virtual_api:
  # Required
  name: string              # Unique identifier
  source: string            # Enrolled data source name

  # Optional
  description: string       # Human-readable description
  endpoint: string          # Source endpoint to expose
  version: string           # Semantic version (auto-incremented if omitted)

  # Control Blocks
  controls:
    - type: redact | tokenize | anonymize | combine | coalesce
      # ... control-specific options

  # Access Controls
  access:
    expires: date           # ISO 8601 date or relative (e.g., "90d")
    geo_allow: [string]     # Country codes
    geo_deny: [string]      # Country codes
    ip_allow: [string]      # CIDR ranges
    rate_limit:
      requests: number
      period: string        # e.g., "1h", "1d"

  # Delivery
  delivery:
    type: rest | mcp | data_lake
    # ... delivery-specific options

  # Marketplace (optional)
  marketplace:
    listed: boolean
    visibility: public | internal
    pricing:
      model: per_request | subscription | free
      price: number

source:
  name: string              # Unique identifier
  type: rest                # Currently only REST supported
  base_url: string          # Base URL of the API

  auth:
    type: bearer | api_key | basic
    # ... auth-specific options

  endpoints:
    - path: string          # e.g., "/customers"
      method: GET | POST    # HTTP method

  schema:                   # Optional explicit schema
    /path:
      type: object | array
      properties: { ... }

- type: redact
  fields:
    - field_name
    - nested.field
    - array[].field

- type: tokenize
  fields:
    - field_name

- type: anonymize
  fields:
    - field_name

- type: combine
  fields:
    - first_field
    - second_field
  into: new_field_name
  separator: string         # Default: " "
  remove_source: boolean    # Default: false

- type: coalesce
  fields:
    - primary_field
    - fallback_field
  into: new_field_name

auth:
  type: bearer
  token: ${ENV_VAR}

auth:
  type: api_key
  header: X-API-Key
  key: ${ENV_VAR}

auth:
  type: api_key
  param: api_key
  key: ${ENV_VAR}

auth:
  type: basic
  username: ${USERNAME}
  password: ${PASSWORD}

delivery:
  type: rest
  keys:
    - name: string
      expires: date
      rate_limit: string    # e.g., "1000/h"

delivery:
  type: mcp
  oauth:
    enabled: true

delivery:
  type: data_lake
  destination:
    type: databricks | snowflake | fabric | bigquery
    # ... destination-specific options
  sync:
    schedule: hourly | daily | weekly
    mode: full | incremental

auth:
  token: ${API_TOKEN}