{
  "name": "Permission review example",
  "baseUrl": "https://api.example.invalid",
  "auth": {
    "type": "runtime-enforced"
  },
  "endpoints": [
    {
      "method": "GET",
      "path": "/invoices/{invoiceId}",
      "name": "get_invoice",
      "summary": "Read the requested invoice after checking the caller account and limiting returned fields."
    },
    {
      "method": "POST",
      "path": "/invoices/{invoiceId}/refund",
      "name": "refund_invoice",
      "summary": "Refund an invoice only after confirming the exact account, amount and currency with the user."
    },
    {
      "method": "DELETE",
      "path": "/customers/{customerId}",
      "name": "delete_customer",
      "summary": "Delete the requested synthetic customer after checking authorization and explicit approval."
    }
  ]
}