{
  "openapi": "3.1.0",
  "info": {
    "title": "Consenti Public API",
    "version": "0.1.0",
    "description": "Visitor-facing endpoints for reading consent profiles and submitting/verifying consent. Rate-limited; no authentication required.",
    "license": {
      "name": "Apache 2.0",
      "url": "https://www.apache.org/licenses/LICENSE-2.0"
    }
  },
  "servers": [
    {
      "url": "/consenti/api",
      "description": "Consenti Public API"
    }
  ],
  "paths": {
    "/v1/profiles/{id}": {
      "get": {
        "tags": [
          "Profile"
        ],
        "summary": "Get profile in its default locale",
        "description": "Returns the resolved profile with banner and modal content for the profile's default locale. Includes `currentLocale`, `locales`, `cookies`, `mainBanner`, `preferenceModal`, and optionally `gpcBanner`.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Resolved profile for the default locale"
          },
          "404": {
            "description": "Profile not found"
          }
        }
      }
    },
    "/v1/profiles/{id}/{locale}": {
      "get": {
        "tags": [
          "Profile"
        ],
        "summary": "Get profile resolved for a specific locale",
        "description": "Same response shape as `GET /v1/profiles/{id}` but resolved for the requested locale, falling back to the default locale for any missing translations.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "locale",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "example": "fr"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Resolved profile for the requested locale"
          },
          "404": {
            "description": "Profile not found"
          }
        }
      }
    },
    "/v1/consent": {
      "post": {
        "tags": [
          "Consent"
        ],
        "summary": "Submit consent",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateConsentInput"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Consent created or updated",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConsentRecord"
                }
              }
            }
          },
          "400": {
            "description": "Validation error"
          }
        }
      }
    },
    "/v1/consent/{visitorId}": {
      "get": {
        "tags": [
          "Consent"
        ],
        "summary": "Get consent for visitor",
        "parameters": [
          {
            "name": "visitorId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Consent record",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConsentRecord"
                }
              }
            }
          },
          "404": {
            "description": "Not found"
          }
        }
      },
      "put": {
        "tags": [
          "Consent"
        ],
        "summary": "Update consent",
        "parameters": [
          {
            "name": "visitorId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Updated consent"
          }
        }
      },
      "delete": {
        "tags": [
          "Consent"
        ],
        "summary": "GDPR erasure — delete all consent data for visitor",
        "parameters": [
          {
            "name": "visitorId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Erased successfully"
          }
        }
      }
    },
    "/v1/consent/{visitorId}/verify": {
      "get": {
        "tags": [
          "Consent"
        ],
        "summary": "Verify consent validity",
        "parameters": [
          {
            "name": "visitorId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Verification result"
          }
        }
      }
    },
    "/v1/consent/{visitorId}/parental-consent-request": {
      "post": {
        "tags": [
          "Consent"
        ],
        "summary": "Request a parental-consent token (stateless hook)",
        "description": "Issues a token — signed with `compliance.dataSigningHash` when configured, otherwise unsigned — for a host's own out-of-band parental-verification flow. Emits `consent.parentalConsentRequired`. Not by itself sufficient verifiable parental consent (COPPA-style VPC is left to the host).",
        "parameters": [
          {
            "name": "visitorId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "profileId"
                ],
                "properties": {
                  "profileId": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Token issued",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "token": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Validation error"
          },
          "403": {
            "description": "Visitor ownership check failed"
          },
          "404": {
            "description": "Profile not found"
          }
        }
      }
    },
    "/v1/consent/parental-consent-resolve": {
      "post": {
        "tags": [
          "Consent"
        ],
        "summary": "Resolve a parental-consent token",
        "description": "Recovers `visitorId`/`profileId` from a token issued by the request route above and emits `consent.parentalConsentGranted` — the host's own backend listener decides what \"granted\" means for stored consent. No visitor-ownership cookie required, since this is typically called from the parent's own device. Token replay is not prevented (stateless by design).",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "token"
                ],
                "properties": {
                  "token": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Token resolved",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "visitorId": {
                      "type": "string"
                    },
                    "profileId": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Validation error"
          },
          "403": {
            "description": "Invalid, tampered, or expired token"
          }
        }
      }
    },
    "/v1/notice-shown": {
      "post": {
        "tags": [
          "Consent"
        ],
        "summary": "Record proof that the consent banner was shown",
        "description": "Lightweight, fire-and-forget ping recording that the banner was rendered to a visitor, independent of whether they ever interact with it. Called automatically by `@consenti/ui` on banner mount when `api.enabled` is configured.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "visitorId",
                  "profileId",
                  "locale"
                ],
                "properties": {
                  "visitorId": {
                    "type": "string"
                  },
                  "profileId": {
                    "type": "string"
                  },
                  "locale": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Recorded"
          },
          "400": {
            "description": "Validation error"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "ConsentRecord": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "visitorId": {
            "type": "string"
          },
          "profileId": {
            "type": "string"
          },
          "profileVersion": {
            "type": "integer",
            "description": "Profile version in force when this consent was last given; with `profileId` it pins the exact on-disk snapshot (the banner text shown). Absent on records created before it was tracked."
          },
          "locale": {
            "type": "string"
          },
          "consentJson": {
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "enum": [
                "granted",
                "denied",
                "objected"
              ]
            }
          },
          "gpcDetected": {
            "type": "boolean"
          },
          "source": {
            "type": "string",
            "enum": [
              "banner",
              "api",
              "import"
            ]
          },
          "ageVerified": {
            "type": "boolean"
          },
          "tcfString": {
            "type": "string"
          },
          "createdAt": {
            "type": "string",
            "format": "date-time"
          },
          "updatedAt": {
            "type": "string",
            "format": "date-time"
          }
        }
      },
      "CreateConsentInput": {
        "type": "object",
        "required": [
          "visitorId",
          "profileId",
          "consentJson"
        ],
        "properties": {
          "visitorId": {
            "type": "string"
          },
          "profileId": {
            "type": "string"
          },
          "consentJson": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            }
          },
          "gpcDetected": {
            "type": "boolean",
            "default": false
          },
          "source": {
            "type": "string",
            "enum": [
              "banner",
              "api",
              "import"
            ],
            "default": "banner"
          },
          "ageVerified": {
            "type": "boolean"
          },
          "parentalConsentToken": {
            "type": "string"
          },
          "tcfString": {
            "type": "string"
          }
        }
      }
    }
  }
}