feat: add PATCH /plg/onboard/:onboardingId for waitlist bypass

.gitignore

@@ -24,3 +24,4 @@ admin-idp-p*.json
 # V1 to V2 migration scripts and test data (local only)
 scripts/
 docs/index.html
+mcp-server.log

docs/openapi/api.yaml

@@ -534,6 +534,8 @@ paths:
     $ref: './plg-onboarding-api.yaml#/plg-onboard'
   /plg/sites:
     $ref: './plg-onboarding-api.yaml#/plg-sites'
+  /plg/onboard/{onboardingId}:
+    $ref: './plg-onboarding-api.yaml#/plg-onboard-update'
   /plg/onboard/status/{imsOrgId}:
     $ref: './plg-onboarding-api.yaml#/plg-onboard-status'
 

docs/openapi/plg-onboarding-api.yaml

@@ -98,6 +98,85 @@ plg-sites:
     security:
       - ims_key: [ ]
 
+plg-onboard-update:
+  parameters:
+    - name: onboardingId
+      in: path
+      required: true
+      schema:
+        $ref: './schemas.yaml#/Id'
+      description: The PLG onboarding record ID
+  patch:
+    tags:
+      - plg
+    summary: Review a waitlisted PLG onboarding
+    description: |
+      Admin-only endpoint for ESEs to review a waitlisted PLG onboarding.
+      Supports BYPASSED (skip the blocking check and re-run the onboarding flow)
+      or UPHELD (block stands, no re-run).
+
+      Behavior per waitlist reason:
+      - **DOMAIN_ALREADY_ONBOARDED_IN_ORG**: Sets the old onboarded domain to INACTIVE,
+        then re-runs the flow for the new domain.
+      - **AEM_SITE_CHECK**: Requires `siteConfig.rumHost`. Derives delivery config (AEM CS)
+        or code/hlx config (AEM EDS) from rumHost, then re-runs the flow.
+      - **DOMAIN_ALREADY_ASSIGNED**: Sets the current record to INACTIVE, then runs the
+        flow under the existing org that owns the site.
+    operationId: updatePlgOnboard
+    requestBody:
+      required: true
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - decision
+              - justification
+            properties:
+              decision:
+                type: string
+                enum:
+                  - BYPASSED
+                  - UPHELD
+                description: "BYPASSED: skip check and resume onboarding. UPHELD: block stands."
+              justification:
+                type: string
+                description: ESE's reason for the decision
+                example: "Customer confirmed AEM migration in progress"
+              siteConfig:
+                type: object
+                description: Required for AEM_SITE_CHECK bypass. Provide rumHost.
+                properties:
+                  rumHost:
+                    type: string
+                    description: |
+                      The RUM host for the site. For AEM CS: publish-p{programId}-e{envId}.adobeaemcloud.com.
+                      For AEM EDS: ref--repo--owner.aem.live.
+                    example: "publish-p123-e456.adobeaemcloud.com"
+    responses:
+      '200':
+        description: |
+          BYPASSED: onboarding flow result (ONBOARDED or re-waitlisted at different check).
+          UPHELD: record returned as-is with WAITLISTED status.
+        content:
+          application/json:
+            schema:
+              $ref: './schemas.yaml#/PlgOnboarding'
+      '400':
+        $ref: './responses.yaml#/400'
+      '401':
+        $ref: './responses.yaml#/401'
+      '403':
+        $ref: './responses.yaml#/403'
+      '404':
+        $ref: './responses.yaml#/404'
+      '409':
+        description: Conflict - PLG onboarding already exists for domain under existing org
+      '500':
+        $ref: './responses.yaml#/500'
+    security:
+      - admin_key: [ ]
+
 plg-onboard-status:
   parameters:
     - $ref: './parameters.yaml#/imsOrgId'

docs/openapi/schemas.yaml

@@ -6779,6 +6779,7 @@ PlgOnboarding:
         - ERROR
         - WAITING_FOR_IP_ALLOWLISTING
         - WAITLISTED
+        - INACTIVE
       example: "ONBOARDED"
     siteId:
       $ref: '#/Id'
@@ -6852,6 +6853,34 @@ PlgOnboarding:
         - 'null'
       description: Reason for waitlisting, if applicable
       example: null
+    reviews:
+      type:
+        - array
+        - 'null'
+      description: Array of ESE review decisions for waitlisted onboardings
+      items:
+        type: object
+        properties:
+          reason:
+            type: string
+            description: The waitlist reason at the time of review
+          decision:
+            type: string
+            enum:
+              - BYPASSED
+              - UPHELD
+            description: "BYPASSED: skip check and resume. UPHELD: block stands."
+          reviewedBy:
+            type: string
+            description: Email of the ESE who made the decision
+          reviewedAt:
+            type: string
+            format: date-time
+            description: Timestamp of the review
+          justification:
+            type: string
+            description: ESE's reason for the decision
+      example: null
     completedAt:
       $ref: '#/DateTime'
     createdAt: