openapi: 3.1.0
info:
  title: TOPMANIDMB Protected Transform Gateway
  version: 0.1.0-draft
  description: Public-safe architecture contract only. No production host, schema, credential, or PII is included.
paths:
  /v1/transform/domain/exact:
    post:
      summary: Resolve an allowlisted Domain entity using an exact read-only query
      security: [{tailnetToken: []}]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [value, purpose, request_id]
              properties:
                value: {type: string, format: hostname}
                purpose: {type: string, minLength: 10, maxLength: 200}
                request_id: {type: string, maxLength: 64}
      responses:
        "200":
          description: Sanitized allowlisted result with provenance
        "403":
          description: Entity, field, purpose, or caller denied
        "429":
          description: Rate limit exceeded
components:
  securitySchemes:
    tailnetToken:
      type: http
      scheme: bearer
security:
  - tailnetToken: []