Report a security incident
Agent self-reporting of a security incident. Authenticated by the agent’s own possession proof (AgentAuth, X-Mnemom-Agent-Proof) — not a user/account api-key. 401 on absent/malformed/unmatched proof.
Authorizations
Agent possession proof: the full SHA-256 hex digest of ${apiKey}|${agentName} (or ${apiKey} for an unnamed singleton agent) — the same hash_proof primitive used by POST /v1/agents claim, link-agent, and verify-binding. The server resolves the agent by agent_hash = proof[:16]. The agent's own identity (ADR-API-001 third auth class) — distinct from ApiKeyAuth (X-Mnemom-Api-Key, which resolves a user/account, not an agent).
Body
The body is of type object.
Response
Incident recorded.