openapi: 3.0.3
info:
  title: Auth internal session validation
  version: 1.0.0
paths:
  /internal/auth/accounts/sessions/validate:
    post:
      summary: Validate persisted account and IAM authorization state
      description: Internal network only. No Gateway public route. Verifies the Redis Access session and state fingerprint against current Auth account and a consistent IAM snapshot. No positive cache; missing state, stale state and dependency failure deny access. Does not accept or forward a user Bearer token.
      security:
        - internalServiceToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [jwtId, userId]
              properties:
                jwtId: {type: string, minLength: 1}
                userId: {type: integer, format: int64}
      responses:
        '200':
          description: Only string code 200 and boolean data true constitute success. Business errors deny access.
          content:
            application/json:
              schema:
                type: object
                required: [code]
                properties:
                  code: {type: string}
                  message: {type: string}
                  data: {type: boolean, nullable: true}
components:
  securitySchemes:
    internalServiceToken:
      type: apiKey
      in: header
      name: X-Internal-Service-Token