From f44fbf5b93269bb3573e8a2701e70ab0d7613153 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.
---
 docs/openapi.yaml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

(limited to 'docs/openapi.yaml')

diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index d067f4f..742a013 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -626,6 +626,40 @@ paths:
         '503':
           description: Node is not ready.
 
+  /admin/refused:
+    get:
+      tags: [Admin]
+      summary: Changes refused under the swarm's policy
+      description: |
+        The changes this node refused under the swarm's policy
+        (`_continuum/access/policy`, `access.md`), newest first, the last thousand at
+        most since it started or switched epochs: each with its hash, when its writer
+        made it (its clock), the node and user it names, what it touched, and why.
+      responses:
+        '200':
+          description: The refused changes.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  required: [hash, at, paths, why]
+                  properties:
+                    hash:
+                      type: string
+                    at:
+                      type: integer
+                    node:
+                      type: string
+                    user:
+                      type: string
+                    paths:
+                      type: array
+                      items:
+                        type: string
+                    why:
+                      type: string
   /admin/changes/{key}:
     get:
       tags: [Admin]
-- 
cgit v1.3.1