openapi: 3.0.3
info:
  title: werkmail API
  version: "1.0"
  description: |
    Compliance email API for medical practices (EU/DACH).
    Authenticated routes use Bearer OTP session or ADMIN_API_TOKEN.
    Public inbound send uses per-practice hook secrets.
servers:
  - url: https://werkmail-production.up.railway.app
    description: Production
paths:
  /healthz:
    get:
      summary: Liveness
      responses:
        "200":
          description: OK (includes cached cheap-tier `vdm` flags; never enables Global dashboard)
  /api/ops/digest:
    get:
      summary: Ops digest (abuse + cheap SES VDM)
      security:
        - bearerAuth: []
      responses:
        "200":
          description: 24h ops snapshot including `vdm` cheap-tier status
  /api/ops/vdm:
    get:
      summary: Cheap SES-deliverability VDM snapshot
      description: Advisor + ISP metrics. Never subscribes to Global / $1,250 dashboard.
      security:
        - bearerAuth: []
      responses:
        "200":
          description: VDM account status and stored metrics
  /openapi.yaml:
    get:
      summary: This OpenAPI document
      responses:
        "200":
          description: YAML
  /api/practices/{id}/send:
    post:
      summary: Send transactional or broadcast email
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
        - name: Idempotency-Key
          in: header
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SendRequest"
      responses:
        "202":
          description: Accepted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SendResult"
  /api/public/hooks/{id}/send:
    post:
      summary: Inbound send webhook (Zapier/Make/n8n)
      description: |
        Authenticate with header `X-Werkmail-Hook-Secret`.
        Same body as `/api/practices/{id}/send`.
      parameters:
        - $ref: "#/components/parameters/practiceId"
        - name: X-Werkmail-Hook-Secret
          in: header
          required: true
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SendRequest"
      responses:
        "202":
          description: Accepted
        "401":
          description: Invalid secret
  /api/public/ses-inbound:
    post:
      summary: SNS endpoint for SES Received notifications
      requestBody:
        content:
          application/json:
            schema:
              type: object
      responses:
        "200":
          description: ok
  /api/practices/{id}/inbound:
    get:
      summary: Inbound receiving status and MX checklist
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Status
    patch:
      summary: Update inbound webhook URL
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Status
  /api/practices/{id}/inbound/enable:
    post:
      summary: Enable SES receiving for in.<domain>
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Enabled
        "403":
          description: IAM pending
        "409":
          description: Domain identity not verified
        "503":
          description: Server inbound topic missing
  /api/practices/{id}/inbound-hooks:
    get:
      summary: List inbound send hooks
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Hooks
    post:
      summary: Create inbound send hook
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
      responses:
        "201":
          description: Created (includes secret)
  /api/practices/{id}/alerts:
    get:
      summary: List Slack/Teams alert endpoints
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Endpoints
    post:
      summary: Create Slack or Teams alert endpoint
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [kind, url]
              properties:
                name:
                  type: string
                kind:
                  type: string
                  enum: [slack, teams]
                url:
                  type: string
                  format: uri
                events:
                  type: array
                  items:
                    type: string
      responses:
        "201":
          description: Created
  /api/practices/{id}/webhooks:
    get:
      summary: List signed outbound webhooks
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "200":
          description: Webhooks
    post:
      summary: Create signed outbound webhook
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      responses:
        "201":
          description: Created
  /api/practices/{id}/integrations/ics-preview:
    post:
      summary: Preview ICS without sending
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                calendar:
                  $ref: "#/components/schemas/CalendarInvite"
                to:
                  type: string
      responses:
        "200":
          description: ICS text
  /api/practices/{id}/integrations/test-termin:
    post:
      summary: Send test Termin with ICS attachment
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/practiceId"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required: [to]
              properties:
                to:
                  type: string
                calendar:
                  $ref: "#/components/schemas/CalendarInvite"
      responses:
        "200":
          description: Sent
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
  parameters:
    practiceId:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
  schemas:
    CalendarInvite:
      type: object
      required: [summary, starts_at]
      properties:
        summary:
          type: string
        description:
          type: string
        location:
          type: string
        starts_at:
          type: string
          format: date-time
        ends_at:
          type: string
          format: date-time
        all_day:
          type: boolean
        uid:
          type: string
    SendRequest:
      type: object
      required: [to, subject]
      properties:
        from:
          type: string
        to:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
        cc:
          type: array
          items:
            type: string
        bcc:
          type: array
          items:
            type: string
        reply_to:
          type: array
          items:
            type: string
        subject:
          type: string
        text:
          type: string
        html:
          type: string
        text_body:
          type: string
        html_body:
          type: string
        tag:
          type: string
        route:
          type: string
        message_kind:
          type: string
          enum: [termin, recall, doi, transactional, newsletter, custom, quality, test]
        metadata:
          type: object
          additionalProperties:
            type: string
        attachments:
          type: array
          maxItems: 5
          description: >
            Office/PDF/ICS only; max 5 files, 10 MiB each (decoded).
            Archives and executables are rejected.
          items:
            type: object
            required: [filename, content]
            properties:
              filename:
                type: string
                description: Must end in an allowed extension (.pdf, .docx, …); no zip/exe/html
              content:
                type: string
                description: base64
              content_type:
                type: string
        calendar:
          $ref: "#/components/schemas/CalendarInvite"
        settings:
          type: object
          properties:
            track_opens:
              type: boolean
            track_clicks:
              type: boolean
    SendResult:
      type: object
      properties:
        message_id:
          type: string
        id:
          type: string
        status:
          type: string
        error:
          type: string
        warning:
          type: string
