openapi: 3.1.0
info:
  title: YEP API Core
  version: 0.1.0
  description: >
    Contract for the YEP API Core backend. Use this file as the source of truth
    for client apps and AI agents that need to integrate authentication and
    notification workflows.
servers:
  - url: http://localhost:3000
    description: Local development
  - url: http://yep-api-core-env.eba-535xtwxk.us-east-1.elasticbeanstalk.com
    description: AWS Elastic Beanstalk
tags:
  - name: Health
  - name: Contracts
  - name: Auth
  - name: Notifications
security:
  - bearerAuth: []
paths:
  /:
    get:
      tags:
        - Contracts
      summary: API landing page
      security: []
      responses:
        '200':
          description: Rendered HTML application index
          content:
            text/html:
              schema:
                type: string
              examples:
                default:
                  value: <!doctype html><html lang="es">...</html>
  /contracts:
    get:
      tags:
        - Contracts
      summary: API contracts index page
      security: []
      responses:
        '200':
          description: Rendered HTML page with links to contract artifacts
          content:
            text/html:
              schema:
                type: string
  /openapi.yaml:
    get:
      tags:
        - Contracts
      summary: Machine-readable OpenAPI contract
      security: []
      responses:
        '200':
          description: OpenAPI YAML contract
          content:
            application/yaml:
              schema:
                type: string
  /API_CONTRACTS.md:
    get:
      tags:
        - Contracts
      summary: Human and AI agent contract guide
      security: []
      responses:
        '200':
          description: Rendered HTML guide by default. Send Accept text/markdown or raw=1 for raw Markdown.
          content:
            text/html:
              schema:
                type: string
            text/markdown:
              schema:
                type: string
  /api-contracts.md:
    get:
      tags:
        - Contracts
      summary: Lowercase alias for the contract guide
      security: []
      responses:
        '200':
          description: Rendered HTML guide by default. Send Accept text/markdown or raw=1 for raw Markdown.
          content:
            text/html:
              schema:
                type: string
            text/markdown:
              schema:
                type: string
  /postman/yep_api_core.postman_collection.json:
    get:
      tags:
        - Contracts
      summary: Postman collection
      security: []
      responses:
        '200':
          description: Postman collection JSON
          content:
            application/json:
              schema:
                type: object
  /health:
    get:
      tags:
        - Health
      summary: Service health check
      security: []
      responses:
        '200':
          description: Service is running
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthResponse'
  /auth/register:
    post:
      tags:
        - Auth
      summary: Create an account and owner user
      description: >
        Creates one account and one owner user. The response includes a JWT that
        can be used immediately for protected endpoints.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegisterRequest'
            examples:
              default:
                value:
                  accountName: Tienda Don Pedro
                  firstName: Pedro
                  lastName: Ramirez
                  email: pedro@example.com
                  password: secret123
      responses:
        '201':
          description: Account and owner user created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '409':
          description: Email already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Database unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /auth/login:
    post:
      tags:
        - Auth
      summary: Login with email and password
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
            examples:
              default:
                value:
                  email: pedro@example.com
                  password: secret123
      responses:
        '200':
          description: Login successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '401':
          description: Invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Database unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /auth/me:
    get:
      tags:
        - Auth
      summary: Get the authenticated user
      responses:
        '200':
          description: Authenticated user
          content:
            application/json:
              schema:
                type: object
                required:
                  - user
                properties:
                  user:
                    $ref: '#/components/schemas/User'
        '401':
          description: Missing or invalid bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /notifications/receive:
    post:
      tags:
        - Notifications
      summary: Receive a raw notification
      description: >
        The client must not send accountId. The API derives accountId from the
        JWT and stores the original payload in MongoDB for auditability.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReceiveNotificationRequest'
            examples:
              mobilePayment:
                value:
                  id: 1
                  notification:
                    title: Pago recibido
                    message: Transferencia por $50.000
                    source: mobile
      responses:
        '201':
          description: Notification stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReceiveNotificationResponse'
        '401':
          description: Missing or invalid bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Database unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /notifications:
    get:
      tags:
        - Notifications
      summary: List notifications for the authenticated account
      responses:
        '200':
          description: Notifications scoped to the account in the JWT
          content:
            application/json:
              schema:
                type: object
                required:
                  - notifications
                properties:
                  notifications:
                    type: array
                    items:
                      $ref: '#/components/schemas/Notification'
        '401':
          description: Missing or invalid bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /notifications/{id}:
    get:
      tags:
        - Notifications
      summary: Get one notification by id
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          example: 6a0db8ca3fd601ca31dd6466
      responses:
        '200':
          description: Notification scoped to the account in the JWT
          content:
            application/json:
              schema:
                type: object
                required:
                  - notification
                properties:
                  notification:
                    $ref: '#/components/schemas/Notification'
        '401':
          description: Missing or invalid bearer token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Notification not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  schemas:
    HealthResponse:
      type: object
      required:
        - status
        - service
        - timestamp
      properties:
        status:
          type: string
          example: ok
        service:
          type: string
          example: transaction-processor-api
        timestamp:
          type: string
          format: date-time
    RegisterRequest:
      type: object
      additionalProperties: false
      required:
        - accountName
        - firstName
        - lastName
        - email
        - password
      properties:
        accountName:
          type: string
          minLength: 1
        firstName:
          type: string
          minLength: 1
        lastName:
          type: string
          minLength: 1
        email:
          type: string
          format: email
        password:
          type: string
          minLength: 8
    LoginRequest:
      type: object
      additionalProperties: false
      required:
        - email
        - password
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          minLength: 8
    AuthResponse:
      type: object
      required:
        - accessToken
        - user
      properties:
        accessToken:
          type: string
          description: JWT signed by the API.
        user:
          $ref: '#/components/schemas/User'
    User:
      type: object
      required:
        - id
        - accountId
        - firstName
        - lastName
        - email
        - role
      properties:
        id:
          type: string
        accountId:
          type: string
        firstName:
          type: string
        lastName:
          type: string
        email:
          type: string
          format: email
        role:
          $ref: '#/components/schemas/UserRole'
    UserRole:
      type: string
      enum:
        - owner
        - admin
        - employee
    ReceiveNotificationRequest:
      type: object
      additionalProperties: false
      required:
        - id
        - notification
      properties:
        id:
          type: number
          description: External notification id from the client or source system.
        notification:
          type: object
          additionalProperties: true
          required:
            - source
          properties:
            source:
              $ref: '#/components/schemas/NotificationSource'
            title:
              type: string
            message:
              type: string
    ReceiveNotificationResponse:
      type: object
      required:
        - received
        - id
        - externalId
        - status
        - timestamp
      properties:
        received:
          type: boolean
          example: true
        id:
          type: string
          description: MongoDB notification id.
        externalId:
          type: string
        status:
          $ref: '#/components/schemas/NotificationStatus'
        timestamp:
          type: string
          format: date-time
    Notification:
      type: object
      required:
        - id
        - accountId
        - source
        - rawPayload
        - status
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
        accountId:
          type: string
          description: Derived from the JWT. Clients must not send this in write requests.
        source:
          $ref: '#/components/schemas/NotificationSource'
        externalId:
          type: string
        rawPayload:
          type: object
          additionalProperties: true
        status:
          $ref: '#/components/schemas/NotificationStatus'
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
    NotificationSource:
      type: string
      enum:
        - web
        - mobile
        - whatsapp
        - api
    NotificationStatus:
      type: string
      enum:
        - received
        - processing
        - processed
        - failed
    ErrorResponse:
      type: object
      properties:
        statusCode:
          type: number
        message:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
        error:
          type: string
