{"openapi":"3.1.0","info":{"title":"CommsHarbor","version":"ef1ee6a8","description":"Manage domain email, mailboxes, aliases and durable jobs. Each call uses its organization's identity."},"x-service-info":{"categories":["email","mailbox-management"],"docs":{"homepage":"https://staging.commsharbor.com/","apiReference":"https://staging.commsharbor.com/developers","llms":"https://staging.commsharbor.com/llms.txt","pricing":"https://staging.commsharbor.com/api/pricing","billing":"https://staging.commsharbor.com/api/billing"}},"servers":[{"url":"https://staging.commsharbor.com"}],"externalDocs":{"url":"https://payapi.market/api/commsharbor","description":"PayAPI Market"},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"Use an organisation API key (`mmk_…`) for permitted work in that organisation. Account operations require the shared account session. Paid routes accept a global credit token (`cred_…`). Monthly purchases require a recent human session."},"globalAccount":{"type":"apiKey","in":"cookie","name":"__Host-mm-auth","description":"Global session in the product's HttpOnly cookie; writes require exact Origin and X-CSRF-Token."},"contaChaveApi":{"type":"http","scheme":"bearer","bearerFormat":"mmk_…","description":"Account API key: `Authorization: Bearer mmk_…` or `X-Api-Key: mmk_…`. Created on the account page (API keys), valid only in the product where it was created; it acts as the account (or the organization that owns it)."},"carteiraAgente":{"type":"http","scheme":"bearer","bearerFormat":"mmw_…","description":"Wallet credential of an agent without an account (`Authorization: Bearer mmw_…`, 30 days, this product only): POST /api/auth/wallet/agent/start, check that the domain and URI of the message are the host and origin that you called, sign the message with the wallet, POST /api/auth/wallet/agent/token. The owner is `x402:<address>`."}},"schemas":{"ApiIndex":{"type":"object","properties":{"name":{"type":"string","description":"Product name."},"description":{"type":"string","description":"What the product does, in one sentence."},"build":{"type":"string","description":"Deployed commit."},"environment":{"type":"string","description":"Which environment answered: `production` or `local`."},"base_url":{"type":"string","description":"Origin this API is served from."},"docs":{"type":"object","description":"Links to llms.txt, llms-full.txt, openapi.json, the MCP endpoint and the human UI."},"auth":{"type":"object","description":"Every authentication mode and how to obtain it."},"endpoints":{"type":"array","items":{"type":"object"},"description":"Every endpoint with method, path, auth, absolute URL and what it returns."},"mcp":{"type":"object","description":"Remote MCP endpoint and transport."},"mcp_tools":{"type":"array","items":{"type":"string"},"description":"Name of every MCP tool."}},"required":["name","description","build","environment","base_url","docs","auth","endpoints","mcp","mcp_tools"],"description":"The self-describing index of the whole API."},"Health":{"type":"object","properties":{"ok":{"type":"boolean","description":"Always true when the Worker answers."},"app":{"type":"string","description":"Product name."},"build":{"type":"string","description":"Deployed commit; CI passes the short SHA at deploy time."},"environment":{"type":"string","description":"Which environment answered."},"timestamp":{"type":"string","description":"Response time (UTC, ISO-8601)."}},"required":["ok","app","build","environment","timestamp"],"description":"Liveness and the commit currently serving. Smoke tests wait for their own deploy here instead of racing edge propagation."},"User":{"type":"object","properties":{"id":{"type":"string","description":"User ID."},"email":{"type":"string","description":"Email address verified by the global account."}},"required":["id","email"],"description":"The person behind the session."},"Profile":{"type":"object","properties":{"name":{"type":"string","description":"Name shown in the interface (empty until the person sets one)."},"locale":{"type":"string","description":"Preferred language, e.g. `pt-BR` or `en`."},"timeZone":{"type":"string","description":"IANA time zone, e.g. `America/Sao_Paulo`."},"theme":{"type":"string","description":"`light`, `dark` or `system`."},"revision":{"type":"integer","description":"Optimistic revision of the profile."}},"required":["name","locale","timeZone","theme","revision"],"description":"Global MM profile. It belongs to the person, edited on the account, not to any organization."},"Identity":{"type":"object","properties":{"kind":{"type":"string","description":"How the identity was resolved.","enum":["session","api_key"]},"organizationId":{"type":"string","description":"The active organization."},"userId":{"type":"string","description":"The person's shared-account ID (session only)."},"sessionId":{"type":"string","description":"Session identifier (session only)."},"apiKeyId":{"type":"string","description":"The organization API key's ID (API key only)."},"scopes":{"type":"array","items":{"type":"string"},"description":"What the API key may do (API key only): the work permissions, never billing, erasure, exports or audit."},"role":{"type":"string","description":"Role inside that organization, from the shared account; null with an API key.","nullable":true,"enum":["owner","admin","member",null]},"organization":{"type":"object","description":"`{ id, name }` of the active organization; `name` is null with an API key."}},"required":["kind","organizationId","userId","sessionId","apiKeyId","scopes","role","organization"],"description":"Who the current session or API key resolves to. Read this before a write when you are not sure which organization is active."},"Organization":{"type":"object","properties":{"id":{"type":"string","description":"Organization ID in the shared account, used in every tenant route."},"name":{"type":"string","description":"Display name, from the shared account; null with an organization API key.","nullable":true},"role":{"type":"string","description":"Your role in it, from the shared account; null with an organization API key.","nullable":true,"enum":["owner","admin","member",null]},"email_workspace":{"type":"string","description":"Tenant-scoped email workspace URL. Read it for the current plan, allowances and resources."}},"required":["id","name","role","email_workspace"],"description":"A tenant, opened by id. It lives in the shared account (name, members, roles); CommsHarbor adds the plan. Every piece of customer data in this product is scoped to exactly one."},"PageCamelAuditEvent":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AuditEvent"},"description":"The records on this page."},"nextCursor":{"type":"string","description":"Cursor for the next page; null when there are no more.","nullable":true}},"required":["items","nextCursor"],"description":"The same listing with the cursor in camelCase. Older resources ship it this way and the name is kept because changing it would break clients already reading it."},"AuditEvent":{"type":"object","properties":{"id":{"type":"string","description":"Event ID."},"action":{"type":"string","description":"What happened, e.g. `domain.created`."},"actor_user_id":{"type":"string","description":"Who did it; null when the actor was a key or the system.","nullable":true},"target":{"type":"string","description":"What it happened to.","nullable":true},"metadata":{"type":"object","description":"Extra context for this action. Never contains recipient PII."},"created_at":{"type":"string","description":"When it happened (UTC)."}},"required":["id","action","actor_user_id","target","metadata","created_at"],"description":"One append-only record of something that happened in the organization. Audit is never rewritten."},"PaymentQuota":{"type":"object","properties":{"free":{"type":"array","items":{"$ref":"#/components/schemas/PaymentFree"},"description":"Free allowances and their windows."},"paid":{"type":"array","items":{"$ref":"#/components/schemas/PaymentPrice"},"description":"List prices in USD or in the stated currency; account-only offers are marked. The operation's 402 is the payable quote."},"how_to_pay":{"type":"string","description":"Payment instructions and availability restrictions."},"live":{"type":"string","description":"Authoritative product quota endpoint.","nullable":true},"free_now":{"type":"array","items":{"type":"string"},"description":"SKUs temporarily free despite their list price."},"charged_now":{"type":"array","items":{"type":"string"},"description":"SKUs charged at their list price even when free_now has `*`."},"trial":{"allOf":[{"$ref":"#/components/schemas/PaymentTrial"}],"description":"Registration trial, when offered."}},"required":["free","paid","how_to_pay","live"]},"PaymentFree":{"type":"object","properties":{"o_que":{"type":"string","description":"Operation or allowance."},"limite":{"type":"string","description":"Allowance and eligibility."},"janela":{"type":"string","description":"Reset window, when applicable.","nullable":true}},"required":["o_que","limite","janela"]},"PaymentPrice":{"type":"object","properties":{"o_que":{"type":"string","description":"Operation and billing unit."},"price_usd":{"type":"number","description":"Current list price in USD."},"price":{"type":"string","description":"Price with its currency or billing unit."},"so_conta":{"type":"boolean","description":"Only a signed-in account can buy this offer."}},"required":["o_que"]},"PaymentTrial":{"type":"object","properties":{"days":{"type":"integer","description":"Trial duration in days."},"how":{"type":"string","description":"Eligibility and activation steps."}},"required":["days","how"]},"VerificacaoAvulsa":{"type":"object","properties":{"domain":{"type":"string","description":"Registrable domain that was checked."},"score":{"type":"integer","description":"0 to 100: DMARC up to 40, SPF 20, DKIM 20, MX 10, MTA-STS 5 and BIMI 5."},"rating":{"type":"string","description":"protected (90+), good (70+), at_risk (40+) or exposed."},"findings":{"type":"array","items":{"type":"object"},"description":"`{code, severity}`, most severe first. Codes: dmarc_missing, dmarc_none, spf_plus_all, spf_missing, spf_multiple, dmarc_quarantine, dkim_not_found, spf_neutral, spf_softfail, dmarc_no_reports, mx_missing, mta_sts_missing, bimi_missing."},"spf":{"type":"object","description":"`{record, ending, multiple}`: the first SPF record, its `all` ending and whether there are two."},"dmarc":{"type":"object","description":"`{record, policy, reports}`: policy reject, quarantine, none or null; reports when `rua` is set."},"dkim":{"type":"object","description":"`{found, checked}`: selectors with a published key and the selectors looked up."},"mx":{"type":"array","items":{"type":"string"},"description":"MX records as `priority host`."},"mta_sts":{"type":"boolean","description":"An MTA-STS policy record exists."},"bimi":{"type":"boolean","description":"A BIMI record exists at the default selector."},"unread":{"type":"array","items":{"type":"string"},"description":"Parts whose DNS query failed (spf, dmarc, dkim, mx, mta_sts, bimi). They have no findings and no points."},"incomplete":{"type":"boolean","description":"At least one DNS query failed."},"checked_at":{"type":"string","description":"ISO time of the DNS reading."},"share_url":{"type":"string","description":"Public page with this result."},"badge_url":{"type":"string","description":"SVG badge with the score."},"cobranca":{"allOf":[{"$ref":"#/components/schemas/CobrancaDaChamada"}],"description":"How this call was paid."}},"required":["domain","score","rating","findings","spf","dmarc","dkim","mx","mta_sts","bimi","unread","incomplete","checked_at","share_url","badge_url","cobranca"],"description":"The email security audit of one domain, paid per call: the fields of `GET /api/email-check`."},"CobrancaDaChamada":{"type":"object","properties":{"via":{"type":"string","description":"`x402`, `credito` or the marketplace that already charged the call."},"preco_usd":{"type":"string","description":"The price charged for this call in US dollars, such as `0.01`: at least US$ 0.01 with single x402 payment; the unit price with credit."},"repetido":{"type":"boolean","description":"`true` when the credit had already paid this request (the same `Idempotency-Key`): nothing was charged again."},"saldo_usd":{"type":"string","description":"The credit balance after the call, such as `$0.99`; includes payment from the account balance."}},"required":["via","preco_usd","repetido"],"description":"The payment of a single call."},"RegistroDeAssinatura":{"type":"object","properties":{"recurso":{"type":"string","description":"Product resource: at most 256 characters, without controls. Empty means an account subscription."},"id":{"type":"string","description":"Local subscription ID: 32 lowercase hexadecimal characters. Use it for reads and cancellation."},"oferta_id":{"type":"string","description":"Accepted offer ID."},"oferta":{"allOf":[{"$ref":"#/components/schemas/OfertaDeAssinatura"}],"description":"Offer saved at acceptance. A catalog change does not replace this record."},"estado":{"type":"string","description":"criando, inconclusiva, checkout, aguardando_pagamento, ativa, cancelando, cancelada, falhou or expirada."},"simulado":{"type":"boolean","description":"Server-recorded environment: true for sandbox, false for production."},"pagamento_em":{"type":"string","description":"Null for API card purchases. Older checkout records can contain an Asaas HTTPS link.","nullable":true},"criado_em":{"type":"string","description":"Subscription creation time in UTC."},"atualizado_em":{"type":"string","description":"Last change time in UTC."},"cancelamento_em":{"type":"string","description":"Cancellation request time in UTC, or null.","nullable":true},"cancelado_em":{"type":"string","description":"Confirmed cancellation time in UTC, or null.","nullable":true},"pago_ate":{"type":"string","description":"On reads and cancellation, UTC end of the last period with a confirmed, non-refunded invoice; null without a paid invoice. It is not the next charge date or the free trial.","nullable":true}},"required":["recurso","id","oferta_id","oferta","estado","simulado","pagamento_em","criado_em","atualizado_em","cancelamento_em","cancelado_em","pago_ate"]},"OfertaDeAssinatura":{"type":"object","properties":{"id":{"type":"string","description":"Offer ID: 2 to 64 characters. Start with a lowercase letter. Use lowercase letters, digits, hyphens or underscores."},"produto":{"type":"string","description":"Product ID, with the same format as the offer ID."},"versao":{"type":"integer","description":"Offer version: 1 to 1,000,000."},"preco_centavos":{"type":"integer","description":"Price per cycle in cents: 500 to 1,000,000."},"moeda":{"type":"string","description":"Fixed currency: BRL."},"ciclo":{"type":"string","description":"MONTHLY for a monthly offer; WEEKLY for a weekly offer."},"renovacao_automatica":{"type":"boolean","description":"true: billing repeats each cycle until cancellation."},"compromisso_meses":{"type":"integer","description":"Present only for MONTHLY: one calendar month."},"compromisso_semanas":{"type":"integer","description":"Present only for WEEKLY: one seven-day period."},"cancelamento":{"type":"string","description":"stop_future_charges: stop new charges."},"acesso_pago":{"type":"string","description":"until_paid_period_end: keep access until the paid period ends."},"teste_dias":{"type":"integer","description":"Configured trial length: 0 to 30 days. Reading the catalog grants no trial or benefit."},"primeira_cobranca":{"type":"string","description":"First charge date in Brasilia (YYYY-MM-DD), selected by the server to preserve the current period. Included in the offer hash and acceptance."},"desconto_primeira_cobranca_centavos":{"type":"integer","description":"Deduction in cents for the first invoice only, at most the cycle price. Requires primeira_cobranca and is included in the accepted offer hash. Following cycles keep preco_centavos."},"conversao_teste":{"type":"string","description":"opt_in: a trial does not create or renew a subscription."},"beneficios":{"type":"array","items":{"$ref":"#/components/schemas/BeneficioDeAssinatura"},"description":"1 to 8 distinct capabilities for each paid period."},"hash":{"type":"string","description":"SHA-256 of the complete offer: 64 lowercase hexadecimal characters."}},"required":["id","produto","versao","preco_centavos","moeda","ciclo","renovacao_automatica","compromisso_meses","compromisso_semanas","cancelamento","acesso_pago","teste_dias","conversao_teste","beneficios","hash"]},"BeneficioDeAssinatura":{"type":"object","properties":{"sku":{"type":"string","description":"Product capability: a lowercase letter followed by letters, digits or underscores; at most 64 characters."},"quantidade":{"type":"integer","description":"1 to 1,000,000 units for each paid period."}},"required":["sku","quantidade"]},"AceiteDeAssinatura":{"type":"object","properties":{"oferta_id":{"type":"string","description":"Offer ID from the current catalog."},"versao":{"type":"integer","description":"Offer version from the current catalog."},"hash":{"type":"string","description":"64-character hash from the current catalog."},"renovacao":{"type":"boolean","description":"Must be true after explicit acceptance of the price, cycle and automatic renewal."}},"required":["oferta_id","versao","hash","renovacao"]},"CartaoDeAssinatura":{"type":"object","properties":{"titular":{"type":"string","description":"Name on the card: 3 to 100 characters."},"numero":{"type":"string","description":"Valid card number: 13 to 19 digits. Spaces and separators are accepted."},"mes":{"type":"string","description":"Expiry month: 1 to 12."},"ano":{"type":"string","description":"Four-digit expiry year. The card must not be expired."},"cvv":{"type":"string","description":"Security code: three digits, or four for American Express."},"documento":{"type":"string","description":"Cardholder's valid Brazilian CPF or CNPJ."},"email":{"type":"string","description":"Cardholder's e-mail: at most 254 characters."},"cep":{"type":"string","description":"Cardholder's Brazilian billing postcode: eight digits."},"numero_endereco":{"type":"string","description":"Billing address number: at most 20 characters."},"telefone":{"type":"string","description":"Cardholder's telephone number: 10 to 13 digits."}},"required":["titular","numero","mes","ano","cvv","documento","email","cep","numero_endereco","telefone"]},"Metricas":{"type":"object","properties":{"app":{"type":"string","description":"Product name."},"today":{"type":"string","description":"Reference day (UTC, YYYY-MM-DD)."},"today_visits":{"type":"integer","description":"Interface visits counted today."},"today_contacts":{"type":"integer","description":"Contact messages today. Only with `METRICS_TOKEN`: contact counts never leave without the token."},"days":{"type":"array","items":{"type":"object"},"description":"One row per day of the window, with each metric's count."},"usage":{"type":"object","description":"`entregas`: deliveries per day — real product usage, not catalog load."},"accounts":{"type":"object","description":"`organizacoes`: total organizations registered."},"financeiro":{"type":"object","description":"Day aggregate: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money never leaves without the token; the full series is `payments`."},"payments":{"type":"object","description":"x402 and BRL financial summary; METRICS_TOKEN only."},"compras":{"type":"object","description":"Who paid in the last 30 days: up to 20 BRL purchases with name, verified email and use, and the x402 payers by wallet. METRICS_TOKEN only."}},"required":["app","today","today_visits","days","usage","accounts"],"description":"7-day operator dashboard. `payments` only appears with the token and only on Base mainnet."}}},"paths":{"/agent.json":{"get":{"operationId":"get_agent_json","summary":"Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`.","description":"Returns: `application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`.","security":[],"responses":{"200":{"description":"`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`."}}}},"/okf/{arquivo}":{"get":{"operationId":"get_okf_by_arquivo","summary":"OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML.","description":"Returns: `text/markdown`. Start at `/okf/index.md`, which lists the bundle.","security":[],"parameters":[{"name":"arquivo","in":"path","required":true,"schema":{"type":"string"},"description":"`index.md`, `sobre.md`, `api.md` or `faq.md`.","example":"index.md"}],"responses":{"200":{"description":"`text/markdown`. Start at `/okf/index.md`, which lists the bundle."},"404":{"description":"File outside the bundle."}}}},"/.well-known/{arquivo}":{"get":{"operationId":"get_well_known_by_arquivo","summary":"Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key).","description":"Returns: `application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two.","security":[],"parameters":[{"name":"arquivo","in":"path","required":true,"schema":{"type":"string"},"description":"`api-catalog`, `security.txt`, `x402`, `mcp-registry-auth` or `apis.json`.","example":"api-catalog"}],"responses":{"200":{"description":"`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two."},"404":{"description":"Name outside the five published."}}}},"/apis.json":{"get":{"operationId":"get_apis_json","summary":"APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`.","description":"Returns: `application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`.","security":[],"responses":{"200":{"description":"`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`."}}}},"/api/":{"get":{"operationId":"get_api","summary":"Discover the whole API: every endpoint, every auth mode and the MCP endpoint.","description":"Returns: { name, description, build, environment, base_url, docs, auth, endpoints, mcp, mcp_tools }","security":[],"responses":{"200":{"description":"{ name, description, build, environment, base_url, docs, auth, endpoints, mcp, mcp_tools }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiIndex"}}}}}}},"/api/health":{"get":{"operationId":"commsharbor_health","summary":"Read liveness, environment and the commit currently deployed.","description":"Smoke tests wait for their own commit to appear here instead of racing edge propagation.\nReturns: { ok, app, build, environment, timestamp }","security":[],"responses":{"200":{"description":"{ ok, app, build, environment, timestamp }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Health"}}}}}}},"/mcp":{"get":{"operationId":"get_mcp","summary":"Inspect the remote MCP server card: transport, protocol and tool count.","description":"`POST /mcp` speaks Streamable HTTP with JSON-RPC 2.0. The tools are the operations in this catalog; the MCP has no backend of its own.\nReturns: { transport, protocol_version, endpoint, server, tools, usage, api_index }","security":[],"responses":{"200":{"description":"{ transport, protocol_version, endpoint, server, tools, usage, api_index }","content":{"application/json":{"schema":{"type":"object","properties":{"transport":{"type":"string","description":"How the server speaks — `streamable-http`."},"protocol_version":{"type":"string","description":"MCP protocol version the server implements."},"endpoint":{"type":"string","description":"Absolute URL to POST JSON-RPC to."},"server":{"type":"object","description":"`name` and `version` of this server; the version is the deployed commit."},"tools":{"type":"integer","description":"How many tools the server exposes."},"usage":{"type":"string","description":"One line saying how to call it."},"api_index":{"type":"string","description":"The self-describing API index, for the operations behind the tools."}},"required":["transport","protocol_version","endpoint","server","tools","usage","api_index"]}}}}}}},"/api/auth/bootstrap":{"get":{"operationId":"get_api_auth_bootstrap","summary":"Prepare the browser for global sign-in.","description":"Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS.\nReturns: { csrf, context }","security":[],"responses":{"200":{"description":"{ csrf, context }","content":{"application/json":{"schema":{"type":"object","properties":{"csrf":{"type":"string","description":"X-CSRF-Token"},"context":{"type":"string","description":"Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial."}},"required":["csrf","context"]}}}},"400":{"description":"invalid_request"},"403":{"description":"invalid_origin / invalid_csrf"},"503":{"description":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"}}}},"/api/account/profile":{"get":{"operationId":"get_api_account_profile","summary":"Read your global profile.","description":"Reads current preferences from the account. Edit them on your account page; products never own a separate profile.\nReturns: {profile:{name,locale,timeZone,theme,revision}}","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{profile:{name,locale,timeZone,theme,revision}}"},"401":{"description":"invalid_session"},"503":{"description":"auth_unavailable"}}}},"/api/account/avatar":{"get":{"operationId":"get_api_account_avatar","summary":"Read your global profile photo.","description":"Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted.\nReturns: image/webp; Cache-Control: no-store","security":[{"globalAccount":[]}],"responses":{"200":{"description":"image/webp; Cache-Control: no-store","content":{"image/webp":{"schema":{"type":"string","format":"binary"}}}},"401":{"description":"invalid_session"},"404":{"description":"not_found: no photo / sem foto"},"503":{"description":"auth_unavailable"}}}},"/api/auth/logout":{"post":{"operationId":"commsharbor_logout","summary":"Revoke this product session.","description":"Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.\nReturns: { ok }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true"}},"required":["ok"]}}}},"400":{"description":"invalid_request"},"403":{"description":"invalid_origin / invalid_csrf"},"503":{"description":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"}}}},"/api/auth/pwa/install":{"post":{"operationId":"post_api_auth_pwa_install","summary":"Prepare a personal app installation.","description":"Requires recent sign-in, exact Origin and browser CSRF. Returns a private signed PIN and a no-store manifest address. At most 10 active installations per account and product.\nReturns: {pin,path,manifest}","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"path":{"type":"string","description":"Same-origin task path, up to 1600 characters."},"state":{"type":"object","description":"Up to 30 allowlisted preference keys and string values."},"manifest":{"type":"object","description":"Public app name and same-origin icons."}},"required":["path","state","manifest"]}}}},"responses":{"200":{"description":"{pin,path,manifest}"},"400":{"description":"invalid_installation_path / invalid_installation_state / invalid_installation_manifest"},"401":{"description":"invalid_session / reauth_required"},"409":{"description":"installation_not_created"},"503":{"description":"auth_unavailable"}}}},"/api/auth/pwa/restore":{"post":{"operationId":"post_api_auth_pwa_restore","summary":"Restore an installed app.","description":"Requires the signed PIN, exact Origin and browser CSRF. Verifies host, product, account status, security version and installation revocation. Keeps the original authentication time. Sensitive actions still require recent sign-in.\nReturns: {ok:true,state,path,manifest}; HttpOnly session cookies","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"pin":{"type":"string","description":"Private signed installation credential."}},"required":["pin"]}}}},"responses":{"200":{"description":"{ok:true,state,path,manifest}; HttpOnly session cookies"},"401":{"description":"invalid_installation"},"403":{"description":"invalid_origin / invalid_csrf"},"503":{"description":"auth_unavailable"}}}},"/api/auth/pwa/manifest":{"get":{"operationId":"get_api_auth_pwa_manifest","summary":"Read the private installation manifest.","description":"Requires the installation cookie and its manifest key. Private, no-store. The start URL keeps the PIN in the fragment.\nReturns: application/manifest+json","security":[],"parameters":[{"name":"key","in":"query","required":true,"schema":{"type":"string"},"description":"Key in the manifest address that the install or restore call returned."}],"responses":{"200":{"description":"application/manifest+json"},"401":{"description":"invalid_installation"}}}},"/api/account/keys":{"get":{"operationId":"get_api_account_keys","summary":"List your API keys in this product.","description":"Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works.\nReturns: { keys }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ keys }","content":{"application/json":{"schema":{"type":"object","properties":{"keys":{"type":"array","items":{"type":"object"},"description":"`id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions)."}},"required":["keys"]}}}},"401":{"description":"invalid_session"},"503":{"description":"auth_unavailable"}}}},"/api/account/keys/create":{"post":{"operationId":"post_api_account_keys_create","summary":"Create an API key for agents and scripts.","description":"Needs a sign-in within the last 2 hours; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE.\nReturns: { key, secret }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","description":"Up to 60 characters."},"organizationId":{"type":["string","null"],"description":"`null` for an account key."}},"required":["name","organizationId"]},"example":{"name":"agent","organizationId":null}}}},"responses":{"200":{"description":"{ key, secret }","content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"object","description":"`id`, `name`, `organizationId`, `last4`, `createdAt`."},"secret":{"type":"string","description":"`mmk_…`, shown once."}},"required":["key","secret"]}}}},"400":{"description":"invalid_key_name / invalid_organization"},"401":{"description":"invalid_session / reauth_required"},"403":{"description":"invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required"},"409":{"description":"key_limit_reached"},"503":{"description":"auth_unavailable"}}}},"/api/account/keys/revoke":{"post":{"operationId":"post_api_account_keys_revoke","summary":"Revoke one of your API keys.","description":"Stops the key at once. Repeating is harmless.\nReturns: { ok }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"The key `id`."}},"required":["id"]},"example":{"id":"…"}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true"}},"required":["ok"]}}}},"400":{"description":"invalid_key_id"},"401":{"description":"invalid_session"},"403":{"description":"invalid_origin / invalid_csrf"},"404":{"description":"key_not_found"},"503":{"description":"auth_unavailable"}}}},"/api/account/apps":{"get":{"operationId":"get_api_account_apps","summary":"List the apps connected to your account in this product.","description":"The MCP clients you signed in with (OAuth), such as claude.ai or ChatGPT. Never returns a token.\nReturns: { apps }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ apps }","content":{"application/json":{"schema":{"type":"object","properties":{"apps":{"type":"array","items":{"type":"object"},"description":"Up to 50: `id`, `nome` (the app; its host when it identifies itself by a metadata document), `criadoEm`, `usadoEm` (hourly, or null)."}},"required":["apps"]}}}},"401":{"description":"invalid_session"},"503":{"description":"auth_unavailable"}}}},"/api/account/apps/revoke":{"post":{"operationId":"post_api_account_apps_revoke","summary":"Disconnect an app from your account.","description":"Stops the app's access at once; it asks you to sign in again. Repeating is harmless.\nReturns: { ok }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"The app `id`."}},"required":["id"]},"example":{"id":"…"}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true"}},"required":["ok"]}}}},"400":{"description":"invalid_app_id"},"401":{"description":"invalid_session"},"403":{"description":"invalid_origin / invalid_csrf"},"404":{"description":"app_not_found"},"503":{"description":"auth_unavailable"}}}},"/api/account/callouts":{"get":{"operationId":"get_api_account_callouts","summary":"List the notices that you closed in this product.","description":"The keys of the notices that stay closed for your account, on every device, such as the explanation of an area.\nReturns: { callouts }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ callouts }","content":{"application/json":{"schema":{"type":"object","properties":{"callouts":{"type":"array","items":{"type":"string"},"description":"Up to 200 keys, in alphabetical order."}},"required":["callouts"]}}}},"401":{"description":"invalid_session"},"403":{"description":"product_required"},"503":{"description":"auth_unavailable"}}}},"/api/account/callouts/dismiss":{"post":{"operationId":"post_api_account_callouts_dismiss","summary":"Close a notice for good.","description":"The notice does not open again for your account in this product. Repeating is harmless.\nReturns: { ok }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"string","description":"The notice key: letters, digits and `_.:-`, up to 80."}},"required":["key"]},"example":{"key":"financeiro_expense"}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true"}},"required":["ok"]}}}},"400":{"description":"invalid_callout"},"401":{"description":"invalid_session"},"403":{"description":"invalid_origin / invalid_csrf"},"409":{"description":"too_many_callouts"},"503":{"description":"auth_unavailable"}}}},"/api/account/callouts/reopen":{"post":{"operationId":"post_api_account_callouts_reopen","summary":"Open a closed notice again.","description":"Undoes the close: the notice shows again for your account in this product. A product also keeps an on/off choice here, as the hidden values of Finance. Repeating is harmless.\nReturns: { ok }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"key":{"type":"string","description":"The notice key: letters, digits and `_.:-`, up to 80."}},"required":["key"]},"example":{"key":"financeiro_expense"}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true"}},"required":["ok"]}}}},"400":{"description":"invalid_callout"},"401":{"description":"invalid_session"},"403":{"description":"invalid_origin / invalid_csrf"},"503":{"description":"auth_unavailable"}}}},"/api/auth/wallet/agent/start":{"post":{"operationId":"post_api_auth_wallet_agent_start","summary":"Start the wallet credential of an agent without an account.","description":"No account: the wallet proves it is hers by signing the message (EIP-4361). Signing does not pay or transfer anything. The message names this product and lasts 5 minutes. Before you sign, compare the message with the URL that you called. The domain on the first line must be the host of that URL. URI must be its origin. If one is different, do not sign. Sign it with personal_sign and send it to /api/auth/wallet/agent/token.\nReturns: { message, issuedAt, expiresIn }","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"address":{"type":"string","description":"0x…, a carteira (EOA ou contrato na Base)"}},"required":["address"]},"example":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23"}}}},"responses":{"200":{"description":"{ message, issuedAt, expiresIn }","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"EIP-4361"},"issuedAt":{"type":"number","description":"segundos / seconds"},"expiresIn":{"type":"number","description":"300"}},"required":["message","issuedAt","expiresIn"]}}}},"400":{"description":"invalid_wallet_address"},"503":{"description":"auth_unavailable"}}}},"/api/auth/wallet/agent/token":{"post":{"operationId":"post_api_auth_wallet_agent_token","summary":"Get the wallet credential (mmw_…) of this product.","description":"The wallet's signature of the start message, checked here (own key) or on Base (contract, EIP-1271/6492). The credential lasts 30 days: send `Authorization: Bearer mmw_…` to the routes that accept the wallet as owner (owner `x402:<address>`). Once the wallet is linked to an account, what it did here moves to the account when the person signs in.\nReturns: { token, owner, expiresAt }","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"address":{"type":"string","description":"0x…, a mesma carteira do start / the same wallet as in start"},"issuedAt":{"type":"number","description":"o issuedAt do start / start's issuedAt"},"signature":{"type":"string","description":"personal_sign (0x…)"}},"required":["address","issuedAt","signature"]},"example":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23","issuedAt":1791400000,"signature":"0x…"}}}},"responses":{"200":{"description":"{ token, owner, expiresAt }","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"mmw_…"},"owner":{"type":"string","description":"x402:0x…"},"expiresAt":{"type":"number","description":"segundos / seconds"}},"required":["token","owner","expiresAt"]}}}},"400":{"description":"invalid_body"},"401":{"description":"invalid_wallet"},"429":{"description":"wallet_limited"},"503":{"description":"wallet_unavailable / auth_unavailable"}}}},"/api/auth/claim/wallets":{"post":{"operationId":"post_api_auth_claim_wallets","summary":"Move to the account what its wallets did without an account.","description":"The sign-in window calls it after every sign-in. For each wallet linked to the account: the rights bought here by x402 (owner x402:<address>) and what this product keeps for that owner. Repeating moves nothing.\nReturns: { carteiras, direitos }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ carteiras, direitos }","content":{"application/json":{"schema":{"type":"object","properties":{"carteiras":{"type":"number","description":"wallets"},"direitos":{"type":"number","description":"rights moved"}},"required":["carteiras","direitos"]}}}},"401":{"description":"invalid_session"},"503":{"description":"auth_unavailable"}}}},"/api/guest":{"post":{"operationId":"post_api_guest","summary":"Open or restore a temporary workspace in this browser.","description":"Sets a host-only HttpOnly guest cookie. The SDK limits issuance to 20 per network per hour; a valid cookie is reused.\nReturns: { guest_token }","security":[],"responses":{"200":{"description":"{ guest_token }","content":{"application/json":{"schema":{"type":"object","properties":{"guest_token":{"type":"string","description":"Signed guest token for an API client."}},"required":["guest_token"]}}}},"429":{"description":"guest_rate_limited"},"503":{"description":"auth_unavailable"}}}},"/api/visitor":{"get":{"operationId":"get_api_visitor","summary":"Read the temporary workspace id.","description":"The id is derived by the shared account library; product data stays under this id when you link an account.\nReturns: { organization }","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"{ organization }","content":{"application/json":{"schema":{"type":"object","properties":{"organization":{"type":"object","description":"`{id,name:null,role:'guest'}`."}},"required":["organization"]}}}},"401":{"description":"unauthorized / guest_ended"},"503":{"description":"auth_unavailable"}}}},"/api/auth/claim":{"post":{"operationId":"post_api_auth_claim","summary":"Attach this browser's temporary workspace to your global account.","description":"Requires a recent sign-in with a second factor, as organization ownership does. The workspace stays available as a guest until the claim succeeds.\nReturns: { ok }","security":[{"globalAccount":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"true when linked."}},"required":["ok"]}}}},"401":{"description":"unauthorized — no account session; sign in at `/conta/global` first"},"409":{"description":"guest_claim_mfa_required / guest_already_claimed"},"503":{"description":"auth_unavailable"}}}},"/api/me":{"get":{"operationId":"commsharbor_me","summary":"Read the global profile and the platform role, if any.","description":"`user.id` is the shared-account ID. Organizations are not listed here: they live in the shared account, which does not list them inside products yet — open a workspace by its ID with `GET /api/organizations/{organization_id}`.\nReturns: { user{id,email}, profile{name,locale,timeZone,theme,revision}, platform_role }","security":[{"globalAccount":[]}],"responses":{"200":{"description":"{ user{id,email}, profile{name,locale,timeZone,theme,revision}, platform_role }","content":{"application/json":{"schema":{"type":"object","properties":{"user":{"allOf":[{"$ref":"#/components/schemas/User"}],"description":"The person behind the session."},"profile":{"allOf":[{"$ref":"#/components/schemas/Profile"}],"description":"Global MM profile — it belongs to the person, edited on the account, not to a tenant."},"platform_role":{"type":"string","description":"Platform role, when one was explicitly granted. Owning a tenant grants nothing here.","nullable":true}},"required":["user","profile","platform_role"]}}}},"401":{"description":"No session, or the session expired."},"503":{"description":"auth_unavailable"}}}},"/api/account/organizations":{"get":{"operationId":"get_api_account_organizations","summary":"List your organizations: ID, name and your role.","description":"Served by the shared account on this domain; every organization you belong to, whether or not this product is enabled there. Creating, renaming, members, invitations and organization API keys are on the account page, `/conta/global`.\nReturns: { organizations, next }","security":[{"bearerAuth":[]}],"parameters":[{"name":"after","in":"query","required":false,"schema":{"type":"string"},"description":"`next` of the previous page."}],"responses":{"200":{"description":"{ organizations, next }","content":{"application/json":{"schema":{"type":"object","properties":{"organizations":{"type":"array","items":{"type":"object"},"description":"Up to 8 per page: `id`, `name`, `revision`, `role` (`owner`, `admin` or `member`) and `mfaRequired`. Product sessions also return `product: {id, enabled, revision}` for this product. Listing does not activate it."},"next":{"type":"string","description":"Cursor for the next page.","nullable":true}},"required":["organizations","next"]}}}},"400":{"description":"invalid_organization_cursor"},"401":{"description":"invalid_session"},"404":{"description":"organization_not_found"},"503":{"description":"auth_unavailable"}}}},"/api/context":{"get":{"operationId":"commsharbor_context","summary":"Resolve which organization and role the current session or API key is acting as.","description":"Read this before a write when you are not certain which tenant is active. Guessing is how data lands in the wrong organization. An organization API key answers `kind: api_key` with its scopes.\nReturns: { kind, organizationId, userId, sessionId, apiKeyId, scopes, role, organization }","security":[{"bearerAuth":[]}],"parameters":[{"name":"X-Organization-Id","in":"header","required":true,"schema":{"type":"string"},"description":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header."}],"responses":{"200":{"description":"{ kind, organizationId, userId, sessionId, apiKeyId, scopes, role, organization }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Identity"}}}},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"503":{"description":"The shared account is unavailable."}}}},"/api/organizations/{organization_id}":{"get":{"operationId":"commsharbor_organization_get","summary":"Open one organization: its name, your role and its CommsHarbor plan.","description":"This is how a workspace is opened. Name and role come from the shared account (null with an organization API key, which carries neither); the plan is the organization's global entitlement in CommsHarbor.\nReturns: { id, name, role, email_workspace }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."},{"name":"X-Organization-Id","in":"header","required":true,"schema":{"type":"string"},"description":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header."}],"responses":{"200":{"description":"{ id, name, role, email_workspace }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}}},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"503":{"description":"The shared account is unavailable."}}}},"/api/organizations/{organization_id}/audit":{"get":{"operationId":"commsharbor_audit","summary":"List the append-only audit trail of the organization.","description":"Audit records are never rewritten and never carry recipient PII.\nReturns: { items[{id,action,actor_user_id,target,metadata,created_at}], nextCursor }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."},{"name":"cursor","in":"query","required":false,"schema":{"type":"string"},"description":"Opaque cursor from the previous page. Do not build or parse it."},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50},"description":"Page size, from 1 to 100."}],"responses":{"200":{"description":"{ items[{id,action,actor_user_id,target,metadata,created_at}], nextCursor }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PageCamelAuditEvent"}}}},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"503":{"description":"The shared account is unavailable."}}}},"/api/platform/context":{"get":{"operationId":"commsharbor_platform_context","summary":"Confirm an explicitly granted platform administrator.","description":"Tenant ownership grants nothing here: platform access is a separate, explicit grant.\nReturns: { role, user_id }","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"{ role, user_id }","content":{"application/json":{"schema":{"type":"object","properties":{"role":{"type":"string","description":"The platform role that was granted."},"user_id":{"type":"string","description":"Who holds it."}},"required":["role","user_id"]}}}},"401":{"description":"No session."},"403":{"description":"This person has no platform grant."}}}},"/api/organizations/{organization_id}/email/domain-import/{service}":{"get":{"operationId":"commsharbor_email_google_catalog","summary":"Read authorized Google metadata. This does not prove DNS ownership.","description":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.\nReturns: { connected, domains, groups?, resolved?, available? }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"service","in":"path","required":true,"schema":{"type":"string"},"description":"search_console or analytics. Each connection has its own consent.","example":"search_console"}],"responses":{"200":{"description":"{ connected, domains, groups?, resolved?, available? }","content":{"application/json":{"schema":{"type":"object","properties":{"connected":{"type":"boolean","description":"This identity has a saved connection for this product and service."},"domains":{"type":"array","items":{"type":"object"},"description":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"type":"array","items":{"type":"object"},"description":"Analytics accounts and properties. No reports are read."},"resolved":{"type":"boolean","description":"Selected Analytics properties have been resolved to domains."},"available":{"type":"boolean","description":"Google client configuration is available. This does not assert consent or verification approval."}},"required":["connected","domains"]}}}},"401":{"description":"Account session required. Organization keys cannot access personal Google connections."},"403":{"description":"Write requires an owner or admin, the same Origin and valid CSRF."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Google connection required or changed."},"503":{"description":"Google import unavailable. Retry or use account/manual domain registration."}}}},"/api/organizations/{organization_id}/email/domain-import/{service}/connect":{"post":{"operationId":"commsharbor_email_google_connect","summary":"Start five-minute Google consent with PKCE. Return an authorization URL. Signing in does not grant this access.","description":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.\nReturns: { redirect }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"service","in":"path","required":true,"schema":{"type":"string"},"description":"search_console or analytics. Each connection has its own consent.","example":"search_console"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"language":{"type":"string","description":"Consent return language.","enum":["en","pt"]}}}}}},"responses":{"200":{"description":"{ redirect }","content":{"application/json":{"schema":{"type":"object","properties":{"redirect":{"type":"string","description":"Google consent URL. The owner must approve it in a browser."}},"required":["redirect"]}}}},"401":{"description":"Account session required. Organization keys cannot access personal Google connections."},"403":{"description":"Write requires an owner or admin, the same Origin and valid CSRF."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Google connection required or changed."},"503":{"description":"Google import unavailable. Retry or use account/manual domain registration."}}}},"/api/organizations/{organization_id}/email/domain-import/{service}/resolve":{"post":{"operationId":"commsharbor_email_google_resolve","summary":"Resolve website addresses for up to 20 selected Analytics properties. Search Console does not use this route.","description":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.\nReturns: { connected, domains, groups?, resolved?, available? }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"service","in":"path","required":true,"schema":{"type":"string"},"description":"search_console or analytics. Each connection has its own consent.","example":"analytics"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"properties":{"type":"object","description":"Authorized properties/ID values from the catalog, at most 20 unique entries."}},"required":["properties"]}}}},"responses":{"200":{"description":"{ connected, domains, groups?, resolved?, available? }","content":{"application/json":{"schema":{"type":"object","properties":{"connected":{"type":"boolean","description":"This identity has a saved connection for this product and service."},"domains":{"type":"array","items":{"type":"object"},"description":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"type":"array","items":{"type":"object"},"description":"Analytics accounts and properties. No reports are read."},"resolved":{"type":"boolean","description":"Selected Analytics properties have been resolved to domains."},"available":{"type":"boolean","description":"Google client configuration is available. This does not assert consent or verification approval."}},"required":["connected","domains"]}}}},"401":{"description":"Account session required. Organization keys cannot access personal Google connections."},"403":{"description":"Write requires an owner or admin, the same Origin and valid CSRF."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Google connection required or changed."},"503":{"description":"Google import unavailable. Retry or use account/manual domain registration."}}}},"/api/organizations/{organization_id}/email/domain-import/{service}/disconnect":{"post":{"operationId":"commsharbor_email_google_disconnect","summary":"Remove this product's saved Google connection and pending consent. Existing email and service resources remain intact.","description":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.\nReturns: { connected, domains, groups?, resolved?, available? }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"service","in":"path","required":true,"schema":{"type":"string"},"description":"search_console or analytics. Each connection has its own consent.","example":"search_console"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ connected, domains, groups?, resolved?, available? }","content":{"application/json":{"schema":{"type":"object","properties":{"connected":{"type":"boolean","description":"This identity has a saved connection for this product and service."},"domains":{"type":"array","items":{"type":"object"},"description":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"type":"array","items":{"type":"object"},"description":"Analytics accounts and properties. No reports are read."},"resolved":{"type":"boolean","description":"Selected Analytics properties have been resolved to domains."},"available":{"type":"boolean","description":"Google client configuration is available. This does not assert consent or verification approval."}},"required":["connected","domains"]}}}},"401":{"description":"Account session required. Organization keys cannot access personal Google connections."},"403":{"description":"Write requires an owner or admin, the same Origin and valid CSRF."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Google connection required or changed."},"503":{"description":"Google import unavailable. Retry or use account/manual domain registration."}}}},"/api/organizations/{organization_id}/email/domains/{resource_id}/products":{"get":{"operationId":"commsharbor_email_domain_products_list","summary":"Read services associated with this exact domain.","description":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.\nReturns: { services }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Domain ID in the caller's email organization."}],"responses":{"200":{"description":"{ services }","content":{"application/json":{"schema":{"type":"object","properties":{"services":{"type":"array","items":{"type":"string"},"description":"Associated services with native organization access still enabled."}},"required":["services"]}}}},"400":{"description":"Invalid or duplicate service."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Native product access must be enabled first."},"503":{"description":"Domain services unavailable."}}},"post":{"operationId":"commsharbor_email_domain_products_add","summary":"Associate explicitly selected services with this domain.","description":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.\nReturns: { services }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID. Must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Domain ID in the caller's email organization."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"services":{"type":"object","description":"At most two unique values: pageaudit and hookpulse."}},"required":["services"]}}}},"responses":{"200":{"description":"{ services }","content":{"application/json":{"schema":{"type":"object","properties":{"services":{"type":"array","items":{"type":"string"},"description":"Associated services with native organization access still enabled."}},"required":["services"]}}}},"400":{"description":"Invalid or duplicate service."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Native product access must be enabled first."},"503":{"description":"Domain services unavailable."}}}},"/api/realtime/ticket":{"post":{"operationId":"post_api_realtime_ticket","summary":"Create a short-lived browser ticket for the selected email workspace.","description":"Use the shared browser client with the session, CSRF and X-Organization-Id headers. Guests and API keys cannot create browser tickets. Server integrations use the HTTP management API.\nReturns: { ticket, expires_in, namespace }","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ ticket, expires_in, namespace }","content":{"application/json":{"schema":{"type":"object","properties":{"ticket":{"type":"string","description":"Opaque browser credential. Do not log or store it."},"expires_in":{"type":"integer","description":"Seconds before an unused ticket expires."},"namespace":{"type":"string","description":"Product namespace on the shared transport."}},"required":["ticket","expires_in","namespace"]}}}},"401":{"description":"Session ended."},"403":{"description":"Organization access denied."},"503":{"description":"Live channel unavailable."}}}},"/api/email/workspaces/{id}":{"get":{"operationId":"commsharbor_email_workspace_snapshot","summary":"Read the aggregate used by the live email workspace.","description":"The ID must match X-Organization-Id. Membership is checked again for each snapshot and delivered event. Events contain only an opaque change ID. DNS checks run in the private backend, with a 24-hour deadline and a visible resume action after pause.\nReturns: { plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Selected organization ID."}],"responses":{"200":{"description":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","content":{"application/json":{"schema":{"type":"object","properties":{"plan":{"type":"string","description":"Current free, paid or operator bootstrap plan.","nullable":true},"subscription":{"type":"object","description":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"type":"object","description":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"type":"boolean","description":"Operator-managed adoption."},"activation_required":{"type":"boolean","description":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"type":"string","description":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"type":"object","description":"Reserved domain, mailbox, alias and storage counts."},"domains":{"type":"array","items":{"type":"object"},"description":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"type":"array","items":{"type":"object"},"description":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"type":"array","items":{"type":"object"},"description":"Alias addresses and destinations."},"jobs":{"type":"array","items":{"type":"object"},"description":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"required":["plan","subscription","capabilities","bootstrap","access_state","usage","domains","mailboxes","aliases","jobs"]}}}},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"503":{"description":"The shared account is unavailable."}}}},"/api/email/plans":{"get":{"operationId":"commsharbor_email_plans","summary":"Read the free Trial, three paid packages, storage allowances and activation terms.","description":"Returns: { currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation }","security":[],"parameters":[{"name":"lingua","in":"query","required":false,"schema":{"type":"string","enum":["en","pt"]},"description":"Selected language. Without it, use the shared request language policy."}],"responses":{"200":{"description":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation }","content":{"application/json":{"schema":{"type":"object","properties":{"currency":{"type":"string","description":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"type":"string","description":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"type":"number","description":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"type":"boolean","description":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"type":"string","description":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"type":"string","description":"Monthly billing."},"auto_renew":{"type":"boolean","description":"Monthly automatic renewal until cancellation."},"cancellation":{"type":"string","description":"Cancellation stops future charges."},"paid_access":{"type":"string","description":"Access lasts until the end of the paid period."},"trial_days":{"type":"integer","description":"Zero. There is no automatic trial conversion."},"trial":{"type":"object","description":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"type":"array","items":{"type":"object"},"description":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"type":"boolean","description":"Whether new real subscriptions are open."},"on_demand_activation":{"type":"string","description":"Agree scope and activation date before charging for on-demand services."}},"required":["currency","country","brl_per_usd","price_is_estimate","billing_currency","interval","auto_renew","cancellation","paid_access","trial_days","trial","plans","checkout_live","on_demand_activation"]}}}}}}},"/api/pricing":{"get":{"operationId":"get_api_pricing","summary":"Read monthly email packages and purchase entry points.","description":"Returns: { currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","security":[],"parameters":[{"name":"lingua","in":"query","required":false,"schema":{"type":"string","enum":["en","pt"]},"description":"Selected language. Without it, use the shared request language policy."}],"responses":{"200":{"description":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","content":{"application/json":{"schema":{"type":"object","properties":{"currency":{"type":"string","description":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"type":"string","description":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"type":"number","description":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"type":"boolean","description":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"type":"string","description":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"type":"string","description":"Monthly billing."},"auto_renew":{"type":"boolean","description":"Monthly automatic renewal until cancellation."},"cancellation":{"type":"string","description":"Cancellation stops future charges."},"paid_access":{"type":"string","description":"Access lasts until the end of the paid period."},"trial_days":{"type":"integer","description":"Zero. There is no automatic trial conversion."},"trial":{"type":"object","description":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"type":"array","items":{"type":"object"},"description":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"type":"boolean","description":"Whether new real subscriptions are open."},"on_demand_activation":{"type":"string","description":"Agree scope and activation date before charging for on-demand services."},"quota":{"allOf":[{"$ref":"#/components/schemas/PaymentQuota"}],"description":"Public allowances and list prices: the free email check, the per-call email check and the mailbox packages (signed-in account only). Not personal usage."},"product":{"type":"string","description":"CommsHarbor."},"pricing":{"type":"string","description":"Current package catalog URL."},"billing":{"type":"string","description":"Monthly subscription offer catalog URL."},"api_index":{"type":"string","description":"API catalog URL."}},"required":["currency","country","brl_per_usd","price_is_estimate","billing_currency","interval","auto_renew","cancellation","paid_access","trial_days","trial","plans","checkout_live","on_demand_activation","quota","product","pricing","billing","api_index"]}}}}}}},"/api/billing":{"get":{"operationId":"pricing","summary":"Read the same email package catalog at the billing address, with the subscription offers URL.","description":"Returns: { currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","security":[],"parameters":[{"name":"lingua","in":"query","required":false,"schema":{"type":"string","enum":["en","pt"]},"description":"Selected language. Without it, use the shared request language policy."}],"responses":{"200":{"description":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","content":{"application/json":{"schema":{"type":"object","properties":{"currency":{"type":"string","description":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"type":"string","description":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"type":"number","description":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"type":"boolean","description":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"type":"string","description":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"type":"string","description":"Monthly billing."},"auto_renew":{"type":"boolean","description":"Monthly automatic renewal until cancellation."},"cancellation":{"type":"string","description":"Cancellation stops future charges."},"paid_access":{"type":"string","description":"Access lasts until the end of the paid period."},"trial_days":{"type":"integer","description":"Zero. There is no automatic trial conversion."},"trial":{"type":"object","description":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"type":"array","items":{"type":"object"},"description":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"type":"boolean","description":"Whether new real subscriptions are open."},"on_demand_activation":{"type":"string","description":"Agree scope and activation date before charging for on-demand services."},"quota":{"allOf":[{"$ref":"#/components/schemas/PaymentQuota"}],"description":"Public allowances and list prices: the free email check, the per-call email check and the mailbox packages (signed-in account only). Not personal usage."},"product":{"type":"string","description":"CommsHarbor."},"pricing":{"type":"string","description":"Current package catalog URL."},"billing":{"type":"string","description":"Monthly subscription offer catalog URL."},"api_index":{"type":"string","description":"API catalog URL."}},"required":["currency","country","brl_per_usd","price_is_estimate","billing_currency","interval","auto_renew","cancellation","paid_access","trial_days","trial","plans","checkout_live","on_demand_activation","quota","product","pricing","billing","api_index"]}}}}}}},"/api/organizations/{organization_id}/email":{"get":{"operationId":"commsharbor_email_workspace","summary":"Read the email workspace.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","x-agent-value":{"when":"How can I use email on my domain without running a mail server?","result":"The authorized email workspace: domains, mailboxes, aliases, quota, observed capabilities and setup jobs.","replaces":"We operate the mail server and webmail. Your agent manages the authorized domains and mailboxes through the existing service.","free":"Read /api/email/plans. If trial.activation_ready is true, activate the 7-day trial, verify your domain and create mailboxes. They share 1 GB and can receive through webmail or IMAP. No card or automatic conversion.","paid":"A monthly package buys sending and the listed mailbox and storage capacity. Sending stays disabled during the trial, including SMTP and external filter forwarding. The human account accepts renewal and cancellation; an organization key manages service but cannot buy it.","limits":"Check checkout_live, domain readiness and observed sending capability. A payment or accepted job alone does not prove activation or delivery. Enterprise services can require activation on demand.","alternative":"The organization already has suitable managed email or requires an activation that is not available.","start":{"href":"/","label":"Set up domain email"}},"security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."}],"responses":{"200":{"description":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","content":{"application/json":{"schema":{"type":"object","properties":{"plan":{"type":"string","description":"Current free, paid or operator bootstrap plan.","nullable":true},"subscription":{"type":"object","description":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"type":"object","description":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"type":"boolean","description":"Operator-managed adoption."},"activation_required":{"type":"boolean","description":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"type":"string","description":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"type":"object","description":"Reserved domain, mailbox, alias and storage counts."},"domains":{"type":"array","items":{"type":"object"},"description":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"type":"array","items":{"type":"object"},"description":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"type":"array","items":{"type":"object"},"description":"Alias addresses and destinations."},"jobs":{"type":"array","items":{"type":"object"},"description":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"required":["plan","subscription","capabilities","bootstrap","access_state","usage","domains","mailboxes","aliases","jobs"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/trial":{"post":{"operationId":"commsharbor_email_trial_activate","summary":"Start the free receive-only Trial for 7 days, once per organization: 1 GB shared storage, unlimited mailboxes and no outgoing SMTP or external filter forwarding. No card, renewal or charge. After 7 days, writes without a paid plan answer 402 `email_trial_expired`. Requires a new workspace and operator-proved native quota.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/domain-setup":{"get":{"operationId":"commsharbor_email_domain_setup","summary":"Find an existing domain. Use it before a purchase. Return its organization and domain IDs only when this exact caller can open that organization. Otherwise return existing: null. This read creates no charge or job.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { existing }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"domain","in":"query","required":true,"schema":{"type":"string"},"description":"Domain to check, at most 253 characters."}],"responses":{"200":{"description":"{ existing }","content":{"application/json":{"schema":{"type":"object","properties":{"existing":{"type":"object","description":"Authorized existing domain: organization_id, domain_id and organization name. Null also covers a foreign or unavailable organization; no foreign ownership information is returned.","nullable":true}},"required":["existing"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/domains":{"post":{"operationId":"commsharbor_email_domain_create","summary":"Register a domain and its ownership challenge.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","description":"Exact domain name."}},"required":["domain"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/domains/{resource_id}":{"get":{"operationId":"commsharbor_email_domain_get","summary":"Read domain setup, DNS records and observed readiness.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { domain }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."}],"responses":{"200":{"description":"{ domain }","content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"object","description":"Domain setup and observed readiness."}},"required":["domain"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/domains/{resource_id}/verify":{"post":{"operationId":"commsharbor_email_domain_verify","summary":"Queue a check of ownership, DNS and certificates.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/domains/{resource_id}/assistance":{"post":{"operationId":"commsharbor_email_domain_assistance","summary":"Request assisted DNS setup. The durable request waits for operator activation. It does not change DNS or expose a provider credential.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/mailboxes":{"post":{"operationId":"commsharbor_email_mailbox_create","summary":"Create a mailbox within the current allowance. Trial mailboxes share 1 GB and cannot send email.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"domain_id":{"type":"string","description":"Domain ID from the workspace."},"local_part":{"type":"string","description":"Mailbox name before @."},"name":{"type":"string","description":"Mailbox display name."}},"required":["domain_id","local_part","name"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/mailboxes/{resource_id}":{"patch":{"operationId":"commsharbor_email_mailbox_update","summary":"Change mailbox name or quota within the plan.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","description":"Display name."},"quota_mb":{"type":"integer","description":"Quota in MiB. Must fit the plan and current usage."},"files_quota_mb":{"type":"integer","description":"File allowance in MiB. The sum of mailbox allowances must fit files_gb in the plan. Zero disables files. Existing files are preserved."}}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/mailboxes/{resource_id}/password":{"post":{"operationId":"commsharbor_email_mailbox_password","summary":"Set the mailbox password. It is encrypted for the executor and is never returned.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"password":{"type":"string","description":"New mailbox password: 14 to 128 characters, with no control characters."}},"required":["password"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/mailboxes/{resource_id}/suspend":{"post":{"operationId":"commsharbor_email_mailbox_suspend","summary":"Suspend access while preserving mailbox data.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/mailboxes/{resource_id}/resume":{"post":{"operationId":"commsharbor_email_mailbox_resume","summary":"Restore suspended mailbox access.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/aliases":{"post":{"operationId":"commsharbor_email_alias_create","summary":"Create an alias to existing mailboxes in this organization.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"domain_id":{"type":"string","description":"Domain ID from the workspace, where the alias is created."},"local_part":{"type":"string","description":"Alias name before @."},"destinations":{"type":"object","description":"Existing mailbox addresses in this organization."}},"required":["domain_id","local_part","destinations"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/aliases/{resource_id}":{"patch":{"operationId":"commsharbor_email_alias_update","summary":"Change the alias destinations within this organization.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"destinations":{"type":"object","description":"Existing mailbox addresses."}},"required":["destinations"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/aliases/{resource_id}/suspend":{"post":{"operationId":"commsharbor_email_alias_suspend","summary":"Suspend an alias without deleting its configuration.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/aliases/{resource_id}/resume":{"post":{"operationId":"commsharbor_email_alias_resume","summary":"Restore a suspended alias without changing its destinations.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{}}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/jobs/{resource_id}":{"get":{"operationId":"commsharbor_email_job_get","summary":"Read one durable job in this organization.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"resource_id","in":"path","required":true,"schema":{"type":"string"},"description":"Opaque resource ID returned by this email API."}],"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/organizations/{organization_id}/email/services":{"post":{"operationId":"commsharbor_email_service_request","summary":"Request an included service with activation on demand.","description":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.\nReturns: { job }","security":[{"bearerAuth":[]}],"parameters":[{"name":"organization_id","in":"path","required":true,"schema":{"type":"string"},"description":"Organization ID from the shared account. It must match X-Organization-Id."},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string"},"description":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"service":{"type":"string","description":"Service code from the plan catalog.","enum":["migration","chat","meetings","documents","shared_mailboxes","bookings","scheduled_send","signatures"]}},"required":["service"]}}}},"responses":{"200":{"description":"{ job }","content":{"application/json":{"schema":{"type":"object","properties":{"job":{"type":"object","description":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"required":["job"]}}}},"400":{"description":"Invalid fields or missing idempotency key."},"401":{"description":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`."},"403":{"description":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`)."},"404":{"description":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere."},"409":{"description":"Conflicting replay, pending setup or plan not active."},"429":{"description":"Daily provisioning capacity reached. Retry later with the same idempotency key."},"503":{"description":"Private email backend unavailable or Trial activation has not passed native proof."}}}},"/api/email-check":{"get":{"operationId":"commsharbor_email_security_check","summary":"Check SPF, DKIM, DMARC, MX, MTA-STS and BIMI of a domain, with a 0-100 score and what to fix.","description":"Public DNS only, no account and no charge. The same domain is served from memory for 10 minutes. A network can run 30 new checks per day. DKIM is looked up in common selectors only; `dkim_not_found` does not prove that no key exists. `incomplete: true` means a DNS answer failed and the score can be lower than the real one; `unread` names those parts, and a failed query never becomes a missing finding.\nReturns: { domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url }","security":[],"parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string"},"description":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain."}],"responses":{"200":{"description":"{ domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url }","content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","description":"Registrable domain that was checked."},"score":{"type":"integer","description":"0 to 100: DMARC up to 40, SPF 20, DKIM 20, MX 10, MTA-STS 5 and BIMI 5."},"rating":{"type":"string","description":"protected (90+), good (70+), at_risk (40+) or exposed."},"findings":{"type":"array","items":{"type":"object"},"description":"`{code, severity}`, most severe first. Codes: dmarc_missing, dmarc_none, spf_plus_all, spf_missing, spf_multiple, dmarc_quarantine, dkim_not_found, spf_neutral, spf_softfail, dmarc_no_reports, mx_missing, mta_sts_missing, bimi_missing."},"spf":{"type":"object","description":"`{record, ending, multiple}`: the first SPF record, its `all` ending and whether there are two."},"dmarc":{"type":"object","description":"`{record, policy, reports}`: policy reject, quarantine, none or null; reports when `rua` is set."},"dkim":{"type":"object","description":"`{found, checked}`: selectors with a published key and the selectors looked up."},"mx":{"type":"array","items":{"type":"string"},"description":"MX records as `priority host`."},"mta_sts":{"type":"boolean","description":"An MTA-STS policy record exists."},"bimi":{"type":"boolean","description":"A BIMI record exists at the default selector."},"unread":{"type":"array","items":{"type":"string"},"description":"Parts whose DNS query failed (spf, dmarc, dkim, mx, mta_sts, bimi). They have no findings and no points."},"incomplete":{"type":"boolean","description":"At least one DNS query failed."},"checked_at":{"type":"string","description":"ISO time of the DNS reading."},"share_url":{"type":"string","description":"Public page with this result."},"badge_url":{"type":"string","description":"SVG badge with the score."}},"required":["domain","score","rating","findings","spf","dmarc","dkim","mx","mta_sts","bimi","unread","incomplete","checked_at","share_url","badge_url"]}}}},"400":{"description":"domain_invalid: not a public domain."},"429":{"description":"rate_limited: 30 new checks per account, or per network without an account, per day."},"503":{"description":"dns_unavailable: the DNS lookup failed; limit_unavailable: the daily limit could not be checked. Retry in a minute."}}}},"/api/email-check/badge":{"get":{"operationId":"get_api_email_check_badge","summary":"SVG badge with the email security score of a domain, for a website or README.","description":"Public DNS only, no account and no charge. The same domain is served from memory for 10 minutes. A network can run 30 new checks per day. The badge does not use the network's daily checks. An invalid domain or a failed lookup shows \"unknown\".\nReturns: `image/svg+xml` — a 20px-high badge with the score in the colour of its rating.","security":[],"parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string"},"description":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain."}],"responses":{"200":{"description":"`image/svg+xml` — a 20px-high badge with the score in the colour of its rating."}}}},"/api/x402/email-check":{"get":{"operationId":"get_api_x402_email_check","summary":"Checks the email security of a domain for an agent, paid per call: SPF, DKIM, DMARC, MX and a score, with no account.","description":"The check of `GET /api/email-check`, sold per call to agents, with no account and without the 30 free checks per day before. A request without payment gets the 402 with the price; a paid one gets the audit in the same response, with the payment in `cobranca`. DKIM is looked up in common selectors only; `incomplete: true` means a DNS answer failed. A refused domain, the hourly limit of the service and a failed DNS lookup are not charged.\nReturns: { domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url, cobranca{via,preco_usd,repetido,saldo_usd?} }","x-price-usd":0.01,"x-agent-value":{"when":"Does this domain publish SPF, DKIM and DMARC?","result":"SPF, DKIM, DMARC and MX findings, a score and source-query limitations.","replaces":"DNS lookups, record parsing and assembling the domain's email-policy findings.","free":"GET /api/email-check offers the same check within its free allowance. Use it first when it covers your task.","paid":"The x402 route buys a check from the first call, without an account or the free allowance first. Monthly domain-email packages buy mailboxes and storage, not this check; management requires organization authority.","limits":"DKIM checks common selectors only. Inspect incomplete and unread. A score does not prove inbox placement, stop every phishing attack or verify the contents of a mailbox.","alternative":"The free check suffices or you already have equivalent DNS analysis. For hosted email, evaluate activation readiness and the actual mailbox package separately."},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.01"},"protocols":[{"x402":{}}]},"security":[{"bearerAuth":[]}],"parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string"},"description":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain.","example":"example.com"},{"name":"authorization","in":"header","required":false,"schema":{"type":"string"},"description":"`Bearer mmk_…` (API key) or `Bearer mmo_…` (OAuth): the paid call uses the account balance without another header. Without an account, use prepaid credit from `POST /api/credito` as `Bearer cred_…`."},{"name":"x-api-key","in":"header","required":false,"schema":{"type":"string"},"description":"The mmk_… API key for this product. It identifies the account and authorizes its balance for the paid call."},{"name":"payment-signature","in":"header","required":false,"schema":{"type":"string"},"description":"The signed x402 payment proof (base64): `PAYMENT-SIGNATURE` (v2) or `X-PAYMENT` (v1)."},{"name":"x-wallet-token","in":"header","required":false,"schema":{"type":"string"},"description":"To recover an x402 response within 24 hours, repeat the same request and payment proof. Send the payer wallet's `mmw_…` credential here, issued through `/api/auth/wallet/agent/start` and `/api/auth/wallet/agent/token`. There is no new charge."}],"responses":{"200":{"description":"{ domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url, cobranca{via,preco_usd,repetido,saldo_usd?} }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerificacaoAvulsa"}}}},"400":{"description":"Paid without `domain` (`missing_input`) or with a domain that is not public (`domain_invalid`), both with `example`. Not charged."},"401":{"description":"API key refused (`invalid_api_key`), OAuth token refused (`invalid_token`), credit refused (`credito_invalido`), test credit outside dev (`credito_simulado`), or recovery without wallet authentication (`wallet_proof_required`). The first x402 purchase needs no account."},"402":{"description":"No payment: `accepts` (x402, USDC on Base) with the price of this call, at least US$ 0.01; `credito.preco_desta_chamada`, the lower price with prepaid credit; and `pacotes` (the credit top-ups and how many calls each one pays). Credit without balance answers `saldo_insuficiente`."},"409":{"description":"Payment is in progress, the request differs from the original, or the amount was recovered as balance. Do not sign another authorization to retry the purchase."},"410":{"description":"The 24-hour response recovery period ended. The financial record remains; the same proof cannot cause another charge."},"429":{"description":"rate_limited: the hourly limit of the service. Retry after the stated delay. Not charged."},"503":{"description":"dns_unavailable: the DNS lookup failed. Retry in a minute. Not charged."}}}},"/api/email-raio-x":{"get":{"operationId":"commsharbor_brazil_email_report","summary":"The monthly Brazil email security report: DMARC and SPF totals of city halls, governments, banks and listed companies.","description":"Public DNS only, read once a month. The sample is built from Brazil's open company registry (Receita Federal, the email of each active head office) and the CVM register of listed companies. Only totals: no domain is listed. A share is `count / (com_mx - dmarc.nao_lido)`; domains without MX are left out. Only the DMARC policy classifies; SPF is counted but does not change the class. `percent` rounds each group to 100 by the largest remainder, the same rule as the page.\nReturns: { mes, medido_em, amostra, grupos, total, method, page, page_pt }","security":[],"responses":{"200":{"description":"{ mes, medido_em, amostra, grupos, total, method, page, page_pt }","content":{"application/json":{"schema":{"type":"object","properties":{"mes":{"type":"string","description":"Month of the reading, `YYYY-MM` (UTC)."},"medido_em":{"type":"string","description":"ISO time when the reading finished."},"amostra":{"type":"string","description":"Date of the domain list, `YYYY-MM-DD`."},"grupos":{"type":"object","description":"Totals by group: `prefeituras` (city halls), `governos_estaduais`, `governo_federal`, `bancos`, `companhias_abertas` (listed companies) and `varejo` (listed retailers), each with the fields of `total`. A domain can be in two groups, so the groups add up to more than `total`."},"total":{"type":"object","description":"`{dominios, com_mx, sem_mx, mx_nao_lido, dmarc, spf, percent}`: domains in the sample and how many receive email (with MX). Among those, `dmarc` counts `reject`, `quarantine`, `none`, `ausente` (no record) and `nao_lido` (the DNS answer failed); `spf` counts the ending: `hardfail` (-all), `softfail` (~all), `fraco` (?all, +all or no ending), `ausente`, `multiplo` and `nao_lido`. `percent` has the whole-number shares of `ausente`, `none`, `quarantine` and `reject`, which add up to 100, and `nao_rejeitam` (100 minus `reject`): the numbers on the page. `null` when no DMARC answer was read."},"method":{"type":"string","description":"How the reading was made."},"page":{"type":"string","description":"Public page with the report, in English."},"page_pt":{"type":"string","description":"Public page with the report, in Portuguese."}},"required":["mes","medido_em","amostra","grupos","total","method","page","page_pt"]}}}},"503":{"description":"report_not_ready: the first monthly reading is still running; retry in an hour."}}}},"/api/credito/assinaturas":{"get":{"operationId":"get_api_credito_assinaturas","summary":"List at most 20 subscriptions owned by this account in this product.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Filters account, product, merchant and environment. Does not query Asaas or count the table. The accepted offer remains readable after sales close. Sandbox reads require a valid ticket. The complete query is limited to 640 characters, including the cursor.\nReturns: { itens[{recurso,id,oferta_id,oferta,estado,simulado,pagamento_em,criado_em,atualizado_em,cancelamento_em,cancelado_em,pago_ate}], proximo, simulado, recursos }","security":[{"bearerAuth":[]}],"parameters":[{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"cursor","in":"query","required":false,"schema":{"type":"string"},"description":"proximo from the previous page: UTC ISO time with milliseconds, ~ and a 32-character hexadecimal ID."},{"name":"recurso","in":"query","required":false,"schema":{"type":"string"},"description":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}],"responses":{"200":{"description":"{ itens[{recurso,id,oferta_id,oferta,estado,simulado,pagamento_em,criado_em,atualizado_em,cancelamento_em,cancelado_em,pago_ate}], proximo, simulado, recursos }","content":{"application/json":{"schema":{"type":"object","properties":{"itens":{"type":"array","items":{"$ref":"#/components/schemas/RegistroDeAssinatura"},"description":"At most 20 records owned by this account."},"proximo":{"type":"string","description":"Next-page cursor, or null.","nullable":true},"simulado":{"type":"boolean","description":"Server-authorized environment for this request."},"recursos":{"type":"object","description":"Optional for organization subscriptions: maps resource IDs on this page and its filter to names verified in this account's organizations; null when the name is not authorized. Never uses a name from the URL."}},"required":["itens","proximo","simulado","recursos"]}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"401":{"description":"Missing or invalid session. An API key cannot authorize these requests."},"403":{"description":"Invalid origin or cookie; invalid CSRF protection on a write."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"431":{"description":"Cookie header exceeds 8 KiB."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}},"post":{"operationId":"post_api_credito_assinaturas","summary":"Subscribe and pay for the selected offer by card through the API.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires a human session authenticated within the last 2 hours. Rejects Authorization and X-Api-Key. Send only the declared fields, with HTTPS and a JSON body of at most 4 KiB. recurso is accepted only when the product verifies it. simulado must match the catalog and authorized environment. An expired test ticket cannot change the request to production. Price and benefits come from the server. Card data goes to Asaas for this request only; it is not stored or returned. The server supplies the buyer IP. Allow up to 120 seconds. A repeated offer returns the existing reservation. An uncertain outcome requires a reference lookup before another creation. Creation grants no benefit. Only an Asaas-confirmed payment grants the paid period.\nReturns: { recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","security":[{"bearerAuth":[]}],"parameters":[{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."},{"name":"Origin","in":"header","required":true,"schema":{"type":"string"},"description":"Exact HTTPS origin of this product."},{"name":"X-CSRF-Token","in":"header","required":true,"schema":{"type":"string"},"description":"64-character token from this product's session bootstrap. Required for writes."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"recurso":{"type":"string","description":"Required when the product sells per resource. The server verifies the resource and account."},"simulado":{"type":"boolean","description":"Value from the catalog. States intent; grants no payment-test authority."},"aceite":{"allOf":[{"$ref":"#/components/schemas/AceiteDeAssinatura"}],"description":"Only oferta_id, versao, hash and renovacao. Match the current catalog."},"cartao":{"allOf":[{"$ref":"#/components/schemas/CartaoDeAssinatura"}],"description":"Cardholder's card and billing data. Do not send price, IP, environment or another account's identifier."}},"required":["simulado","aceite","cartao"]}}}},"responses":{"200":{"description":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegistroDeAssinatura"}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"401":{"description":"Missing or invalid session. An API key cannot authorize these requests."},"403":{"description":"Invalid origin or cookie; invalid CSRF protection on a write."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"409":{"description":"Incompatible state or another offer already reserved for this account and product."},"413":{"description":"JSON body exceeds 4 KiB."},"415":{"description":"Body is not application/json or has content encoding."},"429":{"description":"This account reached its daily charge-creation limit."},"431":{"description":"Cookie header exceeds 8 KiB."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}}},"/api/credito/assinaturas/ofertas":{"get":{"operationId":"get_api_credito_assinaturas_ofertas","summary":"Read the subscription offers and request environment when enabled.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Creates no charge, reservation or benefit. Does not convert a trial into a purchase.\nReturns: { ofertas[{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}], simulado }","security":[],"parameters":[{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}],"responses":{"200":{"description":"{ ofertas[{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}], simulado }","content":{"application/json":{"schema":{"type":"object","properties":{"ofertas":{"type":"array","items":{"$ref":"#/components/schemas/OfertaDeAssinatura"},"description":"1 to 8 versioned offers for this product."},"simulado":{"type":"boolean","description":"Server-authorized environment for this request."}},"required":["ofertas","simulado"]}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}}},"/api/credito/assinaturas/{id}":{"get":{"operationId":"get_api_credito_assinaturas_by_id","summary":"Read an owned subscription and its accepted offer without creating a payment.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires this product's valid human session. Does not query the provider. Sandbox reads also require a valid ticket.\nReturns: { recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Local subscription ID: 32 lowercase hexadecimal characters.","example":"0123456789abcdef0123456789abcdef"},{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"recurso","in":"query","required":false,"schema":{"type":"string"},"description":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}],"responses":{"200":{"description":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegistroDeAssinatura"}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"401":{"description":"Missing or invalid session. An API key cannot authorize these requests."},"403":{"description":"Invalid origin or cookie; invalid CSRF protection on a write."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"431":{"description":"Cookie header exceeds 8 KiB."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}},"post":{"operationId":"post_api_credito_assinaturas_by_id","summary":"Stop future charges for an owned subscription and keep the paid period.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Send only {} as JSON, with a valid session, origin and CSRF token. The server records cancellation intent before it calls Asaas. Pending is not confirmed cancellation. The request is repeatable. Refunds have a separate process; cancellation does not refund a payment.\nReturns: { recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Local subscription ID: 32 lowercase hexadecimal characters.","example":"0123456789abcdef0123456789abcdef"},{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"recurso","in":"query","required":false,"schema":{"type":"string"},"description":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."},{"name":"Origin","in":"header","required":true,"schema":{"type":"string"},"description":"Exact HTTPS origin of this product."},{"name":"X-CSRF-Token","in":"header","required":true,"schema":{"type":"string"},"description":"64-character token from this product's session bootstrap. Required for writes."}],"requestBody":{"required":true,"content":{"application/json":{"example":{}}}},"responses":{"200":{"description":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegistroDeAssinatura"}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"401":{"description":"Missing or invalid session. An API key cannot authorize these requests."},"403":{"description":"Invalid origin or cookie; invalid CSRF protection on a write."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"409":{"description":"Incompatible state or another offer already reserved for this account and product."},"413":{"description":"JSON body exceeds 4 KiB."},"415":{"description":"Body is not application/json or has content encoding."},"431":{"description":"Cookie header exceeds 8 KiB."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}}},"/api/credito/assinaturas/{id}/estado":{"get":{"operationId":"get_api_credito_assinaturas_by_id_estado","summary":"Observe changes to an owned subscription through the realtime channel.","description":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires this product's human session. Returns only ID and cursor, including after reconnection. A signal grants no paid access and exposes no financial data. Read the authenticated subscription after a change. That read still verifies environment, merchant and resource.\nReturns: { id, cursor }","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Local subscription ID: 32 lowercase hexadecimal characters.","example":"0123456789abcdef0123456789abcdef"},{"name":"dev","in":"query","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},{"name":"x402_dev","in":"query","required":false,"schema":{"type":"string"},"description":"Alias for dev. Send only one of these parameters."},{"name":"X-X402-Dev","in":"header","required":false,"schema":{"type":"string"},"description":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}],"responses":{"200":{"description":"{ id, cursor }","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Local subscription ID: 32 lowercase hexadecimal characters."},"cursor":{"type":"string","description":"State version. Compare for equality. It does not confirm a payment."}},"required":["id","cursor"]}}}},"400":{"description":"Invalid body, query, offer, acceptance, card or environment; card declined."},"401":{"description":"Missing or invalid session. An API key cannot authorize these requests."},"403":{"description":"Invalid origin or cookie; invalid CSRF protection on a write."},"404":{"description":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment."},"431":{"description":"Cookie header exceeds 8 KiB."},"503":{"description":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."}}}},"/api/credito/x402/saude":{"get":{"operationId":"get_api_credito_x402_saude","summary":"x402 verifier health: pending payments, missing hashes, failed or stalled reconciliation.","description":"Returns: { verificado_em, ativo, tarefas }","security":[],"responses":{"200":{"description":"{ verificado_em, ativo, tarefas }","content":{"application/json":{"schema":{"type":"object","properties":{"verificado_em":{"type":"string","description":"Reading time in UTC."},"ativo":{"type":"object","description":"Verifier configured in this process."},"tarefas":{"type":"array","items":{"type":"object"},"description":"Failures with id and reason, without payer data. Bounded counts show +."}},"required":["verificado_em","ativo","tarefas"]}}}},"503":{"description":"Verifier unavailable in this process."}}}},"/api/credito/barrados/saude":{"get":{"operationId":"get_api_credito_barrados_saude","summary":"People who paid and were blocked on this site in the last 24 hours: the site asked for payment from someone with balance or a plan, or charged and did not deliver.","description":"Returns: { verificado_em, ativo, total, tarefas }","security":[],"responses":{"200":{"description":"{ verificado_em, ativo, total, tarefas }","content":{"application/json":{"schema":{"type":"object","properties":{"verificado_em":{"type":"string","description":"Reading time in UTC."},"ativo":{"type":"object","description":"The reading worked."},"total":{"type":"integer","description":"Number of different cases."},"tarefas":{"type":"array","items":{"type":"object"},"description":"Up to 8 cases, with class, route, count and last time, without payer data."}},"required":["verificado_em","ativo","total","tarefas"]}}}}}}},"/api/credito/conta":{"get":{"operationId":"get_api_credito_conta","summary":"The balance of the session account: the sum of its purchases in this environment, in every product, without the code. With movimentos=1, the statement of the account.","description":"Returns: { saldo_micros, saldo_usd, referencia_usd, cotacao_brl_por_usd, movimentos, proximo }","security":[{"bearerAuth":[]}],"parameters":[{"name":"movimentos","in":"query","required":false,"schema":{"type":"string"},"description":"`1`: reads only the paged statement of the account, without the balance."},{"name":"de","in":"query","required":false,"schema":{"type":"string"},"description":"Inclusive start in UTC ISO 8601 with milliseconds. Default: 1970-01-01T00:00:00.000Z."},{"name":"ate","in":"query","required":false,"schema":{"type":"string"},"description":"Exclusive end in UTC ISO 8601 with milliseconds. Default: now. Keep the value between pages."},{"name":"antes","in":"query","required":false,"schema":{"type":"string"},"description":"The `proximo` cursor of the previous page. Only with movimentos=1."},{"name":"limite","in":"query","required":false,"schema":{"type":"integer"},"description":"1 to 50 entries per page; default 20. Only with movimentos=1."}],"responses":{"200":{"description":"{ saldo_micros, saldo_usd, referencia_usd, cotacao_brl_por_usd, movimentos, proximo }","content":{"application/json":{"schema":{"type":"object","properties":{"saldo_micros":{"type":"integer","description":"The balance in millionths of a dollar."},"saldo_usd":{"type":"string","description":"The balance in dollars, formatted."},"referencia_usd":{"type":"string","description":"The balance right after the last top-up, added across the wallets with a balance: the base of what is left."},"cotacao_brl_por_usd":{"type":"number","description":"The BRL rate the screen uses to show the balance."},"movimentos":{"type":"array","items":{"type":"object"},"description":"Only with movimentos=1: id, em, valor_usd, saldo_usd, motivo, produto and recurso, newest first."},"proximo":{"type":"string","description":"Only with movimentos=1: the cursor of the next page or null."}},"required":["saldo_micros","saldo_usd","referencia_usd","cotacao_brl_por_usd","movimentos","proximo"]}}}},"400":{"description":"Invalid period, limit or cursor."},"401":{"description":"No session."}}},"post":{"operationId":"post_api_credito_conta","summary":"Links credit bought without an account to the account of the session, USDC included. Then the balance works in the products of the shared credit with `X-Credito: conta`, added to the other purchases of the account.","description":"Returns: { ok, ligadas, da_conta }","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"{ ok, ligadas, da_conta }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"object","description":"The link was checked."},"ligadas":{"type":"integer","description":"Purchases linked now. Zero when the purchase already has an account."},"da_conta":{"type":"object","description":"The balance of this code is already in the account balance."}},"required":["ok","ligadas","da_conta"]}}}},"401":{"description":"No session or no credit code."}}}},"/api/credito":{"post":{"operationId":"post_api_credito","summary":"Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house.","description":"Returns: { token, saldo_usd, guarde, usar, usar_com_outra_credencial, saldo_em, onde_gastar }","x-payment-info":{"price":{"mode":"dynamic","currency":"USD","min":"0.1","max":"25"},"protocols":[{"x402":{}}]},"security":[],"parameters":[{"name":"usd","in":"query","required":true,"schema":{"type":"number"},"description":"Package: 0.1, 1, 5, 10 or 25 dollars."}],"responses":{"200":{"description":"{ token, saldo_usd, guarde, usar, usar_com_outra_credencial, saldo_em, onde_gastar }","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered."},"saldo_usd":{"type":"string","description":"Credited balance."},"guarde":{"type":"string","description":"Warning that the token is the bearer of the credit."},"usar":{"type":"string","description":"How to present the token on paid routes."},"usar_com_outra_credencial":{"type":"string","description":"The `X-Credito` header, for when `Authorization` already carries another credential."},"saldo_em":{"type":"string","description":"Where to check balance and statement."},"onde_gastar":{"type":"object","description":"`precos`: the paid actions and prices of this product (`/api/pricing`); `produtos`: the APIs.json with our other products."}},"required":["token","saldo_usd","guarde","usar","usar_com_outra_credencial","saldo_em","onde_gastar"]}}}},"400":{"description":"Package outside the list (0.1, 1, 5, 10 or 25)."},"402":{"description":"Unpaid — the body carries the x402 `accepts[]`."}}},"get":{"operationId":"get_api_credito","summary":"Balance and statement with cred_…; wallet balance and up to 20 recovery records with mmw_….","description":"A request without a token receives 401. The Link header points to the x402 manifest. When billing is configured, accepts[] contains the same terms as the smallest POST top-up. GET cannot charge or create credit.\nReturns: { saldo_micros, saldo_usd, criado_em, movimentos, wallet, payments, onde_gastar }","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"{ saldo_micros, saldo_usd, criado_em, movimentos, wallet, payments, onde_gastar }","content":{"application/json":{"schema":{"type":"object","properties":{"saldo_micros":{"type":"integer","description":"Balance in micro-dollars (1e-6 USD)."},"saldo_usd":{"type":"string","description":"Formatted balance."},"criado_em":{"type":"string","description":"When the credit was opened."},"movimentos":{"type":"array","items":{"type":"object"},"description":"Recent credits and debits, with product and resource."},"wallet":{"type":"string","description":"Only with mmw_…: authenticated wallet address."},"payments":{"type":"array","items":{"type":"object"},"description":"Only with mmw_…: up to 20 payments with id, produto, rede, tx_hash, micros, estado and criado_ms. creditado means recovered balance."},"onde_gastar":{"type":"object","description":"`precos`: the paid actions and prices of this product; `produtos`: the APIs.json with our other products."}},"required":["saldo_micros","saldo_usd","criado_em","movimentos","wallet","payments","onde_gastar"]}}}},"401":{"description":"No token, or unknown token."}}}},"/api/credito/pix":{"get":{"operationId":"get_api_credito_pix","summary":"Credit by Pix (Brazil): the key, the fixed rate, the packs in reais and what the receipt accepts.","description":"Returns: { chave, brl_por_usd, pacotes, comprovante, liberacao }","security":[],"responses":{"200":{"description":"{ chave, brl_por_usd, pacotes, comprovante, liberacao }","content":{"application/json":{"schema":{"type":"object","properties":{"chave":{"type":"string","description":"The Pix key that receives the payment."},"brl_por_usd":{"type":"number","description":"Fixed rate used for the packs."},"pacotes":{"type":"array","items":{"type":"object"},"description":"The packs (3, 5, 10 or 25 dollars), each with `brl_centavos` and `copia_e_cola` (the Pix copy-and-paste code for the amount, the same text as the QR: the bank app comes with the amount filled in)."},"comprovante":{"type":"object","description":"Accepted types (photo or PDF) and the maximum size, in bytes."},"liberacao":{"type":"string","description":"`manual`: the owner checks the Pix and releases it."}},"required":["chave","brl_por_usd","pacotes","comprovante","liberacao"]}}}}}},"post":{"operationId":"post_api_credito_pix","summary":"Request credit paid by Pix: multipart with `usd`, `comprovante` (photo or PDF up to 2 MB) and `email`; the rest is optional.","description":"The credit code comes back in the response and works once the owner checks the Pix and releases it (by hand, usually the same day). `email` is required: it is how the owner reaches the person. Optional: `nome`, `pagina` (the page the request came from, up to 2,000 characters) and what the person was buying when the 402 came — `recurso` (up to 2,000), `descricao` (up to 300) and `preco_usd` (decimal, e.g. `0.50`); and `navegador_id` (a UUID that links the requests from the same browser). Everything that arrives is recorded with the request — the receipt included —, with the signed-in account (checked by the session cookie), the network and browser.\nReturns: { id, estado, credito, estado_em }","security":[],"responses":{"200":{"description":"{ id, estado, credito, estado_em }","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Request id, to follow it."},"estado":{"type":"string","description":"`pendente` until the decision."},"credito":{"type":"string","description":"The `cred_…` token, shown ONCE; it works after the release."},"estado_em":{"type":"string","description":"Where to follow the request."}},"required":["id","estado","credito","estado_em"]}}}},"400":{"description":"Pack outside the list (3, 5, 10 or 25), no receipt or no valid e-mail."},"413":{"description":"Receipt above 2 MB."},"415":{"description":"Receipt that is neither a photo (JPEG, PNG, WebP) nor a PDF."},"429":{"description":"This network already sent today's requests."},"502":{"description":"The e-mail to the owner did not go out: the request is recorded as `falhou`; send it again."},"503":{"description":"Review queue full, or Pix not available in this app."}}}},"/api/credito/pix/{id}":{"get":{"operationId":"get_api_credito_pix_by_id","summary":"Status of a Pix credit request: `pendente`, `liberado`, `recusado` or `falhou`.","description":"Returns: { estado, usd, decidido_em }","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Request id (32 hex).","example":"0123456789abcdef0123456789abcdef"}],"responses":{"200":{"description":"{ estado, usd, decidido_em }","content":{"application/json":{"schema":{"type":"object","properties":{"estado":{"type":"string","description":"`pendente`, `liberado`, `recusado` or `falhou` (the e-mail to the owner did not go out; send again)."},"usd":{"type":"integer","description":"The requested pack."},"decidido_em":{"type":"string","description":"When the owner decided, or `null`."}},"required":["estado","usd","decidido_em"]}}}},"404":{"description":"Unknown request."}}}},"/api/credito/asaas/{id}/cancelar":{"post":{"operationId":"post_api_credito_asaas_by_id_cancelar","summary":"Cancels a pending charge when the payment dialog closes.","description":"Requires the `cancelamento` capability returned at creation. An older credit charge accepts its token in `credito`. The product and environment must match. This does not refund payments or remove records. 202 means cancellation is pending; the scheduled worker retries provider failures.\nReturns: { id, estado }","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Charge id (32 hex).","example":"0123456789abcdef0123456789abcdef"}],"responses":{"200":{"description":"{ id, estado }","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Charge id."},"estado":{"type":"string","description":"`cancelando`, `vencido`, or the confirmed final state."}},"required":["id","estado"]}}}},"404":{"description":"Invalid charge or capability, or a different product or environment."}}}},"/api/credito/asaas":{"get":{"operationId":"get_api_credito_asaas","summary":"Automatic Pix: whether it is available in this app, the packs in reais and the balance the product sells.","description":"Returns: { disponivel, pacotes, exatos, saldo, precisa_documento }","security":[],"responses":{"200":{"description":"{ disponivel, pacotes, exatos, saldo, precisa_documento }","content":{"application/json":{"schema":{"type":"object","properties":{"disponivel":{"type":"object","description":"`false` when the app has no Asaas configured (use the Pix with receipt)."},"pacotes":{"type":"array","items":{"type":"object"},"description":"The credit packs (3, 5, 10 or 25 dollars), with `brl_centavos`."},"exatos":{"type":"array","items":{"type":"object"},"description":"Prices declared by the app, with `usd` and `brl_centavos`. Amounts start at R$ 5.00 and cannot exceed R$ 10,000."},"saldo":{"type":"object","description":"When the product sells a balance in reais: the range and whether the account can buy."},"precisa_documento":{"type":"object","description":"Whether the payer's CPF or CNPJ is still required."}},"required":["disponivel","pacotes","exatos","saldo","precisa_documento"]}}}}}},"post":{"operationId":"post_api_credito_asaas","summary":"Creates a dynamic Pix: JSON with `oferta` (`pacote` with `usd`, or `saldo` with `centavos`) and the payer.","description":"The payment releases what was bought by itself: the pack becomes the `cred_…` token already in the response; the balance goes to the logged-in account's organization. The first purchase needs `documento` (CPF or CNPJ, sent to the gateway and not stored here) and `nome`; `email`, `pagina` and `navegador_id` are optional. With `forma: \"cartao_boleto\"` the charge is open: the response brings `pagamento_em`, the gateway page where you pay by card, boleto or Pix (due in three days). With `forma: \"cartao\"` and `cartao` (`titular`, `numero`, `mes`, `ano`, `cvv`, `documento`, `email`, `cep`, `numero_endereco`, `telefone`), the charge is paid by card in the same request: 200 with `estado: \"pago\"`, 202 with `conferir` while the issuer reviews it, 422 when the card is declined; the card is not stored. Set `usd` to an amount from `pacotes` or `exatos` in the GET response. The server sets the amount in cents and rejects amounts that the app has not declared.\nReturns: { id, credito, forma, pix, pagamento_em, estado, estado_em, cancelamento }","security":[],"responses":{"200":{"description":"{ id, credito, forma, pix, pagamento_em, estado, estado_em, cancelamento }","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Charge id, to follow up."},"credito":{"type":"string","description":"For a pack: the `cred_…` token, shown ONCE; valid when the payment arrives."},"forma":{"type":"string","description":"`pix` (the default), `cartao` or `cartao_boleto`."},"pix":{"type":"object","description":"`copia_e_cola`, `imagem` (PNG QR, data URI) and `expira_em`; `pix` form only."},"pagamento_em":{"type":"string","description":"In the `cartao_boleto` form: the gateway payment page."},"estado":{"type":"string","description":"In the `cartao` form: `pago`, or `pendente` with `conferir`."},"estado_em":{"type":"string","description":"Where to follow the payment."},"cancelamento":{"type":"string","description":"Capability to cancel a pending Pix or boleto charge."}},"required":["id","credito","forma","pix","pagamento_em","estado","estado_em","cancelamento"]}}}},"400":{"description":"Credit amount outside `pacotes` and `exatos`, amount out of range, invalid CPF/CNPJ, name or e-mail, invalid card data (`cartao_dados`, with the `campo`), or the gateway refused the payer (`pagador_recusado`, with the reason in `detalhe`)."},"422":{"description":"Card declined (`cartao_recusado`, with the `campo` when the gateway says which); try another card with `POST /api/credito/asaas/:id/cartao`."},"429":{"description":"Limit of 3 attempts per minute or 10 per day, per account or network, or the card limit."},"502":{"description":"The gateway did not create the Pix; try again."},"503":{"description":"Automatic Pix unavailable in this app, the gateway is busy (`asaas_ocupado`, wait `retry_after_s`), or too many charges from people not signed in waiting for payment."}}}},"/api/credito/asaas/{id}":{"get":{"operationId":"get_api_credito_asaas_by_id","summary":"State of an automatic Pix charge: `pendente`, `pago`, `vencido`, `estornado` or `falhou`.","description":"Returns: { estado, pago_em }","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Charge id (32 hex).","example":"0123456789abcdef0123456789abcdef"}],"responses":{"200":{"description":"{ estado, pago_em }","content":{"application/json":{"schema":{"type":"object","properties":{"estado":{"type":"string","description":"`pago` releases the pack token or the balance; a Pix paid after the due date counts."},"pago_em":{"type":"string","description":"When the payment was confirmed, or `null`."}},"required":["estado","pago_em"]}}}},"404":{"description":"Unknown charge."}}}},"/api/credito/asaas/{id}/cartao":{"post":{"operationId":"post_api_credito_asaas_by_id_cartao","summary":"Pays a card charge whose card was declined with another card: the same charge, never charged twice.","description":"JSON with the `cartao` (the same fields as `POST /api/credito/asaas`) and, without an account, the `navegador_id` that created the charge. Only a card charge waiting for payment, by whoever created it, and up to five attempts per charge.\nReturns: { estado, estado_em }","security":[],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Id da cobrança (32 hex).","example":"0123456789abcdef0123456789abcdef"}],"responses":{"200":{"description":"{ estado, estado_em }","content":{"application/json":{"schema":{"type":"object","properties":{"estado":{"type":"string","description":"`pago`, or `pendente` with `conferir` while the issuer reviews it."},"estado_em":{"type":"string","description":"Where to follow the payment."}},"required":["estado","estado_em"]}}}},"400":{"description":"Invalid card data (`cartao_dados`, with the `campo`)."},"404":{"description":"Unknown charge, someone else's charge, or not a card charge."},"409":{"description":"The charge expired or was closed; start the payment again."},"422":{"description":"Card declined (`cartao_recusado`)."},"429":{"description":"Used up the card attempts for this charge or for today."}}}},"/api/credito/asaas/saude":{"get":{"operationId":"get_api_credito_asaas_saude","summary":"Health of this app's Pix and enabled subscriptions: failures and reasons for the dashboard.","description":"Returns: { ativo, tarefas }","security":[],"responses":{"200":{"description":"{ ativo, tarefas }","content":{"application/json":{"schema":{"type":"object","properties":{"ativo":{"type":"object","description":"`false` when Asaas and subscriptions are disabled."},"tarefas":{"type":"array","items":{"type":"object"},"description":"Each problem has `id`, `falhando`, and `motivo`. Includes Pix and, when enabled, subscription recovery, queue, and budget. Does not call the provider."}},"required":["ativo","tarefas"]}}}}}}},"/api/erro-cliente":{"post":{"operationId":"post_api_erro_cliente","summary":"Browser error report, sent by the interface itself. Agents need not call it.","description":"The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report.\nReturns: 204 with no body, always — an invalid, repeated or over-cap report also gets 204.","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string","description":"Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report)."},"phase":{"type":"string","description":"Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`…"},"path":{"type":"string","description":"Path of the open page, without query; numbers, hashes and tokens in it are kept as `:id`."},"message":{"type":"string","description":"Error message, up to 2000 characters."},"stack":{"type":"string","description":"Stack trace, up to 12000 characters."},"source":{"type":"string","description":"Originating script; only its path is kept."},"line":{"type":"integer","description":"Line in the originating script."},"column":{"type":"integer","description":"Column in the originating script."},"visivel":{"type":"boolean","description":"Whether the tab was visible when it broke."},"build":{"type":"string","description":"Build of the reporting page (its `<meta name=\"build\">`), up to 64 letters, digits, `.`, `_` or `-`; it dates the failure."}},"required":["code","phase"]},"example":{"code":"UI-APP-001","phase":"carregar_lista","path":"/","message":"lista 500"}}}},"responses":{"200":{"description":"204 with no body, always — an invalid, repeated or over-cap report also gets 204."}}}},"/api/pagamento/aberto":{"post":{"operationId":"post_api_pagamento_aberto","summary":"The interface reports a visible payment prompt. Agents must not call this route.","description":"An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap.\nReturns: 202 with no body when accepted; 204 when ignored. Always no-store.","security":[],"parameters":[{"name":"Origin","in":"header","required":true,"schema":{"type":"string"},"description":"The page origin, identical to this route's origin."},{"name":"Sec-Fetch-Site","in":"header","required":true,"schema":{"type":"string"},"description":"`same-origin`, set by the browser."},{"name":"X-MM-Payment-View","in":"header","required":true,"schema":{"type":"string"},"description":"`1`, set by the shared component."}],"responses":{"202":{"description":"202 with no body when accepted; 204 when ignored. Always no-store."}}}},"/api/funil":{"post":{"operationId":"post_api_funil","summary":"The interface reports the steps of a visit (conversion funnel). Agents must not call this route.","description":"A same-origin batch sent by the page itself: page views, engagement, offer in view, buy click, payment window, payment sent or accepted. It keeps the browser's random id, the path without query, the referring host and the utm tags; never IP, e-mail or account. It writes no database row: one line per batch in the day's journal, with a cap. Declared robots and smoke tests are left out.\nReturns: 202 with no body when stored; 204 when ignored. Always no-store.","security":[],"parameters":[{"name":"Origin","in":"header","required":false,"schema":{"type":"string"},"description":"The page origin, identical to this route's origin."},{"name":"Content-Type","in":"header","required":true,"schema":{"type":"string"},"description":"`application/json` or `text/plain`."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"v":{"type":"number","description":"Batch version: `1`."},"vid":{"type":"string","description":"This browser's random id (UUID v4)."},"sid":{"type":"string","description":"Session id (30 idle minutes end it)."},"sn":{"type":"number","description":"This browser's session number."},"pv":{"type":"string","description":"Page view id."},"e":{"type":"array","items":{"type":"object"},"description":"Up to 40 events `{ t, n, p? }` from the funnel vocabulary."}},"required":["v","vid","sid","sn","pv","e"]}}}},"responses":{"202":{"description":"202 with no body when stored; 204 when ignored. Always no-store."}}}},"/api/funil/arquivos":{"get":{"operationId":"get_api_funil_arquivos","summary":"Operator: the funnel journal days kept by this app, with the size of each.","description":"Returns: { v, produto, teto, dias }","security":[],"parameters":[{"name":"Authorization","in":"header","required":true,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>`."}],"responses":{"200":{"description":"{ v, produto, teto, dias }","content":{"application/json":{"schema":{"type":"object","properties":{"v":{"type":"number","description":"Stored batch version."},"produto":{"type":"string","description":"The product."},"teto":{"type":"object","description":"`bytesDia` and `dias` kept."},"dias":{"type":"array","items":{"type":"object"},"description":"`{ dia, bytes }`, oldest to today."}},"required":["v","produto","teto","dias"]}}}},"401":{"description":"Unauthorized"},"503":{"description":"Not configured"}}}},"/api/funil/arquivo":{"get":{"operationId":"get_api_funil_arquivo","summary":"Operator: a slice of one funnel journal day, as NDJSON, from a byte offset.","description":"Up to 4 MiB per response, cut at the last whole line. `X-MM-Funil-Proximo` says where to ask for the rest; `X-MM-Funil-Tamanho`, the day's size now.\nReturns: JSON lines, one per stored batch.","security":[],"parameters":[{"name":"dia","in":"query","required":true,"schema":{"type":"string"},"description":"The day, `YYYY-MM-DD` (UTC)."},{"name":"desde","in":"query","required":false,"schema":{"type":"number"},"description":"The byte to read from; `0` at the start."},{"name":"Authorization","in":"header","required":true,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>`."}],"responses":{"200":{"description":"JSON lines, one per stored batch."},"400":{"description":"Invalid parameters"},"401":{"description":"Unauthorized"},"503":{"description":"Not configured"}}}},"/api/vitrine":{"get":{"operationId":"get_api_vitrine","summary":"The product's public numbers: traffic, agents, usage and reliability, no money.","description":"Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token.\nReturns: { v, produto, publicado, atualizado_em, stale, nome?, desde?, fuso?, hoje?, dias?, janelas?, visitantes?, pessoas?, agentes?, superficies?, mcp?, uso?, contas?, confiabilidade?, catalogo?, apoio? }","security":[],"responses":{"200":{"description":"{ v, produto, publicado, atualizado_em, stale, nome?, desde?, fuso?, hoje?, dias?, janelas?, visitantes?, pessoas?, agentes?, superficies?, mcp?, uso?, contas?, confiabilidade?, catalogo?, apoio? }","content":{"application/json":{"schema":{"type":"object","properties":{"v":{"type":"integer","description":"Contract version (1)."},"produto":{"type":"string","description":"Product id."},"publicado":{"type":"boolean","description":"`false` before the collector's first publication; then only these five keys come."},"atualizado_em":{"type":"string","description":"When the collector published (ISO 8601).","nullable":true},"stale":{"type":"boolean","description":"`true` when the projection is older than 26 h."},"nome":{"type":"string","description":"Product name."},"desde":{"type":"string","description":"First day the series covers.","nullable":true},"fuso":{"type":"string","description":"Traffic time zone. Audience periods state their time zone in `pessoas.medicao`."},"hoje":{"type":"object","description":"Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage."},"dias":{"type":"array","items":{"type":"object"},"description":"Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`."},"janelas":{"type":"object","description":"7- and 30-day sums (`d7`, `d30`)."},"visitantes":{"type":"object","description":"Unique browsers with recorded interaction over 7 days."},"pessoas":{"type":"object","description":"First-party measurement of browsers confirmed by interaction: unique browsers, sessions and pages over 7 and 30 days, segments and coverage. `null` means no measurement. Browsers are not verified people.","nullable":true},"agentes":{"type":"object","description":"The AI agents and bots that read the most, 7 days."},"superficies":{"type":"object","description":"Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days."},"mcp":{"type":"object","description":"MCP calls over 7 days."},"uso":{"type":"object","description":"Real product usage per resource: label, today, 7 and 30 days."},"contas":{"type":"object","description":"Users and guests.","nullable":true},"confiabilidade":{"type":"object","description":"Share of requests without 5xx over 7 days, and the live build."},"catalogo":{"type":"object","description":"Size of the catalog, when the product has one.","nullable":true},"apoio":{"type":"object","description":"Measured sponsors: 1-second exposures and native clicks per page in confirmed sessions, 7-day CTR, observed days and coverage. Empty means no history, not zero CTR."}},"required":["v","produto","publicado","atualizado_em","stale"]}}}}}}},"/api/vitrine/operador":{"get":{"operationId":"get_api_vitrine_operador","summary":"The product's full document on the operator panel — operator token only.","description":"Returns: { produto, atualizado_em, operador }","security":[],"parameters":[{"name":"Authorization","in":"header","required":true,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>` — the operator class."}],"responses":{"200":{"description":"{ produto, atualizado_em, operador }","content":{"application/json":{"schema":{"type":"object","properties":{"produto":{"type":"string","description":"Product id."},"atualizado_em":{"type":"string","description":"When the collector published.","nullable":true},"operador":{"type":"object","description":"The collector's full document, with what the public projection leaves out.","nullable":true}},"required":["produto","atualizado_em","operador"]}}}},"401":{"description":"No token, wrong token or a token of another class."},"503":{"description":"Worker without `METRICS_TOKEN` or without the control plane."}}}},"/api/vitrine/painel":{"get":{"operationId":"get_api_vitrine_painel","summary":"The whole house panel, in the shape the gm reads — operator token only.","description":"Returns: { apps, updated?, totals? }","security":[],"parameters":[{"name":"Authorization","in":"header","required":true,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>` — the operator class."}],"responses":{"200":{"description":"{ apps, updated?, totals? }","content":{"application/json":{"schema":{"type":"object","properties":{"apps":{"type":"array","items":{"type":"object"},"description":"One operator document per product, ordered by id."},"updated":{"type":"string","description":"When the collector closed the round."},"totals":{"type":"object","description":"House totals."}},"required":["apps"]}}}},"401":{"description":"No token, wrong token or a token of another class."},"503":{"description":"Worker without `METRICS_TOKEN` or without the control plane."}}}},"/api/vitrine/cursores":{"get":{"operationId":"get_api_vitrine_cursores","summary":"Per-product cursors: `borda`, `borda5xx` (5xx only), and `cli`. Operator token only.","description":"Returns: JSON: `{ [product]: { borda?: ISO, borda5xx?: ISO, cli?: ISO } }`; empty is `{}`.","security":[],"parameters":[{"name":"Authorization","in":"header","required":true,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>` — the operator class."}],"responses":{"200":{"description":"JSON: `{ [product]: { borda?: ISO, borda5xx?: ISO, cli?: ISO } }`; empty is `{}`."},"401":{"description":"No token, wrong token or a token of another class."},"503":{"description":"Worker without `METRICS_TOKEN` or without the control plane."}}}},"/api/partners":{"get":{"operationId":"get_api_partners","summary":"Partnerships, integrations and contact.","description":"Partnership ideas, public numbers and contact form. Advertising and ad purchases are unavailable. Cached for 1 hour.\nReturns: { status, produto, idioma, titulo, descricao, publico, modalidades, placements, packages, house_bundle, parcerias, current_sponsors, stats, payment, contact, politica, _links, publicidade_disponivel }","security":[],"responses":{"200":{"description":"{ status, produto, idioma, titulo, descricao, publico, modalidades, placements, packages, house_bundle, parcerias, current_sponsors, stats, payment, contact, politica, _links, publicidade_disponivel }","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","description":"`parceria`."},"produto":{"type":"string","description":"Product name."},"idioma":{"type":"string","description":"Language of the texts (the product's)."},"titulo":{"type":"string","description":"Title of the offer."},"descricao":{"type":"string","description":"One sentence about the offer."},"publico":{"type":"string","description":"Who uses the product — the audience a sponsor reaches."},"modalidades":{"type":"array","items":{"type":"object"},"description":"`{ id, nome }`: patrocinio, parceria, anuncio."},"placements":{"type":"array","items":{"type":"object"},"description":"[]"},"packages":{"type":"array","items":{"type":"object"},"description":"[]"},"house_bundle":{"type":"object","description":"`{ disponivel: false }`."},"parcerias":{"type":"array","items":{"type":"string"},"description":"Partnership ideas the product is open to discuss."},"current_sponsors":{"type":"array","items":{"type":"object"},"description":"Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`."},"stats":{"type":"object","description":"Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication."},"payment":{"type":"object","description":"`{ disponivel: false }`."},"contact":{"type":"object","description":"`email`, `form_url`, `api_url` (`POST /api/contact`, free: one message every 10 s per network), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `message_template`, `instructions`."},"politica":{"type":"object","description":"Refused sectors."},"_links":{"type":"object","description":"`self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products)."},"publicidade_disponivel":{"type":"boolean","description":"`false`."}},"required":["status","produto","idioma","titulo","descricao","publico","modalidades","placements","packages","house_bundle","parcerias","current_sponsors","stats","payment","contact","politica","_links","publicidade_disponivel"]}}}}}}},"/api/contact":{"post":{"operationId":"post_api_contact","summary":"Write to the people behind the product — free, for people and agents alike.","description":"One route for a question and for a sponsorship, partnership or ad proposal (`tipo`, with the placements of `GET /api/partners`). No captcha, no account, no payment. One message every 10 seconds per network: one that arrives sooner waits its turn and then goes out — no error. The message reaches the team by e-mail, with `email` as the reply address. For voice, send multipart/form-data: `dados` is this JSON (up to 32 KiB), and `audio` is one WebM, Ogg or M4A audio file (up to 2 MB). Audio can replace message. The browser records up to two minutes. Audio is attached to the owner's e-mail.\nReturns: { ok }","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","description":"What to call the person writing."},"email":{"type":"string","description":"Where to reply."},"message":{"type":"string","description":"What you want to say."},"whatsapp":{"type":"string","description":"Optional reply number with country code, such as +5561999999999."},"prefer_whatsapp":{"type":"boolean","description":"Request a WhatsApp reply. Requires whatsapp."},"tipo":{"type":"string","description":"Proposal: `patrocinio`, `parceria`, `anuncio` or `consultoria`. Turns on the fields below."},"empresa":{"type":"string","description":"Who is proposing, when it is a company."},"site":{"type":"string","description":"Website of who is proposing."},"orcamento":{"type":"string","description":"Advertising: `ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`. Consulting, in US dollars: `ate_2000`, `2000_5000`, `5000_10000`, `10000_mais` or `nao_sei`."},"espaco":{"type":"array","items":{"type":"string"},"description":"Placement ids from `GET /api/partners`, up to 6."},"duracao":{"type":"string","description":"Exposure in days: `30`, `90` or `365`."},"pagamento":{"type":"string","description":"`usdc`, `deposito` or `a_combinar`."},"projeto":{"type":"string","description":"Consulting: the kind of project (`llm_privado`, `voz`, `dados_sensiveis`, `gpu`, `integracao` or `outro`)."},"prazo":{"type":"string","description":"Consulting: when to start (`agora`, `1_mes`, `1_3_meses` or `explorando`)."},"formato":{"type":"string","description":"Consulting: `projeto` (per scope), `mensal` (monthly) or `assessoria` (advisory)."},"pais":{"type":"string","description":"Consulting: the country of the person asking."},"fuso":{"type":"string","description":"Consulting: the IANA time zone, such as `America/New_York`."},"horarios":{"type":"array","items":{"type":"string"},"description":"Consulting: up to 3 times for the call, `YYYY-MM-DDTHH:MM` in that time zone."}},"required":["name","email","message"]},"example":{"name":"Agent","email":"agent@example.com","message":"hello from an agent"}}}},"responses":{"200":{"description":"{ ok }","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","description":"Always `true` when the message was accepted."}},"required":["ok"]}}}},"400":{"description":"Validation: `code` names the field."},"503":{"description":"Contact is not configured on this server."}}}},"/api/metrics":{"get":{"operationId":"get_api_metrics","summary":"Last-7-day metrics for the operator dashboard; with the token, payments come along.","description":"Without credentials it returns product usage: deliveries per day and organization totals. With `METRICS_TOKEN` as Bearer it adds `payments` — x402 settled on Base mainnet only — and `compras`, who paid in the last 30 days.\nReturns: { app, today, today_visits, today_contacts?, days, usage, accounts, financeiro?, payments?, compras? }","security":[],"parameters":[{"name":"Authorization","in":"header","required":false,"schema":{"type":"string"},"description":"`Bearer <METRICS_TOKEN>` to include the financial block; a wrong token is 401."}],"responses":{"200":{"description":"{ app, today, today_visits, today_contacts?, days, usage, accounts, financeiro?, payments?, compras? }","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Metricas"}}}},"401":{"description":"Wrong operator token."},"503":{"description":"Worker without METRICS_TOKEN configured."}}}}}}