{
 "openapi": "3.0.3",
 "info": {
  "title": "Bramble Gateway API",
  "version": "2026-11-13",
  "description": "The reverse proxy in front of every app."
 },
 "servers": [
  {
   "url": "https://{org}.brambleit.cloud",
   "variables": {
    "org": {
     "default": "your-org"
    }
   }
  }
 ],
 "components": {
  "securitySchemes": {
   "apiKey": {
    "type": "apiKey",
    "in": "header",
    "name": "X-API-Key"
   },
   "session": {
    "type": "apiKey",
    "in": "cookie",
    "name": "sso_session"
   },
   "bearer": {
    "type": "http",
    "scheme": "bearer",
    "bearerFormat": "JWT"
   }
  }
 },
 "tags": [
  {
   "name": "  Tenant Info"
  },
  {
   "name": ".Well Known"
  },
  {
   "name": "General"
  }
 ],
 "paths": {
  "/__tenant-info": {
   "get": {
    "tags": [
     "  Tenant Info"
    ],
    "summary": "So the login page can brand itself for whichever tenant vanity domain it's being loaded on — {name, slug, domain}, or {tenant:null} on sso.brambleit.cloud / …",
    "operationId": "get-tenant-info",
    "description": "So the login page can brand itself for whichever tenant vanity domain it's being loaded on — {name, slug, domain}, or {tenant:null} on sso.brambleit.cloud / the bare apex, where there's deliberately no tenant to brand for. Safe to expose pre-auth: none of this (name, colors, wording, logo) is sensitive — it's the same stuff visible in the hostname/rendered page itself. branding is null when the tenant hasn't customized anything (server-provided defaults kick in client-side).\n\nRequires: None: public, or protected by a token in the address or body.",
    "parameters": [],
    "responses": {
     "200": {
      "description": "Success",
      "content": {
       "application/json": {
        "schema": {
         "type": "object",
         "properties": {
          "tenant": {},
          "branding": {}
         }
        }
       }
      }
     }
    },
    "security": [
     {
      "session": []
     }
    ]
   }
  },
  "/": {
   "get": {
    "tags": [
     "General"
    ],
    "summary": "Get the item",
    "operationId": "get",
    "description": "Requires: None: public, or protected by a token in the address or body.",
    "parameters": [],
    "responses": {
     "200": {
      "description": "File, page or redirect"
     }
    },
    "security": [
     {
      "session": []
     }
    ]
   }
  }
 }
}