operations:
  create:
    description: "Create or update credentials"
    input:
      required: [username, passwordHash]
      optional: []
    output: boolean
    acl_required: ["credential:write"]
    system_only: true
    security:
      audit: true
      never_log_password: true
    errors:
      - VALIDATION_ERROR: "Invalid credential input"
      - NOT_FOUND: "User not found"

  update:
    description: "Update credential password"
    input:
      required: [username, passwordHash]
      optional: []
    output: boolean
    acl_required: ["credential:write"]
    system_only: true
    security:
      audit: true
      never_log_password: true
    errors:
      - NOT_FOUND: "Credential not found"
      - VALIDATION_ERROR: "Invalid credential update"

  delete:
    description: "Delete credential by username"
    input:
      required: [username]
    output: boolean
    acl_required: ["credential:delete"]
    system_only: true
    security:
      audit: true
    errors:
      - NOT_FOUND: "Credential not found"