Hlido Incidents API

openapi: 3.2.0
info:
  title: Hlido Recommendation Incidents API
  version: wave4-v1
  description: 'Public REST surface for Hlido''s agent review corpus. Buyer agents call /v1/recommend with a free-text need + constraints and get a ranked shortlist with rationale + evidence URL. Free tier: 100 calls/day, top-1 results, no key. Paid: hlk_live_* Bearer.'
  contact:
    name: Hlido
    url: https://hlido.eu
    email: ankit@hlido.eu
  license:
    name: Proprietary — see https://hlido.eu/legal/
servers:
- url: https://hlido.eu/v1
  description: Production
tags:
- name: Incidents
  description: 'Public registry of agent failures (Wave 4 PR #44).'
paths:
  /incidents:
    get:
      summary: List published incidents (filter + paginate)
      tags:
      - Incidents
      parameters:
      - name: slug
        in: query
        schema:
          type: string
        description: Filter by agent slug.
      - name: severity
        in: query
        schema:
          $ref: '#/components/schemas/IncidentSeverity'
      - name: since
        in: query
        schema:
          type: string
        description: ISO-8601 datetime or relative (e.g. 'now-30d').
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 25
      responses:
        '200':
          description: Published incidents matching the filter.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentListResponse'
      operationId: getIncidents
      x-operation-id-source: derived
    post:
      summary: Submit a new incident report (private beta — gated)
      tags:
      - Incidents
      description: Submissions enter a moderation queue with status=pending_review until staff publish. Public submissions are gated until media liability cover binds; the endpoint exists but currently accepts only authorized submitters.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentSubmitRequest'
      responses:
        '202':
          description: Submission accepted for review.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  status:
                    type: string
                    enum:
                    - pending_review
        '400':
          description: Invalid body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate-limited.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postIncidents
      x-operation-id-source: derived
  /incidents/{id}:
    get:
      summary: Single incident detail (published only)
      tags:
      - Incidents
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
          pattern: ^inc_[A-Za-z0-9_-]+$
      responses:
        '200':
          description: Incident detail.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentDetail'
        '404':
          description: Not published or not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getIncidentsById
      x-operation-id-source: derived
  /incidents/feed.xml:
    get:
      summary: RSS 2.0 feed of latest 50 published incidents
      tags:
      - Incidents
      responses:
        '200':
          description: RSS 2.0 XML feed.
          content:
            application/rss+xml:
              schema:
                type: string
      operationId: getIncidentsFeedXml
      x-operation-id-source: derived
components:
  schemas:
    IncidentSummary:
      type: object
      properties:
        id:
          type: string
          pattern: ^inc_[A-Za-z0-9_-]+$
        slug:
          type: string
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        title:
          type: string
        summary:
          type: string
        observed_at:
          type: string
          format: date-time
          nullable: true
        published_at:
          type: string
          format: date-time
          nullable: true
        status:
          type: string
          enum:
          - pending_review
          - published
          - rejected
      required:
      - id
      - slug
      - severity
      - title
      - status
    IncidentSubmitRequest:
      type: object
      required:
      - slug
      - severity
      - title
      - summary
      properties:
        slug:
          type: string
          pattern: ^[a-z0-9][a-z0-9-]{0,80}$
        severity:
          $ref: '#/components/schemas/IncidentSeverity'
        title:
          type: string
          minLength: 5
          maxLength: 200
        summary:
          type: string
          minLength: 20
          maxLength: 4000
        evidence_urls:
          type: array
          items:
            type: string
            format: uri
          maxItems: 10
        observed_at:
          type: string
          format: date-time
        submitter_handle:
          type: string
          maxLength: 80
        submitter_email:
          type: string
          format: email
          description: Hashed at intake; never stored in plaintext.
      additionalProperties: false
    IncidentListResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/IncidentSummary'
        total:
          type: integer
        as_of:
          type: string
          nullable: true
        model_version:
          type: string
      required:
      - items
    Error:
      type: object
      properties:
        error:
          type: string
          enum:
          - invalid_json
          - invalid_body
          - missing_field
          - quota_exceeded
          - unauthorized
          - invalid_api_key
          - configuration_error
          - internal_error
          - not_found
        request_id:
          type: string
      required:
      - error
    IncidentSeverity:
      type: string
      enum:
      - low
      - medium
      - high
      - critical
    IncidentDetail:
      allOf:
      - $ref: '#/components/schemas/IncidentSummary'
      - type: object
        properties:
          evidence_urls:
            type: array
            items:
              type: string
              format: uri
          submitter_handle:
            type: string
            nullable: true
          vendor_response:
            type: string
            nullable: true
          model_version:
            type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: hlk_live