{
  "endpoint": "AdministrativeHandler",
  "preferredHttpPath": "\u8D85",
  "alternateHttpPaths": [
    "HttpAdministrative"
  ],
  "summary": "Administrative APIs.",
  "description": "This endpoint contains all APIs related to administrative functionality.",
  "apis": [
    {
      "name": "GetSystemDashboard",
      "httpMethod": "GET",
      "httpPathRegex": "^/system-dashboard",
      "subPathPattern": "/system-dashboard",
      "summary": "Gets system stats.",
      "parameters": [
        {
          "name": "statisticIds",
          "required": true,
          "type": "String[]",
          "description": "An array of the desired statistic IDs."
        },
        {
          "name": "startRange",
          "required": false,
          "type": "DateOnly?",
          "description": "A <see cref=\"T:System.DateOnly\" /> indicating the start of the desired range.  Defaults to 30 days ago."
        },
        {
          "name": "endRange",
          "required": false,
          "type": "DateOnly?",
          "description": "A <see cref=\"T:System.DateOnly\" /> indicating the end of the desired range.  Defaults to today."
        }
      ],
      "return": {
        "type": "GetSystemStatsResponse",
        "description": "The <see cref=\"T:PicMeApi.GetSystemStatsResponse\" /> containing the response."
      }
    },
    {
      "name": "ListReferralLinks",
      "httpMethod": "GET",
      "httpPathRegex": "^/referral-links",
      "subPathPattern": "/referral-links",
      "summary": "Lists raw referral links for administrative/migration export. Root administrators only.",
      "parameters": [
        {
          "name": "referrerUserId",
          "required": false,
          "type": "UserId?",
          "description": "An optional <see cref=\"T:AmbientServices.UserId\" /> restricting the export to referrals made by a single referrer; if omitted, every referral link in the system is exported."
        }
      ],
      "return": {
        "type": "ListReferralLinksResponse",
        "description": "A <see cref=\"T:PicMeApi.ListReferralLinksResponse\" /> containing one <see cref=\"T:PicMeApi.ReferralLinkRecord\" /> per referral link."
      }
    },
    {
      "name": "GetServerStats",
      "httpMethod": "GET",
      "httpPathRegex": "^/server-stats",
      "subPathPattern": "/server-stats",
      "summary": "Gets server stats.",
      "parameters": [
        {
          "name": "statisticIds",
          "required": true,
          "type": "String[]",
          "description": "An array of the desired statistic IDs."
        }
      ],
      "return": {
        "type": "GetServerStatsResponse",
        "description": "The <see cref=\"T:PicMeApi.GetServerStatsResponse\" /> containing the response."
      }
    },
    {
      "name": "ListAvailableSystemStats",
      "httpMethod": "GET",
      "httpPathRegex": "^/system-stats",
      "subPathPattern": "/system-stats",
      "summary": "Gets a list of the available system stats.",
      "parameters": [],
      "return": {
        "type": "ListAvailableSystemStatsResponse",
        "description": "The <see cref=\"T:PicMeApi.ListAvailableSystemStatsResponse\" /> containing the response."
      }
    },
    {
      "name": "ListResponsibleUserDownloadRecords",
      "httpMethod": "GET",
      "httpPathRegex": "^/downloads",
      "subPathPattern": "/downloads",
      "summary": "Lists raw download records that the specified user is responsible for (the party billed/quota-enforced for the download), for administrative/migration export. Root administrators only.\n            Downloads are read responsible-user-first via the <see cref=\"P:PicMeLogic.Download.RDAC\" /> index, mirroring how download usage is enforced.",
      "parameters": [
        {
          "name": "responsibleUserId",
          "required": true,
          "type": "UserId",
          "description": "The <see cref=\"T:AmbientServices.UserId\" /> of the responsible party whose download records are wanted."
        },
        {
          "name": "start",
          "required": false,
          "type": "DateTime?",
          "description": "The inclusive start of the date range; defaults to two years before now (the oldest the index retains)."
        },
        {
          "name": "end",
          "required": false,
          "type": "DateTime?",
          "description": "The exclusive end of the date range; defaults to one day in the future so just-recorded current-period downloads are always included."
        }
      ],
      "return": {
        "type": "ListAdminDownloadsResponse",
        "description": "A <see cref=\"T:PicMeApi.ListAdminDownloadsResponse\" /> containing one <see cref=\"T:PicMeApi.AdminDownloadRecord\" /> per download, with every attribute."
      }
    },
    {
      "name": "GetUserAuthExport",
      "httpMethod": "GET",
      "httpPathRegex": "^/user-auth",
      "subPathPattern": "/user-auth",
      "summary": "Exports the raw authentication credentials for a single user — SSO external identities, the password hash, and the MFA secret — for migration. Root administrators only.\n            This is the only path that returns the unmasked MFA secret and the password hash; every other API masks or omits them. The data is never exposed to anyone but a root administrator.",
      "parameters": [
        {
          "name": "userId",
          "required": true,
          "type": "UserId",
          "description": "The <see cref=\"T:AmbientServices.UserId\" /> whose credentials are wanted."
        }
      ],
      "return": {
        "type": "GetUserAuthExportResponse",
        "description": "A <see cref=\"T:PicMeApi.GetUserAuthExportResponse\" /> containing the user's SSO identities, password credential, and MFA configuration."
      }
    },
    {
      "name": "SendExecutiveSummaryEmail",
      "httpMethod": "GET",
      "httpPathRegex": "^/exec-sum",
      "subPathPattern": "/exec-sum",
      "summary": "Sends the executive summary email on demand. Root administrators only.",
      "parameters": [
        {
          "name": "recipientAddress",
          "required": false,
          "type": "String?",
          "description": "Address to send to; if omitted, sends to all standard admin addresses."
        }
      ],
      "return": {
        "type": "SendExecutiveSummaryEmailResponse",
        "description": "A <see cref=\"T:PicMeApi.SendExecutiveSummaryEmailResponse\" />."
      }
    }
  ],
  "types": [
    {
      "name": "GetSystemStatsResponse",
      "summary": "A record containing the response from <see cref=\"M:PicMeApi.AdministrativeApis.GetSystemDashboard(AmbientServices.Database,AmbientServices.IFileSystem,System.String[],System.Nullable{System.DateOnly},System.Nullable{System.DateOnly})\" />.",
      "type": "composite",
      "members": [
        {
          "name": "rangeInfo",
          "type": "StatsRangeInfo",
          "summary": "The <see cref=\"T:AmbientServices.StatsRangeInfo\" /> containing information about the range of statistics returned."
        },
        {
          "name": "stats",
          "type": "StatInfo[]",
          "summary": "An array of <see cref=\"T:AmbientServices.StatInfo\" /> containing the statistics samples for each requested statistic."
        }
      ]
    },
    {
      "name": "StatInfo",
      "type": "composite",
      "members": [
        {
          "name": "id",
          "type": "String"
        },
        {
          "name": "name",
          "type": "String"
        },
        {
          "name": "description",
          "type": "String"
        },
        {
          "name": "units",
          "type": "String?"
        },
        {
          "name": "fixedFloatingPointAdjustment",
          "type": "Double"
        },
        {
          "name": "preferredTemporalAggregationType",
          "type": "AggregationTypes"
        },
        {
          "name": "samples",
          "type": "Int32[]"
        }
      ]
    },
    {
      "name": "AggregationTypes",
      "type": "enum",
      "flags": true,
      "enumValues": [
        {
          "name": "None",
          "value": 0
        },
        {
          "name": "Sum",
          "value": 1
        },
        {
          "name": "Average",
          "value": 2
        },
        {
          "name": "Min",
          "value": 4
        },
        {
          "name": "Max",
          "value": 8
        },
        {
          "name": "MostRecent",
          "value": 16
        }
      ]
    },
    {
      "name": "StatsRangeInfo",
      "type": "composite",
      "members": [
        {
          "name": "start",
          "type": "DateTime"
        },
        {
          "name": "end",
          "type": "DateTime"
        },
        {
          "name": "durationPerSample",
          "type": "TimeSpan"
        }
      ]
    },
    {
      "name": "UserId",
      "summary": "A struct that holds a user identifier.",
      "description": "<pitch>Compact, URL-safe user identifier; use as the key for user-scoped database records and as a <see cref=\"T:AmbientServices.DataScope\" /> to partition records per-user.</pitch>\n<pledge>May not contain slashes or backslashes; <see cref=\"P:AmbientServices.UserId.Anonymous\" /> is the empty-string sentinel for unauthenticated users; <see cref=\"M:AmbientServices.UserId.New\" /> generates a globally unique ID from <see cref=\"T:AmbientServices.GenericIdentifier\" />.</pledge>",
      "type": "proxy",
      "representedBy": "String"
    },
    {
      "name": "ListReferralLinksResponse",
      "summary": "Response for <see cref=\"M:PicMeApi.AdministrativeApis.ListReferralLinks(AmbientServices.Auth,AmbientServices.Database,PicMeApi.AuthData,System.Nullable{AmbientServices.UserId})\" />.",
      "type": "composite",
      "members": [
        {
          "name": "referrals",
          "type": "ReferralLinkRecord[]",
          "summary": "An array of <see cref=\"T:PicMeApi.ReferralLinkRecord\" />, one per referral link."
        }
      ]
    },
    {
      "name": "ReferralLinkRecord",
      "summary": "A raw referral relationship exported for migration: a single directed referral link from a referrer to a referred user.",
      "type": "composite",
      "members": [
        {
          "name": "referrerUserId",
          "type": "UserId",
          "summary": "The <see cref=\"T:AmbientServices.UserId\" /> of the user who made the referral."
        },
        {
          "name": "referredUserId",
          "type": "UserId",
          "summary": "The <see cref=\"T:AmbientServices.UserId\" /> of the user who was referred."
        },
        {
          "name": "type",
          "type": "ReferralType",
          "summary": "The <see cref=\"T:AmbientServices.ReferralType\" /> qualifying the referral."
        },
        {
          "name": "linkDate",
          "type": "DateTime",
          "summary": "The <see cref=\"T:System.DateTime\" /> (UTC) when the referral link was created."
        }
      ]
    },
    {
      "name": "ReferralType",
      "summary": "An enumeration of type of referrals.",
      "description": "<pitch>Qualifies the <see cref=\"P:AmbientServices.AuthLinkRelationshipTypes.ReferralLinkType\" /> link relationship; currently only <see cref=\"F:AmbientServices.ReferralType.Normal\" /> is defined.</pitch>",
      "type": "enum",
      "flags": false,
      "enumValues": [
        {
          "name": "Normal",
          "summary": "The referral is a normal referral (no other types yet).",
          "value": 0
        }
      ]
    },
    {
      "name": "GetServerStatsResponse",
      "summary": "A record containing the response from <see cref=\"M:PicMeApi.AdministrativeApis.GetServerStats(AmbientServices.IFileSystem,System.String[])\" />."
    },
    {
      "name": "ListAvailableSystemStatsResponse",
      "summary": "A record containing the response from <see cref=\"M:PicMeApi.AdministrativeApis.ListAvailableSystemStats(AmbientServices.IFileSystem)\" />.",
      "type": "composite",
      "members": [
        {
          "name": "availableStats",
          "type": "Statistic[]",
          "summary": "An array of system statistics available to be queried using <see cref=\"M:PicMeApi.AdministrativeApis.GetSystemDashboard(AmbientServices.Database,AmbientServices.IFileSystem,System.String[],System.Nullable{System.DateOnly},System.Nullable{System.DateOnly})\" />."
        }
      ]
    },
    {
      "name": "Statistic",
      "summary": "Represents a system statistic with a name and a unique identifier.",
      "type": "composite",
      "members": [
        {
          "name": "id",
          "type": "String",
          "summary": "The unique identifier for the system statistic. Cannot be null."
        },
        {
          "name": "name",
          "type": "String",
          "summary": "The display name of the system statistic. Cannot be null."
        }
      ]
    },
    {
      "name": "ListAdminDownloadsResponse",
      "summary": "Response for <see cref=\"M:PicMeApi.AdministrativeApis.ListResponsibleUserDownloadRecords(AmbientServices.Database,PicMeApi.AuthData,AmbientServices.UserId,System.Nullable{System.DateTime},System.Nullable{System.DateTime})\" />.",
      "type": "composite",
      "members": [
        {
          "name": "records",
          "type": "AdminDownloadRecord[]",
          "summary": "An array of <see cref=\"T:PicMeApi.AdminDownloadRecord\" />, one per download."
        }
      ]
    },
    {
      "name": "AdminDownloadRecord",
      "summary": "A raw download record exported for migration, exposing every attribute of the underlying <see cref=\"T:PicMeLogic.Download\" /> MISO record.",
      "type": "composite",
      "members": [
        {
          "name": "time",
          "type": "DateTime",
          "summary": "The <see cref=\"T:System.DateTime\" /> (UTC, minute resolution) the download occurred."
        },
        {
          "name": "collectionId",
          "type": "CollectionId",
          "summary": "The <see cref=\"P:PicMeApi.AdminDownloadRecord.CollectionId\" /> downloaded from."
        },
        {
          "name": "responsiblePartyUserId",
          "type": "UserId",
          "summary": "The <see cref=\"T:AmbientServices.UserId\" /> of the party billed/quota-enforced for the download."
        },
        {
          "name": "actualDownloaderUserId",
          "type": "UserId?",
          "summary": "The <see cref=\"T:AmbientServices.UserId\" /> of the actual downloader, or null when it is the responsible party."
        },
        {
          "name": "type",
          "type": "TrackedDownloadType",
          "summary": "The <see cref=\"T:PicMeLogic.TrackedDownloadType\" /> of the download."
        },
        {
          "name": "bytes",
          "type": "Int64",
          "summary": "The number of bytes downloaded."
        },
        {
          "name": "uploadId",
          "type": "UploadId?",
          "summary": "The <see cref=\"P:PicMeApi.AdminDownloadRecord.UploadId\" /> downloaded, or null when the download was a zip package."
        }
      ]
    },
    {
      "name": "UploadId",
      "summary": "A struct that holds a PicMe upload id.  A collection id is required for this to uniquely identify a upload.",
      "description": "<pitch>Typed upload identifier that encodes the MIME type, timestamp, and optional uploader metadata into a sortable string, with factory methods and local-record-path conversion.</pitch>",
      "type": "proxy",
      "representedBy": "String"
    },
    {
      "name": "TrackedDownloadType",
      "summary": "An enumeration of tracked download types.",
      "type": "enum",
      "flags": false,
      "enumValues": [
        {
          "name": "Thumbnail",
          "summary": "The thumbnail was downloaded (probably not tracked).",
          "value": 0
        },
        {
          "name": "View",
          "summary": "The view was downloaded (probably tracked).",
          "value": 1
        },
        {
          "name": "Details",
          "summary": "The original was downloaded (definitely tracked).",
          "value": 2
        },
        {
          "name": "Zip",
          "summary": "A zip was downloaded (definitely tracked).",
          "value": 3
        }
      ]
    },
    {
      "name": "CollectionId",
      "summary": "A struct that holds a PicMe collection id.",
      "description": "<pitch>Typed wrapper around a PicMe collection identifier string, with factory methods, <see cref=\"T:AmbientServices.DataScope\" /> integration, and a stable ELF hash for sharding.</pitch>",
      "type": "proxy",
      "representedBy": "String"
    },
    {
      "name": "GetUserAuthExportResponse",
      "summary": "Response for <see cref=\"M:PicMeApi.AdministrativeApis.GetUserAuthExport(AmbientServices.Auth,PicMeApi.AuthData,AmbientServices.UserId)\" />: a single user's complete authentication credentials for migration. Root-administrator export only.",
      "type": "composite",
      "members": [
        {
          "name": "userId",
          "type": "UserId",
          "summary": "The <see cref=\"P:PicMeApi.GetUserAuthExportResponse.UserId\" /> the credentials belong to."
        },
        {
          "name": "externalIds",
          "type": "ExternalEntityIdentifier[]",
          "summary": "The user's SSO external identities (empty when the user has none)."
        },
        {
          "name": "password",
          "type": "UserPasswordExport?",
          "summary": "The user's password credential, or null when the account has no password (e.g. SSO-only)."
        },
        {
          "name": "mfa",
          "type": "UserMfaExport?",
          "summary": "The user's MFA configuration, or null when MFA is not configured."
        }
      ]
    },
    {
      "name": "UserMfaExport",
      "summary": "A user's raw MFA configuration exported for migration, including the unmasked TOTP secret. Root-administrator export only — never expose this to anyone else.",
      "type": "composite",
      "members": [
        {
          "name": "delivery",
          "type": "MfaDelivery",
          "summary": "The <see cref=\"T:AmbientServices.MfaDelivery\" /> channel."
        },
        {
          "name": "encryption",
          "type": "TotpEncryptionType",
          "summary": "The <see cref=\"T:AmbientServices.TotpEncryptionType\" /> used to generate codes."
        },
        {
          "name": "requiredDigits",
          "type": "Int32",
          "summary": "The number of digits required for a code."
        },
        {
          "name": "secret",
          "type": "String",
          "summary": "The unmasked BASE32 TOTP secret."
        },
        {
          "name": "sendButDontRequire",
          "type": "Boolean",
          "summary": "Whether the MFA record is still provisional (set during setup until a verification round-trip completes)."
        },
        {
          "name": "createdDate",
          "type": "DateTime",
          "summary": "When the MFA record was created (UTC)."
        },
        {
          "name": "modifiedDate",
          "type": "DateTime",
          "summary": "When the MFA record was last modified (UTC)."
        }
      ]
    },
    {
      "name": "TotpEncryptionType",
      "summary": "An enumeration of TOTP encryption types.",
      "description": "<pitch>Selects the HMAC algorithm used by <see cref=\"T:AmbientServices.Totp\" />; SHA1 is still the only algorithm supported by most authenticator apps.</pitch>",
      "type": "enum",
      "flags": false,
      "enumValues": [
        {
          "name": "SHA1",
          "summary": "SHA1 encryption type (still the only one supported by Microsoft Authenticator).",
          "value": 0
        },
        {
          "name": "SHA256",
          "summary": "SHA256 encryption type.",
          "value": 1
        },
        {
          "name": "SHA512",
          "summary": "SHA512 encryption type.",
          "value": 2
        }
      ]
    },
    {
      "name": "MfaDelivery",
      "summary": "An enumeration of ways to deliver MFA tokens to users.",
      "description": "<pitch>Selects the out-of-band channel used to deliver TOTP codes for multi-factor authentication; <see cref=\"F:AmbientServices.MfaDelivery.None\" /> means the user supplies their own token app or hardware key.</pitch>",
      "type": "enum",
      "flags": false,
      "enumValues": [
        {
          "name": "None",
          "summary": "There is no delivery (ie. the user has a way to generate tokens such as a hardware key, an MFA app, a password manager, etc.)",
          "value": 0
        },
        {
          "name": "Email",
          "summary": "The MFA token should be delivered by email.",
          "value": 1
        },
        {
          "name": "Sms",
          "summary": "The MFA token should be delivered by SMS text message.",
          "value": 2
        }
      ]
    },
    {
      "name": "UserPasswordExport",
      "summary": "A user's raw password credential exported for migration. Root-administrator export only — never expose this to anyone else.",
      "type": "composite",
      "members": [
        {
          "name": "algorithm",
          "type": "PasswordHashAlgorithm",
          "summary": "The <see cref=\"T:AmbientServices.PasswordHashAlgorithm\" /> that produced <paramref name=\"Hash\" />."
        },
        {
          "name": "hash",
          "type": "String",
          "summary": "The stored password hash (e.g. the BCrypt hash)."
        }
      ]
    },
    {
      "name": "PasswordHashAlgorithm",
      "summary": "An enumeration of password hash algorithms.",
      "description": "<pitch>Tags which hashing algorithm produced a stored password hash so the verifier can apply the correct algorithm without probing.</pitch>",
      "type": "enum",
      "flags": false,
      "enumValues": [
        {
          "name": "None",
          "summary": "No password hash algorithm has been used (because a password does not exist).",
          "value": 0
        },
        {
          "name": "BCrypt",
          "summary": "The associated hash comes from the BCrypt algorithm with a time-adjusted work factor.",
          "value": 1
        }
      ]
    },
    {
      "name": "ExternalEntityIdentifier",
      "summary": "A record that contains an external system identifier and an identifier for a specific item in that system.",
      "description": "<pitch>Opaque cross-system reference pairing a system name (e.g. \"com.facebook\") with a system-specific item ID; used to link database records to their counterparts in external platforms.</pitch>",
      "type": "composite",
      "members": [
        {
          "name": "externalSystemId",
          "type": "String",
          "summary": "A string that uniquely identifies an external system, often a reverse domain name like 'com.facebook' or 'com.venmo'."
        },
        {
          "name": "externalItemId",
          "type": "String",
          "summary": "A string that uniquely identifies an item in that external system."
        }
      ]
    },
    {
      "name": "SendExecutiveSummaryEmailResponse",
      "summary": "Response for <see cref=\"M:PicMeApi.AdministrativeApis.SendExecutiveSummaryEmail(AmbientServices.Auth,AmbientServices.Database,AmbientServices.IFileSystem,AmbientServices.IMail,PicMeApi.AuthData,System.String)\" />."
    }
  ]
}