{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://flex-auth.netkingdom/schemas/readback_request.schema.json",
  "title": "ReadbackRequest",
  "description": "POST /v1/readback/application_access (FLEX-DEC-2026-019). There is no action, resource or purpose: the pin evaluates application.access only and sets purpose itself.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "subject",
    "systems"
  ],
  "properties": {
    "tenant": {
      "type": "string",
      "minLength": 1
    },
    "subject": {
      "$ref": "#/$defs/subject_ref"
    },
    "context": {
      "type": "object",
      "additionalProperties": true
    },
    "systems": {
      "type": "array",
      "minItems": 1,
      "maxItems": 64,
      "uniqueItems": true,
      "items": {
        "type": "string",
        "minLength": 1
      }
    }
  },
  "$defs": {
    "subject_ref": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id"
      ],
      "description": "Same shape as check_request subject_ref; user-engine sends what FlexAuthHTTPAdapter sends to /v1/check (FLEX-WP-0035 review).",
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1
        },
        "type": {
          "type": "string",
          "minLength": 1
        },
        "tenant": {
          "type": "string",
          "minLength": 1
        },
        "attributes": {
          "type": "object",
          "additionalProperties": true
        }
      }
    }
  }
}