{
    "success": true,
    "data": {
        "release": "3.1.0",
        "architecture": "Controller -> Service -> Repository",
        "token_model": "opaque-hash-only",
        "refresh_rotation": true,
        "reuse_detection": true,
        "mfa": {
            "totp": "RFC 6238",
            "recovery_codes": "hash-only"
        },
        "email_outbox": {
            "recipient": "ciphertext",
            "lookup": "sha256",
            "payload": "ciphertext"
        },
        "runtime": {
            "ready": true,
            "runtime_ready": false,
            "activation_status": "foundation-installed-runtime-locked",
            "summary": {
                "runtime_profiles": 1,
                "queued_email": 0,
                "login_attempts_24h": 0,
                "pending_mfa_challenges": 0,
                "security_notifications": 0,
                "active_sessions": 0
            },
            "profile": {
                "profile_key": "default",
                "environment": "demo",
                "status": "foundation",
                "writes_enabled": 0,
                "email_delivery_enabled": 0,
                "require_verified_email": 1,
                "require_mfa_privileged": 1,
                "activated_at": null,
                "updated_at": "2026-07-27 11:15:27",
                "readiness": {
                    "release": "3.0.0",
                    "state": "foundation-installed-runtime-locked",
                    "required": [
                        "https",
                        "allowed_hosts",
                        "secret_key",
                        "mail_sender",
                        "privacy_policy",
                        "csrf",
                        "rate_limit",
                        "audit_logging"
                    ]
                }
            },
            "checks": [
                {
                    "code": "runtime_mode",
                    "label": "Runtime-modus",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Zet auth_runtime.mode uitsluitend na acceptatietests op runtime."
                },
                {
                    "code": "writes_switch",
                    "label": "Accountwrites",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Zowel auth als auth_runtime moeten writes expliciet toestaan."
                },
                {
                    "code": "auth_registration",
                    "label": "Registratiepoort",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "auth_login",
                    "label": "Loginpoort",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer login in beide configuratielagen."
                },
                {
                    "code": "auth_email_verification",
                    "label": "E-mailverificatiepoort",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer e-mailverificatie pas na outbox- en afleverproeven."
                },
                {
                    "code": "auth_password_reset",
                    "label": "Wachtwoordherstelpoort",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer wachtwoordherstel pas na token- en afleverproeven."
                },
                {
                    "code": "auth_mfa_enrollment",
                    "label": "MFA-enrollmentpoort",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer MFA-enrollment pas na TOTP- en recoverytests."
                },
                {
                    "code": "publication_auth_ready",
                    "label": "Authenticatieacceptatie",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Markeer authenticatie pas gereed na het volledige acceptatieplan."
                },
                {
                    "code": "publication_object_auth",
                    "label": "Objectautorisatieacceptatie",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Objectniveau-autorisatie moet aantoonbaar gereed zijn."
                },
                {
                    "code": "https",
                    "label": "HTTPS afgedwongen",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "allowed_hosts",
                    "label": "Toegestane hosts",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "allowed_origins",
                    "label": "Toegestane origins",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "secret_key",
                    "label": "Encryptiesleutel",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Configureer een afzonderlijke sleutel van minimaal 32 bytes."
                },
                {
                    "code": "crypto",
                    "label": "Secretcryptografie",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "email_sender",
                    "label": "Mailafzender",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Configureer een geverifieerd afzenderadres."
                },
                {
                    "code": "email_delivery",
                    "label": "E-maildelivery",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer delivery pas na provider- en domeintests."
                },
                {
                    "code": "email_worker",
                    "label": "Mailworker",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Activeer de afzonderlijke outboxworker pas na end-to-end tests."
                },
                {
                    "code": "email_transport",
                    "label": "Mailtransport",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Configureer native_mail of voeg een gecontroleerde provideradapter toe."
                },
                {
                    "code": "public_base_url",
                    "label": "Publieke account-URL",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "privacy_policy",
                    "label": "Privacybeleid",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "terms_policy",
                    "label": "Gebruiksvoorwaarden",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "runtime_migration",
                    "label": "Runtime-migratie",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "auth_migration",
                    "label": "Authenticatiemigratie",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "privacy_migration",
                    "label": "Privacymigratie",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "csrf",
                    "label": "CSRF-bescherming",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "rate_limit",
                    "label": "Rate limiting",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "audit",
                    "label": "Auditlogging",
                    "pass": true,
                    "status": "pass",
                    "remediation": null
                },
                {
                    "code": "production_gate",
                    "label": "Publicatiepoort",
                    "pass": false,
                    "status": "fail",
                    "remediation": "Gebruik staging of productie en open de publicatiepoort bewust."
                }
            ],
            "blocking_count": 14,
            "config": {
                "release": "3.0.0",
                "mode": "foundation",
                "writes_enabled": false,
                "registration_enabled": false,
                "login_enabled": false,
                "email_delivery_enabled": false,
                "email_worker_enabled": false,
                "email_transport": "disabled",
                "email_sender_configured": false,
                "public_base_url_configured": true,
                "allowed_origin_count": 1,
                "require_verified_email": true,
                "require_mfa_for_privileged_roles": true,
                "email_verification_ttl_seconds": 86400,
                "password_reset_ttl_seconds": 3600,
                "mfa_challenge_ttl_seconds": 300,
                "max_failed_logins": 5,
                "lockout_seconds": 900
            },
            "database": {
                "auth_migration": true,
                "privacy_migration": true,
                "runtime_migration": true,
                "active_privacy_policy": true,
                "active_terms_policy": true
            },
            "write_error_code": "AUTH_RUNTIME_NOT_READY"
        }
    },
    "meta": {
        "api_version": "v1",
        "release": "3.1.0",
        "runtime": "secure-account"
    }
}