openapi: 3.1.0
info:
  title: DishControl Integration API
  version: 1.0.0
  summary: Machine-to-machine API boundary for DishControl integrations.
  description: >
    API contract for supplier, admin, and customer integrations. Keep this file
    updated whenever integration endpoints, request bodies, responses, or
    authentication rules change.
servers:
  - url: https://integration.sbx.dishcontrol.com
    description: Sandbox
  - url: https://integration.dishcontrol.com
    description: Production
tags:
  - name: System
  - name: Authorisation
  - name: Supplier
  - name: Supplier EDI
  - name: Admin
  - name: Customer Orders
  - name: Customer Recipes
security:
  - bearerAuth: []
paths:
  /:
    get:
      tags:
        - System
      summary: Documentation website
      security: []
      responses:
        '200':
          description: Human-readable integration API documentation.
          content:
            text/html:
              schema:
                type: string
  /v1:
    get:
      tags:
        - System
      summary: Versioned integration index
      security: []
      responses:
        '200':
          description: Service index with available namespaces.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntegrationIndexResponse'
  /health:
    get:
      tags:
        - System
      summary: Health check
      security: []
      responses:
        '200':
          description: Service is reachable.
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - service
                  - time
                properties:
                  status:
                    type: string
                    example: ok
                  service:
                    type: string
                    example: DishControl Integration Server
                  time:
                    type: string
                    format: date-time
  /authorisation/v1/accesstoken:
    post:
      tags:
        - Authorisation
      summary: Issue bearer access token
      description: >
        Exchanges a Client ID and Client Secret created in the DishControl admin
        portal for a short-lived bearer access token. The token namespace is
        based on the configured client type: supplier, customer, or admin.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AccessTokenRequest'
      responses:
        '200':
          description: Access token issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
        '400':
          description: Missing client_id or client_secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: error
                error:
                  code: invalid_request
                  message: client_id and client_secret are required.
        '401':
          description: Invalid client credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: error
                error:
                  code: invalid_client
                  message: Invalid client credentials.
  /supplier/v1/api:
    get:
      tags:
        - Supplier
      summary: Supplier API index
      description: Requires a supplier token or admin token.
      responses:
        '200':
          description: Supplier API endpoints.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NamespaceIndexResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /supplier/v1/api/orders:
    get:
      tags:
        - Supplier
      summary: List supplier orders
      description: Requires a supplier token or admin token. Supplier tokens are scoped to their own supplier.
      parameters:
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 250
            default: 100
        - name: offset
          in: query
          schema:
            type: integer
            minimum: 0
            default: 0
        - name: supplier_id
          in: query
          description: Optional supplier external key or UUID for admin tokens.
          schema:
            type: string
      responses:
        '200':
          description: Supplier orders.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierOrderListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /supplier/v1/api/assortments:
    get:
      tags:
        - Supplier
      summary: List supplier assortments
      description: Requires a supplier token or admin token. Supplier tokens are scoped to their own supplier.
      parameters:
        - name: supplier_id
          in: query
          description: Optional supplier external key or UUID for admin tokens.
          schema:
            type: string
      responses:
        '200':
          description: Supplier assortments.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierAssortmentListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /supplier/v1/api/articles:
    post:
      tags:
        - Supplier
      summary: Create or update supplier article
      description: >
        Creates or updates an article for the authenticated supplier. Supplier
        tokens are scoped to their own supplier. Admin tokens may pass
        supplier_id in the payload. The article must be linked to at least one
        valid supplier assortment.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SupplierArticleUpsertRequest'
      responses:
        '201':
          description: Article created or updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierArticleResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /supplier/v1/api/assortments/{id}:
    get:
      tags:
        - Supplier
      summary: Get supplier assortment detail
      description: Returns the assortment details plus a paginated article list.
      parameters:
        - $ref: '#/components/parameters/IdPath'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 250
            default: 100
        - name: offset
          in: query
          schema:
            type: integer
            minimum: 0
            default: 0
      responses:
        '200':
          description: Supplier assortment detail with articles.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierAssortmentDetailResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /supplier/v1/api/orders/{id}:
    get:
      tags:
        - Supplier
      summary: Get supplier order detail
      description: Requires a supplier token scoped to the order supplier or an admin token.
      parameters:
        - $ref: '#/components/parameters/IdPath'
      responses:
        '200':
          description: Supplier order detail with items.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierOrderDetailResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /supplier/v1/api/orders/{id}/status:
    patch:
      tags:
        - Supplier
      summary: Update supplier order status
      description: Requires a supplier token scoped to the order supplier or an admin token.
      parameters:
        - $ref: '#/components/parameters/IdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - status
              properties:
                status:
                  type: string
                  enum:
                    - sent
                    - confirmed
                    - processing
                    - delivered
                    - cancelled
                comment:
                  type: string
      responses:
        '200':
          description: Updated supplier order detail.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SupplierOrderDetailResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /supplier/v1/edi/inbound:
    post:
      tags:
        - Supplier EDI
      summary: Submit supplier inbound EDI
      description: Reserved endpoint for supplier EDI intake.
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
          text/plain:
            schema:
              type: string
      responses:
        '501':
          $ref: '#/components/responses/NotImplemented'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /admin/v1:
    get:
      tags:
        - Admin
      summary: Admin API index
      description: Requires an admin token.
      responses:
        '200':
          description: Admin API endpoints.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NamespaceIndexResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /admin/v1/integration-logs:
    get:
      tags:
        - Admin
      summary: List integration logs
      description: Reserved endpoint for integration logs.
      responses:
        '501':
          $ref: '#/components/responses/NotImplemented'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /customer/v1/orders:
    get:
      tags:
        - Customer Orders
      summary: Customer order API index
      description: Requires a customer token or admin token.
      responses:
        '501':
          $ref: '#/components/responses/NotImplemented'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /customer/v1/recipes:
    get:
      tags:
        - Customer Recipes
      summary: Customer recipe API index
      description: Requires a customer token or admin token.
      responses:
        '501':
          $ref: '#/components/responses/NotImplemented'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: DishControl access token
  parameters:
    IdPath:
      name: id
      in: path
      required: true
      schema:
        type: string
  responses:
    BadRequest:
      description: Invalid request payload or parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: error
            error:
              code: bad_request
              message: Status must be one of: sent, confirmed, processing, delivered, cancelled.
    Unauthorized:
      description: Missing or invalid bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: error
            error:
              code: unauthorized
              message: A valid bearer token is required.
    Forbidden:
      description: Token is not allowed for the requested namespace.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: error
            error:
              code: forbidden
              message: This token is not allowed for this namespace.
    NotImplemented:
      description: Endpoint is reserved but not implemented yet.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: error
            error:
              code: not_implemented
              message: Feature is not available yet.
    NotFound:
      description: Requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: error
            error:
              code: not_found
              message: Order was not found for this supplier.
  schemas:
    AccessTokenRequest:
      type: object
      required:
        - client_id
        - client_secret
      properties:
        client_id:
          type: string
          example: dc_sup_5d4e8c1a9b70
        client_secret:
          type: string
          format: password
          example: dcs_4bb6d3f4b0f84e41a3f7f0f60a74d9a2
    AccessTokenResponse:
      type: object
      required:
        - status
        - access_token
        - token_type
        - expires_in
        - actor_type
        - owner
      properties:
        status:
          type: string
          example: ok
        access_token:
          type: string
          example: dca_8e6f5a1d2c3b4a59687766554433221100ffeeddccbbaa998877665544332211
        token_type:
          type: string
          example: Bearer
        expires_in:
          type: integer
          example: 3600
        actor_type:
          type: string
          enum:
            - supplier
            - customer
            - admin
          example: supplier
        owner:
          $ref: '#/components/schemas/AccessTokenOwner'
    AccessTokenOwner:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: string
          example: sup_freshdirect
        name:
          type: string
          example: FreshDirect
    IntegrationIndexResponse:
      type: object
      required:
        - status
        - service
        - namespaces
      properties:
        status:
          type: string
          example: ok
        service:
          type: string
          example: DishControl Integration Server
        namespaces:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              type: string
    NamespaceIndexResponse:
      type: object
      required:
        - status
        - namespace
        - version
        - endpoints
      properties:
        status:
          type: string
          example: ok
        namespace:
          type: string
          example: supplier
        version:
          type: string
          example: v1
        endpoints:
          type: object
          additionalProperties:
            type: string
    SupplierOrderListResponse:
      type: object
      required:
        - status
        - data
        - pagination
      properties:
        status:
          type: string
          example: ok
        data:
          type: array
          items:
            $ref: '#/components/schemas/SupplierOrder'
        pagination:
          type: object
          properties:
            limit:
              type: integer
              example: 100
            offset:
              type: integer
              example: 0
            count:
              type: integer
              example: 2
    SupplierOrderDetailResponse:
      type: object
      required:
        - status
        - data
      properties:
        status:
          type: string
          example: ok
        data:
          $ref: '#/components/schemas/SupplierOrderDetail'
    SupplierAssortmentListResponse:
      type: object
      required:
        - status
        - data
      properties:
        status:
          type: string
          example: ok
        data:
          type: array
          items:
            $ref: '#/components/schemas/SupplierAssortment'
    SupplierAssortmentDetailResponse:
      type: object
      required:
        - status
        - data
      properties:
        status:
          type: string
          example: ok
        data:
          $ref: '#/components/schemas/SupplierAssortmentDetail'
    SupplierArticleResponse:
      type: object
      required:
        - status
        - data
      properties:
        status:
          type: string
          example: ok
        data:
          $ref: '#/components/schemas/SupplierArticle'
    SupplierArticleUpsertRequest:
      type: object
      required:
        - name
      anyOf:
        - required:
            - assortment_ids
        - required:
            - assortments
      properties:
        supplier_id:
          type: string
          description: Supplier external key or UUID. Only used for admin tokens.
          example: sup_freshdirect
        external_key:
          type: string
          description: Optional stable external article key.
        name:
          type: string
          example: Aardappel vastkokend
        gtin:
          type: string
          description: Primary GTIN.
          example: '08712345100005'
        primary_gtin:
          type: string
          description: Alternative field name for the primary GTIN.
        gtins:
          oneOf:
            - type: array
              items:
                $ref: '#/components/schemas/SupplierArticleGtinInput'
            - type: string
              description: Comma, semicolon, or pipe separated GTIN list.
          description: Optional multiple GTINs for this article.
        supplier_number:
          type: string
          example: GRO-006
        article_number:
          type: string
          description: Alternative field name for supplier_number.
        pack_size:
          type: string
          example: 1 kg
        base_unit:
          type: string
          example: kg
        unit_price:
          type: number
          example: 1.59
        price:
          type: number
          description: Alternative field name for unit_price.
        currency:
          type: string
          example: EUR
        obsolete:
          type: boolean
          default: false
        stock:
          type: number
          nullable: true
          description: Null means stock is ignored and the article remains orderable.
        assortment_ids:
          type: array
          items:
            type: string
          description: Required assortment external keys or UUIDs to link this article to.
        assortments:
          type: array
          items:
            type: string
          description: Alternative required field name for assortment_ids.
    SupplierArticleGtinInput:
      type: object
      properties:
        gtin:
          type: string
          example: '08712345100005'
        code:
          type: string
          description: Alternative field name for gtin.
        type:
          type: string
          example: consumer
        is_primary:
          type: boolean
          default: false
        quantity_factor:
          type: number
          nullable: true
        factor:
          type: number
          nullable: true
          description: Alternative field name for quantity_factor.
    SupplierArticle:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        id:
          type: string
        name:
          type: string
        gtin:
          type: string
        supplier_number:
          type: string
        pack_size:
          type: string
        base_unit:
          type: string
        unit_price:
          type: number
        currency:
          type: string
        obsolete:
          type: boolean
        stock:
          type: number
          nullable: true
        created_by:
          type: string
        updated_at:
          type: string
          format: date-time
    SupplierAssortment:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        id:
          type: string
        name:
          type: string
        type:
          type: string
          example: custom
        status:
          type: string
          example: active
        article_count:
          type: integer
        period:
          type: object
          properties:
            starts_at:
              type: string
              nullable: true
            ends_at:
              type: string
              nullable: true
        supplier:
          type: object
          properties:
            id:
              type: string
            name:
              type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    SupplierAssortmentDetail:
      allOf:
        - $ref: '#/components/schemas/SupplierAssortment'
        - type: object
          properties:
            articles:
              type: array
              items:
                $ref: '#/components/schemas/SupplierAssortmentArticle'
            pagination:
              type: object
              properties:
                limit:
                  type: integer
                offset:
                  type: integer
                count:
                  type: integer
    SupplierAssortmentArticle:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        id:
          type: string
        name:
          type: string
        gtin:
          type: string
        supplier_number:
          type: string
        pack_size:
          type: string
        base_unit:
          type: string
        unit_price:
          type: number
        currency:
          type: string
        obsolete:
          type: boolean
        stock:
          type: number
          nullable: true
        created_by:
          type: string
        updated_at:
          type: string
          format: date-time
    SupplierOrder:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        id:
          type: string
        order_number:
          type: string
        customer:
          type: object
          properties:
            name:
              type: string
            location:
              type: string
            customer_number:
              type: string
            delivery_address_id:
              type: string
        supplier:
          type: object
          properties:
            id:
              type: string
            name:
              type: string
        status:
          type: string
        channel:
          type: string
        order_date:
          type: string
          format: date
        delivery_date:
          type: string
          format: date
        total_value:
          type: number
        currency:
          type: string
        lines:
          type: integer
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    SupplierOrderDetail:
      allOf:
        - $ref: '#/components/schemas/SupplierOrder'
        - type: object
          properties:
            internal_comment:
              type: string
            cancellation_comment:
              type: string
            items:
              type: array
              items:
                $ref: '#/components/schemas/SupplierOrderItem'
    SupplierOrderItem:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
        article:
          type: object
          properties:
            id:
              type: string
            name:
              type: string
            gtin:
              type: string
            supplier_number:
              type: string
            pack_size:
              type: string
            unit:
              type: string
        quantity:
          type: number
        unit_price:
          type: number
        line_total:
          type: number
    ErrorResponse:
      type: object
      required:
        - status
        - error
      properties:
        status:
          type: string
          example: error
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
            message:
              type: string
