{
  "openapi": "3.1.0",
  "info": {
    "title": "Osmesys Reporting API",
    "description": "Unified HTTP API for the Osmesys ESG / Impact reporting platform. All routes are exposed through the API Gateway. Protected routes require a Bearer JWT obtained from `/api/auth/login`.",
    "version": "1.0.0",
    "contact": {
      "name": "Osmesys",
      "url": "https://reporting.osmesys.com"
    }
  },
  "servers": [
    {
      "url": "https://reporting.osmesys.com",
      "description": "Production"
    },
    {
      "url": "http://localhost:8000",
      "description": "Local development"
    }
  ],
  "tags": [
    { "name": "Auth", "description": "Registration, login, logout" },
    { "name": "Tenants", "description": "Tenant settings, branding, reseller children" },
    { "name": "Documents", "description": "Upload and document lifecycle" },
    { "name": "Companies", "description": "Company master data and YoY comparison" },
    { "name": "Indicators", "description": "Extracted ESG indicators" },
    { "name": "Watchlist", "description": "Portfolio IR-page monitoring" },
    { "name": "Anomaly", "description": "Statistical anomaly detection" },
    { "name": "Greenwashing", "description": "Narrative / greenwashing analysis" },
    { "name": "Reports", "description": "Impact reports and certification" },
    { "name": "Verify", "description": "Public certificate verification" },
    { "name": "Docs", "description": "This documentation portal" }
  ],
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "properties": {
          "error": { "type": "string" }
        },
        "required": ["error"]
      },
      "LoginRequest": {
        "type": "object",
        "required": ["email", "password", "tenant_slug"],
        "properties": {
          "email": { "type": "string", "format": "email" },
          "password": { "type": "string", "format": "password" },
          "tenant_slug": { "type": "string" }
        }
      },
      "AuthTokens": {
        "type": "object",
        "properties": {
          "access_token": { "type": "string" },
          "refresh_token": { "type": "string" },
          "token_type": { "type": "string", "example": "Bearer" },
          "expires_in": { "type": "integer" }
        }
      },
      "ChangePasswordRequest": {
        "type": "object",
        "required": ["current_password", "new_password"],
        "properties": {
          "current_password": { "type": "string", "format": "password" },
          "new_password": { "type": "string", "format": "password", "description": "At least 12 characters, with an uppercase letter, a lowercase letter, and a digit or special character." }
        }
      },
      "WatchlistEntry": {
        "type": "object",
        "properties": {
          "id": { "type": "string", "format": "uuid" },
          "company_id": { "type": "string", "format": "uuid", "nullable": true },
          "company_name": { "type": "string" },
          "monitoring_enabled": { "type": "boolean" },
          "check_frequency": { "type": "string", "enum": ["daily", "weekly"] },
          "ir_page_url": { "type": "string", "nullable": true },
          "lei": { "type": "string", "nullable": true },
          "last_checked": { "type": "string", "format": "date-time", "nullable": true },
          "new_discovery_count": { "type": "integer", "nullable": true }
        }
      },
      "CertificateVerification": {
        "type": "object",
        "properties": {
          "valid": { "type": "boolean" },
          "certificate_id": { "type": "string", "format": "uuid" },
          "company_name": { "type": "string", "nullable": true },
          "reporting_year": { "type": "integer", "nullable": true },
          "credibility_score": { "type": "number", "nullable": true },
          "issued_at": { "type": "string", "format": "date-time", "nullable": true },
          "revoked": { "type": "boolean" },
          "reason": { "type": "string", "nullable": true }
        }
      }
    }
  },
  "paths": {
    "/api/docs/openapi.json": {
      "get": {
        "tags": ["Docs"],
        "summary": "OpenAPI specification",
        "security": [],
        "responses": {
          "200": {
            "description": "OpenAPI 3.1 document",
            "content": {
              "application/json": {
                "schema": { "type": "object" }
              }
            }
          }
        }
      }
    },
    "/api/docs": {
      "get": {
        "tags": ["Docs"],
        "summary": "Scalar interactive documentation UI",
        "security": [],
        "responses": {
          "200": {
            "description": "HTML documentation portal",
            "content": {
              "text/html": {
                "schema": { "type": "string" }
              }
            }
          }
        }
      }
    },
    "/api/auth/login": {
      "post": {
        "tags": ["Auth"],
        "summary": "Login and obtain JWT",
        "security": [],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": { "$ref": "#/components/schemas/LoginRequest" }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Tokens issued",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/AuthTokens" }
              }
            }
          },
          "401": {
            "description": "Invalid credentials",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/Error" }
              }
            }
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/auth/logout": {
      "post": {
        "tags": ["Auth"],
        "summary": "Logout and revoke access token JTI",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Logged out" }
        }
      }
    },
    "/api/auth/change-password": {
      "post": {
        "tags": ["Auth"],
        "summary": "Change the caller's own password",
        "description": "Verifies current_password, then rotates the credential. All other refresh tokens for this user are revoked; a fresh token pair is issued for the calling session.",
        "security": [{ "bearerAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": { "$ref": "#/components/schemas/ChangePasswordRequest" }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Password changed — new tokens issued",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/AuthTokens" }
              }
            }
          },
          "400": {
            "description": "New password fails policy, or matches the current password",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/Error" }
              }
            }
          },
          "401": {
            "description": "Invalid/expired access token, or current_password is incorrect",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/Error" }
              }
            }
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/api/tenants/me": {
      "get": {
        "tags": ["Tenants"],
        "summary": "Current tenant (includes branding)",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Tenant object" }
        }
      }
    },
    "/api/tenants/me/children": {
      "get": {
        "tags": ["Tenants"],
        "summary": "List sub-tenants (reseller)",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Array of child tenants" }
        }
      },
      "post": {
        "tags": ["Tenants"],
        "summary": "Create a sub-tenant (reseller)",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "201": { "description": "Sub-tenant created" }
        }
      }
    },
    "/api/ssl/documents/upload": {
      "post": {
        "tags": ["Documents"],
        "summary": "Upload a document for extraction",
        "security": [{ "bearerAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "required": ["file"],
                "properties": {
                  "file": { "type": "string", "format": "binary" },
                  "frameworks": { "type": "string", "example": "GRI,SASB" },
                  "industry": { "type": "string" }
                }
              }
            }
          }
        },
        "responses": {
          "200": { "description": "Document queued" },
          "401": { "description": "Unauthorized" }
        }
      }
    },
    "/api/ssl/companies": {
      "get": {
        "tags": ["Companies"],
        "summary": "List companies",
        "security": [{ "bearerAuth": [] }],
        "parameters": [
          { "name": "page", "in": "query", "schema": { "type": "integer", "default": 1 } },
          { "name": "per_page", "in": "query", "schema": { "type": "integer", "default": 20 } },
          { "name": "sector", "in": "query", "schema": { "type": "string" } },
          { "name": "search", "in": "query", "schema": { "type": "string" } }
        ],
        "responses": {
          "200": { "description": "Paginated company list" }
        }
      },
      "post": {
        "tags": ["Companies"],
        "summary": "Create a company",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "201": { "description": "Company created" }
        }
      }
    },
    "/api/ssl/query/indicators": {
      "get": {
        "tags": ["Indicators"],
        "summary": "List extracted indicators",
        "description": "Returns multilingual names (`indicator_name_en`, `indicator_name_original`) when available.",
        "security": [{ "bearerAuth": [] }],
        "parameters": [
          { "name": "document_id", "in": "query", "schema": { "type": "string", "format": "uuid" } },
          { "name": "company_id", "in": "query", "schema": { "type": "string", "format": "uuid" } },
          { "name": "framework", "in": "query", "schema": { "type": "string" } },
          { "name": "label_status", "in": "query", "schema": { "type": "string" } }
        ],
        "responses": {
          "200": { "description": "Paginated indicators" }
        }
      }
    },
    "/api/ssl/watchlist": {
      "get": {
        "tags": ["Watchlist"],
        "summary": "List watchlist entries",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": {
            "description": "Paginated watchlist",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": { "$ref": "#/components/schemas/WatchlistEntry" }
                    },
                    "total": { "type": "integer" }
                  }
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": ["Watchlist"],
        "summary": "Add a company to the watchlist",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "201": { "description": "Watchlist entry created" }
        }
      }
    },
    "/api/ssl/watchlist/{id}/check": {
      "post": {
        "tags": ["Watchlist"],
        "summary": "Run an IR-page check now (SSRF-hardened)",
        "security": [{ "bearerAuth": [] }],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": { "type": "string", "format": "uuid" }
          }
        ],
        "responses": {
          "200": { "description": "Check result with new discovery count" },
          "400": { "description": "Cooldownoldown active or invalid URL" }
        }
      }
    },
    "/api/anomaly": {
      "get": {
        "tags": ["Anomaly"],
        "summary": "List anomaly detections",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Detections list" }
        }
      }
    },
    "/api/greenwashing/assessments": {
      "get": {
        "tags": ["Greenwashing"],
        "summary": "List greenwashing assessments",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Assessments list" }
        }
      }
    },
    "/api/reports": {
      "get": {
        "tags": ["Reports"],
        "summary": "List impact reports",
        "security": [{ "bearerAuth": [] }],
        "responses": {
          "200": { "description": "Reports list" }
        }
      }
    },
    "/api/verify/{id}": {
      "get": {
        "tags": ["Verify"],
        "summary": "Verify an Osmesys Verified certificate (public)",
        "security": [],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": { "type": "string", "format": "uuid" }
          }
        ],
        "responses": {
          "200": {
            "description": "Verification result",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/CertificateVerification" }
              }
            }
          },
          "429": { "description": "Rate limited" }
        }
      }
    }
  },
  "security": [
    { "bearerAuth": [] }
  ]
}