{
  "components": {
    "schemas": {
      "ComplianceScore": {
        "properties": {
          "active_timers": {
            "items": {
              "properties": {
                "early_warning_deadline": {
                  "format": "date-time",
                  "type": "string"
                },
                "full_notification_deadline": {
                  "format": "date-time",
                  "type": "string"
                },
                "incident_number": {
                  "type": "integer"
                },
                "title": {
                  "type": "string"
                }
              },
              "type": "object"
            },
            "type": "array"
          },
          "cra_health_score": {
            "type": "integer"
          },
          "generated_at": {
            "format": "date-time",
            "type": "string"
          },
          "mttn_seconds": {
            "type": "integer"
          },
          "open_incidents": {
            "type": "integer"
          },
          "sbom_coverage_percent": {
            "type": "integer"
          }
        },
        "type": "object"
      },
      "Errore": {
        "properties": {
          "errore": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "IncidenteCreato": {
        "properties": {
          "awareness_timestamp": {
            "format": "date-time",
            "type": "string"
          },
          "early_warning_deadline": {
            "format": "date-time",
            "type": "string"
          },
          "full_notification_deadline": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "incident_number": {
            "type": "integer"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "NuovoIncidente": {
        "properties": {
          "cve": {
            "example": "CVE-2026-12345",
            "type": "string"
          },
          "description": {
            "example": "Heap overflow sfruttabile da remoto; PoC osservato.",
            "type": "string"
          },
          "gtin": {
            "example": "8012345678901",
            "type": "string"
          },
          "sku": {
            "example": "SGX2-100",
            "type": "string"
          },
          "title": {
            "example": "RCE nel modulo OTA",
            "type": "string"
          }
        },
        "required": [
          "description"
        ],
        "type": "object"
      },
      "Prodotto": {
        "properties": {
          "end_of_support": {
            "format": "date-time",
            "type": "string"
          },
          "firmware_version": {
            "type": "string"
          },
          "gtin": {
            "type": "string"
          },
          "id": {
            "format": "uuid",
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "risk_level": {
            "enum": [
              "low",
              "medium",
              "high"
            ],
            "type": "string"
          },
          "sbom_components": {
            "type": "integer"
          },
          "sbom_status": {
            "enum": [
              "none",
              "cyclonedx",
              "spdx"
            ],
            "type": "string"
          },
          "sku": {
            "type": "string"
          },
          "status": {
            "enum": [
              "active",
              "archived"
            ],
            "type": "string"
          }
        },
        "type": "object"
      }
    },
    "securitySchemes": {
      "apiKey": {
        "in": "header",
        "name": "X-CRA-API-Key",
        "type": "apiKey"
      },
      "bearer": {
        "scheme": "bearer",
        "type": "http"
      }
    }
  },
  "info": {
    "description": "API B2B per SIEM e sistemi cliente: apertura incidenti (Art. 14 CRA), catalogo prodotti, KPI di conformità. Autenticazione con API key (header X-CRA-API-Key: cra_live_…) o Bearer token. Rate limit: 100 richieste/minuto per chiave (header X-RateLimit-Limit / X-RateLimit-Remaining, 429 oltre soglia).",
    "title": "CRA Incident Command Center — Public API",
    "version": "1.0.0"
  },
  "openapi": "3.0.3",
  "paths": {
    "/compliance-score": {
      "get": {
        "description": "Scope richiesto: compliance:read. CRA Health Score (0-100, a regole), MTTN medio, copertura SBOM, timer 24h/72h attivi.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ComplianceScore"
                }
              }
            },
            "description": "KPI"
          },
          "401": {
            "description": "API key non valida"
          },
          "403": {
            "description": "Scope insufficiente"
          },
          "429": {
            "description": "Rate limit superato"
          }
        },
        "summary": "KPI di conformità in tempo reale"
      }
    },
    "/incidents": {
      "post": {
        "description": "Scope richiesto: incidents:write. Matching del prodotto per SKU o GTIN; senza corrispondenza il caso entra in «Segnalazioni non attribuite». I termini 24h/72h partono dall'istante di ricezione.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/NuovoIncidente"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IncidenteCreato"
                }
              }
            },
            "description": "Incidente aperto"
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Errore"
                }
              }
            },
            "description": "API key mancante/revocata/scaduta"
          },
          "403": {
            "description": "Scope insufficiente"
          },
          "422": {
            "description": "Campi mancanti (description obbligatoria)"
          },
          "429": {
            "description": "Rate limit superato (100/min per chiave)"
          }
        },
        "summary": "Apre un incidente (Step 1 con awareness UTC = adesso)"
      }
    },
    "/products": {
      "get": {
        "description": "Scope richiesto: products:read. risk_level: high = casi attivi notificabili sul prodotto, medium = casi attivi, low = nessuno.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "count": {
                      "type": "integer"
                    },
                    "products": {
                      "items": {
                        "$ref": "#/components/schemas/Prodotto"
                      },
                      "type": "array"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "Catalogo"
          },
          "401": {
            "description": "API key non valida"
          },
          "403": {
            "description": "Scope insufficiente"
          },
          "429": {
            "description": "Rate limit superato"
          }
        },
        "summary": "Catalogo prodotti con stato SBOM e livello di rischio"
      }
    }
  },
  "security": [
    {
      "apiKey": []
    },
    {
      "bearer": []
    }
  ],
  "servers": [
    {
      "description": "istanza corrente",
      "url": "https://app.cranotify.eu/api/v1/external"
    },
    {
      "description": "produzione",
      "url": "https://api.cranotify.eu/api/v1/external"
    }
  ]
}