{
  "openapi": "3.1.1",
  "info": {
    "title": "Auto Core internal web API",
    "version": "1.0.0",
    "description": "Authenticated browser endpoints used by the Auto Core dashboard. This is not a public partner API. A valid Auto Core Supabase session token is required for every operation."
  },
  "servers": [
    {
      "url": "https://www.auto-core.app",
      "description": "Production"
    }
  ],
  "tags": [
    {
      "name": "WhatsApp",
      "description": "Authenticated WhatsApp connection and message operations for the CRM."
    }
  ],
  "paths": {
    "/api/send": {
      "post": {
        "tags": ["WhatsApp"],
        "summary": "Send an authenticated CRM WhatsApp command",
        "description": "Relays a command to the active WhatsApp connection for the authenticated user's agency. The caller must have access to the CRM module.",
        "operationId": "sendWhatsappCommand",
        "security": [{ "supabaseBearerAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": true,
                "description": "CRM WhatsApp command payload. The dashboard supplies the action and its command-specific fields."
              }
            }
          }
        },
        "responses": {
          "200": { "description": "Command accepted by the active WhatsApp connection." },
          "400": { "$ref": "#/components/responses/InvalidRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "403": { "$ref": "#/components/responses/Forbidden" },
          "409": { "description": "The agency does not have an available WhatsApp connection." },
          "502": { "description": "The active WhatsApp connection could not complete the command." }
        }
      }
    },
    "/api/wa-qr": {
      "get": {
        "tags": ["WhatsApp"],
        "summary": "Read WhatsApp connection and pairing status",
        "description": "Returns connection information and, only while an authorized pairing window is open, the QR code for the authenticated user's agency.",
        "operationId": "getWhatsappPairingStatus",
        "security": [{ "supabaseBearerAuth": [] }],
        "responses": {
          "200": { "description": "Connection status was read." },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "403": { "$ref": "#/components/responses/Forbidden" },
          "409": { "description": "The agency does not have an available WhatsApp connection." }
        }
      },
      "post": {
        "tags": ["WhatsApp"],
        "summary": "Open or cancel a WhatsApp pairing window",
        "description": "Requests or cancels a temporary pairing window. The server enforces the required agency role.",
        "operationId": "manageWhatsappPairing",
        "security": [{ "supabaseBearerAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": ["accion"],
                "properties": {
                  "accion": {
                    "type": "string",
                    "enum": ["solicitar", "cancelar"],
                    "description": "`solicitar` opens a five-minute pairing window; `cancelar` closes it."
                  }
                },
                "additionalProperties": false
              }
            }
          }
        },
        "responses": {
          "200": { "description": "The pairing operation completed." },
          "400": { "$ref": "#/components/responses/InvalidRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "403": { "$ref": "#/components/responses/Forbidden" },
          "409": { "description": "The agency does not have an available WhatsApp connection." },
          "502": { "description": "The active WhatsApp connection could not complete the operation." }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "supabaseBearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Supabase access token issued to an Auto Core user."
      }
    },
    "responses": {
      "InvalidRequest": { "description": "The request body is invalid or a required command field is not supported." },
      "Unauthorized": { "description": "A valid Auto Core Supabase bearer token was not provided." },
      "Forbidden": { "description": "The authenticated user does not have access to the CRM module or required agency role." }
    }
  }
}