{
  "typeName" : "AWS::DevOpsAgent::Service",
  "description" : "The AWS::DevOpsAgent::Service resource registers external services (like Dynatrace, MCP servers, GitLab) for integration with DevOpsAgent.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "ServiceId" : {
      "description" : "The unique identifier of the service",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 255
    },
    "ServiceType" : {
      "description" : "The type of service being registered",
      "type" : "string",
      "enum" : [ "dynatrace", "mcpserver", "mcpserversplunk", "mcpservernewrelic", "gitlab", "servicenow", "pagerduty", "azureidentity", "mcpserversigv4", "mcpservergrafana" ]
    },
    "ServiceDetails" : {
      "description" : "Service-specific configuration details - only MCPServerSigV4 supports in-place updates, all other service types require replacement when modified",
      "type" : "object",
      "oneOf" : [ {
        "properties" : {
          "Dynatrace" : {
            "$ref" : "#/definitions/DynatraceServiceDetails"
          }
        },
        "required" : [ "Dynatrace" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServer" : {
            "$ref" : "#/definitions/MCPServerDetails"
          }
        },
        "required" : [ "MCPServer" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerSplunk" : {
            "$ref" : "#/definitions/MCPServerSplunkDetails"
          }
        },
        "required" : [ "MCPServerSplunk" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerNewRelic" : {
            "$ref" : "#/definitions/NewRelicServiceDetails"
          }
        },
        "required" : [ "MCPServerNewRelic" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "GitLab" : {
            "$ref" : "#/definitions/GitLabDetails"
          }
        },
        "required" : [ "GitLab" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "ServiceNow" : {
            "$ref" : "#/definitions/ServiceNowServiceDetails"
          }
        },
        "required" : [ "ServiceNow" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "PagerDuty" : {
            "$ref" : "#/definitions/PagerDutyDetails"
          }
        },
        "required" : [ "PagerDuty" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "AzureIdentity" : {
            "$ref" : "#/definitions/AzureIdentityServiceDetails"
          }
        },
        "required" : [ "AzureIdentity" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerSigV4" : {
            "$ref" : "#/definitions/MCPServerSigV4Details"
          }
        },
        "required" : [ "MCPServerSigV4" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerGrafana" : {
            "$ref" : "#/definitions/MCPServerGrafanaDetails"
          }
        },
        "required" : [ "MCPServerGrafana" ],
        "additionalProperties" : false
      } ]
    },
    "DynatraceServiceDetails" : {
      "description" : "Dynatrace service configuration",
      "type" : "object",
      "properties" : {
        "AccountUrn" : {
          "description" : "Dynatrace resource account URN",
          "type" : "string"
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/DynatraceAuthorizationConfig"
        }
      },
      "required" : [ "AccountUrn" ],
      "additionalProperties" : false
    },
    "DynatraceAuthorizationConfig" : {
      "description" : "Dynatrace OAuth authorization configuration",
      "type" : "object",
      "properties" : {
        "OAuthClientCredentials" : {
          "$ref" : "#/definitions/OAuthClientDetails"
        }
      },
      "additionalProperties" : false
    },
    "ServiceNowServiceDetails" : {
      "description" : "ServiceNow service configuration",
      "type" : "object",
      "properties" : {
        "InstanceUrl" : {
          "description" : "ServiceNow instance URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9-]+\\.service-now\\.com/?$"
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/ServiceNowAuthorizationConfig"
        }
      },
      "required" : [ "InstanceUrl" ],
      "additionalProperties" : false
    },
    "ServiceNowAuthorizationConfig" : {
      "description" : "ServiceNow OAuth authorization configuration",
      "type" : "object",
      "properties" : {
        "OAuthClientCredentials" : {
          "$ref" : "#/definitions/OAuthClientDetails"
        }
      },
      "additionalProperties" : false
    },
    "PagerDutyDetails" : {
      "description" : "PagerDuty service configuration",
      "type" : "object",
      "properties" : {
        "Scopes" : {
          "description" : "PagerDuty scopes",
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/PagerDutyAuthorizationConfig"
        }
      },
      "required" : [ "Scopes", "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "PagerDutyAuthorizationConfig" : {
      "description" : "PagerDuty OAuth authorization configuration",
      "type" : "object",
      "properties" : {
        "OAuthClientCredentials" : {
          "$ref" : "#/definitions/OAuthClientDetails"
        }
      },
      "additionalProperties" : false
    },
    "MCPServerSigV4Details" : {
      "description" : "SigV4-authenticated MCP server configuration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_-]+$"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$"
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string",
          "maxLength" : 500
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/MCPServerSigV4AuthorizationConfig"
        }
      },
      "required" : [ "Name", "Endpoint", "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "MCPServerSigV4AuthorizationConfig" : {
      "description" : "SigV4 authorization configuration for MCP server",
      "type" : "object",
      "properties" : {
        "Region" : {
          "description" : "AWS region for SigV4 signing. Use '*' for SigV4a multi-region signing.",
          "type" : "string",
          "pattern" : "^(\\*|[a-z]{2,4}(-[a-z]+)+-\\d+)$"
        },
        "Service" : {
          "description" : "AWS service name for SigV4 signing",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 100
        },
        "RoleArn" : {
          "description" : "IAM role ARN to assume for SigV4 signing",
          "type" : "string",
          "pattern" : "^arn:aws:iam::\\d{12}:role/[a-zA-Z0-9+=,.@_/-]+$"
        },
        "CustomHeaders" : {
          "description" : "Custom headers for the SigV4 MCP server",
          "type" : "object",
          "maxProperties" : 10,
          "patternProperties" : {
            "^[a-zA-Z0-9-_]+$" : {
              "type" : "string"
            }
          },
          "additionalProperties" : false
        }
      },
      "required" : [ "Region", "Service", "RoleArn" ],
      "additionalProperties" : false
    },
    "MCPServerDetails" : {
      "description" : "MCP server configuration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_-]+$"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$"
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string",
          "maxLength" : 500
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/MCPServerAuthorizationConfig"
        }
      },
      "required" : [ "Name", "Endpoint", "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "MCPServerAuthorizationConfig" : {
      "description" : "MCP server authorization configuration",
      "type" : "object",
      "oneOf" : [ {
        "properties" : {
          "OAuthClientCredentials" : {
            "$ref" : "#/definitions/MCPServerOAuthClientCredentialsConfig"
          }
        },
        "required" : [ "OAuthClientCredentials" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "ApiKey" : {
            "$ref" : "#/definitions/ApiKeyDetails"
          }
        },
        "required" : [ "ApiKey" ],
        "additionalProperties" : false
      } ]
    },
    "MCPServerSplunkAuthorizationConfig" : {
      "description" : "MCP server splunk authorization configuration",
      "type" : "object",
      "oneOf" : [ {
        "properties" : {
          "BearerToken" : {
            "$ref" : "#/definitions/BearerTokenDetails"
          }
        },
        "required" : [ "BearerToken" ],
        "additionalProperties" : false
      } ]
    },
    "MCPServerOAuthClientCredentialsConfig" : {
      "description" : "MCP server OAuth client credentials configuration",
      "type" : "object",
      "properties" : {
        "ClientName" : {
          "description" : "User friendly OAuth client name",
          "type" : "string"
        },
        "ClientId" : {
          "description" : "OAuth client ID",
          "type" : "string"
        },
        "ClientSecret" : {
          "description" : "OAuth client secret",
          "type" : "string"
        },
        "ExchangeUrl" : {
          "description" : "OAuth token exchange URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$"
        },
        "Scopes" : {
          "description" : "OAuth scopes",
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        },
        "ExchangeParameters" : {
          "description" : "OAuth token exchange parameters",
          "type" : "object"
        }
      },
      "required" : [ "ClientId", "ClientSecret", "ExchangeUrl" ],
      "additionalProperties" : false
    },
    "GitLabDetails" : {
      "description" : "GitLab service configuration",
      "type" : "object",
      "properties" : {
        "TargetUrl" : {
          "description" : "GitLab instance URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?(?::[0-9]{1,5})?/?$"
        },
        "TokenType" : {
          "description" : "Type of GitLab access token",
          "type" : "string",
          "enum" : [ "personal", "group" ]
        },
        "TokenValue" : {
          "description" : "GitLab access token value",
          "type" : "string",
          "pattern" : "^glpat-[a-zA-Z0-9._-]+$"
        },
        "GroupId" : {
          "description" : "Optional GitLab group ID for group-level access tokens",
          "type" : "string"
        }
      },
      "required" : [ "TargetUrl", "TokenType", "TokenValue" ],
      "additionalProperties" : false
    },
    "OAuthClientDetails" : {
      "description" : "OAuth client credentials",
      "type" : "object",
      "properties" : {
        "ClientName" : {
          "description" : "User friendly OAuth client name",
          "type" : "string"
        },
        "ClientId" : {
          "description" : "OAuth client ID",
          "type" : "string"
        },
        "ClientSecret" : {
          "description" : "OAuth client secret",
          "type" : "string"
        },
        "ExchangeParameters" : {
          "description" : "OAuth token exchange parameters",
          "type" : "object"
        }
      },
      "required" : [ "ClientId", "ClientSecret" ],
      "additionalProperties" : false
    },
    "ApiKeyDetails" : {
      "description" : "API key authentication details",
      "type" : "object",
      "properties" : {
        "ApiKeyName" : {
          "description" : "User friendly API key name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_\\s-]+$"
        },
        "ApiKeyValue" : {
          "description" : "API key value",
          "type" : "string",
          "pattern" : "^[!-~]([ \\t]*[!-~])*$"
        },
        "ApiKeyHeader" : {
          "description" : "HTTP header name to send the API key",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9-]+$"
        }
      },
      "required" : [ "ApiKeyName", "ApiKeyValue", "ApiKeyHeader" ],
      "additionalProperties" : false
    },
    "BearerTokenDetails" : {
      "description" : "Bearer token authentication details",
      "type" : "object",
      "properties" : {
        "TokenName" : {
          "description" : "User friendly bearer token name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_\\s-]+$"
        },
        "TokenValue" : {
          "description" : "Bearer token value",
          "type" : "string",
          "pattern" : "^[\\S]+$"
        },
        "AuthorizationHeader" : {
          "description" : "HTTP header name to send the bearer token",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9-]+$",
          "default" : "Authorization"
        }
      },
      "required" : [ "TokenName", "TokenValue" ],
      "additionalProperties" : false
    },
    "MCPServerSplunkDetails" : {
      "description" : "Splunk MCP server configuration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_-]+$"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$"
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string",
          "maxLength" : 500
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/MCPServerSplunkAuthorizationConfig"
        }
      },
      "required" : [ "Name", "Endpoint", "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "MCPServerGrafanaDetails" : {
      "description" : "Grafana MCP server configuration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string",
          "pattern" : "^[a-zA-Z0-9_-]+$"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string",
          "pattern" : "^https://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$"
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string",
          "maxLength" : 500
        },
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/MCPServerGrafanaAuthorizationConfig"
        }
      },
      "required" : [ "Name", "Endpoint", "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "MCPServerGrafanaAuthorizationConfig" : {
      "description" : "Grafana MCP server authorization configuration",
      "type" : "object",
      "oneOf" : [ {
        "properties" : {
          "BearerToken" : {
            "$ref" : "#/definitions/BearerTokenDetails"
          }
        },
        "required" : [ "BearerToken" ],
        "additionalProperties" : false
      } ]
    },
    "NewRelicServiceDetails" : {
      "description" : "New Relic service configuration",
      "type" : "object",
      "properties" : {
        "AuthorizationConfig" : {
          "$ref" : "#/definitions/NewRelicAuthorizationConfig"
        }
      },
      "required" : [ "AuthorizationConfig" ],
      "additionalProperties" : false
    },
    "NewRelicAuthorizationConfig" : {
      "description" : "New Relic authorization configuration",
      "type" : "object",
      "properties" : {
        "ApiKey" : {
          "$ref" : "#/definitions/NewRelicApiKeyConfig"
        }
      },
      "required" : [ "ApiKey" ],
      "additionalProperties" : false
    },
    "NewRelicApiKeyConfig" : {
      "description" : "New Relic API key configuration",
      "type" : "object",
      "properties" : {
        "ApiKey" : {
          "description" : "New Relic User API Key",
          "type" : "string",
          "pattern" : "^NRAK-[A-Z0-9]+$"
        },
        "AccountId" : {
          "description" : "New Relic Account ID",
          "type" : "string",
          "pattern" : "^[0-9]+$"
        },
        "Region" : {
          "description" : "New Relic region",
          "type" : "string",
          "enum" : [ "US", "EU" ]
        },
        "ApplicationIds" : {
          "description" : "List of monitored APM application IDs",
          "type" : "array",
          "items" : {
            "type" : "string",
            "pattern" : "^[0-9]+$"
          }
        },
        "EntityGuids" : {
          "description" : "List of globally unique IDs for New Relic resources",
          "type" : "array",
          "items" : {
            "type" : "string",
            "pattern" : "^[a-zA-Z0-9_.-]+$"
          }
        },
        "AlertPolicyIds" : {
          "description" : "List of alert policy IDs",
          "type" : "array",
          "items" : {
            "type" : "string",
            "pattern" : "^[0-9]+$"
          }
        }
      },
      "required" : [ "ApiKey", "AccountId", "Region" ],
      "additionalProperties" : false
    },
    "AzureIdentityServiceDetails" : {
      "description" : "Azure Identity service configuration for federated identity",
      "type" : "object",
      "properties" : {
        "TenantId" : {
          "description" : "Azure AD tenant ID",
          "type" : "string",
          "pattern" : "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "ClientId" : {
          "description" : "Azure AD application client ID",
          "type" : "string",
          "pattern" : "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "WebIdentityRoleArn" : {
          "description" : "ARN of the IAM role for web identity token exchange",
          "type" : "string",
          "pattern" : "^arn:aws[a-zA-Z-]*:iam::[0-9]{12}:role/.+$"
        },
        "WebIdentityTokenAudiences" : {
          "description" : "List of audiences for the web identity token",
          "type" : "array",
          "minItems" : 1,
          "items" : {
            "type" : "string"
          }
        }
      },
      "required" : [ "TenantId", "ClientId", "WebIdentityRoleArn", "WebIdentityTokenAudiences" ],
      "additionalProperties" : false
    },
    "AdditionalServiceDetails" : {
      "description" : "Additional details specific to the service type returned after registration",
      "type" : "object",
      "oneOf" : [ {
        "properties" : {
          "MCPServer" : {
            "$ref" : "#/definitions/RegisteredMCPServerDetails"
          }
        },
        "required" : [ "MCPServer" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "GitLab" : {
            "$ref" : "#/definitions/RegisteredGitLabServiceDetails"
          }
        },
        "required" : [ "GitLab" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerSplunk" : {
            "$ref" : "#/definitions/RegisteredMCPServerDetails"
          }
        },
        "required" : [ "MCPServerSplunk" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerNewRelic" : {
            "$ref" : "#/definitions/RegisteredNewRelicDetails"
          }
        },
        "required" : [ "MCPServerNewRelic" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "Dynatrace" : {
            "$ref" : "#/definitions/RegisteredDynatraceDetails"
          }
        },
        "required" : [ "Dynatrace" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "ServiceNow" : {
            "$ref" : "#/definitions/RegisteredServiceNowDetails"
          }
        },
        "required" : [ "ServiceNow" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "PagerDuty" : {
            "$ref" : "#/definitions/RegisteredPagerDutyDetails"
          }
        },
        "required" : [ "PagerDuty" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "AzureIdentity" : {
            "$ref" : "#/definitions/RegisteredAzureIdentityDetails"
          }
        },
        "required" : [ "AzureIdentity" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerSigV4" : {
            "$ref" : "#/definitions/RegisteredMCPServerSigV4Details"
          }
        },
        "required" : [ "MCPServerSigV4" ],
        "additionalProperties" : false
      }, {
        "properties" : {
          "MCPServerGrafana" : {
            "$ref" : "#/definitions/RegisteredMCPServerGrafanaDetails"
          }
        },
        "required" : [ "MCPServerGrafana" ],
        "additionalProperties" : false
      } ]
    },
    "RegisteredMCPServerDetails" : {
      "description" : "MCP server details returned after registration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string"
        },
        "AuthorizationMethod" : {
          "description" : "MCP server authorization method",
          "type" : "string",
          "enum" : [ "oauth-client-credentials", "api-key", "bearer-token" ]
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string"
        },
        "ApiKeyHeader" : {
          "description" : "API key header name if using API key authentication",
          "type" : "string"
        }
      },
      "required" : [ "Name", "Endpoint", "AuthorizationMethod" ],
      "additionalProperties" : false
    },
    "RegisteredMCPServerGrafanaDetails" : {
      "description" : "Grafana MCP server details returned after registration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "MCP server name",
          "type" : "string"
        },
        "Endpoint" : {
          "description" : "MCP server endpoint URL",
          "type" : "string"
        },
        "AuthorizationMethod" : {
          "description" : "MCP server authorization method",
          "type" : "string",
          "enum" : [ "bearer-token" ]
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string"
        }
      },
      "required" : [ "Endpoint", "AuthorizationMethod" ],
      "additionalProperties" : false
    },
    "RegisteredNewRelicDetails" : {
      "description" : "New Relic service details returned after registration",
      "type" : "object",
      "properties" : {
        "AccountId" : {
          "description" : "New Relic account ID",
          "type" : "string"
        },
        "Region" : {
          "description" : "New Relic region",
          "type" : "string",
          "enum" : [ "US", "EU" ]
        },
        "Description" : {
          "description" : "Optional user description",
          "type" : "string"
        }
      },
      "required" : [ "AccountId", "Region" ],
      "additionalProperties" : false
    },
    "RegisteredGitLabServiceDetails" : {
      "description" : "GitLab service details returned after registration",
      "type" : "object",
      "properties" : {
        "TargetUrl" : {
          "description" : "GitLab instance URL",
          "type" : "string"
        },
        "TokenType" : {
          "description" : "Type of GitLab access token",
          "type" : "string",
          "enum" : [ "personal", "group" ]
        },
        "GroupId" : {
          "description" : "Optional GitLab group ID for group-level access tokens",
          "type" : "string"
        }
      },
      "required" : [ "TargetUrl", "TokenType" ],
      "additionalProperties" : false
    },
    "RegisteredDynatraceDetails" : {
      "description" : "Dynatrace service details returned after registration",
      "type" : "object",
      "properties" : {
        "AccountUrn" : {
          "description" : "Dynatrace resource account URN",
          "type" : "string"
        }
      },
      "required" : [ "AccountUrn" ],
      "additionalProperties" : false
    },
    "RegisteredServiceNowDetails" : {
      "description" : "ServiceNow service details returned after registration",
      "type" : "object",
      "properties" : {
        "InstanceUrl" : {
          "description" : "ServiceNow instance URL",
          "type" : "string"
        }
      },
      "required" : [ "InstanceUrl" ],
      "additionalProperties" : false
    },
    "RegisteredPagerDutyDetails" : {
      "description" : "PagerDuty service details returned after registration",
      "type" : "object",
      "properties" : {
        "Scopes" : {
          "description" : "The scopes assigned to the service",
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        }
      },
      "required" : [ "Scopes" ],
      "additionalProperties" : false
    },
    "RegisteredAzureIdentityDetails" : {
      "description" : "Azure Identity service details returned after registration",
      "type" : "object",
      "properties" : {
        "TenantId" : {
          "description" : "Azure AD tenant ID",
          "type" : "string",
          "pattern" : "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "ClientId" : {
          "description" : "Azure AD application client ID",
          "type" : "string",
          "pattern" : "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "WebIdentityRoleArn" : {
          "description" : "ARN of the IAM role for web identity token exchange",
          "type" : "string",
          "pattern" : "^arn:aws[a-zA-Z-]*:iam::[0-9]{12}:role/.+$"
        },
        "WebIdentityTokenAudiences" : {
          "description" : "List of audiences for the web identity token",
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        }
      },
      "required" : [ "TenantId", "ClientId", "WebIdentityRoleArn", "WebIdentityTokenAudiences" ],
      "additionalProperties" : false
    },
    "RegisteredMCPServerSigV4Details" : {
      "description" : "SigV4-authenticated MCP server details returned after registration",
      "type" : "object",
      "properties" : {
        "Name" : {
          "description" : "The MCP server name",
          "type" : "string"
        },
        "Endpoint" : {
          "description" : "The MCP server endpoint URL",
          "type" : "string"
        },
        "Description" : {
          "description" : "Optional description for the MCP server",
          "type" : "string"
        },
        "Region" : {
          "description" : "AWS region for SigV4 signing",
          "type" : "string"
        },
        "Service" : {
          "description" : "AWS service name for SigV4 signing",
          "type" : "string"
        },
        "RoleArn" : {
          "description" : "IAM role ARN for SigV4 signing",
          "type" : "string"
        },
        "CustomHeaders" : {
          "description" : "Custom headers for the SigV4 MCP server",
          "type" : "object",
          "patternProperties" : {
            "^[a-zA-Z0-9-_]+$" : {
              "type" : "string"
            }
          },
          "additionalProperties" : false
        }
      },
      "required" : [ "Name", "Endpoint", "Region", "Service", "RoleArn" ],
      "additionalProperties" : false
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key name of the tag.",
          "minLength" : 1,
          "maxLength" : 128
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag.",
          "minLength" : 0,
          "maxLength" : 256
        }
      },
      "required" : [ "Key", "Value" ]
    }
  },
  "properties" : {
    "ServiceId" : {
      "description" : "The unique identifier of the service",
      "$ref" : "#/definitions/ServiceId"
    },
    "ServiceType" : {
      "description" : "The type of service being registered",
      "$ref" : "#/definitions/ServiceType"
    },
    "ServiceDetails" : {
      "description" : "Service-specific configuration details for create operation",
      "$ref" : "#/definitions/ServiceDetails"
    },
    "AccessibleResources" : {
      "description" : "List of accessible resources for this service",
      "type" : "array",
      "items" : {
        "type" : "object",
        "patternProperties" : {
          ".*" : {
            "type" : "string"
          }
        }
      }
    },
    "AdditionalServiceDetails" : {
      "description" : "Additional details specific to the service type",
      "$ref" : "#/definitions/AdditionalServiceDetails"
    },
    "KmsKeyArn" : {
      "description" : "The ARN of the KMS key to use for encryption.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 2048
    },
    "Arn" : {
      "description" : "The Amazon Resource Name (ARN) of the Service.",
      "type" : "string"
    },
    "Tags" : {
      "description" : "An array of key-value pairs to apply to this resource.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    }
  },
  "additionalProperties" : false,
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "aidevops:TagResource", "aidevops:UntagResource", "aidevops:ListTagsForResource" ]
  },
  "required" : [ "ServiceType" ],
  "readOnlyProperties" : [ "/properties/ServiceId", "/properties/AccessibleResources", "/properties/AdditionalServiceDetails", "/properties/Arn" ],
  "writeOnlyProperties" : [ "/properties/ServiceDetails" ],
  "createOnlyProperties" : [ "/properties/ServiceType", "/properties/ServiceDetails/Dynatrace", "/properties/ServiceDetails/MCPServer", "/properties/ServiceDetails/MCPServerSplunk", "/properties/ServiceDetails/MCPServerNewRelic", "/properties/ServiceDetails/GitLab", "/properties/ServiceDetails/ServiceNow", "/properties/ServiceDetails/PagerDuty", "/properties/ServiceDetails/AzureIdentity", "/properties/ServiceDetails/MCPServerGrafana", "/properties/KmsKeyArn" ],
  "primaryIdentifier" : [ "/properties/ServiceId" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "aidevops:RegisterService", "aidevops:GetService", "aidevops:TagResource", "aidevops:ListTagsForResource", "iam:CreateServiceLinkedRole", "iam:PassRole", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyPair", "kms:GenerateDataKeyPairWithoutPlaintext", "kms:GenerateDataKeyWithoutPlaintext", "kms:ReEncryptFrom", "kms:ReEncryptTo" ]
    },
    "read" : {
      "permissions" : [ "aidevops:GetService", "aidevops:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "aidevops:UpdateService", "aidevops:GetService", "aidevops:TagResource", "aidevops:UntagResource", "aidevops:ListTagsForResource" ]
    },
    "delete" : {
      "permissions" : [ "aidevops:DeregisterService", "aidevops:GetService" ]
    },
    "list" : {
      "permissions" : [ "aidevops:ListServices" ]
    }
  }
}