API spec cleanup and Go client regeneration

[hdm]

Summary

Top-to-bottom cleanup of runzero-api.yml (the OpenAPI 3.0 source of truth) and a full regeneration of the Go SDK in ./go using openapi-generator v7.22.0. The result is a clean spec that codegens to an idiomatic Go client with no duplicate declarations and stable, descriptive type names.

Spec changes (runzero-api.yml)

Type / naming deconfliction

Renamed schemas that collided with generator-emitted type names or that were ambiguous:

• StatusMessage (schema) → OperationStatus
• Search → SearchQuery
• APIClient → APIClientCredentials
• APIKey (schema) → OrganizationAPIKey
• NewCustomIntegration → CustomIntegrationCreate

Extracted 14+ inline oneOf / anonymous 200-response shapes into named, stable component schemas (e.g. AssetPage, AssetExportResponse, ServicePage, ImportTask, etc.) so generated Go types no longer carry operation-name-derived suffixes like ExportAssetsJSON200ResponseOneOf.

Correctness fixes

• BaseResponse switched to snake_case (client_id, created_at, created_by_id, updated_at, destroyed_at) to match server output — previously camelCase would silently zero-value real responses.
• JSONL / binary export endpoints now correctly declare type: string, format: binary (previously some advertised a Certificate object or Event array).
• Removed broken pattern: constraints that the Go generator double-escaped into invalid validate: tags (e.g. BaseCustomIntegration.name, NetworkInterface.macAddress).
• Deleted dead Explorer / ExplorerPatchedSettings aliases; the relevant ops now reference Agent / AgentPatchedSettings directly.
• OrgOptions.expiration_* switched from invented formats to plain type: string with descriptions.
• Stripped all x-go-type / x-go-import vendor extensions and trailing whitespace.

Tag hygiene

• Retagged getOrgCustomIntegration[s] from Org → Organization.
• Tagged the previously untagged exportAssetMetricsJSON as Export.
• Removed duplicate tags on 4 export-certificates ops and on importCustomIntegrationAssets so each op ends up in exactly one API service file (avoids duplicate Go declarations).

Final structural QA pass

• Added requestBody.required: true to 5 PUT ops that mandate a body: importScanData, importNessusScanData, importPacketData, createScan, createSample.
• Synced Credential.type enum from 9 to all 27 values, matching CredentialOptions.type.
• Fixed non-standard text/json → application/json on createScan and createSample.

Audit results

• 181 unique operationIds, no duplicates
• All declared tags are used; all used tags are declared
• All $refs resolve
• All media types are standard
• All path parameters declared

Go client (./go)

• Regenerated from the cleaned spec with openapi-generator -g go.
• Package renamed from generator default openapi → runzero.
• Module path stays github.com/runZeroInc/runzero-api; generator's go.mod/go.sum are removed after each regen (the repo's root go.mod covers ./go).
• 8 API service files: api_account.go, api_cisco_sntc.go, api_export.go, api_import.go, api_organization.go, api_public.go, api_service_now.go, api_splunk.go.
• New, descriptive model files for the extracted schemas (e.g. model_asset_page.go, model_asset_export_response.go, model_import_task.go, model_search_query.go, model_operation_status.go, model_api_client_credentials.go, model_organization_api_key.go, model_custom_integration_create.go, the various model_*_credential_fields.go, etc.).

Examples

• go/runzero-client/examples/basic/main.go and go/runzero-client/examples/scan-all-sites/main.go updated for the new PublicAPI / OrganizationAPI field names.
• Verified live against https://console.runzero.com/api/v1.0 — returns Agent / Scanner / Platform versions.

Tests

• Hand-curated tests under go/test/ use package runzero and import github.com/runZeroInc/runzero-api/go.
• Stale per-tag test stubs for removed/renamed tags were deleted.
• go test ./go/... → ok github.com/runZeroInc/runzero-api/go/test.

Verification

go build ./...                        # clean
go test  ./go/...                     # ok
go run   ./go/runzero-client/examples/basic/   # live API returns versions

Notes (intentional, not blockers)

• ImportAsset schema is retained as documentation for the binary assetData upload body format even though no op $refs it directly.
• DELETE /account/assets/ownership-types carries a body (uncommon but valid for this bulk endpoint).
• 3 task-data endpoints return 303 only — intentional redirects to S3.