postman_collection.json

{
  "auth": {
    "bearer": [
      {
        "key": "token",
        "type": "string",
        "value": "{{apiKey}}"
      }
    ],
    "type": "bearer"
  },
  "info": {
    "description": "## Fast start\n\nRun the first public demo for a real unmetered result. Then request a key, paste the emailed token into `claimToken`, and claim once; the claim test stores `apiKey` and clears `claimToken` locally. Saved 200 examples are produced by a pinned local execution of the same engine.\n\n## Errors\n\n`401` means a missing, invalid, or revoked API key. The service uses `400 invalid_request`, not 422. On `429`, branch on `error.code`, honor `Retry-After`, and back off. Every committed secret-bearing variable is empty.",
    "name": "Regulation to Control API",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "event": [
        {
          "listen": "test",
          "script": {
            "exec": [
              "pm.test('customer-ready demo contract', function () {",
              "  pm.response.to.have.status(200);",
              "  const b = pm.response.json();",
              "  pm.expect(b.change.summary.obligations).to.eql(3);",
              "  pm.expect(b.change.summary.gaps).to.eql(1);",
              "  pm.expect(b.notice).to.include('not legal advice');",
              "});"
            ],
            "type": "text/javascript"
          }
        }
      ],
      "name": "Public demo — map one change with no API key",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"controls\": [\n    {\n      \"controlId\": \"CTL-014\",\n      \"name\": \"Consumer disclosure template review\",\n      \"owner\": \"Payments Compliance\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"payments\",\n        \"disclosure\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2026-07-01T00:00:00Z\",\n      \"testFrequencyDays\": 180,\n      \"evidence\": [\n        {\n          \"kind\": \"policy_document\",\n          \"artifactId\": \"POL-221\",\n          \"collectedAt\": \"2026-07-02T00:00:00Z\"\n        },\n        {\n          \"kind\": \"notification_record\",\n          \"artifactId\": \"NR-9930\",\n          \"collectedAt\": \"2026-07-14T00:00:00Z\"\n        }\n      ]\n    },\n    {\n      \"controlId\": \"CTL-027\",\n      \"name\": \"Fee change customer notification job\",\n      \"owner\": \"Payments Engineering\",\n      \"status\": \"planned\",\n      \"tags\": [\n        \"payments\",\n        \"notification\",\n        \"us\"\n      ],\n      \"testFrequencyDays\": 90\n    },\n    {\n      \"controlId\": \"CTL-101\",\n      \"name\": \"Account record retention schedule\",\n      \"owner\": \"Records Management\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"recordkeeping\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2024-02-01T00:00:00Z\",\n      \"evidence\": [\n        {\n          \"kind\": \"retention_schedule\",\n          \"artifactId\": \"RS-04\",\n          \"collectedAt\": \"2024-02-01T00:00:00Z\"\n        }\n      ]\n    }\n  ],\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00Z\",\n    \"currency\": \"USD\",\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 500000000\n      },\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"appliesTo\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"supervisory\"\n      }\n    ]\n  }\n}"
        },
        "description": "Run first. The first useful result is the deny-by-default coverage summary: one obligation is covered, one is weak, and one has no matching control. The highest priority is critical and every graph edge states why it exists. Nothing is stored or metered; the payload is synthetic.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "demo",
            "map"
          ],
          "raw": "{{baseUrl}}/v1/demo/map"
        }
      },
      "response": [
        {
          "_postman_previewlanguage": "json",
          "body": "{\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00.000Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00.000Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00.000Z\",\n    \"evidenceCutoff\": \"2026-03-02T00:00:00.000Z\",\n    \"evaluatedAt\": \"2026-09-06T20:30:00.000Z\",\n    \"summary\": {\n      \"obligations\": 3,\n      \"covered\": 1,\n      \"weak\": 1,\n      \"gaps\": 1,\n      \"controlsMatched\": 2,\n      \"controlsUnmatched\": 1,\n      \"teams\": 2,\n      \"highestPriority\": \"critical\",\n      \"earliestDeadline\": \"2026-09-01T00:00:00.000Z\",\n      \"passedDeadlines\": 3,\n      \"unmetEvidenceKinds\": 4\n    },\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"enforcement\": \"penalty\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"coverage\": \"weak\",\n        \"coverageReason\": \"1 control(s) match on (payments, notification), but none of them is currently operating and 2 required evidence kind(s) are not held. See findings.\",\n        \"matchedControls\": [\n          {\n            \"controlId\": \"CTL-027\",\n            \"name\": \"Fee change customer notification job\",\n            \"owner\": \"Payments Engineering\",\n            \"status\": \"planned\",\n            \"matchedTags\": [\n              \"payments\",\n              \"notification\"\n            ],\n            \"lastTestedAt\": null,\n            \"daysSinceTest\": null,\n            \"testFrequencyDays\": 90,\n            \"operating\": false,\n            \"issues\": [\n              \"control_not_implemented\",\n              \"control_untested\"\n            ]\n          }\n        ],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"notification_record\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          },\n          {\n            \"kind\": \"policy_document\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          }\n        ],\n        \"findings\": [\n          {\n            \"code\": \"control_not_implemented\",\n            \"controlId\": \"CTL-027\",\n            \"detail\": \"Control CTL-027 (\\\"Fee change customer notification job\\\") is planned, so it is not operating yet.\"\n          },\n          {\n            \"code\": \"control_untested\",\n            \"controlId\": \"CTL-027\",\n            \"detail\": \"Control CTL-027 has no recorded test date, so there is nothing to show an auditor that it works.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"notification_record\\\", which this obligation requires.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"policy_document\\\", which this obligation requires.\"\n          }\n        ],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-10T00:00:00.000Z\",\n            \"daysRemaining\": 65,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-10 to be ready for 2026-12-01: a notification obligation is allowed 21 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 78,\n          \"band\": \"critical\",\n          \"components\": {\n            \"enforcement\": 40,\n            \"coverage\": 18,\n            \"urgency\": 10,\n            \"evidence\": 10\n          },\n          \"derivation\": [\n            \"enforcement = penalty -> 40\",\n            \"coverage = weak -> 18\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 2 of 2 required kind(s) unmet -> 10\",\n            \"total = 40 + 18 + 10 + 10 = 78 -> critical\"\n          ]\n        },\n        \"owners\": [\n          \"Payments Engineering\"\n        ],\n        \"exposureMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"enforcement\": \"supervisory\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"coverage\": \"gap\",\n        \"coverageReason\": \"Nothing in the inventory carries all of (recordkeeping, disclosure), so this obligation is unmapped. Deny by default: an unmatched obligation is a gap, never an assumption of coverage.\",\n        \"matchedControls\": [],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"retention_schedule\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          },\n          {\n            \"kind\": \"audit_log\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          }\n        ],\n        \"findings\": [\n          {\n            \"code\": \"no_control_mapped\",\n            \"detail\": \"No control in the inventory carries every tag this obligation requires (recordkeeping, disclosure). An unmatched obligation is a gap; it is never assumed covered.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"retention_schedule\\\", which this obligation requires.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"audit_log\\\", which this obligation requires.\"\n          }\n        ],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-01T00:00:00.000Z\",\n            \"daysRemaining\": 56,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-01 to be ready for 2026-12-01: a recordkeeping obligation is allowed 30 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 75,\n          \"band\": \"critical\",\n          \"components\": {\n            \"enforcement\": 25,\n            \"coverage\": 30,\n            \"urgency\": 10,\n            \"evidence\": 10\n          },\n          \"derivation\": [\n            \"enforcement = supervisory -> 25\",\n            \"coverage = gap -> 30\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 2 of 2 required kind(s) unmet -> 10\",\n            \"total = 25 + 30 + 10 + 10 = 75 -> critical\"\n          ]\n        },\n        \"owners\": [],\n        \"exposureMinor\": 0\n      },\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"enforcement\": \"penalty\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"coverage\": \"covered\",\n        \"coverageReason\": \"Control CTL-014 (\\\"Consumer disclosure template review\\\") matches on (payments, disclosure), is implemented and was tested 67 day(s) ago against a 180-day frequency, and every required evidence kind is held.\",\n        \"matchedControls\": [\n          {\n            \"controlId\": \"CTL-014\",\n            \"name\": \"Consumer disclosure template review\",\n            \"owner\": \"Payments Compliance\",\n            \"status\": \"implemented\",\n            \"matchedTags\": [\n              \"payments\",\n              \"disclosure\"\n            ],\n            \"lastTestedAt\": \"2026-07-01T00:00:00.000Z\",\n            \"daysSinceTest\": 67,\n            \"testFrequencyDays\": 180,\n            \"operating\": true,\n            \"issues\": []\n          }\n        ],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"policy_document\",\n            \"satisfied\": true,\n            \"satisfiedBy\": \"CTL-014\",\n            \"artifactId\": \"POL-221\",\n            \"collectedAt\": \"2026-07-02T00:00:00.000Z\"\n          },\n          {\n            \"kind\": \"notification_record\",\n            \"satisfied\": true,\n            \"satisfiedBy\": \"CTL-014\",\n            \"artifactId\": \"NR-9930\",\n            \"collectedAt\": \"2026-07-14T00:00:00.000Z\"\n          }\n        ],\n        \"findings\": [],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-01T00:00:00.000Z\",\n            \"daysRemaining\": 56,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-01 to be ready for 2026-12-01: a disclosure obligation is allowed 30 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 50,\n          \"band\": \"high\",\n          \"components\": {\n            \"enforcement\": 40,\n            \"coverage\": 0,\n            \"urgency\": 10,\n            \"evidence\": 0\n          },\n          \"derivation\": [\n            \"enforcement = penalty -> 40\",\n            \"coverage = covered -> 0\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 0 of 2 required kind(s) unmet -> 0\",\n            \"total = 40 + 0 + 10 + 0 = 50 -> high\"\n          ]\n        },\n        \"owners\": [\n          \"Payments Compliance\"\n        ],\n        \"exposureMinor\": 0\n      }\n    ],\n    \"graph\": {\n      \"nodes\": [\n        {\n          \"id\": \"change:REG-2026-0117\",\n          \"type\": \"change\",\n          \"label\": \"12 CFR 1026.19(e)\",\n          \"attributes\": {\n            \"citation\": \"12 CFR 1026.19(e)\",\n            \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n            \"jurisdiction\": \"US\",\n            \"changeType\": \"amendment\",\n            \"publishedAt\": \"2026-03-02\",\n            \"effectiveAt\": \"2026-09-01\",\n            \"obligations\": 3,\n            \"regulator\": \"CFPB\"\n          }\n        },\n        {\n          \"id\": \"obligation:OB-1\",\n          \"type\": \"obligation\",\n          \"label\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n          \"attributes\": {\n            \"obligationType\": \"disclosure\",\n            \"enforcement\": \"penalty\",\n            \"coverage\": \"covered\",\n            \"priority\": \"high\",\n            \"score\": 50,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"obligation:OB-2\",\n          \"type\": \"obligation\",\n          \"label\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n          \"attributes\": {\n            \"obligationType\": \"notification\",\n            \"enforcement\": \"penalty\",\n            \"coverage\": \"weak\",\n            \"priority\": \"critical\",\n            \"score\": 78,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"obligation:OB-3\",\n          \"type\": \"obligation\",\n          \"label\": \"Retain each issued disclosure for five years and produce it on request.\",\n          \"attributes\": {\n            \"obligationType\": \"recordkeeping\",\n            \"enforcement\": \"supervisory\",\n            \"coverage\": \"gap\",\n            \"priority\": \"critical\",\n            \"score\": 75,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"control:CTL-014\",\n          \"type\": \"control\",\n          \"label\": \"Consumer disclosure template review\",\n          \"attributes\": {\n            \"status\": \"implemented\",\n            \"operating\": true,\n            \"testFrequencyDays\": 180,\n            \"lastTestedAt\": \"2026-07-01\",\n            \"owner\": \"Payments Compliance\"\n          }\n        },\n        {\n          \"id\": \"control:CTL-027\",\n          \"type\": \"control\",\n          \"label\": \"Fee change customer notification job\",\n          \"attributes\": {\n            \"status\": \"planned\",\n            \"operating\": false,\n            \"testFrequencyDays\": 90,\n            \"owner\": \"Payments Engineering\"\n          }\n        },\n        {\n          \"id\": \"team:Payments Compliance\",\n          \"type\": \"team\",\n          \"label\": \"Payments Compliance\",\n          \"attributes\": {\n            \"name\": \"Payments Compliance\"\n          }\n        },\n        {\n          \"id\": \"team:Payments Engineering\",\n          \"type\": \"team\",\n          \"label\": \"Payments Engineering\",\n          \"attributes\": {\n            \"name\": \"Payments Engineering\"\n          }\n        },\n        {\n          \"id\": \"evidence:audit_log\",\n          \"type\": \"evidence\",\n          \"label\": \"audit_log\",\n          \"attributes\": {\n            \"kind\": \"audit_log\"\n          }\n        },\n        {\n          \"id\": \"evidence:notification_record\",\n          \"type\": \"evidence\",\n          \"label\": \"notification_record\",\n          \"attributes\": {\n            \"kind\": \"notification_record\"\n          }\n        },\n        {\n          \"id\": \"evidence:policy_document\",\n          \"type\": \"evidence\",\n          \"label\": \"policy_document\",\n          \"attributes\": {\n            \"kind\": \"policy_document\"\n          }\n        },\n        {\n          \"id\": \"evidence:retention_schedule\",\n          \"type\": \"evidence\",\n          \"label\": \"retention_schedule\",\n          \"attributes\": {\n            \"kind\": \"retention_schedule\"\n          }\n        }\n      ],\n      \"edges\": [\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-1\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this disclosure obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-2\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this notification obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-3\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this recordkeeping obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"control:CTL-014\",\n          \"kind\": \"mapped_to\",\n          \"reason\": \"Control CTL-014 carries every tag this obligation requires (payments, disclosure). Matching is a set rule over tags, not a similarity score.\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"control:CTL-027\",\n          \"kind\": \"mapped_to\",\n          \"reason\": \"Control CTL-027 carries every tag this obligation requires (payments, notification). Matching is a set rule over tags, not a similarity score; the control is not currently operating (control_not_implemented, control_untested).\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"team:Payments Compliance\",\n          \"kind\": \"owned_by\",\n          \"reason\": \"Control CTL-014 names Payments Compliance as its owning team, so work arising from this change routes there.\"\n        },\n        {\n          \"from\": \"control:CTL-027\",\n          \"to\": \"team:Payments Engineering\",\n          \"kind\": \"owned_by\",\n          \"reason\": \"Control CTL-027 names Payments Engineering as its owning team, so work arising from this change routes there.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-1 requires \\\"notification_record\\\"; it is held by control CTL-014.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-1 requires \\\"policy_document\\\"; it is held by control CTL-014.\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-2 requires \\\"notification_record\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-2 requires \\\"policy_document\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-3\",\n          \"to\": \"evidence:audit_log\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-3 requires \\\"audit_log\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-3\",\n          \"to\": \"evidence:retention_schedule\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-3 requires \\\"retention_schedule\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"evidenced_by\",\n          \"reason\": \"Control CTL-014 holds \\\"notification_record\\\" (NR-9930), collected 2026-07-14.\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"evidenced_by\",\n          \"reason\": \"Control CTL-014 holds \\\"policy_document\\\" (POL-221), collected 2026-07-02.\"\n        }\n      ]\n    },\n    \"unmatchedControls\": [\n      \"CTL-101\"\n    ],\n    \"exposure\": {\n      \"currency\": \"USD\",\n      \"totalMinor\": 250000000,\n      \"byOwner\": [\n        {\n          \"owner\": \"Payments Engineering\",\n          \"amountMinor\": 250000000\n        }\n      ],\n      \"unassignedMinor\": 0\n    },\n    \"warnings\": []\n  },\n  \"dueSoonWindowDays\": 30,\n  \"notice\": \"This is arithmetic and graph mapping over inputs you supply. It does not read, interpret or apply law, and it is not legal advice.\",\n  \"requestId\": \"req_example\"\n}",
          "code": 200,
          "cookie": [],
          "header": [
            {
              "key": "Content-Type",
              "value": "application/json"
            }
          ],
          "name": "200 — first useful result",
          "originalRequest": {
            "auth": {
              "type": "noauth"
            },
            "body": {
              "mode": "raw",
              "options": {
                "raw": {
                  "language": "json"
                }
              },
              "raw": "{\n  \"controls\": [\n    {\n      \"controlId\": \"CTL-014\",\n      \"name\": \"Consumer disclosure template review\",\n      \"owner\": \"Payments Compliance\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"payments\",\n        \"disclosure\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2026-07-01T00:00:00Z\",\n      \"testFrequencyDays\": 180,\n      \"evidence\": [\n        {\n          \"kind\": \"policy_document\",\n          \"artifactId\": \"POL-221\",\n          \"collectedAt\": \"2026-07-02T00:00:00Z\"\n        },\n        {\n          \"kind\": \"notification_record\",\n          \"artifactId\": \"NR-9930\",\n          \"collectedAt\": \"2026-07-14T00:00:00Z\"\n        }\n      ]\n    },\n    {\n      \"controlId\": \"CTL-027\",\n      \"name\": \"Fee change customer notification job\",\n      \"owner\": \"Payments Engineering\",\n      \"status\": \"planned\",\n      \"tags\": [\n        \"payments\",\n        \"notification\",\n        \"us\"\n      ],\n      \"testFrequencyDays\": 90\n    },\n    {\n      \"controlId\": \"CTL-101\",\n      \"name\": \"Account record retention schedule\",\n      \"owner\": \"Records Management\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"recordkeeping\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2024-02-01T00:00:00Z\",\n      \"evidence\": [\n        {\n          \"kind\": \"retention_schedule\",\n          \"artifactId\": \"RS-04\",\n          \"collectedAt\": \"2024-02-01T00:00:00Z\"\n        }\n      ]\n    }\n  ],\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00Z\",\n    \"currency\": \"USD\",\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 500000000\n      },\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"appliesTo\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"supervisory\"\n      }\n    ]\n  }\n}"
            },
            "description": "Run first. The first useful result is the deny-by-default coverage summary: one obligation is covered, one is weak, and one has no matching control. The highest priority is critical and every graph edge states why it exists. Nothing is stored or metered; the payload is synthetic.",
            "header": [
              {
                "key": "content-type",
                "value": "application/json"
              }
            ],
            "method": "POST",
            "url": {
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "v1",
                "demo",
                "map"
              ],
              "raw": "{{baseUrl}}/v1/demo/map"
            }
          },
          "status": "OK"
        }
      ]
    },
    {
      "name": "Request a free sandbox API key (sends a verification email)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"email\": \"you@example.com\",\n  \"name\": \"postman\",\n  \"source\": {\n    \"source\": \"postman\",\n    \"medium\": \"collection\",\n    \"campaign\": \"controlgraph-postman\",\n    \"content\": \"public-collection\"\n  }\n}"
        },
        "description": "Returns 202 and emails a one-time claim token; it never returns an API key. The source tuple is the exact Postman attribution for this collection.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys"
          ],
          "raw": "{{baseUrl}}/v1/keys"
        }
      }
    },
    {
      "event": [
        {
          "listen": "test",
          "script": {
            "exec": [
              "if (pm.response.code === 201) {",
              "  const b = pm.response.json();",
              "  pm.collectionVariables.set('apiKey', b.apiKey);",
              "  pm.collectionVariables.set('keyId', b.keyId);",
              "  pm.collectionVariables.set('claimToken', '');",
              "}"
            ],
            "type": "text/javascript"
          }
        }
      ],
      "name": "Exchange an emailed claim token for the API key",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"token\": \"{{claimToken}}\"\n}"
        },
        "description": "Paste the emailed token into claimToken and run once. On 201, this test stores apiKey/keyId locally and clears claimToken.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "claim"
          ],
          "raw": "{{baseUrl}}/v1/keys/claim"
        }
      }
    },
    {
      "name": "Map regulatory changes onto your obligations, controls, evidence and deadlines",
      "request": {
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"controls\": [\n    {\n      \"controlId\": \"CTL-014\",\n      \"name\": \"Consumer disclosure template review\",\n      \"owner\": \"Payments Compliance\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"payments\",\n        \"disclosure\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2026-07-01T00:00:00Z\",\n      \"testFrequencyDays\": 180,\n      \"evidence\": [\n        {\n          \"kind\": \"policy_document\",\n          \"artifactId\": \"POL-221\",\n          \"collectedAt\": \"2026-07-02T00:00:00Z\"\n        },\n        {\n          \"kind\": \"notification_record\",\n          \"artifactId\": \"NR-9930\",\n          \"collectedAt\": \"2026-07-14T00:00:00Z\"\n        }\n      ]\n    },\n    {\n      \"controlId\": \"CTL-027\",\n      \"name\": \"Fee change customer notification job\",\n      \"owner\": \"Payments Engineering\",\n      \"status\": \"planned\",\n      \"tags\": [\n        \"payments\",\n        \"notification\",\n        \"us\"\n      ],\n      \"testFrequencyDays\": 90\n    },\n    {\n      \"controlId\": \"CTL-101\",\n      \"name\": \"Account record retention schedule\",\n      \"owner\": \"Records Management\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"recordkeeping\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2024-02-01T00:00:00Z\",\n      \"evidence\": [\n        {\n          \"kind\": \"retention_schedule\",\n          \"artifactId\": \"RS-04\",\n          \"collectedAt\": \"2024-02-01T00:00:00Z\"\n        }\n      ]\n    }\n  ],\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00Z\",\n    \"currency\": \"USD\",\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 500000000\n      },\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"appliesTo\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"supervisory\"\n      }\n    ]\n  }\n}"
        },
        "description": "Authenticated primary-value call. Reuses the complete demo payload. You supply the legal interpretation, dates, obligations, tags, controls, and evidence. ControlGraph performs deterministic graph mapping; it does not read law and is not legal advice.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "changes"
          ],
          "raw": "{{baseUrl}}/v1/changes"
        }
      },
      "response": [
        {
          "_postman_previewlanguage": "json",
          "body": "{\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00.000Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00.000Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00.000Z\",\n    \"evidenceCutoff\": \"2026-03-02T00:00:00.000Z\",\n    \"evaluatedAt\": \"2026-09-06T20:30:00.000Z\",\n    \"summary\": {\n      \"obligations\": 3,\n      \"covered\": 1,\n      \"weak\": 1,\n      \"gaps\": 1,\n      \"controlsMatched\": 2,\n      \"controlsUnmatched\": 1,\n      \"teams\": 2,\n      \"highestPriority\": \"critical\",\n      \"earliestDeadline\": \"2026-09-01T00:00:00.000Z\",\n      \"passedDeadlines\": 3,\n      \"unmetEvidenceKinds\": 4\n    },\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"enforcement\": \"penalty\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"coverage\": \"weak\",\n        \"coverageReason\": \"1 control(s) match on (payments, notification), but none of them is currently operating and 2 required evidence kind(s) are not held. See findings.\",\n        \"matchedControls\": [\n          {\n            \"controlId\": \"CTL-027\",\n            \"name\": \"Fee change customer notification job\",\n            \"owner\": \"Payments Engineering\",\n            \"status\": \"planned\",\n            \"matchedTags\": [\n              \"payments\",\n              \"notification\"\n            ],\n            \"lastTestedAt\": null,\n            \"daysSinceTest\": null,\n            \"testFrequencyDays\": 90,\n            \"operating\": false,\n            \"issues\": [\n              \"control_not_implemented\",\n              \"control_untested\"\n            ]\n          }\n        ],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"notification_record\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          },\n          {\n            \"kind\": \"policy_document\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          }\n        ],\n        \"findings\": [\n          {\n            \"code\": \"control_not_implemented\",\n            \"controlId\": \"CTL-027\",\n            \"detail\": \"Control CTL-027 (\\\"Fee change customer notification job\\\") is planned, so it is not operating yet.\"\n          },\n          {\n            \"code\": \"control_untested\",\n            \"controlId\": \"CTL-027\",\n            \"detail\": \"Control CTL-027 has no recorded test date, so there is nothing to show an auditor that it works.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"notification_record\\\", which this obligation requires.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"policy_document\\\", which this obligation requires.\"\n          }\n        ],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-10T00:00:00.000Z\",\n            \"daysRemaining\": 65,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-10 to be ready for 2026-12-01: a notification obligation is allowed 21 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 78,\n          \"band\": \"critical\",\n          \"components\": {\n            \"enforcement\": 40,\n            \"coverage\": 18,\n            \"urgency\": 10,\n            \"evidence\": 10\n          },\n          \"derivation\": [\n            \"enforcement = penalty -> 40\",\n            \"coverage = weak -> 18\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 2 of 2 required kind(s) unmet -> 10\",\n            \"total = 40 + 18 + 10 + 10 = 78 -> critical\"\n          ]\n        },\n        \"owners\": [\n          \"Payments Engineering\"\n        ],\n        \"exposureMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"enforcement\": \"supervisory\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"coverage\": \"gap\",\n        \"coverageReason\": \"Nothing in the inventory carries all of (recordkeeping, disclosure), so this obligation is unmapped. Deny by default: an unmatched obligation is a gap, never an assumption of coverage.\",\n        \"matchedControls\": [],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"retention_schedule\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          },\n          {\n            \"kind\": \"audit_log\",\n            \"satisfied\": false,\n            \"reason\": \"evidence_missing\"\n          }\n        ],\n        \"findings\": [\n          {\n            \"code\": \"no_control_mapped\",\n            \"detail\": \"No control in the inventory carries every tag this obligation requires (recordkeeping, disclosure). An unmatched obligation is a gap; it is never assumed covered.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"retention_schedule\\\", which this obligation requires.\"\n          },\n          {\n            \"code\": \"evidence_missing\",\n            \"detail\": \"No matched control holds \\\"audit_log\\\", which this obligation requires.\"\n          }\n        ],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-01T00:00:00.000Z\",\n            \"daysRemaining\": 56,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-01 to be ready for 2026-12-01: a recordkeeping obligation is allowed 30 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 75,\n          \"band\": \"critical\",\n          \"components\": {\n            \"enforcement\": 25,\n            \"coverage\": 30,\n            \"urgency\": 10,\n            \"evidence\": 10\n          },\n          \"derivation\": [\n            \"enforcement = supervisory -> 25\",\n            \"coverage = gap -> 30\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 2 of 2 required kind(s) unmet -> 10\",\n            \"total = 25 + 30 + 10 + 10 = 75 -> critical\"\n          ]\n        },\n        \"owners\": [],\n        \"exposureMinor\": 0\n      },\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"enforcement\": \"penalty\",\n        \"enforcementAssumed\": false,\n        \"requiredTags\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"coverage\": \"covered\",\n        \"coverageReason\": \"Control CTL-014 (\\\"Consumer disclosure template review\\\") matches on (payments, disclosure), is implemented and was tested 67 day(s) ago against a 180-day frequency, and every required evidence kind is held.\",\n        \"matchedControls\": [\n          {\n            \"controlId\": \"CTL-014\",\n            \"name\": \"Consumer disclosure template review\",\n            \"owner\": \"Payments Compliance\",\n            \"status\": \"implemented\",\n            \"matchedTags\": [\n              \"payments\",\n              \"disclosure\"\n            ],\n            \"lastTestedAt\": \"2026-07-01T00:00:00.000Z\",\n            \"daysSinceTest\": 67,\n            \"testFrequencyDays\": 180,\n            \"operating\": true,\n            \"issues\": []\n          }\n        ],\n        \"requiredEvidence\": [\n          {\n            \"kind\": \"policy_document\",\n            \"satisfied\": true,\n            \"satisfiedBy\": \"CTL-014\",\n            \"artifactId\": \"POL-221\",\n            \"collectedAt\": \"2026-07-02T00:00:00.000Z\"\n          },\n          {\n            \"kind\": \"notification_record\",\n            \"satisfied\": true,\n            \"satisfiedBy\": \"CTL-014\",\n            \"artifactId\": \"NR-9930\",\n            \"collectedAt\": \"2026-07-14T00:00:00.000Z\"\n          }\n        ],\n        \"findings\": [],\n        \"deadlines\": [\n          {\n            \"kind\": \"effective\",\n            \"dueAt\": \"2026-09-01T00:00:00.000Z\",\n            \"daysRemaining\": -5,\n            \"status\": \"passed\",\n            \"description\": \"The change takes effect on 2026-09-01.\"\n          },\n          {\n            \"kind\": \"prepare_by\",\n            \"dueAt\": \"2026-11-01T00:00:00.000Z\",\n            \"daysRemaining\": 56,\n            \"status\": \"upcoming\",\n            \"description\": \"Work must start by 2026-11-01 to be ready for 2026-12-01: a disclosure obligation is allowed 30 day(s) of preparation.\"\n          },\n          {\n            \"kind\": \"transition_end\",\n            \"dueAt\": \"2026-12-01T00:00:00.000Z\",\n            \"daysRemaining\": 86,\n            \"status\": \"upcoming\",\n            \"description\": \"The transition period ends on 2026-12-01. This is the last day the obligation can go unmet.\"\n          }\n        ],\n        \"complianceDate\": \"2026-12-01T00:00:00.000Z\",\n        \"daysToCompliance\": 86,\n        \"priority\": {\n          \"score\": 50,\n          \"band\": \"high\",\n          \"components\": {\n            \"enforcement\": 40,\n            \"coverage\": 0,\n            \"urgency\": 10,\n            \"evidence\": 0\n          },\n          \"derivation\": [\n            \"enforcement = penalty -> 40\",\n            \"coverage = covered -> 0\",\n            \"urgency = 86 day(s) to 2026-12-01 (31–90 days) -> 10\",\n            \"evidence = 0 of 2 required kind(s) unmet -> 0\",\n            \"total = 40 + 0 + 10 + 0 = 50 -> high\"\n          ]\n        },\n        \"owners\": [\n          \"Payments Compliance\"\n        ],\n        \"exposureMinor\": 0\n      }\n    ],\n    \"graph\": {\n      \"nodes\": [\n        {\n          \"id\": \"change:REG-2026-0117\",\n          \"type\": \"change\",\n          \"label\": \"12 CFR 1026.19(e)\",\n          \"attributes\": {\n            \"citation\": \"12 CFR 1026.19(e)\",\n            \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n            \"jurisdiction\": \"US\",\n            \"changeType\": \"amendment\",\n            \"publishedAt\": \"2026-03-02\",\n            \"effectiveAt\": \"2026-09-01\",\n            \"obligations\": 3,\n            \"regulator\": \"CFPB\"\n          }\n        },\n        {\n          \"id\": \"obligation:OB-1\",\n          \"type\": \"obligation\",\n          \"label\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n          \"attributes\": {\n            \"obligationType\": \"disclosure\",\n            \"enforcement\": \"penalty\",\n            \"coverage\": \"covered\",\n            \"priority\": \"high\",\n            \"score\": 50,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"obligation:OB-2\",\n          \"type\": \"obligation\",\n          \"label\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n          \"attributes\": {\n            \"obligationType\": \"notification\",\n            \"enforcement\": \"penalty\",\n            \"coverage\": \"weak\",\n            \"priority\": \"critical\",\n            \"score\": 78,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"obligation:OB-3\",\n          \"type\": \"obligation\",\n          \"label\": \"Retain each issued disclosure for five years and produce it on request.\",\n          \"attributes\": {\n            \"obligationType\": \"recordkeeping\",\n            \"enforcement\": \"supervisory\",\n            \"coverage\": \"gap\",\n            \"priority\": \"critical\",\n            \"score\": 75,\n            \"complianceDate\": \"2026-12-01\",\n            \"daysToCompliance\": 86\n          }\n        },\n        {\n          \"id\": \"control:CTL-014\",\n          \"type\": \"control\",\n          \"label\": \"Consumer disclosure template review\",\n          \"attributes\": {\n            \"status\": \"implemented\",\n            \"operating\": true,\n            \"testFrequencyDays\": 180,\n            \"lastTestedAt\": \"2026-07-01\",\n            \"owner\": \"Payments Compliance\"\n          }\n        },\n        {\n          \"id\": \"control:CTL-027\",\n          \"type\": \"control\",\n          \"label\": \"Fee change customer notification job\",\n          \"attributes\": {\n            \"status\": \"planned\",\n            \"operating\": false,\n            \"testFrequencyDays\": 90,\n            \"owner\": \"Payments Engineering\"\n          }\n        },\n        {\n          \"id\": \"team:Payments Compliance\",\n          \"type\": \"team\",\n          \"label\": \"Payments Compliance\",\n          \"attributes\": {\n            \"name\": \"Payments Compliance\"\n          }\n        },\n        {\n          \"id\": \"team:Payments Engineering\",\n          \"type\": \"team\",\n          \"label\": \"Payments Engineering\",\n          \"attributes\": {\n            \"name\": \"Payments Engineering\"\n          }\n        },\n        {\n          \"id\": \"evidence:audit_log\",\n          \"type\": \"evidence\",\n          \"label\": \"audit_log\",\n          \"attributes\": {\n            \"kind\": \"audit_log\"\n          }\n        },\n        {\n          \"id\": \"evidence:notification_record\",\n          \"type\": \"evidence\",\n          \"label\": \"notification_record\",\n          \"attributes\": {\n            \"kind\": \"notification_record\"\n          }\n        },\n        {\n          \"id\": \"evidence:policy_document\",\n          \"type\": \"evidence\",\n          \"label\": \"policy_document\",\n          \"attributes\": {\n            \"kind\": \"policy_document\"\n          }\n        },\n        {\n          \"id\": \"evidence:retention_schedule\",\n          \"type\": \"evidence\",\n          \"label\": \"retention_schedule\",\n          \"attributes\": {\n            \"kind\": \"retention_schedule\"\n          }\n        }\n      ],\n      \"edges\": [\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-1\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this disclosure obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-2\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this notification obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"change:REG-2026-0117\",\n          \"to\": \"obligation:OB-3\",\n          \"kind\": \"creates\",\n          \"reason\": \"\\\"12 CFR 1026.19(e)\\\" (amendment, published 2026-03-02) creates this recordkeeping obligation, to be met by 2026-12-01.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"control:CTL-014\",\n          \"kind\": \"mapped_to\",\n          \"reason\": \"Control CTL-014 carries every tag this obligation requires (payments, disclosure). Matching is a set rule over tags, not a similarity score.\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"control:CTL-027\",\n          \"kind\": \"mapped_to\",\n          \"reason\": \"Control CTL-027 carries every tag this obligation requires (payments, notification). Matching is a set rule over tags, not a similarity score; the control is not currently operating (control_not_implemented, control_untested).\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"team:Payments Compliance\",\n          \"kind\": \"owned_by\",\n          \"reason\": \"Control CTL-014 names Payments Compliance as its owning team, so work arising from this change routes there.\"\n        },\n        {\n          \"from\": \"control:CTL-027\",\n          \"to\": \"team:Payments Engineering\",\n          \"kind\": \"owned_by\",\n          \"reason\": \"Control CTL-027 names Payments Engineering as its owning team, so work arising from this change routes there.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-1 requires \\\"notification_record\\\"; it is held by control CTL-014.\"\n        },\n        {\n          \"from\": \"obligation:OB-1\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-1 requires \\\"policy_document\\\"; it is held by control CTL-014.\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-2 requires \\\"notification_record\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-2\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-2 requires \\\"policy_document\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-3\",\n          \"to\": \"evidence:audit_log\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-3 requires \\\"audit_log\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"obligation:OB-3\",\n          \"to\": \"evidence:retention_schedule\",\n          \"kind\": \"requires_evidence\",\n          \"reason\": \"Obligation OB-3 requires \\\"retention_schedule\\\"; it is held by no matched control (evidence_missing).\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"evidence:notification_record\",\n          \"kind\": \"evidenced_by\",\n          \"reason\": \"Control CTL-014 holds \\\"notification_record\\\" (NR-9930), collected 2026-07-14.\"\n        },\n        {\n          \"from\": \"control:CTL-014\",\n          \"to\": \"evidence:policy_document\",\n          \"kind\": \"evidenced_by\",\n          \"reason\": \"Control CTL-014 holds \\\"policy_document\\\" (POL-221), collected 2026-07-02.\"\n        }\n      ]\n    },\n    \"unmatchedControls\": [\n      \"CTL-101\"\n    ],\n    \"exposure\": {\n      \"currency\": \"USD\",\n      \"totalMinor\": 250000000,\n      \"byOwner\": [\n        {\n          \"owner\": \"Payments Engineering\",\n          \"amountMinor\": 250000000\n        }\n      ],\n      \"unassignedMinor\": 0\n    },\n    \"warnings\": []\n  },\n  \"dueSoonWindowDays\": 30,\n  \"notice\": \"This is arithmetic and graph mapping over inputs you supply. It does not read, interpret or apply law, and it is not legal advice.\",\n  \"requestId\": \"req_example\"\n}",
          "code": 200,
          "cookie": [],
          "header": [
            {
              "key": "Content-Type",
              "value": "application/json"
            }
          ],
          "name": "200 — authenticated primary result shape",
          "originalRequest": {
            "body": {
              "mode": "raw",
              "options": {
                "raw": {
                  "language": "json"
                }
              },
              "raw": "{\n  \"controls\": [\n    {\n      \"controlId\": \"CTL-014\",\n      \"name\": \"Consumer disclosure template review\",\n      \"owner\": \"Payments Compliance\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"payments\",\n        \"disclosure\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2026-07-01T00:00:00Z\",\n      \"testFrequencyDays\": 180,\n      \"evidence\": [\n        {\n          \"kind\": \"policy_document\",\n          \"artifactId\": \"POL-221\",\n          \"collectedAt\": \"2026-07-02T00:00:00Z\"\n        },\n        {\n          \"kind\": \"notification_record\",\n          \"artifactId\": \"NR-9930\",\n          \"collectedAt\": \"2026-07-14T00:00:00Z\"\n        }\n      ]\n    },\n    {\n      \"controlId\": \"CTL-027\",\n      \"name\": \"Fee change customer notification job\",\n      \"owner\": \"Payments Engineering\",\n      \"status\": \"planned\",\n      \"tags\": [\n        \"payments\",\n        \"notification\",\n        \"us\"\n      ],\n      \"testFrequencyDays\": 90\n    },\n    {\n      \"controlId\": \"CTL-101\",\n      \"name\": \"Account record retention schedule\",\n      \"owner\": \"Records Management\",\n      \"status\": \"implemented\",\n      \"tags\": [\n        \"recordkeeping\",\n        \"us\"\n      ],\n      \"lastTestedAt\": \"2024-02-01T00:00:00Z\",\n      \"evidence\": [\n        {\n          \"kind\": \"retention_schedule\",\n          \"artifactId\": \"RS-04\",\n          \"collectedAt\": \"2024-02-01T00:00:00Z\"\n        }\n      ]\n    }\n  ],\n  \"change\": {\n    \"changeId\": \"REG-2026-0117\",\n    \"citation\": \"12 CFR 1026.19(e)\",\n    \"title\": \"Revised timing and content of cost-of-credit disclosures\",\n    \"jurisdiction\": \"US\",\n    \"regulator\": \"CFPB\",\n    \"changeType\": \"amendment\",\n    \"publishedAt\": \"2026-03-02T00:00:00Z\",\n    \"effectiveAt\": \"2026-09-01T00:00:00Z\",\n    \"transitionEndsAt\": \"2026-12-01T00:00:00Z\",\n    \"currency\": \"USD\",\n    \"obligations\": [\n      {\n        \"obligationId\": \"OB-1\",\n        \"type\": \"disclosure\",\n        \"text\": \"Provide the revised cost-of-credit disclosure within three business days of application.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 500000000\n      },\n      {\n        \"obligationId\": \"OB-2\",\n        \"type\": \"notification\",\n        \"text\": \"Notify existing customers of the fee schedule change at least 45 days before it applies.\",\n        \"appliesTo\": [\n          \"payments\",\n          \"notification\"\n        ],\n        \"enforcement\": \"penalty\",\n        \"maxPenaltyMinor\": 250000000\n      },\n      {\n        \"obligationId\": \"OB-3\",\n        \"type\": \"recordkeeping\",\n        \"text\": \"Retain each issued disclosure for five years and produce it on request.\",\n        \"appliesTo\": [\n          \"recordkeeping\",\n          \"disclosure\"\n        ],\n        \"enforcement\": \"supervisory\"\n      }\n    ]\n  }\n}"
            },
            "description": "Authenticated primary-value call. Reuses the complete demo payload. You supply the legal interpretation, dates, obligations, tags, controls, and evidence. ControlGraph performs deterministic graph mapping; it does not read law and is not legal advice.",
            "header": [
              {
                "key": "content-type",
                "value": "application/json"
              },
              {
                "key": "authorization",
                "value": "Bearer {{apiKey}}"
              }
            ],
            "method": "POST",
            "url": {
              "host": [
                "{{baseUrl}}"
              ],
              "path": [
                "v1",
                "changes"
              ],
              "raw": "{{baseUrl}}/v1/changes"
            }
          },
          "status": "OK"
        }
      ]
    },
    {
      "name": "The code catalogue: obligation types, evidence kinds, findings and the priority weights",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "description": "Public stable-code catalogue. Use codes and constants for integrations; prose details may be reworded.",
        "header": [],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "obligation-types"
          ],
          "raw": "{{baseUrl}}/v1/obligation-types"
        }
      }
    },
    {
      "name": "Liveness and deployed version",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "header": [],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "health"
          ],
          "raw": "{{baseUrl}}/health"
        }
      }
    },
    {
      "name": "Service index — endpoints, auth and error format",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "header": [],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [],
          "raw": "{{baseUrl}}/"
        }
      }
    },
    {
      "name": "Start a hosted Square checkout for a paid tier",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"tier\": \"developer\"\n}"
        },
        "description": "Returns a Square-hosted payment URL for the requested tier. No API key is needed — a prospect has not got one yet. The email Square collects becomes the account, so a key issued later for the same address inherits the paid quota. Enterprise returns a contact route rather than a payment link. THIS IS THE PATH FOR SOMEONE WHO IS NOT YET PAYING. It starts a NEW Square recurring subscription, so it is refused with 409 `conflict` (`details.reason` `existing_subscription`) when the request carries a dashboard session for an account that already has a live plan on this API — a second subscription would be charged alongside the first, every month, and this API cannot cancel either one. Change tier with POST /v1/subscription/plan, or, when Square collects your base fee, cancel it with Square first.\n\nPostman authentication: No Auth. This public checkout bootstrap must not inherit the collection API key.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "checkout"
          ],
          "raw": "{{baseUrl}}/v1/checkout"
        }
      }
    },
    {
      "name": "Square billing events, forwarded by the shared hub",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "description": "Machine-to-machine only. The shared Square billing hub POSTs signed events here; the signature is verified over the exact request bytes. Not callable by API consumers — documented so the integration is auditable.\n\nMachine-to-machine only. Postman uses No Auth so bearer credentials cannot leak onto this request. An authorized hub must set local `hubTimestamp` and `hubSignature`, where the signature is HMAC-SHA256 over `${x-hub-timestamp}.${rawBody}` with the shared hub secret. Both committed placeholders are empty.",
        "header": [
          {
            "description": "Machine-to-machine HMAC-SHA256 signature. Empty in the committed collection; never use an API key here.",
            "key": "x-hub-signature",
            "type": "text",
            "value": "{{hubSignature}}"
          },
          {
            "description": "Unix timestamp covered by the hub signature and five-minute replay window. Empty in the committed collection.",
            "key": "x-hub-timestamp",
            "type": "text",
            "value": "{{hubTimestamp}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "api",
            "billing",
            "webhook"
          ],
          "raw": "{{baseUrl}}/api/billing/webhook"
        }
      }
    },
    {
      "name": "List your API keys for this API",
      "request": {
        "description": "Every key on YOUR account for this API — label, non-secret prefix, status, when it was created, when it was last used, and what it has consumed this period. Authenticate with any active key on the account; the account is taken from that key, never from a parameter, so this can only ever return your own keys. Keys you hold for other APIs in the portfolio are not listed here. Secrets are not returned and cannot be: only a peppered hash is stored. Free, and consumes no quota.",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys"
          ],
          "raw": "{{baseUrl}}/v1/keys"
        }
      }
    },
    {
      "name": "Revoke one of your API keys",
      "request": {
        "description": "Kills a key immediately: the very next request made with it is refused with 401 invalid_api_key. There is no propagation delay and no cache to wait out. You may revoke the key you are authenticating with — that is the correct move when it has leaked, though you will then need another key, or the email flow, to get back in; rotate does both in one call. A key belonging to another account, or to another API, answers 404 exactly as an unknown id does, so this cannot be used to probe for keys you do not own. Idempotent, and free.",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "{{keyId}}",
            "revoke"
          ],
          "raw": "{{baseUrl}}/v1/keys/{{keyId}}/revoke"
        }
      }
    },
    {
      "name": "Replace one of your API keys with a new secret",
      "request": {
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"name\": \"production (rotated)\"\n}"
        },
        "description": "Issues a replacement key and revokes the old one. This is the answer to a leaked or lost key: the new secret is returned once, the old secret stops working immediately, and the label carries over unless you supply a new one. The replacement is issued at your account's current allowance — your paid plan if you have one — not at the old key's. Rotating does not count against the active-key limit, because it replaces rather than adds. Free, and it works while you are out of quota.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "{{keyId}}",
            "rotate"
          ],
          "raw": "{{baseUrl}}/v1/keys/{{keyId}}/rotate"
        }
      }
    },
    {
      "name": "Your consumption and remaining allowance for this period",
      "request": {
        "description": "Reports what YOUR ACCOUNT has consumed in the current quota period, the ceiling being enforced against it, and when that ceiling resets. The allowance belongs to the account, not to a key: every key you hold for this API draws on the same budget, so \"used\" is the total across all of them and a new key does not arrive with a fresh one. Free, and it consumes no quota, so it still answers once you are getting 429 quota_exceeded — which is the point: compare \"used\" against \"ceiling\" and read \"period.resetsAt\" to tell a period you have simply exhausted from a plan that is no longer active, which shows as a \"status\" of canceled and a ceiling of 0. \"used\" counts billing units (see \"unit\"), not HTTP requests: a single request can consume several. All money is in integer minor units (cents), never a decimal. The period reported here is the quota period — the calendar month in UTC, resetting at 00:00 UTC on the 1st. Your invoice window is anchored to the date you subscribed and is a different window; the amounts here are what this period’s usage has accrued so far, not a bill.",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "usage"
          ],
          "raw": "{{baseUrl}}/v1/usage"
        }
      }
    },
    {
      "name": "Your current plan, billing window and available changes (dashboard session required)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "description": "Reports the plan this account is on, the billing window it is in, any tier change already staged for the next invoice, and the full pricing ladder marked up so you can see which rungs are an upgrade and which a downgrade. `planChangesGoThrough` is the field to branch on: `self_serve` means POST /v1/subscription/plan can move you; `provider_managed` means Square’s own recurring subscription holds your price and neither this API nor a new checkout can move it — buying again would create a SECOND Square subscription and charge you twice; `checkout` appears only when you have no plan at all, where starting one is exactly right. All money is in integer minor units (cents). AUTHENTICATION IS YOUR DASHBOARD SESSION, NOT AN API KEY. Send the `@sp/core` session cookie this API sets when you sign in, from the same origin. An API key is refused here on purpose: it is a data-plane credential that lives in CI and in third-party integrations, and it must never be able to change what you are billed, cancel your account, or read your payment history. Errors: 401 `unauthenticated` when there is no valid session, 403 `forbidden` when the request is cross-origin or its `x-csrf-token` header is missing or wrong.\n\nPostman: use No Auth and provide the dashboard `sp_session` through the host cookie jar or the local empty-by-default `sessionCookie` placeholder. An API key is rejected.",
        "header": [
          {
            "description": "Dashboard session only. Keep sessionCookie empty in the committed collection; set it locally or use the Postman cookie jar for this host.",
            "key": "Cookie",
            "type": "text",
            "value": "sp_session={{sessionCookie}}"
          }
        ],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "subscription"
          ],
          "raw": "{{baseUrl}}/v1/subscription"
        }
      }
    },
    {
      "name": "Upgrade or downgrade to another plan (dashboard session required)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"planId\": \"growth\"\n}"
        },
        "description": "Moves this account to another rung of the published pricing ladder and re-derives the ceiling enforced against every API key on it, so an upgrade is usable immediately rather than at the next invoice. The change is STAGED, not overwritten: the current billing window is closed at this instant and priced against the tier that was actually in force for it, and the incoming tier opens the next window with the original billing anniversary preserved. A downgrade therefore never re-prices days you already consumed on the dearer plan. Refused with 409 `conflict` (`details.reason` `provider_owned_base_fee`) when Square’s own recurring subscription holds your price (`baseFeeOwner` is `provider`) — read `planChangesGoThrough` from GET /v1/subscription first. That case cannot be moved from here at all: this API holds no Square subscription of yours to change, and POST /v1/checkout would create a SECOND one and charge you for both. Cancel with Square and buy the tier you want, or contact support. AUTHENTICATION IS YOUR DASHBOARD SESSION, NOT AN API KEY. Send the `@sp/core` session cookie this API sets when you sign in, from the same origin. An API key is refused here on purpose: it is a data-plane credential that lives in CI and in third-party integrations, and it must never be able to change what you are billed, cancel your account, or read your payment history. Errors: 401 `unauthenticated` when there is no valid session, 403 `forbidden` when the request is cross-origin or its `x-csrf-token` header is missing or wrong.\n\nPostman: use No Auth, provide `sp_session` through the host cookie jar or local `sessionCookie`, and set local `csrfToken` for `x-csrf-token`. Both placeholders are committed empty. An API key is rejected.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "description": "Dashboard session only. Keep sessionCookie empty in the committed collection; set it locally or use the Postman cookie jar for this host.",
            "key": "Cookie",
            "type": "text",
            "value": "sp_session={{sessionCookie}}"
          },
          {
            "description": "CSRF token paired with the dashboard session. Empty in the committed collection; set locally immediately before the request.",
            "key": "x-csrf-token",
            "type": "text",
            "value": "{{csrfToken}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "subscription",
            "plan"
          ],
          "raw": "{{baseUrl}}/v1/subscription/plan"
        }
      }
    },
    {
      "name": "Cancel this plan and end metered access (dashboard session required)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "body": {
          "mode": "raw",
          "options": {
            "raw": {
              "language": "json"
            }
          },
          "raw": "{\n  \"acknowledgeProviderBilling\": true\n}"
        },
        "description": "Cancels the plan and drops every API key on this account for this product to a ceiling of 0, so access ends at the moment you cancel rather than at some later date nothing would enforce. The window you cancel in is closed and invoiced first, prorated to that instant: the elapsed share of the base fee plus any overage you accrued, still under the same spend cap. The invoice it writes is returned as `finalInvoice` and appears in GET /v1/invoices. When Square’s own recurring subscription collects your flat monthly fee (`baseFeeOwner` is `provider`) this API cannot stop that charge, so the request is refused with 409 unless you send `acknowledgeProviderBilling: true` — that flag exists so nobody ends up with a ceiling of zero and a live monthly charge without having been told first. AUTHENTICATION IS YOUR DASHBOARD SESSION, NOT AN API KEY. Send the `@sp/core` session cookie this API sets when you sign in, from the same origin. An API key is refused here on purpose: it is a data-plane credential that lives in CI and in third-party integrations, and it must never be able to change what you are billed, cancel your account, or read your payment history. Errors: 401 `unauthenticated` when there is no valid session, 403 `forbidden` when the request is cross-origin or its `x-csrf-token` header is missing or wrong.\n\nPostman: use No Auth, provide `sp_session` through the host cookie jar or local `sessionCookie`, and set local `csrfToken` for `x-csrf-token`. Both placeholders are committed empty. An API key is rejected.",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "description": "Dashboard session only. Keep sessionCookie empty in the committed collection; set it locally or use the Postman cookie jar for this host.",
            "key": "Cookie",
            "type": "text",
            "value": "sp_session={{sessionCookie}}"
          },
          {
            "description": "CSRF token paired with the dashboard session. Empty in the committed collection; set locally immediately before the request.",
            "key": "x-csrf-token",
            "type": "text",
            "value": "{{csrfToken}}"
          }
        ],
        "method": "POST",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "subscription",
            "cancel"
          ],
          "raw": "{{baseUrl}}/v1/subscription/cancel"
        }
      }
    },
    {
      "name": "Every invoice issued against this account, newest first (dashboard session required)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "description": "Returns the stored `api_plan_invoices` rows for this account and this API — the rows the billing run actually wrote, never a reconstruction. Each one reconciles against itself: the included allowance and base fee shown are the PRORATED figures applied to that window, `overageMinorRaw` is the uncapped overage and `overageMinorCapped` is what was charged, and `baseChargedMinor` says how much of the base fee this invoice collected — 0 when Square’s recurring subscription had already taken it. An account with no billing history yet gets an empty list and a `note` explaining why, never a fabricated row. AUTHENTICATION IS YOUR DASHBOARD SESSION, NOT AN API KEY. Send the `@sp/core` session cookie this API sets when you sign in, from the same origin. An API key is refused here on purpose: it is a data-plane credential that lives in CI and in third-party integrations, and it must never be able to change what you are billed, cancel your account, or read your payment history. Errors: 401 `unauthenticated` when there is no valid session, 403 `forbidden` when the request is cross-origin or its `x-csrf-token` header is missing or wrong.\n\nPostman: use No Auth and provide the dashboard `sp_session` through the host cookie jar or the local empty-by-default `sessionCookie` placeholder. An API key is rejected.",
        "header": [
          {
            "description": "Dashboard session only. Keep sessionCookie empty in the committed collection; set it locally or use the Postman cookie jar for this host.",
            "key": "Cookie",
            "type": "text",
            "value": "sp_session={{sessionCookie}}"
          }
        ],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "invoices"
          ],
          "raw": "{{baseUrl}}/v1/invoices"
        }
      }
    },
    {
      "name": "Every payment attempted against this account and how it went (dashboard session required)",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "description": "The money movements behind your invoices, newest first: what was charged, whether it succeeded, and the processor’s payment id when it did. A billing period that came to nothing produces NO row here — it was closed without asking the processor for anything, and listing it would show you a payment that never happened. A failed attempt does appear, with its reason, because that is why an account goes past due. AUTHENTICATION IS YOUR DASHBOARD SESSION, NOT AN API KEY. Send the `@sp/core` session cookie this API sets when you sign in, from the same origin. An API key is refused here on purpose: it is a data-plane credential that lives in CI and in third-party integrations, and it must never be able to change what you are billed, cancel your account, or read your payment history. Errors: 401 `unauthenticated` when there is no valid session, 403 `forbidden` when the request is cross-origin or its `x-csrf-token` header is missing or wrong.\n\nPostman: use No Auth and provide the dashboard `sp_session` through the host cookie jar or the local empty-by-default `sessionCookie` placeholder. An API key is rejected.",
        "header": [
          {
            "description": "Dashboard session only. Keep sessionCookie empty in the committed collection; set it locally or use the Postman cookie jar for this host.",
            "key": "Cookie",
            "type": "text",
            "value": "sp_session={{sessionCookie}}"
          }
        ],
        "method": "GET",
        "url": {
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "payments"
          ],
          "raw": "{{baseUrl}}/v1/payments"
        }
      }
    }
  ],
  "variable": [
    {
      "key": "baseUrl",
      "type": "string",
      "value": "https://controlgraph-api.com"
    },
    {
      "description": "Set locally after a successful claim. Empty in this committed collection.",
      "key": "apiKey",
      "type": "string",
      "value": ""
    },
    {
      "description": "Paste the one-time emailed token. Cleared locally after a successful claim.",
      "key": "claimToken",
      "type": "string",
      "value": ""
    },
    {
      "description": "Set locally after claim for rotate/revoke operations.",
      "key": "keyId",
      "type": "string",
      "value": ""
    },
    {
      "description": "Dashboard sp_session cookie value. Empty in this committed collection; set locally or use the Postman cookie jar.",
      "key": "sessionCookie",
      "type": "string",
      "value": ""
    },
    {
      "description": "Dashboard CSRF token. Empty in this committed collection; set locally only for a session-authenticated mutation.",
      "key": "csrfToken",
      "type": "string",
      "value": ""
    },
    {
      "description": "Machine-to-machine x-hub-signature value. Empty in this committed collection; never substitute an API key.",
      "key": "hubSignature",
      "type": "string",
      "value": ""
    },
    {
      "description": "Machine-to-machine x-hub-timestamp value covered by the HMAC signature. Empty in this committed collection.",
      "key": "hubTimestamp",
      "type": "string",
      "value": ""
    }
  ]
}