Aura Historia Administration API

openapi: 3.2.0
info:
  title: Aura Historia API Reference Administration API
  description: '## Overview


    The Aura Historia API powers the Aura Historia antiques platform and its partner-facing integrations. It exposes product discovery, listing source discovery, personalization, partner onboarding, and integration

    workflows on top of Aura Historia''s serverless AWS platform. This reference is designed for two audiences:

    - **Internal developers** building Aura Historia product-listings, operational tooling, and backoffice workflows

    - **External partners and integrators** synchronizing inventory, consuming platform data, or

    integrating with delegated access


    ## Core API domains


    - **ProductListings and listing-sources** — search, retrieve, and explore product-listings, related product-listings, product

    history, and listing source data

    - **Personalization** — manage watchlists, saved search filters, and user notifications

    - **Partner workflows** — submit partnership applications, maintain partnerships, ingest catalog data

    in batches, and receive WooCommerce webhooks

    - **Identity and access** — manage user accounts, Aura Historia access tokens, and OAuth 2.0

    clients and token flows

    - **Billing** — create Stripe checkout, billing-portal, and subscription-management sessions


    ## Authentication model


    The API uses more than one authentication scheme depending on the route:


    - **`BearerAuth`** — Cognito **access** JWT bearer tokens for authenticated user, admin, and

    partner-user workflows. Cognito ID tokens are not accepted as API credentials. - **`AccessTokenAuth`** — Aura Historia opaque bearer access tokens created via

    `/v1/me/access-tokens` or OAuth 2.0, primarily intended for partner automations and server-to-server

    ingestion scenarios. When a route lists multiple security schemes, any one of the listed schemes may be accepted. Some read endpoints can also be called without authentication, while a valid user token may enrich

    the response with personalized state such as watchlist, notification, or search-filter metadata. Aura Historia access

    tokens receive only the sections their read scopes permit; see `ProductListingUserStateData`. ## MCP interface


    The separate `https://mcp.aura-historia.com/v1` Streamable HTTP endpoint accepts opaque Aura access tokens only. Public calls may omit credentials; invalid supplied credentials receive HTTP 401, protected operations require their declared scopes, and insufficient grants receive HTTP 403 with the complete required scope set. Credential-free protected-resource metadata is served on the MCP host at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-protected-resource/v1`. See the MCP contract for protocol and discovery details. ## Data and response conventions


    - **PATCH:** an omitted request member remains unchanged. A documented nullable PATCH member

    accepts `null` to clear its value; `null` for any other member returns `400 BAD_BODY_VALUE`. Use `[]`, not `null`, to replace a non-null collection with an empty collection. Empty HTTP

    bodies are invalid, `{}` is a valid object-PATCH no-op, and the partner-product PATCH `[]`

    remains a valid empty batch. Responses may omit absent optional values. - Product detail, watchlist, and saved-search match reads accept optional **`language`** and

    **`currency`** parameters. Currency defaults to `EUR`. Detail pricing contains the seller''s source

    amounts, converted display amounts, and FX valuation metadata. Active product-listings use the latest persisted

    snapshot; sold product-listings use their immutable sale snapshot. Product history preserves immutable source values and accepts optional `currency` for historical FX display projections. History text is not localized. - Request-wide REST errors are returned as **`application/problem+json`** using a consistent RFC 9457-style structure

    with `status`, `title`, `error`, optional `source`, and optional `detail`.'
  version: 1.0.0
  contact:
    name: Aura-Historia Team
    url: https://aura-historia.com/
  license:
    name: License
    url: https://github.com/aura-historia/backend/blob/develop/LICENSE
servers:
- url: https://api.stage.aura-historia.com
  description: Development environment
- url: https://api.aura-historia.com
  description: Production environment
tags:
- name: Administration
paths:
  /v1/admin/overview:
    get:
      summary: Get the administrator operational overview
      description: 'Delegated Aura access tokens require `admin-overview:read`; missing scope returns `403 FORBIDDEN`.

        Returns a bounded landing-page summary for authenticated administrators. `schemaVersion` is

        required so clients can select a compatible response decoder. Every counter is read from

        authoritative PostgreSQL by one aggregate statement; OpenSearch and other rebuildable

        projections are not used.


        `listingSources.methodAssignments` counts source-method assignments, not distinct sources,

        so its values may sum to more than `listingSources.total`. ProductListing availability

        counts include only `ACTIVE` listings; `activeWithoutAvailability` identifies active rows

        without a current source availability assertion. Responses contain no PII, secrets, or

        embedded collections and always use `Cache-Control: no-store`.'
      operationId: getAdminOverview
      tags:
      - Administration
      security:
      - BearerAuth: []
      - AccessTokenAuth: []
      responses:
        '200':
          description: Authoritative operational counters returned successfully.
          headers:
            Cache-Control:
              description: Administrator overview responses are never stored.
              schema:
                type: string
              example: no-store
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdminOverviewData'
        '401':
          description: Missing or invalid bearer credentials.
          headers:
            Cache-Control:
              description: Error responses are never stored.
              schema:
                type: string
              example: no-store
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 401
                title: Unauthorized
                error: INVALID_CREDENTIALS
        '403':
          description: The caller does not have the persisted ADMIN role.
          headers:
            Cache-Control:
              description: Error responses are never stored.
              schema:
                type: string
              example: no-store
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 403
                title: Forbidden
                error: FORBIDDEN
        '500':
          description: An invalid authoritative read model or internal overview failure occurred.
          headers:
            Cache-Control:
              description: Error responses are never stored.
              schema:
                type: string
              example: no-store
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 500
                title: Internal Server Error
                error: ADMIN_OVERVIEW_INTERNAL_ERROR
        '503':
          description: PostgreSQL or persisted administrator authorization is temporarily unavailable.
          headers:
            Cache-Control:
              description: Error responses are never stored.
              schema:
                type: string
              example: no-store
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 503
                title: Service Unavailable
                error: ADMIN_OVERVIEW_TEMPORARILY_UNAVAILABLE
components:
  schemas:
    ApiError:
      type: object
      description: Standard error response format (RFC 9457)
      required:
      - status
      - title
      - error
      properties:
        status:
          type: integer
          description: HTTP status code
          example: 400
        title:
          type: string
          description: HTTP status code in human-readable form
          example: Bad Request
        error:
          type: string
          description: Error code identifier
          example: BAD_PARAMETER
        source:
          $ref: '#/components/schemas/ApiErrorSource'
        detail:
          type: string
          description: Human-readable error message
          example: 'Expected any of: ''true'' or ''false''. Got: ''invalid'''
    AdminOverviewListingSourceMethodAssignmentCountsData:
      type: object
      required:
      - webCrawl
      - shopify
      - woocommerce
      - partnerApi
      properties:
        webCrawl:
          type: integer
          format: int64
          minimum: 0
        shopify:
          type: integer
          format: int64
          minimum: 0
        woocommerce:
          type: integer
          format: int64
          minimum: 0
        partnerApi:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewPartnershipApplicationsData:
      type: object
      required:
      - total
      - byState
      properties:
        total:
          type: integer
          format: int64
          minimum: 0
        byState:
          $ref: '#/components/schemas/AdminOverviewPartnershipApplicationStateCountsData'
    AdminOverviewListingSourcesData:
      type: object
      description: methodAssignments counts source-method rows and need not sum to total.
      required:
      - total
      - withoutIngestionMethod
      - methodAssignments
      properties:
        total:
          type: integer
          format: int64
          minimum: 0
        withoutIngestionMethod:
          type: integer
          format: int64
          minimum: 0
        methodAssignments:
          $ref: '#/components/schemas/AdminOverviewListingSourceMethodAssignmentCountsData'
    AdminOverviewPartnershipApplicationStateCountsData:
      type: object
      required:
      - submitted
      - inReview
      - approved
      - rejected
      - withdrawn
      properties:
        submitted:
          type: integer
          format: int64
          minimum: 0
        inReview:
          type: integer
          format: int64
          minimum: 0
        approved:
          type: integer
          format: int64
          minimum: 0
        rejected:
          type: integer
          format: int64
          minimum: 0
        withdrawn:
          type: integer
          format: int64
          minimum: 0
    ApiErrorSource:
      type: object
      description: Information about the source of the error
      required:
      - field
      - type
      properties:
        field:
          type: string
          description: Name of the field that caused the error
          example: listingSourceId
        type:
          type: string
          enum:
          - QUERY
          - PATH
          - HEADER
          - BODY
          description: Type of parameter that caused the error
          example: PATH
    AdminOverviewData:
      type: object
      description: Versioned bounded administrator operational summary sourced from authoritative PostgreSQL.
      required:
      - schemaVersion
      - users
      - partnershipApplications
      - parties
      - listingSources
      - partnerships
      - productListings
      properties:
        schemaVersion:
          type: integer
          minimum: 1
          enum:
          - 1
          description: Response contract version.
        users:
          $ref: '#/components/schemas/AdminOverviewUsersData'
        partnershipApplications:
          $ref: '#/components/schemas/AdminOverviewPartnershipApplicationsData'
        parties:
          $ref: '#/components/schemas/AdminOverviewCountData'
        listingSources:
          $ref: '#/components/schemas/AdminOverviewListingSourcesData'
        partnerships:
          $ref: '#/components/schemas/AdminOverviewCountData'
        productListings:
          $ref: '#/components/schemas/AdminOverviewProductListingsData'
    AdminOverviewProductListingLifecycleCountsData:
      type: object
      required:
      - active
      - withdrawn
      properties:
        active:
          type: integer
          format: int64
          minimum: 0
        withdrawn:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewUsersData:
      type: object
      required:
      - total
      - byTier
      - byRole
      properties:
        total:
          type: integer
          format: int64
          minimum: 0
        byTier:
          $ref: '#/components/schemas/AdminOverviewUserTierCountsData'
        byRole:
          $ref: '#/components/schemas/AdminOverviewUserRoleCountsData'
    AdminOverviewCountData:
      type: object
      required:
      - total
      properties:
        total:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewUserRoleCountsData:
      type: object
      required:
      - user
      - admin
      properties:
        user:
          type: integer
          format: int64
          minimum: 0
        admin:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewProductListingsData:
      type: object
      description: Availability counts include ACTIVE listings only.
      required:
      - total
      - byLifecycle
      - activeAvailability
      - activeWithoutAvailability
      properties:
        total:
          type: integer
          format: int64
          minimum: 0
        byLifecycle:
          $ref: '#/components/schemas/AdminOverviewProductListingLifecycleCountsData'
        activeAvailability:
          $ref: '#/components/schemas/AdminOverviewActiveListingAvailabilityCountsData'
        activeWithoutAvailability:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewActiveListingAvailabilityCountsData:
      type: object
      required:
      - available
      - inStock
      - limitedAvailability
      - backOrder
      - madeToOrder
      - preOrder
      - preSale
      - unavailable
      - reserved
      - outOfStock
      - soldOut
      properties:
        available:
          type: integer
          format: int64
          minimum: 0
        inStock:
          type: integer
          format: int64
          minimum: 0
        limitedAvailability:
          type: integer
          format: int64
          minimum: 0
        backOrder:
          type: integer
          format: int64
          minimum: 0
        madeToOrder:
          type: integer
          format: int64
          minimum: 0
        preOrder:
          type: integer
          format: int64
          minimum: 0
        preSale:
          type: integer
          format: int64
          minimum: 0
        unavailable:
          type: integer
          format: int64
          minimum: 0
        reserved:
          type: integer
          format: int64
          minimum: 0
        outOfStock:
          type: integer
          format: int64
          minimum: 0
        soldOut:
          type: integer
          format: int64
          minimum: 0
    AdminOverviewUserTierCountsData:
      type: object
      required:
      - free
      - pro
      - ultimate
      properties:
        free:
          type: integer
          format: int64
          minimum: 0
        pro:
          type: integer
          format: int64
          minimum: 0
        ultimate:
          type: integer
          format: int64
          minimum: 0
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Cognito access JWT bearer token. Signature, issuer, client, token use and expiry

        are validated locally. Signed integer `auth_time` and `iat` claims are required;

        sessions authenticated at or before the persisted local revocation cutoff are rejected.

        This check shares the existing identity lookup and makes no live Cognito status request.

        Revocation requested only in Cognito is not observed immediately; already-issued JWTs

        can remain accepted until expiry. Use the administrator session-revocation endpoint

        for immediate local enforcement. Database authentication failures return

        `503 AUTH_TEMPORARILY_UNAVAILABLE`.

        This scheme is used for authenticated user routes and for partner routes that accept Cognito user tokens.

        '
    AccessTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: opaque
      description: 'Aura Historia bearer access token created through `/v1/me/access-tokens`.

        Tokens are sent as standard bearer authorization headers.

        Selected partner routes accept this scheme instead of the removed partner API-key flow.

        '
x-tagGroups:
- name: Operations
  tags:
  - Operations
- name: Discovery
  tags:
  - ProductListings
  - ListingSources
  - Auctions
- name: User Experience
  tags:
  - Search Filters
  - Watchlist
  - Notifications
  - User Account
  - Billing
  - Newsletter
- name: Partner & Platform Integrations
  tags:
  - Partnerships
  - PartnershipApplications
  - OAuth