swagger: '2.0' info: title: Orchard OWS Account API version: v1 host: qa-ows-account.theorchard.io basePath: / schemes: - https consumes: - application/json produces: - application/json paths: /identity: get: summary: Return account information if a user is logged in. parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string responses: '200': examples: success: - account_type: "vendor" account_id: 7123 account_name: "Vendor Name" description: OK '401': description: UNAUTHORIZED /distributor: head: summary: Return whether the user is a distributor parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: true type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: true type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string responses: '200': description: OK '204': description: User is not a distributor '400': description: BAD REQUEST /subaccount: head: summary: Determine if Grass user is a subaccount parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: true type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: true type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string responses: '200': description: OK '400': description: BAD REQUEST /subaccount/{subaccountId}: get: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a subaccount name: subaccountId in: path required: true type: string responses: '200': examples: success: subaccount_name: "Metal Mayhem" vendor_id: 16055 subaccount_id: 7123 description: "A description" description: OK '403': examples: default: message: "No authorization" code: "authorization_error" description: FORBIDDEN '404': examples: default: message: null code: "not_found_error" description: NOT FOUND description: Return subaccount information. /subaccounts: get: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: true type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: true type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string responses: '200': examples: success: pagination: count: 22 type: standard page_offset: 0 page_limit: 50 items: - subaccount_name: "Cover Cows" vendor_id: 16055 subaccount_id: 1 description: "my first subaccount" description: OK '403': examples: default: message: "User is forbidden" code: "authorization_error" description: FORBIDDEN '404': examples: default: message: null code: "not_found_error" description: When a vendor id has no subaccounts, this vendor is considered to not be a D3 and should have no concept of subaccounts. ows-account returns a 404 response to obfuscate the subaccounts concept. description: Return list of subaccounts. /v2/subaccounts: post: description: Create a subaccount in art_relations and authorize via Permissions Platform. parameters: - in: body name: body required: true schema: $ref: "#/definitions/CreateSubaccountSchema" responses: '200': description: Subaccount created successfully. schema: type: object properties: subaccount_id: type: integer description: The unique identifier of the created subaccount. subaccount_uuid: type: string description: The UUID of the created subaccount. subaccount_name: type: string description: The name of the created subaccount. vendor_id: type: integer description: The vendor ID associated with the subaccount. country_id: type: integer description: The country ID associated with the subaccount. subaccount_split_type: type: string description: The split type of the created subaccount. Default value is 'Net' if not provided. commission_override: type: number description: The commission override percentage for the subaccount. Default value is 1.0 if not provided. description: type: string description: The description of the created subaccount. '400': description: Invalid input. schema: type: object properties: code: type: string example: invalid_input message: type: string example: Request payload is not valid. '403': description: Unauthorized or forbidden. schema: type: object properties: code: type: string example: unauthorized message: type: string example: You do not have permission to create a subaccount. '500': description: Internal server error. schema: type: object properties: code: type: string example: internal_error message: type: string example: An unexpected error occurred. /v2/subaccounts/{subaccountUuid}: delete: description: Soft-delete a subaccount by setting its date_deleted field. parameters: - in: path name: subaccountUuid required: true type: string description: UUID of the subaccount to delete. responses: '200': description: Successfully deleted subaccount '403': description: Forbidden '500': description: Internal server error /{vendorId}/distributor: head: summary: Return whether the vendor id is a distributor parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer responses: '200': description: OK '204': description: User is not a distributor '400': description: BAD REQUEST '403': description: FORBIDDEN /{vendorId}/subaccount/{subaccountId}: head: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer - description: Unique identifier of a subaccount in: path name: subaccountId required: true type: integer responses: '200': description: OK '403': description: FORBIDDEN description: Validates a subaccount belongs to a vendor. /{vendorId}/subaccounts: get: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer responses: '200': examples: success: pagination: count: 22 type: standard page_offset: 0 page_limit: 50 items: - subaccount_name: "Cover Cows" vendor_id: 16055 subaccount_id: 1 description: "my first subaccount" description: OK '403': examples: default: message: "User is forbidden" code: "authorization_error" description: FORBIDDEN '404': examples: default: message: null code: "not_found_error" description: When a vendor id has no subaccounts, this vendor is considered to not be a D3 and should have no concept of subaccounts. ows-account returns a 404 response to obfuscate the subaccounts concept. description: Return list of subaccounts. /vendor: patch: description: Create or Update a vendor. *DEPRECATION WARNING:* This endpoint is exclusively for OA usage, which accesses it through GraphQL. It will eventually be replaced by a series of v2 endpoints that authorize solely via PP. The transition has already begun with * POST /v2/vendors * PATCH /v2/vendor//external-identifier-1 parameters: - description: Profile Type. name: Orchard-Profile-Type in: header required: true type: string - description: Profile Id. name: Orchard-Profile-Id in: header required: true type: integer - description: Unique identifier. name: Orchard-Identity-Id in: header required: true type: string - in: body name: body schema: # Request body contents type: object required: - vendor_name - email properties: vendor_name: type: string email: type: string owner: type: string label_identifier: type: string status: type: string migrated_to_abacus: type: boolean responses: '403': description: HEADERS MISSING '200': examples: success: vendor_id: 12345 is_distributor: "N" owner: "odd" name: "10 Ball Records" country_id: 24 status: "signed" description: OK /v2/vendors: post: description: Create a vendor in art_relations with minimal attributes. parameters: - in: body name: body required: true schema: type: object required: - name - owner - company_brand - service_tier_uuid - payment_currency properties: name: type: string description: Full name of the Vendor owner: type: string description: Owner of this Vendor (what business unit it maps back to) company_brand: type: string description: Company's brand name, e.g. awal, columbia, theorchard, hrs service_tier_uuid: type: string description: Unique id for service tier. payment_currency: type: string description: > 3 char currency code. Not validated. Not persisted to the vendor table — passed through to the post-creation account event payload. is_distributor: type: boolean description: Whether this vendor is a distributor. Defaults to false. country: type: string description: ISO alpha-3 country code, e.g. USA, FRA. primary_genre: type: integer description: Primary genre id. label_summary: type: string description: Free-text summary of the label. assigned_to: type: integer description: > Relationship Manager (orchadmin_users.id). Responsible for the client relationship and success. Receives Content Review escalations. assigned_reviewer: type: integer description: > Content Review assignee (orchadmin_users.id). Identifies who approves client product before delivery. Not shown in OA UI — API-only field. quarterback_label_manager: type: integer description: > Secondary Relationship Manager (orchadmin_users.id). Backup point of contact for the label. Feature-flagged in OA UI via quarterback_label_managers_in_oa. wel_email_sender: type: integer description: > Welcome Email Sender (orchadmin_users.id). Records which orchadmin user triggered the welcome email. Write-once audit field. product_manager: type: integer description: > Product Manager (orchadmin_users.id). Optional. Set post-create via the existing v1 setter; not atomic with vendor insert and not echoed in the response body. closers: type: array items: type: integer description: > Closer ids (orchadmin_users.id) credited with the deal. Optional. Applied via the vendor closers setter within the create. For company_brand 'awal', a default closer is assigned when this is omitted. responses: '200': description: Successfully created vendor '400': description: Missing or invalid parameters /v2/vendors/{vendorUuid}: delete: description: Soft-delete a vendor by setting its status to 'deletion'. parameters: - in: path name: vendorUuid required: true type: string description: UUID of the vendor to delete. responses: '200': description: Successfully deleted vendor '403': description: Forbidden '500': description: Internal server error /v2/vendor/{vendorUuid}/internal-staff: patch: description: > Update internal staff assignments on a vendor. At least one of assigned_to, assigned_reviewer, quarterback_label_manager, wel_email_sender, or product_manager must be provided. Omitted fields are left unchanged. Sending an explicit null clears the column for nullable FKs (assigned_to, assigned_reviewer, quarterback_label_manager, wel_email_sender). product_manager cannot be unset via this endpoint. Authorized via PP action update_internal_staff on the account resource. parameters: - in: path name: vendorUuid required: true type: string description: UUID of the vendor to update. - in: body name: body schema: type: object properties: assigned_to: type: integer x-nullable: true description: > Relationship Manager (orchadmin_users.id). Responsible for the client relationship and success. Receives Content Review escalations. Send null to clear. assigned_reviewer: type: integer x-nullable: true description: > Content Review assignee (orchadmin_users.id). Identifies who approves client product before delivery. Not shown in OA UI — API-only field. Send null to clear. quarterback_label_manager: type: integer x-nullable: true description: > Secondary Relationship Manager (orchadmin_users.id). Backup point of contact for the label. Send null to clear. wel_email_sender: type: integer x-nullable: true description: > Welcome Email Sender (orchadmin_users.id). Records which orchadmin user triggered the welcome email. Send null to clear. product_manager: type: integer description: > Product Manager (orchadmin_users.id). Applied via the existing v1 setter. Cannot be cleared via this endpoint. responses: '200': description: Successfully updated internal staff '400': description: Input validation error (no staff fields provided or invalid types) '401': description: Missing or invalid JWT identity '403': description: Forbidden '404': description: Vendor not found '500': description: Internal server error /v2/vendor/{vendorUuid}/service_tier: patch: description: > Replace the service tier for a vendor. Writes the vendor_service_tier join row in art_relations and the IN_SERVICE_TIER edge in neo4j. service_tier_uuid is required and must be one of the registered tiers. Authorized via PP action update:service_tier on the account resource. parameters: - in: path name: vendorUuid required: true type: string description: UUID of the vendor to update. - in: body name: body required: true schema: type: object required: - service_tier_uuid properties: service_tier_uuid: type: string description: UUID of the target service tier (see service_tier table). responses: '200': description: Successfully updated service tier '400': description: Input validation error or unknown service_tier_uuid '401': description: Missing or invalid JWT identity '403': description: Forbidden '500': description: Internal server error /v2/vendor/{vendorUuid}: patch: description: > Update vendor metadata. All body properties are optional; sending an explicit null clears the column (every property listed here is nullable in art_relations). At least one property must be provided. Authorized via PP action update on the account resource. parameters: - in: path name: vendorUuid required: true type: string description: UUID of the vendor to update. - in: body name: body required: true schema: type: object properties: name: type: string description: Display name of the vendor. owner: type: string x-nullable: true description: Owning business unit (e.g. orchard, awal). company: type: string x-nullable: true description: Company name as filed. support_contact_email: type: string x-nullable: true description: Address that receives support correspondence. label_identifier: type: string enum: - Frontline - Client Services - Catalog - D3 - Film - TV - Test - Accounting Only description: Label classification used by OA. contact_email: type: string x-nullable: true description: Primary contact email for the vendor. label_summary: type: string x-nullable: true description: Free-text description of the label. relationship_notes: type: string x-nullable: true description: Free-text relationship notes managed by Account team. newsletter: type: string enum: - 'Y' - 'N' description: Whether the vendor is subscribed to the newsletter. website: type: string x-nullable: true description: Vendor's website URL. priority: type: integer description: Priority ranking for the label. primary_genre: type: integer description: Primary genre id. date_signed: type: string format: date description: Date the vendor was signed (YYYY-MM-DD). status: type: string enum: - pitched - pending - verbal - signed - passed - inactive - deletion - waiting_for_approval - approved description: Vendor lifecycle status. responses: '200': description: Successfully updated vendor metadata '400': description: Input validation error (no fields provided or invalid value) '401': description: Missing or invalid JWT identity '403': description: Forbidden '404': description: Vendor not found '500': description: Internal server error /vendor/{vendorId}: head: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer responses: '200': description: OK '404': description: NOT FOUND description: Determine if an active vendor exists with this id. get: parameters: - description: Describes the account identifier the authenticated user belongs to. name: Grass-Account-Id in: header required: false type: integer - description: Describes the type of account the authenticated user belongs to. name: Grass-Account-Type in: header required: false type: string - description: Unique identifier of the request name: Correlation-Id in: header required: false type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer responses: '200': examples: success: vendor_id: 12345 is_distributor: "N" owner: "odd" name: "10 Ball Records" country_id: 24 status: "signed" description: OK '404': description: NOT FOUND description: Returns vendor information. patch: description: Update an existing vendor in art_relations and neo4j with provided details. *DEPRECATION WARNING:* This endpoint is exclusively for OA usage, which accesses it through GraphQL. It will eventually be replaced by a series of v2 endpoints that authorize solely via PP. The transition has already begun with * PATCH /v2/vendor//external-identifier-1 parameters: - description: Profile Type. name: Orchard-Profile-Type in: header required: true type: string - description: Profile Id. name: Orchard-Profile-Id in: header required: true type: integer - description: Unique identifier. name: Orchard-Identity-Id in: header required: true type: string - description: Unique identifier of a vendor in: path name: vendorId required: true type: integer - in: body name: body schema: type: object required: - vendor_id properties: vendor_name: type: string company_name: type: string service_tier_uuid: type: string responses: '403': description: HEADERS MISSING '500': description: Server Error / DB Exception '400': description: Input Validation Error '200': description: Update Successful, Vendor Information /vendor/{vendorId}/suppliers: get: parameters: - description: Vendor ID for request vendor/account in: path name: vendorId required: true type: integer responses: '200': description: OK '400': description: BAD REQUEST '403': description: FORBIDDEN '404': description: NOT FOUND '500': description: INTERNAL SERVER ERROR description: WIP. Returns physical supply chain selection for given vendorId. put: summary: Set default suppliers parameters: - description: Vendor ID for request vendor/account in: path name: vendorId required: true type: integer - in: body name: storeIds schema: $ref: '#/definitions/SetSuppliers' responses: '200': description: OK '400': description: BAD REQUEST '403': description: FORBIDDEN '404': description: NOT FOUND '500': description: INTERNAL SERVER ERROR description: WIP. Returns physical supply chain selection for given vendorId. /vendor/{vendor_id}/features: get: description: Get the list of enabled feature control for a vendor parameters: - in: path name: vendor_id required: true type: number - in: header name: Grass-Account-Type type: string - in: header name: Grass-Account-Id type: number responses: 200: description: 200 OK schema: type: object properties: items: type: array items: type: object properties: feature_id: type: number feature_name: type: string 400: description: 400 Bad Request schema: example: code: bad_grass_request_error message: Incomplete Grass Headers 403: description: 403 Forbidden schema: example: code: authorization_error message: User is forbidden 404: description: 404 Not Found schema: example: code: not_found_error message: Vendor not found 500: description: 500 Internal Error schema: example: code: internal_error message: Could not connect to database /vendor/{vendor_id}/restricted_features/add: post: description: Add restricted features for a vendor consumes: - application/json parameters: - in: path name: vendor_id required: true type: number - in: header name: Grass-Account-Type type: string - in: header name: Grass-Account-Id type: number - in: body name: feature_ids description: Feature ids to add to vendor restricted features. schema: $ref: '#/definitions/VendorRestrictedFeaturesCreateSchema' responses: 200: description: 200 OK schema: type: object properties: items: type: array items: type: object properties: feature_id: type: number feature_name: type: string 400: description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Invalid input type. Expected: List[int].' 403: description: 403 Forbidden schema: example: code: authorization_error message: User is forbidden 404: description: 404 Not Found schema: example: code: not_found_error message: Vendor not found 500: description: 500 Internal Error schema: example: code: internal_error message: Could not connect to database /vendor/{vendor_id}/restricted_features/remove: post: description: Remove restricted features for a vendor consumes: - application/json parameters: - in: path name: vendor_id required: true type: number - in: header name: Grass-Account-Type type: string - in: header name: Grass-Account-Id type: number - in: body name: feature_ids description: Feature ids to remove from vendor restricted features. schema: $ref: '#/definitions/VendorRestrictedFeaturesCreateSchema' responses: 200: description: 200 OK schema: type: array items: type: integer example: [1, 2, 3] 400: description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Invalid input type. Expected: List[int].' 403: description: 403 Forbidden schema: example: code: authorization_error message: User is forbidden 404: description: 404 Not Found schema: example: code: not_found_error message: Vendor not found 500: description: 500 Internal Error schema: example: code: internal_error message: Could not connect to database /vendor/{vendorId}/service-details: get: description: Return account branding and service details parameters: - in: path name: vendorId required: true type: integer responses: '200': description: OK schema: type: object properties: name: type: string uuid: type: string example: name: My Company uuid: ffffffff-1111-1111-2222-eeeeeeeeeeee /account_managers: get: summary: Return list of account managers from orchadmin_users table. responses: '200': description: OK '404': examples: default: message: null code: "not_found_error" description: No account managers were returned. /genres: get: summary: Return list of genres from the genre table. responses: '200': description: OK '404': examples: default: message: null code: "not_found_error" description: No genres were returned. /countries: get: summary: Return list of countries from the country table. responses: '200': description: OK '404': examples: default: message: null code: "not_found_error" description: No countries were returned. /regions: get: summary: Return list of regions from the region table. responses: '200': description: OK '404': examples: default: message: null code: "not_found_error" description: No regions were returned. /service-tiers: get: summary: Return list of service tier uuids and display names from neo4j. responses: '200': description: OK '404': examples: default: message: null code: "not_found_error" description: No service tiers were returned. /parent_companies: get: summary: Get list of parent companies. description: | Returns all parent companies. Public data — requires only a valid JWT. responses: '200': description: Returns list of parent companies. schema: type: object properties: parent_companies: type: array items: $ref: '#/definitions/ParentCompany' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. /parent_companies/{parent_company_uuid}: get: summary: Get a single parent company by UUID. description: | Returns a single parent company. Public data — requires only a valid JWT. parameters: - in: path name: parent_company_uuid required: true type: string description: UUID of the parent company. responses: '200': description: Returns a single parent company. schema: $ref: '#/definitions/ParentCompany' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. '404': description: Not found - No parent company with the given UUID. schema: type: object properties: code: type: string example: not_found message: type: string example: Parent company not found /parent_companies/{parent_company_uuid}/companies: get: summary: Get companies for a parent company. description: | Returns the companies associated with a parent company. Public data — requires only a valid JWT. parameters: - in: path name: parent_company_uuid required: true type: string description: UUID of the parent company. responses: '200': description: Returns list of companies for the parent company. schema: type: object properties: companies: type: array items: $ref: '#/definitions/CompanyBrand' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. '404': description: Not found - No parent company with the given UUID. schema: type: object properties: code: type: string example: not_found message: type: string example: Parent company not found /internal/parent_company/{parent_company_uuid}/applications: get: summary: Get applications and default roles for a parent company. description: | This endpoint is used by the SEAT employee invitation flow to display available applications and roles when configuring permissions for a new employee. Authorization is checked via PDP for seat_can_administer_users role. parameters: - in: path name: parent_company_uuid required: true type: string description: UUID of the parent company (must be SME or The Orchard). responses: '200': description: Returns applications list with their default roles. schema: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' '400': description: Invalid parent company UUID (not in allowed list). schema: type: object properties: code: type: string example: invalid_input message: type: string example: Invalid parent company UUID '403': description: Forbidden - User lacks seat_can_administer_users role. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Forbidden /brands: get: summary: Return list of company brands. description: | Returns all company brands as a flat list. Requires a valid JWT. responses: '200': description: Returns list of company brands. schema: type: array items: $ref: '#/definitions/CompanyBrand' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. /companies: get: summary: Return list of companies. description: | Returns all companies wrapped in a companies key. responses: '200': description: Returns list of companies. schema: type: object properties: companies: type: array items: $ref: '#/definitions/CompanyBrand' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. /companies/{company_uuid}: get: summary: Return a single company by UUID. parameters: - name: company_uuid in: path required: true type: string description: UUID of the company. responses: '200': description: Returns the company brand. schema: $ref: '#/definitions/CompanyBrand' '401': description: Unauthorized - Missing or invalid JWT. schema: type: object properties: code: type: string example: authorization_error message: type: string example: Request context has no identity uuid. '404': description: Company brand not found. /lookup/vendors/uuids: post: description: Get list of vendor ids using their uuids. consumes: - application/json parameters: - in: body name: uuids schema: $ref: "#/definitions/LookupVendorsByUuidsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: vendors: type: array items: type: object properties: vendor_id: type: integer uuid: type: string '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /lookup/vendors/features/uuids: post: description: Get enabled feature ids for vendors using their uuids. consumes: - application/json parameters: - in: body name: uuids schema: $ref: "#/definitions/LookupVendorFeaturesByUuidsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: vendors: type: array items: type: object properties: vendor_uuid: type: string feature_ids: type: array items: type: integer '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /lookup/subaccounts/features/uuids: post: description: Get enabled feature ids for subaccounts using their uuids. consumes: - application/json parameters: - in: body name: uuids schema: $ref: "#/definitions/LookupSubaccountFeaturesByUuidsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: subaccounts: type: array items: type: object properties: subaccount_uuid: type: string feature_ids: type: array items: type: integer '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /lookup/vendors/vendor-ids: post: description: Get list of vendor uuids using their vendor ids. consumes: - application/json parameters: - in: body name: vendor_ids schema: $ref: "#/definitions/LookupVendorsByVendorIdsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: vendors: type: array items: type: object properties: vendor_id: type: integer uuid: type: string '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /lookup/subaccounts/uuids: post: description: Get list of subaccount ids using their uuids. consumes: - application/json parameters: - in: body name: uuids schema: $ref: "#/definitions/LookupSubaccountsByUuidsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: subaccounts: type: array items: type: object properties: subaccount_id: type: integer vendor_id: type: integer uuid: type: string '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /lookup/subaccounts/subaccount-ids: post: description: Get list of subaccount uuids using their subaccount ids. consumes: - application/json parameters: - in: body name: uuids schema: $ref: "#/definitions/LookupSubaccountsBySubaccountIdsRequestSchema" responses: '200': description: 200 OK schema: type: object properties: subaccounts: type: array items: type: object properties: subaccount_id: type: integer vendor_id: type: integer uuid: type: string '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /vendor/{vendor_uuid}/applications: get: summary: Returns applications the calling user is able to administer for the given vendor. parameters: - in: path name: vendor_uuid required: true type: string responses: '200': description: Returns tenant applications, or an empty array if no applications are available to be administered. An admin access check is made to ows-permissions. schema: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' /vendors/applications/dataloader: post: summary: Returns applications the calling user is able to administer for the given list of vendors. parameters: - in: body name: vendor_uuids required: true schema: type: array items: type: string description: List of vendor UUIDs to retrieve applications for responses: '200': description: Returns a mapping of vendor UUIDs to their applications. For each vendor, either returns applications array or error message. An admin access check is made to ows-permissions for all vendors. schema: type: object additionalProperties: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' '400': description: Invalid request payload (not a list, empty list, or invalid JSON) '403': description: Unauthorized to access one or more tenants /subaccount/{subaccount_uuid}/applications: get: summary: Returns applications the calling user is able to administer for the given subaccount. parameters: - in: path name: subaccount_uuid required: true type: string responses: '200': description: Returns tenant applications, or an empty array if no applications are available to be administered. An admin access check is made to ows-permissions. schema: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' /subaccounts/applications/dataloader: post: summary: Dataloader endpoint that returns applications the calling user is able to administer for the given subaccounts. parameters: - in: body name: subaccount_uuids required: true schema: type: array items: type: string description: List of subaccount UUIDs to retrieve applications for responses: '200': description: Returns a mapping of subaccount UUIDs to their applications. For each subaccount, either returns applications array or error message. An admin access check is made to ows-permissions for all subaccounts. schema: type: object additionalProperties: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' '400': description: Invalid request payload (not a list, empty list, or invalid JSON) '403': description: Unauthorized to access one or more tenants /label-participant/{label_participant_uuid}/applications: get: summary: Returns applications the calling user is able to administer for the given label participant. parameters: - in: path name: label_participant_uuid required: true type: string responses: '200': description: Returns tenant applications, or an empty array if no applications are available to be administered. An admin access check is made to ows-permissions. schema: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' /collaborator/{collaborator_uuid}/applications: get: summary: Returns applications the calling user is able to administer for the given collaborator. parameters: - in: path name: collaborator_uuid required: true type: string responses: '200': description: Returns tenant applications, or an empty array if no applications are available to be administered. An admin access check is made to ows-permissions. schema: type: object properties: applications: type: array items: $ref: '#/definitions/TenantApplication' /applications/dataloader: post: summary: Dataloader endpoint that returns details about applications by their application ids. parameters: - in: body name: application_ids schema: type: array items: type: string responses: '200': description: Returns a list of application details or null values if no applications are found by the specified ID. schema: type: array items: oneOf: - $ref: '#/definitions/Application' - type: null /roles/dataloader: post: summary: Dataloader endpoint that returns details about roles by their role ids. parameters: - in: body name: role_ids schema: type: array items: type: string responses: '200': description: Returns a list of role details or null values if no applications are found by the specified ID. schema: type: array items: oneOf: - $ref: '#/definitions/Role' - type: null /subaccounts/names/dataloader: post: summary: Dataloader endpoint that returns subaccount names. No permissions checks are done. parameters: - in: body name: vendor_uuids schema: type: array items: type: string responses: '200': description: Returns a list of subaccount names or null values if no subaccount are found by the specified uuid. schema: type: array items: $ref: '#/definitions/SubaccountNameDataloaded' /vendors/dataloader: post: summary: Dataloader endpoint that returns details about Vendors and does permission checks. This endpoint will use PDP for checks if the profile type is not listed in the access rules yaml file. Otherwise it will do neo4j profile based permissions checks. parameters: - in: body name: vendor_uuids schema: type: array items: type: string responses: '200': description: Returns a list of vendor details or null values if no vendors are found by the specified uuid. schema: type: array items: $ref: '#/definitions/VendorDataloaded' /vendors/names/dataloader: post: summary: Dataloader endpoint that returns vendor names. No permissions checks are done. parameters: - in: body name: vendor_uuids schema: type: array items: type: string responses: '200': description: Returns a list of vendor names or null values if no vendors are found by the specified uuid. schema: type: array items: $ref: '#/definitions/VendorNameDataloaded' /vendors/closers/dataloader: post: description: Get list of vendor closers using their vendor uuids. consumes: - application/json parameters: - in: body name: vendor_uuids schema: $ref: "#/definitions/VendorClosersRequestSchema" responses: '200': description: 200 OK schema: type: array items: type: object properties: uuid: type: string closers: type: array items: type: integer '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /vendors/first_statement_period/dataloader: post: description: Get list of vendors first statement period using their vendor uuids. consumes: - application/json parameters: - in: body name: vendor_uuids schema: $ref: "#/definitions/VendorFirstStatementPeriodRequestSchema" responses: '200': description: 200 OK schema: type: array items: type: object properties: vendors: type: array items: type: object properties: uuid: type: string first_statement_period: type: string '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /vendors/company_brands/dataloader: post: summary: Dataloader endpoint that returns vendor company_brands. No permissions checks are done. parameters: - in: body name: vendor_uuids schema: type: array items: type: string responses: '200': description: Returns a list of vendor company_brands or null values if no vendors are found by the specified uuid. schema: type: array items: $ref: '#/definitions/VendorCompanyBrandDataloaded' /vendors/service_tier/dataloader: post: summary: Dataloader endpoint that returns vendor service_tier. parameters: - in: body name: vendor_uuids schema: type: object properties: vendor_uuids: type: array items: type: string skip_access_check: type: boolean default: false responses: '200': description: Returns a list of vendor service_tiers or null values if no vendors are found by the specified uuid. schema: type: array items: $ref: '#/definitions/VendorServiceTierDataloaded' /vendor/{vendor_uuid}/closers: put: description: Update vendor closers using vendor uuid. consumes: - application/json parameters: - description: Orchard User ID. name: Orchard-User-Id in: header required: true type: string - in: body name: closers schema: $ref: "#/definitions/UpdateVendorClosersSchema" responses: '200': description: 200 OK schema: type: object properties: vendor_id: type: string vendor_uuid: type: string closers: type: array items: type: integer '400': description: 400 Bad Request / Invalid input schema: example: code: invalid_input message: 'Request payload is not valid' /vendor/{vendor_uuid}/first_statement_period: patch: description: Update vendor first_statement_period using vendor UUID. consumes: - application/json parameters: - name: vendor_uuid in: path required: true type: string description: UUID of the vendor to update. - in: body name: first_statement_period required: true schema: $ref: "#/definitions/UpdateVendorFirstStatementPeriodSchema" responses: '200': description: Successfully updated vendor's first_statement_period. schema: type: object properties: vendor_id: type: integer vendor_uuid: type: string first_statement_period: type: string '400': description: Bad Request / Invalid input schema: type: object properties: code: type: string example: invalid_input message: type: string example: Request payload is not valid definitions: SetSuppliers: type: object properties: store_ids: type: array items: type: integer example: - 1 - 2 - 3 VendorRestrictedFeaturesCreateSchema: type: object properties: feature_ids: type: array items: type: integer example: - 1 - 2 - 3 LookupSubaccountFeaturesByUuidsRequestSchema: type: object properties: uuids: type: array items: type: string LookupVendorFeaturesByUuidsRequestSchema: type: object properties: uuids: type: array items: type: string LookupVendorsByUuidsRequestSchema: type: object properties: uuids: type: array items: type: string fetch_flags: type: array items: type: string LookupVendorsByVendorIdsRequestSchema: type: object properties: vendor_ids: type: array items: type: number fetch_flags: type: array items: type: string LookupSubaccountsByUuidsRequestSchema: type: object properties: uuids: type: array items: type: string fetch_flags: type: array items: type: string LookupSubaccountsBySubaccountIdsRequestSchema: type: object properties: subaccount_ids: type: array items: type: number fetch_flags: type: array items: type: string TenantApplication: type: object properties: application_id: type: string roles: type: array items: type: string url: type: string Application: type: object properties: application_id: type: string group_id: type: string Role: type: object properties: application_id: type: string group_id: type: string is_default: type: boolean SubaccountNameDataloaded: type: object properties: subaccount_id: type: integer uuid: type: string name: type: string VendorDataloaded: type: object properties: vendor_id: type: integer uuid: type: string status: type: string is_distributor: type: string name: type: string owner: type: string company_brand_id: type: string VendorCompanyBrandDataloaded: type: object properties: vendor_id: type: integer uuid: type: string company_brand_id: type: integer company_brand_uuid: type: string VendorClosersRequestSchema: type: object properties: vendor_uuids: type: array items: type: string UpdateVendorClosersSchema: type: object properties: closers: type: array items: type: integer UpdateVendorFirstStatementPeriodSchema: type: object properties: first_statement_period: type: integer VendorFirstStatementPeriodRequestSchema: type: object properties: vendor_uuids: type: array items: type: string CreateSubaccountSchema: type: object properties: vendor_id: type: integer description: The id of Vendor subaccount_name: type: string description: Full name of the Subaccount description: type: string description: Optional description of the Subaccount country_id: type: integer description: Optional country ID associated with the Subaccount commission_override: type: number format: float description: Optional commission override value subaccount_split_type: type: string enum: - Gross - Net description: Optional split type for the Subaccount required: - vendor_id - subaccount_name VendorServiceTierDataloaded: type: object properties: vendor_id: type: integer uuid: type: string service_tier_uuid: type: string service_tier_name: type: string service_tier_display_name: type: string VendorNameDataloaded: type: object properties: vendor_id: type: integer uuid: type: string name: type: string ParentCompany: type: object properties: id: type: integer description: Parent company ID name: type: string description: Parent company name uuid: type: string description: Parent company UUID display_name: type: string description: Parent company display name CompanyBrand: type: object properties: id: type: integer description: Company brand ID name: type: string description: Company brand name uuid: type: string description: Company brand UUID display_name: type: string description: Company brand display name logo_url: type: string description: URL of the company brand logo nullable: true parent_company_id: type: integer description: Parent company ID this brand belongs to securityDefinitions: {}