - name: recap_id
+          in: path
+          description: Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Recap deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/recaps/{recap_id}/read":
+    post:
+      tags:
+        - recaps
+        - ai
+      summary: Mark a recap as read
+      description: >
+        Mark a recap as read by the authenticated user. This updates the recap's
+        read status and timestamp.
+
+        ##### Permissions
+
+        Must be authenticated. Can only mark recaps created by the current user as read.
+
+        __Minimum server version__: 11.2
+      operationId: MarkRecapAsRead
+      parameters:
+        - name: recap_id
+          in: path
+          description: Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Recap marked as read successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Recap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/recaps/{recap_id}/regenerate":
+    post:
+      tags:
+        - recaps
+        - ai
+      summary: Regenerate a recap
+      description: >
+        Regenerate a recap by its ID. This creates a new background job to
+        regenerate the AI-powered recap with the latest messages from the
+        specified channels.
+
+        ##### Permissions
+
+        Must be authenticated. Can only regenerate recaps created by the current user.
+
+        __Minimum server version__: 11.2
+      operationId: RegenerateRecap
+      parameters:
+        - name: recap_id
+          in: path
+          description: Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Recap regeneration initiated successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Recap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+

api/v4/source/remoteclusters.yaml

@@ -0,0 +1,473 @@
+  "/api/v4/remotecluster":
+    get:
+      tags:
+        - remote clusters
+      summary: Get a list of remote clusters.
+      description: |
+        Get a list of remote clusters.
+
+        ##### Permissions
+        `manage_secure_connections` or `manage_shared_channels`
+      operationId: GetRemoteClusters
+      parameters:
+        - name: page
+          in: query
+          description: The page to select
+          schema:
+            type: integer
+        - name: per_page
+          in: query
+          description: The number of remote clusters per page
+          schema:
+            type: integer
+        - name: exclude_offline
+          in: query
+          description: Exclude offline remote clusters
+          schema:
+            type: boolean
+        - name: in_channel
+          in: query
+          description: Select remote clusters in channel
+          schema:
+            type: string
+        - name: not_in_channel
+          in: query
+          description: Select remote clusters not in this channel
+          schema:
+            type: string
+        - name: only_confirmed
+          in: query
+          description: Select only remote clusters already confirmed
+          schema:
+            type: boolean
+        - name: only_plugins
+          in: query
+          description: Select only remote clusters that belong to a plugin
+          schema:
+            type: boolean
+        - name: exclude_plugins
+          in: query
+          description: Select only remote clusters that don't belong to a plugin
+          schema:
+            type: boolean
+        - name: include_deleted
+          in: query
+          description: Include those remote clusters that have been deleted
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Remote clusters fetch successful. Result might be empty.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/RemoteCluster"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+    post:
+      tags:
+        - remote clusters
+      summary: Create a new remote cluster.
+      description: |
+        Create a new remote cluster and generate an invite code.
+
+        ##### Permissions
+        `manage_secure_connections`
+      operationId: CreateRemoteCluster
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - name
+                - default_team_id
+              properties:
+                name:
+                  type: string
+                display_name:
+                  type: string
+                default_team_id:
+                  type: string
+                password:
+                  type: string
+                  description: |
+                    The password to use in the invite code. If empty,
+                    the server will generate one and it will be part
+                    of the response
+      responses:
+        "201":
+          description: Remote cluster creation successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  remote_cluster:
+                    $ref: "#/components/schemas/RemoteCluster"
+                  invite:
+                    type: string
+                    description: The encrypted invite for the newly created remote cluster
+                  password:
+                    type: string
+                    description: |
+                      The password generated by the server if none was
+                      sent on the create request
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/remotecluster/{remote_id}":
+    get:
+      tags:
+        - remote clusters
+      summary: Get a remote cluster.
+      description: |
+        Get the Remote Cluster details from the provided id string.
+
+        ##### Permissions
+        `manage_secure_connections` or `manage_shared_channels`
+      operationId: GetRemoteCluster
+      parameters:
+        - name: remote_id
+          in: path
+          description: Remote Cluster GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Remote Cluster retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteCluster"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    patch:
+      tags:
+        - remote clusters
+      summary: Patch a remote cluster.
+      description: |
+        Partially update a Remote Cluster by providing only the fields you want to update. Ommited fields will not be updated.
+
+        ##### Permissions
+        `manage_secure_connections`
+      operationId: PatchRemoteCluster
+      parameters:
+        - name: remote_id
+          in: path
+          description: Remote Cluster GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                display_name:
+                  type: string
+                default_team_id:
+                  type: string
+                  description: The team where channels from invites are created
+      responses:
+        "200":
+          description: Remote Cluster patch successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteCluster"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    delete:
+      tags:
+        - remote clusters
+      summary: Delete a remote cluster.
+      description: |
+        Deletes a Remote Cluster.
+
+        ##### Permissions
+        `manage_secure_connections`
+      operationId: DeleteRemoteCluster
+      parameters:
+        - name: remote_id
+          in: path
+          description: Remote Cluster GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "204":
+          description: Remote Cluster deletion successful
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+  "/api/v4/remotecluster/{remote_id}/generate_invite":
+    post:
+      tags:
+        - remote clusters
+      summary: Generate invite code.
+      description: |
+        Generates an invite code for a given remote cluster.
+
+        ##### Permissions
+        `manage_secure_connections`
+      operationId: GenerateRemoteClusterInvite
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - password
+              properties:
+                password:
+                  type: string
+                  description: The password to encrypt the invite code with.
+      responses:
+        "201":
+          description: Invite code generated
+          content:
+            application/json:
+              schema:
+                type: string
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/remotecluster/accept_invite":
+    post:
+      tags:
+        - remote clusters
+      summary: Accept a remote cluster invite code.
+      description: |
+        Accepts a remote cluster invite code.
+
+        ##### Permissions
+        `manage_secure_connections`
+      operationId: AcceptRemoteClusterInvite
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - invite
+                - name
+                - default_team_id
+                - password
+              properties:
+                invite:
+                  type: string
+                name:
+                  type: string
+                display_name:
+                  type: string
+                default_team_id:
+                  type: string
+                password:
+                  type: string
+                  description: The password to decrypt the invite code.
+      responses:
+        "201":
+          description: Invite successfully accepted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteCluster"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/remotecluster/ping":
+    post:
+      tags:
+        - remote clusters
+      summary: Receive a ping from a remote cluster.
+      description: |
+        Receives heartbeat traffic from an already linked remote cluster.
+        This endpoint is authenticated with a remote-cluster token and is
+        used by the secure connection transport layer.
+
+        ##### Permissions
+        No user session permissions required.
+      operationId: RemoteClusterPing
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RemoteClusterFrame"
+      responses:
+        "200":
+          description: Ping response successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteClusterPing"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+  "/api/v4/remotecluster/msg":
+    post:
+      tags:
+        - remote clusters
+      summary: Receive a remote cluster message.
+      description: |
+        Receives and processes an incoming transport message from a linked
+        remote cluster. This endpoint is authenticated with a remote-cluster
+        token and is part of the secure connection protocol.
+
+        ##### Permissions
+        No user session permissions required.
+      operationId: RemoteClusterAcceptMessage
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RemoteClusterFrame"
+      responses:
+        "200":
+          description: Message accepted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteClusterResponse"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+  "/api/v4/remotecluster/confirm_invite":
+    post:
+      tags:
+        - remote clusters
+      summary: Confirm an invite with a remote cluster.
+      description: |
+        Confirms an invitation handshake from a linked remote cluster.
+        This endpoint is authenticated with a remote-cluster token and is
+        used by the secure connection protocol.
+
+        ##### Permissions
+        No user session permissions required.
+      operationId: RemoteClusterConfirmInvite
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RemoteClusterFrame"
+      responses:
+        "200":
+          description: Invitation confirmation successful
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+  "/api/v4/remotecluster/upload/{upload_id}":
+    post:
+      tags:
+        - remote clusters
+      summary: Upload file data for a remote upload session.
+      description: |
+        Streams file data into an existing upload session from a linked
+        remote cluster. This endpoint is authenticated with a remote-cluster token.
+
+        ##### Permissions
+        No user session permissions required.
+      operationId: UploadRemoteClusterData
+      parameters:
+        - name: upload_id
+          in: path
+          description: The upload session ID.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+      responses:
+        "200":
+          description: Upload chunk accepted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FileInfo"
+        "204":
+          description: Upload data accepted with no file completion yet
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+  "/api/v4/remotecluster/{user_id}/image":
+    post:
+      tags:
+        - remote clusters
+      summary: Set profile image for a remote user.
+      description: |
+        Uploads and sets a profile image for a remote user managed by the
+        requesting remote cluster. This endpoint is authenticated with a
+        remote-cluster token.
+
+        ##### Permissions
+        No user session permissions required.
+      operationId: RemoteSetProfileImage
+      parameters:
+        - name: user_id
+          in: path
+          description: The remote user ID.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                image:
+                  type: string
+                  format: binary
+      responses:
+        "200":
+          description: Profile image updated successfully
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"

api/v4/source/reports.yaml

@@ -0,0 +1,361 @@
+  /api/v4/reports/users:
+    get:
+      tags:
+        - reports
+      summary: Get a list of paged and sorted users for admin reporting purposes
+      description: >
+        Get a list of paged users for admin reporting purposes, based on provided parameters.
+        
+        ##### Permissions
+        
+        Requires `sysconsole_read_user_management_users`.
+
+      operationId: GetUsersForReporting
+      parameters:
+        - name: sort_column
+          in: query
+          description: The column to sort the users by. Must be one of ("CreateAt", "Username", "FirstName", "LastName", "Nickname", "Email") or the API will return an error.
+          schema:
+            type: string
+            default: 'Username'
+        - name: direction
+          in: query
+          description: The direction to accept paging values from. Will return values ahead of the cursor if "prev", and below the cursor if "next". Default is "next".
+          schema:
+            type: string
+            default: 'next'
+        - name: sort_direction
+          in: query
+          description: The sorting direction. Must be one of ("asc", "desc"). Will default to 'asc' if not specified or the input is invalid.
+          schema:
+            type: string
+            default: 'asc'
+        - name: page_size
+          in: query
+          description: The maximum number of users to return.
+          schema:
+            type: integer
+            default: 50
+            minimum: 1
+            maximum: 100
+        - name: from_column_value
+          in: query
+          description: The value of the sorted column corresponding to the cursor to read from. Should be blank for the first page asked for.
+          schema:
+            type: string
+        - name: from_id
+          in: query
+          description: The value of the user id corresponding to the cursor to read from. Should be blank for the first page asked for.
+          schema:
+            type: string
+        - name: date_range
+          in: query
+          description: The date range of the post statistics to display. Must be one of ("last30days", "previousmonth", "last6months", "alltime"). Will default to 'alltime' if the input is not valid.
+          schema:
+            type: string
+            default: 'alltime'
+        - name: role_filter
+          in: query
+          description: Filter users by their role.
+          schema:
+            type: string
+        - name: team_filter
+          in: query
+          description: Filter users by a specified team ID.
+          schema:
+            type: string
+        - name: has_no_team
+          in: query
+          description: If true, show only users that have no team. Will ignore provided "team_filter" if true.
+          schema:
+            type: boolean
+        - name: hide_active
+          in: query
+          description: If true, show only users that are inactive. Cannot be used at the same time as "hide_inactive"
+          schema:
+            type: boolean
+        - name: hide_inactive
+          in: query
+          description: If true, show only users that are active. Cannot be used at the same time as "hide_active"
+          schema:
+            type: boolean
+        - name: search_term
+          in: query
+          description: A filtering search term that allows filtering by Username, FirstName, LastName, Nickname or Email
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User page retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/UserReport"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/reports/users/count:
+    get:
+      tags:
+        - reports
+      summary: Gets the full count of users that match the filter.
+      description: >
+        Get the full count of users admin reporting purposes, based on provided parameters.
+        
+        ##### Permissions
+        
+        Requires `sysconsole_read_user_management_users`.
+      operationId: GetUserCountForReporting
+      parameters:
+        - name: role_filter
+          in: query
+          description: Filter users by their role.
+          schema:
+            type: string
+        - name: team_filter
+          in: query
+          description: Filter users by a specified team ID.
+          schema:
+            type: string
+        - name: has_no_team
+          in: query
+          description: If true, show only users that have no team. Will ignore provided "team_filter" if true.
+          schema:
+            type: boolean
+        - name: hide_active
+          in: query
+          description: If true, show only users that are inactive. Cannot be used at the same time as "hide_inactive"
+          schema:
+            type: boolean
+        - name: hide_inactive
+          in: query
+          description: If true, show only users that are active. Cannot be used at the same time as "hide_active"
+          schema:
+            type: boolean
+        - name: search_term
+          in: query
+          description: A filtering search term that allows filtering by Username, FirstName, LastName, Nickname or Email
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User count retrieval successful
+          content:
+            application/json:
+              schema:
+                type: number
+  /api/v4/reports/users/export:
+    post:
+      tags:
+        - reports
+      summary: Starts a job to export the users to a report file.
+      description: >
+        Starts a job to export the users to a report file.
+
+        ##### Permissions
+
+        Requires `sysconsole_read_user_management_users`.
+      operationId: StartBatchUsersExport
+      parameters:
+        - name: date_range
+          in: query
+          description: The date range of the post statistics to display. Must be one of ("last30days", "previousmonth", "last6months", "alltime"). Will default to 'alltime' if the input is not valid.
+          schema:
+            type: string
+            default: 'alltime'
+      responses:
+        "200":
+          description: Job successfully started
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/UserReport"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/reports/posts:
+    post:
+      tags:
+        - reports
+      summary: Get posts for reporting and compliance purposes using cursor-based pagination
+      description: >
+        Get posts from a specific channel for reporting, compliance, and auditing purposes.
+        This endpoint uses cursor-based pagination to efficiently retrieve large datasets.
+
+        The cursor is an opaque, base64-encoded token that contains all pagination state.
+        Clients should treat the cursor as an opaque string and pass it back unchanged.
+        When a cursor is provided, query parameters from the initial request are embedded
+        in the cursor and take precedence over request body parameters.
+
+        ##### Permissions
+
+        Requires `manage_system` permission (system admin only).
+
+        ##### License
+
+        Requires an Enterprise license (or higher).
+
+        ##### Features
+
+        - Cursor-based pagination for efficient large dataset retrieval
+        - Support for both create_at and update_at time fields
+        - Ascending or descending sort order
+        - Time range filtering with optional end_time
+        - Include/exclude deleted posts
+        - Exclude system posts (any type starting with "system_")
+        - Optional metadata enrichment (file info, reactions, emojis, priority, acknowledgements)
+      operationId: GetPostsForReporting
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_id
+              properties:
+                channel_id:
+                  type: string
+                  description: The ID of the channel to retrieve posts from
+                cursor:
+                  type: string
+                  description: >
+                    Opaque cursor string for pagination. Omit or use empty string for the first request.
+                    For subsequent requests, use the exact cursor value from the previous response's next_cursor.
+                    The cursor is base64-encoded and contains all pagination state including time, post ID,
+                    and query parameters. Do not attempt to parse or modify the cursor value.
+                  default: ""
+                start_time:
+                  type: integer
+                  format: int64
+                  description: >
+                    Optional start time for query range in Unix milliseconds. Only used for the first request (ignored when cursor is provided).
+                    - For "asc" (ascending): starts retrieving from this time going forward
+                    - For "desc" (descending): starts retrieving from this time going backward
+                    If omitted, defaults to 0 for ascending or MaxInt64 for descending.
+                time_field:
+                  type: string
+                  enum: [create_at, update_at]
+                  default: create_at
+                  description: >
+                    Which timestamp field to use for sorting and filtering.
+                    Use "create_at" to retrieve posts by creation time, or "update_at" to
+                    retrieve posts by last modification time.
+                sort_direction:
+                  type: string
+                  enum: [asc, desc]
+                  default: asc
+                  description: >
+                    Sort direction for pagination. Use "asc" to retrieve posts from oldest
+                    to newest, or "desc" to retrieve from newest to oldest.
+                per_page:
+                  type: integer
+                  minimum: 1
+                  maximum: 1000
+                  default: 100
+                  description: Number of posts to return per page. Maximum 1000.
+                include_deleted:
+                  type: boolean
+                  default: false
+                  description: >
+                    If true, include posts that have been deleted (DeleteAt > 0).
+                    By default, only non-deleted posts are returned.
+                exclude_system_posts:
+                  type: boolean
+                  default: false
+                  description: >
+                    If true, exclude all system posts.
+                include_metadata:
+                  type: boolean
+                  default: false
+                  description: >
+                    If true, enrich posts with additional metadata including file information,
+                    reactions, custom emojis, priority, and acknowledgements. Note that this
+                    may increase response time for large result sets.
+            examples:
+              first_page_ascending:
+                summary: First page, ascending order
+                value:
+                  channel_id: "4xp9fdt77pncbef59f4k1qe83o"
+                  cursor: ""
+                  per_page: 100
+              subsequent_page:
+                summary: Subsequent page using cursor
+                value:
+                  channel_id: "4xp9fdt77pncbef59f4k1qe83o"
+                  cursor: "MTphYmMxMjM6Y3JlYXRlX2F0OmZhbHNlOmZhbHNlOmFzYzoxNjM1NzI0ODAwMDAwOnBvc3QxMjM"
+                  per_page: 100
+              time_range_query:
+                summary: Query with time range starting from specific time
+                value:
+                  channel_id: "4xp9fdt77pncbef59f4k1qe83o"
+                  cursor: ""
+                  start_time: 1635638400000
+                  per_page: 100
+              descending_order:
+                summary: Descending order from recent
+                value:
+                  channel_id: "4xp9fdt77pncbef59f4k1qe83o"
+                  cursor: ""
+                  sort_direction: "desc"
+                  per_page: 100
+      responses:
+        "200":
+          description: Posts retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  posts:
+                    type: object
+                    additionalProperties:
+                      $ref: "#/components/schemas/Post"
+                    description: Map of post IDs to post objects
+                  next_cursor:
+                    type: object
+                    nullable: true
+                    description: >
+                      Opaque cursor for retrieving the next page. If null, there are no more pages.
+                      Pass the cursor string from this object in the next request.
+                    properties:
+                      cursor:
+                        type: string
+                        description: Base64-encoded opaque cursor string containing pagination state
+              examples:
+                with_more_pages:
+                  summary: Response with more pages available
+                  value:
+                    posts:
+                      "post_id_1": { "id": "post_id_1", "message": "First post", "create_at": 1635638400000 }
+                      "post_id_2": { "id": "post_id_2", "message": "Second post", "create_at": 1635638500000 }
+                    next_cursor:
+                      cursor: "MTphYmMxMjM6Y3JlYXRlX2F0OmZhbHNlOmZhbHNlOmFzYzoxNjM1NjM4NTAwMDAwOnBvc3RfaWRfMg"
+                last_page:
+                  summary: Last page (no more results)
+                  value:
+                    posts:
+                      "post_id_99": { "id": "post_id_99", "message": "Last post", "create_at": 1635724800000 }
+                    next_cursor: null
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/roles.yaml

@@ -0,0 +1,180 @@
+  "/api/v4/roles":
+    get:
+      tags:
+        - roles
+      summary: Get a list of all the roles
+      description: |
+        ##### Permissions
+
+        `manage_system` permission is required.
+
+        __Minimum server version__: 5.33
+      operationId: GetAllRoles
+      responses:
+        "200":
+          description: Roles retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Role"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/roles/{role_id}":
+    get:
+      tags:
+        - roles
+      summary: Get a role
+      description: |
+        Get a role from the provided role id.
+
+        ##### Permissions
+        Requires an active session but no other permissions.
+
+        __Minimum server version__: 4.9
+      operationId: GetRole
+      parameters:
+        - name: role_id
+          in: path
+          description: Role GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Role retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Role"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/roles/name/{role_name}":
+    get:
+      tags:
+        - roles
+      summary: Get a role
+      description: |
+        Get a role from the provided role name.
+
+        ##### Permissions
+        Requires an active session but no other permissions.
+
+        __Minimum server version__: 4.9
+      operationId: GetRoleByName
+      parameters:
+        - name: role_name
+          in: path
+          description: Role Name
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Role retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Role"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/roles/{role_id}/patch":
+    put:
+      tags:
+        - roles
+      summary: Patch a role
+      description: >
+        Partially update a role by providing only the fields you want to update.
+        Omitted fields will not be updated. The fields that can be updated are
+        defined in the request body, all other provided fields will be ignored.
+
+
+        ##### Permissions
+
+        Must have `sysconsole_write_user_management_permissions` or `manage_system` permission.
+        When updating the role of a system admin, the `manage_system` permission is mandatory.
+
+
+        __Minimum server version__: 4.9
+      operationId: PatchRole
+      parameters:
+        - name: role_id
+          in: path
+          description: Role GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                permissions:
+                  type: array
+                  items:
+                    type: string
+                  description: The permissions the role should grant.
+        description: Role object to be updated
+        required: true
+      responses:
+        "200":
+          description: Role patch successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Role"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  /api/v4/roles/names:
+    post:
+      tags:
+        - roles
+      summary: Get a list of roles by name
+      description: |
+        Get a list of roles from their names.
+
+        ##### Permissions
+        Requires an active session but no other permissions.
+
+        __Minimum server version__: 4.9
+      operationId: GetRolesByNames
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+        description: List of role names
+        required: true
+      responses:
+        "200":
+          description: Role list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Role"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/saml.yaml

@@ -0,0 +1,323 @@
+  /api/v4/saml/metadata:
+    get:
+      tags:
+        - SAML
+      summary: Get metadata
+      description: |
+        Get SAML metadata from the server. SAML must be configured properly.
+        ##### Permissions
+        No permission required.
+      operationId: GetSamlMetadata
+      responses:
+        "200":
+          description: SAML metadata retrieval successful
+          content:
+            application/json:
+              schema:
+                type: string
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/metadatafromidp:
+    post:
+      tags:
+        - SAML
+      summary: Get metadata from Identity Provider
+      description: |
+        Get SAML metadata from the Identity Provider. SAML must be configured properly.
+        ##### Permissions
+        No permission required.
+      operationId: GetSamlMetadataFromIdp
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                saml_metadata_url:
+                  type: string
+                  description: The URL from which to retrieve the SAML IDP data.
+      responses:
+        "200":
+          description: SAML metadata retrieval successful
+          content:
+            application/json:
+              schema:
+                type: string
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/certificate/idp:
+    post:
+      tags:
+        - SAML
+      summary: Upload IDP certificate
+      description: >
+        Upload the IDP certificate to be used with your SAML configuration. The
+        server will pick a hard-coded filename for the IdpCertificateFile
+        setting in your `config.json`.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: UploadSamlIdpCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The IDP certificate file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: SAML certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - SAML
+      summary: Remove IDP certificate
+      description: >
+        Delete the current IDP certificate being used with your SAML
+        configuration. This will also disable SAML on your system as this
+        certificate is required for SAML.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: DeleteSamlIdpCertificate
+      responses:
+        "200":
+          description: SAML certificate delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/certificate/public:
+    post:
+      tags:
+        - SAML
+      summary: Upload public certificate
+      description: >
+        Upload the public certificate to be used for encryption with your SAML
+        configuration. The server will pick a hard-coded filename for the
+        PublicCertificateFile setting in your `config.json`.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: UploadSamlPublicCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The public certificate file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: SAML certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - SAML
+      summary: Remove public certificate
+      description: >
+        Delete the current public certificate being used with your SAML
+        configuration. This will also disable encryption for SAML on your system
+        as this certificate is required for that.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: DeleteSamlPublicCertificate
+      responses:
+        "200":
+          description: SAML certificate delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/certificate/private:
+    post:
+      tags:
+        - SAML
+      summary: Upload private key
+      description: >
+        Upload the private key to be used for encryption with your SAML
+        configuration. The server will pick a hard-coded filename for the
+        PrivateKeyFile setting in your `config.json`.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: UploadSamlPrivateCertificate
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                certificate:
+                  description: The private key file
+                  type: string
+                  format: binary
+              required:
+                - certificate
+      responses:
+        "200":
+          description: SAML certificate upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - SAML
+      summary: Remove private key
+      description: >
+        Delete the current private key being used with your SAML configuration.
+        This will also disable encryption for SAML on your system as this key is
+        required for that.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: DeleteSamlPrivateCertificate
+      responses:
+        "200":
+          description: SAML certificate delete successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/certificate/status:
+    get:
+      tags:
+        - SAML
+      summary: Get certificate status
+      description: >
+        Get the status of the uploaded certificates and keys in use by your SAML
+        configuration.
+
+        ##### Permissions
+
+        Must have `sysconsole_write_authentication` permission.
+      operationId: GetSamlCertificateStatus
+      responses:
+        "200":
+          description: SAML certificate status retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SamlCertificateStatus"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/saml/reset_auth_data:
+    post:
+      tags:
+        - SAML
+      summary: Reset AuthData to Email
+      description: >
+        Reset the AuthData field of SAML users to their email. This is meant to be
+        used when the "id" attribute is set to an empty value ("") from a previously
+        non-empty value.
+
+        __Minimum server version__: 5.35
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+      operationId: ResetSamlAuthDataToEmail
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                include_deleted:
+                  type: boolean
+                  default: false
+                  description: Whether to include deleted users.
+                dry_run:
+                  type: boolean
+                  default: false
+                  description: If set to true, the number of users who would be affected is returned.
+                user_ids:
+                  type: array
+                  items:
+                    type: string
+                  default: []
+                  description: If set to a non-empty array, then users whose IDs are not in the array will be excluded.
+      responses:
+        "200":
+          description: AuthData successfully reset
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  num_affected:
+                    type: integer
+                    description: The number of users whose AuthData field was reset.
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/scheduled_post.yaml

@@ -0,0 +1,215 @@
+  /api/v4/posts/schedule:
+    post:
+      tags:
+        - scheduled_post
+      summary: Creates a scheduled post
+      description: >
+        Creates a scheduled post
+
+        ##### Permissions
+
+        Must have `create_post` permission for the channel the post is being created in.
+
+        __Minimum server version__: 10.3
+      operationId: CreateScheduledPost
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_id
+                - message
+                - scheduled_at
+              properties:
+                scheduled_at:
+                  type: integer
+                  description: UNIX timestamp in milliseconds of the time when the scheduled post should be sent
+                channel_id:
+                  type: string
+                  description: The channel ID to post in
+                message:
+                  type: string
+                  description: The message contents, can be formatted with Markdown
+                root_id:
+                  type: string
+                  description: The post ID to comment on
+                file_ids:
+                  type: array
+                  description: A list of file IDs to associate with the post. Note that
+                    posts are limited to 5 files maximum. Please use additional
+                    posts for more files.
+                props:
+                  description: A general JSON property bag to attach to the post
+                  type: object
+                repeat_type:
+                  type: string
+                  description: Set to `weekly` for a recurring weekly schedule, or omit for a one-time schedule
+                repeat_timezone:
+                  type: string
+                  description: IANA timezone for weekly recurrence; required when `repeat_type` is `weekly`
+      responses:
+        "200":
+          description: Created scheduled post
+          content:
+            application/json:
+              schema:
+                type: object
+                items:
+                  $ref: "#/components/schemas/ScheduledPost"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/posts/scheduled/team/{team_id}:
+    get:
+      tags:
+        - scheduled_post
+      summary: Gets all scheduled posts for a user for the specified team..
+      description: >
+        Get user-team scheduled posts
+
+        ##### Permissions
+
+        Must have `view_team` permission for the team the scheduled posts are being fetched for.
+
+        __Minimum server version__: 10.3
+      operationId: GetUserScheduledPosts
+      parameters:
+        - name: includeDirectChannels
+          in: query
+          description: Whether to include scheduled posts from DMs an GMs or not. Default is false
+          required: false
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: Created scheduled post
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties:
+                  type: array
+                  items:
+                    $ref: "#/components/schemas/ScheduledPost"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/posts/schedule/{scheduled_post_id}:
+    put:
+      tags:
+        - scheduled_post
+      summary: Update a scheduled post
+      description: >
+        Updates a scheduled post
+
+        ##### Permissions
+
+        Must have `create_post` permission for the channel where the scheduled post belongs to.
+
+        __Minimum server version__: 10.3
+      operationId: UpdateScheduledPost
+      parameters:
+        - name: scheduled_post_id
+          in: path
+          description: ID of the scheduled post to update
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - id
+                - channel_id
+                - user_id
+                - message
+                - scheduled_at
+              properties:
+                id:
+                  description: ID of the scheduled post to update
+                  type: string
+                channel_id:
+                  type: string
+                  description: The channel ID to post in
+                user_id:
+                  type: string
+                  description: The current user ID
+                scheduled_at:
+                  type: integer
+                  description: UNIX timestamp in milliseconds of the time when the scheduled post should be sent
+                message:
+                  type: string
+                  description: The message contents, can be formatted with Markdown
+                repeat_type:
+                  type: string
+                  description: Set to `weekly` for a recurring weekly schedule, or empty for a one-time schedule
+                repeat_timezone:
+                  type: string
+                  description: IANA timezone for weekly recurrence; required when `repeat_type` is `weekly`
+      responses:
+        "200":
+          description: Updated scheduled post
+          content:
+            application/json:
+              schema:
+                type: object
+                items:
+                  $ref: "#/components/schemas/ScheduledPost"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      tags:
+        - scheduled_post
+      summary: Delete a scheduled post
+      description: >
+        Delete a scheduled post
+
+        __Minimum server version__: 10.3
+      operationId: DeleteScheduledPost
+      parameters:
+        - name: scheduled_post_id
+          in: path
+          description: ID of the scheduled post to delete
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Deleted scheduled post
+          content:
+            application/json:
+              schema:
+                type: object
+                items:
+                  $ref: "#/components/schemas/ScheduledPost"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/scheduled_recaps.yaml

@@ -0,0 +1,424 @@
+  /api/v4/scheduled_recaps:
+    post:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Create a scheduled recap
+      description: >
+        Create a new scheduled recap configuration. Scheduled recaps run on a
+        recurring or one-time schedule, generating AI-powered channel summaries
+        at the configured time and day(s).
+
+        ##### Permissions
+
+        Must be authenticated. The recap is created for the authenticated user.
+
+        __Minimum server version__: 11.2
+      operationId: CreateScheduledRecap
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - title
+                - days_of_week
+                - time_of_day
+                - timezone
+                - time_period
+                - channel_mode
+                - agent_id
+              properties:
+                title:
+                  type: string
+                  description: Title for the scheduled recap
+                  maxLength: 255
+                days_of_week:
+                  type: integer
+                  description: >
+                    Bitmask for days of the week the recap should run.
+                    Sun=1, Mon=2, Tue=4, Wed=8, Thu=16, Fri=32, Sat=64.
+                    For example, weekdays = 62, every day = 127.
+                  minimum: 1
+                  maximum: 127
+                time_of_day:
+                  type: string
+                  description: Time of day in HH:MM format (e.g., "09:00")
+                  pattern: "^([0-1][0-9]|2[0-3]):([0-5][0-9])$"
+                timezone:
+                  type: string
+                  description: IANA timezone (e.g., "America/New_York")
+                time_period:
+                  type: string
+                  description: The lookback period for the recap content
+                  enum:
+                    - last_24h
+                    - last_week
+                    - since_last_read
+                channel_mode:
+                  type: string
+                  description: How channels are selected for the recap
+                  enum:
+                    - specific
+                    - all_unreads
+                channel_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: List of channel IDs to include (required when channel_mode is "specific")
+                custom_instructions:
+                  type: string
+                  description: Custom AI instructions for the recap
+                agent_id:
+                  type: string
+                  description: ID of the AI agent to use for generating the recap
+                is_recurring:
+                  type: boolean
+                  description: Whether the recap runs on a recurring schedule or just once
+              oneOf:
+                - properties:
+                    channel_mode:
+                      type: string
+                      enum:
+                        - specific
+                    channel_ids:
+                      type: array
+                      items:
+                        type: string
+                      minItems: 1
+                  required:
+                    - channel_mode
+                    - channel_ids
+                - properties:
+                    channel_mode:
+                      type: string
+                      enum:
+                        - all_unreads
+                  required:
+                    - channel_mode
+        description: Scheduled recap configuration
+        required: true
+      responses:
+        "201":
+          description: Scheduled recap created successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledRecap"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    get:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Get current user's scheduled recaps
+      description: >
+        Get a paginated list of scheduled recaps for the authenticated user.
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 11.2
+      operationId: GetScheduledRecaps
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of scheduled recaps per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Scheduled recaps retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/ScheduledRecap"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/scheduled_recaps/{scheduled_recap_id}:
+    get:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Get a scheduled recap
+      description: >
+        Get a scheduled recap by its ID. Only the user who owns the scheduled
+        recap can retrieve it.
+
+        ##### Permissions
+
+        Must be authenticated. Must own the scheduled recap.
+
+        __Minimum server version__: 11.2
+      operationId: GetScheduledRecap
+      parameters:
+        - name: scheduled_recap_id
+          in: path
+          description: Scheduled Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheduled recap retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledRecap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    put:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Update a scheduled recap
+      description: >
+        Update a scheduled recap configuration. Only the user who owns the
+        scheduled recap can update it. The `user_id` and `create_at` fields
+        are preserved from the original and cannot be changed.
+
+        ##### Permissions
+
+        Must be authenticated. Must own the scheduled recap.
+
+        __Minimum server version__: 11.2
+      operationId: UpdateScheduledRecap
+      parameters:
+        - name: scheduled_recap_id
+          in: path
+          description: Scheduled Recap GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                title:
+                  type: string
+                  description: Title for the scheduled recap
+                  maxLength: 255
+                days_of_week:
+                  type: integer
+                  description: >
+                    Bitmask for days of the week the recap should run.
+                    Sun=1, Mon=2, Tue=4, Wed=8, Thu=16, Fri=32, Sat=64.
+                  minimum: 1
+                  maximum: 127
+                time_of_day:
+                  type: string
+                  description: Time of day in HH:MM format (e.g., "09:00")
+                  pattern: "^([0-1][0-9]|2[0-3]):([0-5][0-9])$"
+                timezone:
+                  type: string
+                  description: IANA timezone (e.g., "America/New_York")
+                time_period:
+                  type: string
+                  description: The lookback period for the recap content
+                  enum:
+                    - last_24h
+                    - last_week
+                    - since_last_read
+                channel_mode:
+                  type: string
+                  description: How channels are selected for the recap
+                  enum:
+                    - specific
+                    - all_unreads
+                channel_ids:
+                  type: array
+                  items:
+                    type: string
+                  description: List of channel IDs to include (required when channel_mode is "specific")
+                custom_instructions:
+                  type: string
+                  description: Custom AI instructions for the recap
+                agent_id:
+                  type: string
+                  description: ID of the AI agent to use for generating the recap
+                is_recurring:
+                  type: boolean
+                  description: Whether the recap runs on a recurring schedule or just once
+                enabled:
+                  type: boolean
+                  description: Whether the scheduled recap is active
+              oneOf:
+                - properties:
+                    channel_mode:
+                      type: string
+                      enum:
+                        - specific
+                    channel_ids:
+                      type: array
+                      items:
+                        type: string
+                      minItems: 1
+                  required:
+                    - channel_mode
+                    - channel_ids
+                - properties:
+                    channel_mode:
+                      type: string
+                      enum:
+                        - all_unreads
+                  required:
+                    - channel_mode
+        description: Updated scheduled recap configuration
+        required: true
+      responses:
+        "200":
+          description: Scheduled recap updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledRecap"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Delete a scheduled recap
+      description: >
+        Delete a scheduled recap by its ID. Only the user who owns the scheduled
+        recap can delete it.
+
+        ##### Permissions
+
+        Must be authenticated. Must own the scheduled recap.
+
+        __Minimum server version__: 11.2
+      operationId: DeleteScheduledRecap
+      parameters:
+        - name: scheduled_recap_id
+          in: path
+          description: Scheduled Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheduled recap deleted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/scheduled_recaps/{scheduled_recap_id}/pause:
+    post:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Pause a scheduled recap
+      description: >
+        Pause a scheduled recap, preventing it from running until resumed.
+        Only the user who owns the scheduled recap can pause it.
+
+        ##### Permissions
+
+        Must be authenticated. Must own the scheduled recap.
+
+        __Minimum server version__: 11.2
+      operationId: PauseScheduledRecap
+      parameters:
+        - name: scheduled_recap_id
+          in: path
+          description: Scheduled Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheduled recap paused successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledRecap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  /api/v4/scheduled_recaps/{scheduled_recap_id}/resume:
+    post:
+      tags:
+        - scheduled recaps
+        - ai
+      summary: Resume a scheduled recap
+      description: >
+        Resume a previously paused scheduled recap, allowing it to run on its
+        configured schedule again. Only the user who owns the scheduled recap
+        can resume it.
+
+        ##### Permissions
+
+        Must be authenticated. Must own the scheduled recap.
+
+        __Minimum server version__: 11.2
+      operationId: ResumeScheduledRecap
+      parameters:
+        - name: scheduled_recap_id
+          in: path
+          description: Scheduled Recap GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheduled recap resumed successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledRecap"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/schemes.yaml

@@ -0,0 +1,336 @@
+  /api/v4/schemes:
+    get:
+      tags:
+        - schemes
+      summary: Get the schemes.
+      description: >
+        Get a page of schemes. Use the query parameters to modify the behaviour
+        of this endpoint.
+
+
+        ##### Permissions
+
+        Must have `manage_system` permission.
+
+
+        __Minimum server version__: 5.0
+      operationId: GetSchemes
+      parameters:
+        - name: scope
+          in: query
+          description: Limit the results returned to the provided scope, either `team` or
+            `channel`.
+          schema:
+            type: string
+            default: ""
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of schemes per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Scheme list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Scheme"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    post:
+      tags:
+        - schemes
+      summary: Create a scheme
+      description: |
+        Create a new scheme.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.0
+      operationId: CreateScheme
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - display_name
+                - scope
+              properties:
+                name:
+                  type: string
+                  description: The name of the scheme
+                display_name:
+                  type: string
+                  description: The display name of the scheme
+                description:
+                  type: string
+                  description: The description of the scheme
+                scope:
+                  type: string
+                  description: The scope of the scheme ("team" or "channel")
+        description: Scheme object to create
+        required: true
+      responses:
+        "201":
+          description: Scheme creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Scheme"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/schemes/{scheme_id}":
+    get:
+      tags:
+        - schemes
+      summary: Get a scheme
+      description: |
+        Get a scheme from the provided scheme id.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.0
+      operationId: GetScheme
+      parameters:
+        - name: scheme_id
+          in: path
+          description: Scheme GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheme retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Scheme"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    delete:
+      tags:
+        - schemes
+      summary: Delete a scheme
+      description: |
+        Soft deletes a scheme, by marking the scheme as deleted in the database.
+
+        ##### Permissions
+        Must have `manage_system` permission.
+
+        __Minimum server version__: 5.0
+      operationId: DeleteScheme
+      parameters:
+        - name: scheme_id
+          in: path
+          description: ID of the scheme to delete
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Scheme deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/schemes/{scheme_id}/patch":
+    put:
+      tags:
+        - schemes
+      summary: Patch a scheme
+      description: >
+        Partially update a scheme by providing only the fields you want to
+        update. Omitted fields will not be updated. The fields that can be
+        updated are defined in the request body, all other provided fields will
+        be ignored.
+
+
+        ##### Permissions
+
+        `manage_system` permission is required.
+
+
+        __Minimum server version__: 5.0
+      operationId: PatchScheme
+      parameters:
+        - name: scheme_id
+          in: path
+          description: Scheme GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                  description: The human readable name of the scheme
+                description:
+                  type: string
+                  description: The description of the scheme
+        description: Scheme object to be updated
+        required: true
+      responses:
+        "200":
+          description: Scheme patch successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Scheme"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/schemes/{scheme_id}/teams":
+    get:
+      tags:
+        - schemes
+      summary: Get a page of teams which use this scheme.
+      description: >
+        Get a page of teams which use this scheme. The provided Scheme ID should
+        be for a Team-scoped Scheme.
+
+        Use the query parameters to modify the behaviour of this endpoint.
+
+
+        ##### Permissions
+
+        `manage_system` permission is required.
+
+
+        __Minimum server version__: 5.0
+      operationId: GetTeamsForScheme
+      parameters:
+        - name: scheme_id
+          in: path
+          description: Scheme GUID
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of teams per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Team list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Team"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/schemes/{scheme_id}/channels":
+    get:
+      tags:
+        - schemes
+      summary: Get a page of channels which use this scheme.
+      description: >
+        Get a page of channels which use this scheme. The provided Scheme ID
+        should be for a Channel-scoped Scheme.
+
+        Use the query parameters to modify the behaviour of this endpoint.
+
+
+        ##### Permissions
+
+        `manage_system` permission is required.
+
+
+        __Minimum server version__: 5.0
+      operationId: GetChannelsForScheme
+      parameters:
+        - name: scheme_id
+          in: path
+          description: Scheme GUID
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of channels per page.
+          schema:
+            type: integer
+            default: 60
+      responses:
+        "200":
+          description: Channel list retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Channel"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/service_terms.yaml

@@ -0,0 +1,45 @@
+  /api/v4/terms_of_service:
+    get:
+      tags:
+        - terms of service
+      summary: Get latest terms of service
+      description: |
+        Get latest terms of service from the server
+
+        __Minimum server version__: 5.4
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetTermsOfService
+      responses:
+        "200":
+          description: Terms of service fetched successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/TermsOfService"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+    post:
+      tags:
+        - terms of service
+      summary: Creates a new terms of service
+      description: |
+        Creates new terms of service
+
+        __Minimum server version__: 5.4
+        ##### Permissions
+        Must have `manage_system` permission.
+      operationId: CreateTermsOfService
+      responses:
+        "200":
+          description: terms of service fetched successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/TermsOfService"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"

api/v4/source/sharedchannels.yaml

@@ -0,0 +1,324 @@
+  "/api/v4/sharedchannels/{team_id}":
+    get:
+      tags:
+        - shared channels
+      summary: Get all shared channels for team.
+      description: |
+        Get all shared channels for a team.
+
+        __Minimum server version__: 5.50
+
+        ##### Permissions
+        Must be authenticated and have the `view_team` permission for the team.
+        Results are restricted to channels the user is a member of unless the user has
+        `manage_shared_channels`.
+      operationId: GetAllSharedChannels
+      parameters:
+        - name: team_id
+          in: path
+          description: Team Id
+          required: true
+          schema:
+            type: string
+        - name: page
+          description: The page to select.
+          in: query
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          description: The number of sharedchannels per page.
+          in: query
+          schema:
+            type: integer
+            default: 0
+      responses:
+        "200":
+          description: Shared channels fetch successful. Result may be empty.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/SharedChannel"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/remotecluster/{remote_id}/sharedchannelremotes":
+    get:
+      tags:
+        - shared channels
+      summary: Get shared channel remotes by remote cluster.
+      description: |
+        Get a list of the channels shared with a given remote cluster
+        and their status.
+
+        ##### Permissions
+        `manage_secure_connections` or `manage_shared_channels`
+      operationId: GetSharedChannelRemotesByRemoteCluster
+      parameters:
+        - name: remote_id
+          in: path
+          description: The remote cluster GUID
+          required: true
+          schema:
+            type: string
+        - name: include_unconfirmed
+          in: query
+          description: Include those Shared channel remotes that are unconfirmed
+          schema:
+            type: boolean
+        - name: exclude_confirmed
+          in: query
+          description: Show only those Shared channel remotes that are not confirmed yet
+          schema:
+            type: boolean
+        - name: exclude_home
+          in: query
+          description: Show only those Shared channel remotes that were shared with this server
+          schema:
+            type: boolean
+        - name: exclude_remote
+          in: query
+          description: Show only those Shared channel remotes that were shared from this server
+          schema:
+            type: boolean
+        - name: include_deleted
+          in: query
+          description: Include those Shared channel remotes that have been deleted
+          schema:
+            type: boolean
+        - name: page
+          in: query
+          description: The page to select
+          schema:
+            type: integer
+        - name: per_page
+          in: query
+          description: The number of shared channels per page
+          schema:
+            type: integer
+      responses:
+        "200":
+          description: Shared channel remotes fetch successful. Result might be empty.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/SharedChannelRemote"
+
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/sharedchannels/remote_info/{remote_id}":
+    get:
+      tags:
+        - shared channels
+      summary: Get remote cluster info by ID for user.
+      description: |
+        Get remote cluster info based on remoteId.
+
+        __Minimum server version__: 5.50
+
+        ##### Permissions
+        Must be authenticated and user must belong to at least one channel shared with the remote cluster.
+      operationId: GetRemoteClusterInfo
+      parameters:
+        - name: remote_id
+          in: path
+          description: Remote Cluster GUID
+          required: true
+          schema:
+            type: string
+        - name: include_deleted
+          in: query
+          description: Include deleted remote clusters
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: Remote cluster info retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteClusterInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+  "/api/v4/remotecluster/{remote_id}/channels/{channel_id}/invite":
+    post:
+      tags:
+        - shared channels
+      summary: Invites a remote cluster to a channel.
+      description: |
+        Invites a remote cluster to a channel, sharing the channel if
+        needed. If the remote cluster was already invited to the
+        channel, calling this endpoint will have no effect.
+
+        ##### Permissions
+        `manage_shared_channels`
+      operationId: InviteRemoteClusterToChannel
+      parameters:
+        - name: remote_id
+          in: path
+          description: The remote cluster GUID
+          required: true
+          schema:
+            type: string
+        - name: channel_id
+          in: path
+          description: The channel GUID to invite the remote cluster to
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Remote cluster invited successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/remotecluster/{remote_id}/channels/{channel_id}/uninvite":
+    post:
+      tags:
+        - shared channels
+      summary: Uninvites a remote cluster to a channel.
+      description: |
+        Stops sharing a channel with a remote cluster. If the channel
+        was not shared with the remote, calling this endpoint will
+        have no effect.
+
+        ##### Permissions
+        `manage_shared_channels`
+      operationId: UninviteRemoteClusterToChannel
+      parameters:
+        - name: remote_id
+          in: path
+          description: The remote cluster GUID
+          required: true
+          schema:
+            type: string
+        - name: channel_id
+          in: path
+          description: The channel GUID to uninvite the remote cluster to
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Remote cluster uninvited successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "204":
+          description: Channel was not shared with the remote cluster. No action needed.
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+
+  "/api/v4/sharedchannels/{channel_id}/remotes":
+    get:
+      tags:
+        - shared channels
+      summary: Get remote clusters for a shared channel
+      description: |
+        Gets the remote clusters information for a shared channel.
+
+        __Minimum server version__: 10.11
+
+        ##### Permissions
+        Must be authenticated and have the `read_channel` permission for the channel.
+      operationId: GetSharedChannelRemotes
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Remote clusters retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/RemoteClusterInfo"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+
+  "/api/v4/sharedchannels/users/{user_id}/can_dm/{other_user_id}":
+    get:
+      tags:
+        - shared channels
+      summary: Check if user can DM another user in shared channels context
+      description: |
+        Checks if a user can send direct messages to another user in a shared channels context.
+        In addition to user visibility, this evaluates remote-cluster direct-connect restrictions
+        for remote users.
+
+        __Minimum server version__: 10.11
+
+        ##### Permissions
+        Must be authenticated and able to view the target user.
+      operationId: CanUserDirectMessage
+      parameters:
+        - name: user_id
+          in: path
+          description: User GUID
+          required: true
+          schema:
+            type: string
+        - name: other_user_id
+          in: path
+          description: Other user GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: DM permission check successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  can_dm:
+                    type: boolean
+                    description: Whether the user can send DMs to the other user
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"

api/v4/source/status.yaml

@@ -0,0 +1,280 @@
+  "/api/v4/users/{user_id}/status":
+    get:
+      tags:
+        - status
+      summary: Get user status
+      description: |
+        Get user status by id from the server.
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetUserStatus
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User status retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+    put:
+      tags:
+        - status
+      summary: Update user status
+      description: >
+        Manually set a user's status. When setting a user's status, the status
+        will remain that value until set "online" again, which will return the
+        status to being automatically updated based on user activity.
+
+        ##### Permissions
+
+        Must have `edit_other_users` permission for the team.
+      operationId: UpdateUserStatus
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - status
+                - user_id
+              properties:
+                user_id:
+                  type: string
+                  description: User ID
+                status:
+                  type: string
+                  description: User status, can be `online`, `away`, `offline` and `dnd`
+                dnd_end_time:
+                  type: integer
+                  description: Time in epoch seconds at which a dnd status would be unset.
+        description: Status object that is to be updated
+        required: true
+      responses:
+        "200":
+          description: User status update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Status"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  /api/v4/users/status/ids:
+    post:
+      tags:
+        - status
+      summary: Get user statuses by id
+      description: |
+        Get a list of user statuses by id from the server.
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetUsersStatusesByIds
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+        description: List of user ids to fetch
+        required: true
+      responses:
+        "200":
+          description: User statuses retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Status"
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+  "/api/v4/users/{user_id}/status/custom":
+    put:
+      tags:
+        - status
+      summary: Update user custom status
+      description: |
+        Updates a user's custom status by setting the value in the user's props and updates the user. Also save the given custom status to the recent custom statuses in the user's props
+        ##### Permissions
+        Must be logged in as the user whose custom status is being updated.
+      operationId: UpdateUserCustomStatus
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - emoji
+                - text
+              properties:
+                emoji:
+                  type: string
+                  description: Any emoji
+                text:
+                  type: string
+                  description: Any custom status text
+                duration:
+                  type: string
+                  description: Duration of custom status, can be `thirty_minutes`, `one_hour`, `four_hours`, `today`, `this_week` or `date_and_time`
+                expires_at:
+                  type: string
+                  description: The time at which custom status should be expired. It should be in ISO format.
+        description: Custom status object that is to be updated
+        required: true
+      responses:
+        "200":
+          description: User custom status update successful
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+
+    delete:
+      tags:
+        - status
+      summary: Unsets user custom status
+      description: |
+        Unsets a user's custom status by updating the user's props and updates the user
+        ##### Permissions
+        Must be logged in as the user whose custom status is being removed.
+      operationId: UnsetUserCustomStatus
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: User custom status delete successful
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  "/api/v4/users/{user_id}/status/custom/recent":
+    delete:
+      tags:
+        - status
+      summary: Delete user's recent custom status
+      description: |
+        Deletes a user's recent custom status by removing the specific status from the recentCustomStatuses in the user's props and updates the user.
+        ##### Permissions
+        Must be logged in as the user whose recent custom status is being deleted.
+      operationId: RemoveRecentCustomStatus
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - emoji
+                - text
+                - duration
+                - expires_at
+              properties:
+                emoji:
+                  type: string
+                  description: Any emoji
+                text:
+                  type: string
+                  description: Any custom status text
+                duration:
+                  type: string
+                  description: Duration of custom status, can be `thirty_minutes`, `one_hour`, `four_hours`, `today`, `this_week` or `date_and_time`
+                expires_at:
+                  type: string
+                  description: The time at which custom status should be expired. It should be in ISO format.
+        description: Custom Status object that is to be removed from the recent custom statuses.
+        required: true
+      responses:
+        "200":
+          description: User recent custom status delete successful
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  "/api/v4/users/{user_id}/status/custom/recent/delete":
+    post:
+      tags:
+        - status
+      summary: Delete user's recent custom status
+      description: |
+        Deletes a user's recent custom status by removing the specific status from the recentCustomStatuses in the user's props and updates the user.
+        ##### Permissions
+        Must be logged in as the user whose recent custom status is being deleted.
+      operationId: PostUserRecentCustomStatusDelete
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - emoji
+                - text
+                - duration
+                - expires_at
+              properties:
+                emoji:
+                  type: string
+                  description: Any emoji
+                text:
+                  type: string
+                  description: Any custom status text
+                duration:
+                  type: string
+                  description: Duration of custom status, can be `thirty_minutes`, `one_hour`, `four_hours`, `today`, `this_week` or `date_and_time`
+                expires_at:
+                  type: string
+                  description: The time at which custom status should be expired. It should be in ISO format.
+        description: Custom Status object that is to be removed from the recent custom statuses.
+        required: true
+      responses:
+        "200":
+          description: User recent custom status delete successful
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"

api/v4/source/uploads.yaml

@@ -0,0 +1,137 @@
+  "/api/v4/uploads":
+    post:
+      tags:
+        - uploads
+      summary: Create an upload
+      description: >
+        Creates a new upload session.
+
+
+        __Minimum server version__: 5.28
+
+        ##### Permissions
+
+        Must have `upload_file` permission.
+
+      operationId: CreateUpload
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_id
+                - filename
+                - file_size
+              properties:
+                channel_id:
+                  description: The ID of the channel to upload to.
+                  type: string
+                filename:
+                  description: The name of the file to upload.
+                  type: string
+                file_size:
+                  description: The size of the file to upload in bytes.
+                  type: integer
+                  format: int64
+        required: true
+      responses:
+        "201":
+          description: Upload creation successful.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UploadSession"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+  "/api/v4/uploads/{upload_id}":
+    get:
+      tags:
+        - uploads
+      summary: Get an upload session
+      description: |
+        Gets an upload session that has been previously created.
+
+        ##### Permissions
+        Must be logged in as the user who created the upload session.
+      operationId: GetUpload
+      parameters:
+        - name: upload_id
+          in: path
+          description: The ID of the upload session to get.
+          required: true
+          schema:
+            type: string
+      responses:
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "501":
+          $ref: "#/components/responses/NotImplemented"
+    post:
+      tags:
+        - uploads
+      summary: Perform a file upload
+      description: |
+        Starts or resumes a file upload.  
+        To resume an existing (incomplete) upload, data should be sent starting from the offset specified in the upload session object.
+
+        The request body can be in one of two formats:
+        - Binary file content streamed in request's body
+        - multipart/form-data
+
+        ##### Permissions
+        Must be logged in as the user who created the upload session.
+      operationId: UploadData
+      parameters:
+        - name: upload_id
+          in: path
+          description: The ID of the upload session the data belongs to.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/octet-stream:
+            schema:
+              type: string
+              format: binary
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+      responses:
+        "201":
+          description: Upload successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/FileInfo"
+        "204":
+          description: Upload incomplete
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "413":
+          $ref: "#/components/responses/TooLarge"
+        "501":
+          $ref: "#/components/responses/NotImplemented"

api/v4/source/usage.yaml

@@ -0,0 +1,81 @@
+  /api/v4/usage/posts:
+    get:
+      tags:
+        - usage
+      summary: Get current usage of posts
+      description: >
+        Retrieve rounded off total no. of posts for this instance.
+        Example: returns 4000 instead of 4321
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 7.0
+      operationId: GetPostsUsage
+      responses:
+        "200":
+          description: Total no. of posts returned successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PostsUsage"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/usage/storage:
+    get:
+      tags:
+        - usage
+      summary: Get the total file storage usage for the instance in bytes.
+      description: >
+        Get the total file storage usage for the instance in bytes rounded down to the most significant digit.
+        Example: returns 4000 instead of 4321
+
+        ##### Permissions
+
+        Must be authenticated.
+
+        __Minimum server version__: 7.1
+      operationId: GetStorageUsage
+      responses:
+        "200":
+          description: The total file storage usage for the instance in bytes rounded down to the most significant digit.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StorageUsage"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+  /api/v4/usage/teams:
+    get:
+      tags:
+        - usage
+      summary: Get current usage of teams
+      description: >
+        Retrieve rounded total number of teams for this instance.
+
+        ##### Permissions
+        Must be authenticated.
+      operationId: GetTeamsUsage
+      responses:
+        "200":
+          description: Total number of teams returned successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  active:
+                    type: integer
+                  cloud_archived:
+                    type: integer
+                  teams:
+                    type: integer
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/views.yaml

@@ -0,0 +1,406 @@
+  /api/v4/channels/{channel_id}/views:
+    get:
+      tags:
+        - views
+      summary: List channel views
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Get a list of views for a channel.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `read_channel_content` permission for the channel.
+      operationId: ListChannelViews
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: per_page
+          in: query
+          description: The number of views per page (default 60, max 200)
+          required: false
+          schema:
+            type: integer
+            default: 60
+            maximum: 200
+        - name: page
+          in: query
+          description: The 0-based page number for pagination (default 0)
+          required: false
+          schema:
+            type: integer
+            default: 0
+            minimum: 0
+        - name: include_total_count
+          in: query
+          description: >
+            When true, the response is a ViewsWithCount object containing
+            a views array and a total_count integer. When false or omitted,
+            the response is a plain JSON array of View objects.
+          required: false
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: Channel views retrieval successful
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: array
+                    items:
+                      $ref: "#/components/schemas/View"
+                    description: Plain array of views (default, when include_total_count is false)
+                  - $ref: "#/components/schemas/ViewsWithCount"
+                    description: Views with total count (when include_total_count is true)
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    post:
+      tags:
+        - views
+      summary: Create channel view
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Create a new view for a channel.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `create_post` permission for the channel.
+      operationId: CreateChannelView
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - title
+                - type
+              properties:
+                title:
+                  type: string
+                  description: The title of the view
+                  maxLength: 256
+                type:
+                  type: string
+                  enum: [kanban]
+                  description: |
+                    The type of the view.
+                    * `kanban` - a kanban view
+                description:
+                  type: string
+                  description: The description of the view
+                  maxLength: 1024
+                sort_order:
+                  type: integer
+                  description: The display order of the view within the channel
+                props:
+                  type: object
+                  description: Arbitrary key-value properties for the view
+                  additionalProperties: true
+        description: View object to be created
+        required: true
+      responses:
+        "201":
+          description: Channel view creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/View"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/channels/{channel_id}/views/{view_id}:
+    get:
+      tags:
+        - views
+      summary: Get a channel view
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Get a single view by its ID.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `read_channel_content` permission for the channel.
+      operationId: GetChannelView
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: view_id
+          in: path
+          description: View GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Channel view retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/View"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    patch:
+      tags:
+        - views
+      summary: Update a channel view
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Partially update a channel view by providing only the fields
+        you want to update. Omitted fields will not be updated.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `create_post` permission for the channel.
+      operationId: UpdateChannelView
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: view_id
+          in: path
+          description: View GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/ViewPatch"
+        description: View fields to be updated
+        required: true
+      responses:
+        "200":
+          description: Channel view update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/View"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+    delete:
+      tags:
+        - views
+      summary: Delete a channel view
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Soft-deletes a channel view. Sets `delete_at` to current timestamp.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `create_post` permission for the channel.
+      operationId: DeleteChannelView
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: view_id
+          in: path
+          description: View GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Channel view deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/channels/{channel_id}/views/{view_id}/posts:
+    get:
+      tags:
+        - views
+      summary: Get posts for a view
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Get a paginated list of posts that belong to a specific view.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `read_channel_content` permission for the channel.
+      operationId: GetPostsForView
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: view_id
+          in: path
+          description: View GUID
+          required: true
+          schema:
+            type: string
+        - name: page
+          in: query
+          description: The 0-based page number for pagination (default 0)
+          required: false
+          schema:
+            type: integer
+            default: 0
+            minimum: 0
+        - name: per_page
+          in: query
+          description: The number of posts per page (default 60, max 200)
+          required: false
+          schema:
+            type: integer
+            default: 60
+            maximum: 200
+      responses:
+        "200":
+          description: Post list retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PostList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"
+
+  /api/v4/channels/{channel_id}/views/{view_id}/sort_order:
+    post:
+      tags:
+        - views
+      summary: Update a channel view's sort order
+      description: |
+        *__Experimental__: This endpoint is experimental and may change or be removed in a future release.*
+
+        Updates the sort order of a channel view, setting its new index
+        from the request body and updating the rest of the views in the
+        channel to accommodate the change.
+
+        __Minimum server version__: 11.6
+
+        ##### Permissions
+        Must have `create_post` permission for the channel.
+      operationId: UpdateChannelViewSortOrder
+      parameters:
+        - name: channel_id
+          in: path
+          description: Channel GUID
+          required: true
+          schema:
+            type: string
+        - name: view_id
+          in: path
+          description: View GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: integer
+              format: int64
+              description: The new sort order index for the view
+      responses:
+        "200":
+          description: Channel view sort order update successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/View"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "500":
+          $ref: "#/components/responses/InternalServerError"

api/v4/source/webhooks.yaml

@@ -0,0 +1,534 @@
+  /api/v4/hooks/incoming:
+    post:
+      tags:
+        - webhooks
+      summary: Create an incoming webhook
+      description: |
+        Create an incoming webhook for a channel.
+        ##### Permissions
+        `manage_webhooks` for the team the webhook is in.
+
+        `manage_others_incoming_webhooks` for the team the webhook is in if the user is different than the requester.
+      operationId: CreateIncomingWebhook
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - channel_id
+              properties:
+                channel_id:
+                  type: string
+                  description: The ID of a public channel or private group that receives
+                    the webhook payloads.
+                user_id:
+                  type: string
+                  description: The ID of the owner of the webhook if different than the requester. Required for [local mode](https://docs.mattermost.com/administration/mmctl-cli-tool.html#local-mode).
+                display_name:
+                  type: string
+                  description: The display name for this incoming webhook
+                description:
+                  type: string
+                  description: The description for this incoming webhook
+                username:
+                  type: string
+                  description: The username this incoming webhook will post as.
+                icon_url:
+                  type: string
+                  description: The profile picture this incoming webhook will use when
+                    posting.
+                channel_locked:
+                  type: boolean
+                  description: Whether the webhook is locked to the channel.
+        description: Incoming webhook to be created
+        required: true
+      responses:
+        "201":
+          description: Incoming webhook creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/IncomingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+    get:
+      tags:
+        - webhooks
+      summary: List incoming webhooks
+      description: >
+        Get a page of a list of incoming webhooks. Optionally filter for a
+        specific team using query parameters.
+
+        ##### Permissions
+
+        `manage_webhooks` for the system or `manage_webhooks` for the specific team.
+      operationId: GetIncomingWebhooks
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of hooks per page.
+          schema:
+            type: integer
+            default: 60
+        - name: team_id
+          in: query
+          description: The ID of the team to get hooks for.
+          schema:
+            type: string
+        - name: include_total_count
+          description: >-
+            Appends a total count of returned hooks inside the response object - ex: `{ "incoming_webhooks": [], "total_count": 0 }`.
+          in: query
+          schema:
+            type: boolean
+            default: false
+      responses:
+        "200":
+          description: Incoming webhooks retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/IncomingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+  "/api/v4/hooks/incoming/{hook_id}":
+    get:
+      tags:
+        - webhooks
+      summary: Get an incoming webhook
+      description: >
+        Get an incoming webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: GetIncomingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: Incoming Webhook GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Webhook retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/IncomingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    delete:
+      tags:
+        - webhooks
+      summary: Delete an incoming webhook
+      description: >
+        Delete an incoming webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: DeleteIncomingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: Incoming webhook GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Webhook deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    put:
+      tags:
+        - webhooks
+      summary: Update an incoming webhook
+      description: >
+        Update an incoming webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: UpdateIncomingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: Incoming Webhook GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - id
+                - channel_id
+                - display_name
+                - description
+              properties:
+                id:
+                  type: string
+                  description: Incoming webhook GUID
+                channel_id:
+                  type: string
+                  description: The ID of a public channel or private group that receives
+                    the webhook payloads.
+                display_name:
+                  type: string
+                  description: The display name for this incoming webhook
+                description:
+                  type: string
+                  description: The description for this incoming webhook
+                username:
+                  type: string
+                  description: The username this incoming webhook will post as.
+                icon_url:
+                  type: string
+                  description: The profile picture this incoming webhook will use when
+                    posting.
+                channel_locked:
+                  type: boolean
+                  description: Whether the webhook is locked to the channel.
+        description: Incoming webhook to be updated
+        required: true
+      responses:
+        "200":
+          description: Webhook update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/IncomingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  /api/v4/hooks/outgoing:
+    post:
+      tags:
+        - webhooks
+      summary: Create an outgoing webhook
+      description: |
+        Create an outgoing webhook for a team.
+        ##### Permissions
+        `manage_webhooks` for the team the webhook is in.
+
+        `manage_others_outgoing_webhooks` for the team the webhook is in if the user is different than the requester.
+      operationId: CreateOutgoingWebhook
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - team_id
+                - display_name
+                - trigger_words
+                - callback_urls
+              properties:
+                team_id:
+                  description: The ID of the team that the webhook watchs
+                  type: string
+                channel_id:
+                  description: The ID of a public channel that the webhook watchs
+                  type: string
+                creator_id:
+                  description: The ID of the owner of the webhook if different than the requester. Required in [local mode](https://docs.mattermost.com/administration/mmctl-cli-tool.html#local-mode).
+                  type: string
+                description:
+                  description: The description for this outgoing webhook
+                  type: string
+                display_name:
+                  description: The display name for this outgoing webhook
+                  type: string
+                trigger_words:
+                  description: List of words for the webhook to trigger on
+                  type: array
+                  items:
+                    type: string
+                trigger_when:
+                  description: When to trigger the webhook, `0` when a trigger word is
+                    present at all and `1` if the message starts with a trigger
+                    word
+                  type: integer
+                callback_urls:
+                  description: The URLs to POST the payloads to when the webhook is
+                    triggered
+                  type: array
+                  items:
+                    type: string
+                content_type:
+                  description: The format to POST the data in, either `application/json` or
+                    `application/x-www-form-urlencoded`
+                  default: application/x-www-form-urlencoded
+                  type: string
+        description: Outgoing webhook to be created
+        required: true
+      responses:
+        "201":
+          description: Outgoing webhook creation successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    get:
+      tags:
+        - webhooks
+      summary: List outgoing webhooks
+      description: >
+        Get a page of a list of outgoing webhooks. Optionally filter for a
+        specific team or channel using query parameters.
+
+        ##### Permissions
+
+        `manage_webhooks` for the system or `manage_webhooks` for the specific team/channel.
+      operationId: GetOutgoingWebhooks
+      parameters:
+        - name: page
+          in: query
+          description: The page to select.
+          schema:
+            type: integer
+            default: 0
+        - name: per_page
+          in: query
+          description: The number of hooks per page.
+          schema:
+            type: integer
+            default: 60
+        - name: team_id
+          in: query
+          description: The ID of the team to get hooks for.
+          schema:
+            type: string
+        - name: channel_id
+          in: query
+          description: The ID of the channel to get hooks for.
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Outgoing webhooks retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/OutgoingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/hooks/outgoing/{hook_id}":
+    get:
+      tags:
+        - webhooks
+      summary: Get an outgoing webhook
+      description: >
+        Get an outgoing webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: GetOutgoingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: Outgoing webhook GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Outgoing webhook retrieval successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    delete:
+      tags:
+        - webhooks
+      summary: Delete an outgoing webhook
+      description: >
+        Delete an outgoing webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: DeleteOutgoingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: Outgoing webhook GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Webhook deletion successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+    put:
+      tags:
+        - webhooks
+      summary: Update an outgoing webhook
+      description: >
+        Update an outgoing webhook given the hook id.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: UpdateOutgoingWebhook
+      parameters:
+        - name: hook_id
+          in: path
+          description: outgoing Webhook GUID
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - id
+                - channel_id
+                - display_name
+                - description
+              properties:
+                id:
+                  type: string
+                  description: Outgoing webhook GUID
+                channel_id:
+                  type: string
+                  description: The ID of a public channel or private group that receives
+                    the webhook payloads.
+                display_name:
+                  type: string
+                  description: The display name for this incoming webhook
+                description:
+                  type: string
+                  description: The description for this incoming webhook
+        description: Outgoing webhook to be updated
+        required: true
+      responses:
+        "200":
+          description: Webhook update successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/OutgoingWebhook"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  "/api/v4/hooks/outgoing/{hook_id}/regen_token":
+    post:
+      tags:
+        - webhooks
+      summary: Regenerate the token for the outgoing webhook.
+      description: >
+        Regenerate the token for the outgoing webhook.
+
+        ##### Permissions
+
+        `manage_webhooks` for system or `manage_webhooks` for the specific team or `manage_webhooks` for the channel.
+      operationId: RegenOutgoingHookToken
+      parameters:
+        - name: hook_id
+          in: path
+          description: Outgoing webhook GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Webhook token regenerate successful
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/StatusOK"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"