Aura Historia Overview API

openapi: 3.2.0
info:
  title: Aura Historia API Reference Overview API
  description: '## Overview


    The Aura Historia API powers the Aura Historia antiques platform and its partner-facing integrations. It exposes product discovery, listing source discovery, personalization, partner onboarding, and integration

    workflows on top of Aura Historia''s serverless AWS platform. This reference is designed for two audiences:

    - **Internal developers** building Aura Historia product-listings, operational tooling, and backoffice workflows

    - **External partners and integrators** synchronizing inventory, consuming platform data, or

    integrating with delegated access


    ## Core API domains


    - **ProductListings and listing-sources** — search, retrieve, and explore product-listings, related product-listings, product

    history, and listing source data

    - **Personalization** — manage watchlists, saved search filters, and user notifications

    - **Partner workflows** — submit partnership applications, maintain partnerships, ingest catalog data

    in batches, and receive WooCommerce webhooks

    - **Identity and access** — manage user accounts, Aura Historia access tokens, and OAuth 2.0

    clients and token flows

    - **Billing** — create Stripe checkout, billing-portal, and subscription-management sessions


    ## Authentication model


    The API uses more than one authentication scheme depending on the route:


    - **`BearerAuth`** — Cognito **access** JWT bearer tokens for authenticated user, admin, and

    partner-user workflows. Cognito ID tokens are not accepted as API credentials. - **`AccessTokenAuth`** — Aura Historia opaque bearer access tokens created via

    `/v1/me/access-tokens` or OAuth 2.0, primarily intended for partner automations and server-to-server

    ingestion scenarios. When a route lists multiple security schemes, any one of the listed schemes may be accepted. Some read endpoints can also be called without authentication, while a valid user token may enrich

    the response with personalized state such as watchlist, notification, or search-filter metadata. Aura Historia access

    tokens receive only the sections their read scopes permit; see `ProductListingUserStateData`. ## MCP interface


    The separate `https://mcp.aura-historia.com/v1` Streamable HTTP endpoint accepts opaque Aura access tokens only. Public calls may omit credentials; invalid supplied credentials receive HTTP 401, protected operations require their declared scopes, and insufficient grants receive HTTP 403 with the complete required scope set. Credential-free protected-resource metadata is served on the MCP host at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-protected-resource/v1`. See the MCP contract for protocol and discovery details. ## Data and response conventions


    - **PATCH:** an omitted request member remains unchanged. A documented nullable PATCH member

    accepts `null` to clear its value; `null` for any other member returns `400 BAD_BODY_VALUE`. Use `[]`, not `null`, to replace a non-null collection with an empty collection. Empty HTTP

    bodies are invalid, `{}` is a valid object-PATCH no-op, and the partner-product PATCH `[]`

    remains a valid empty batch. Responses may omit absent optional values. - Product detail, watchlist, and saved-search match reads accept optional **`language`** and

    **`currency`** parameters. Currency defaults to `EUR`. Detail pricing contains the seller''s source

    amounts, converted display amounts, and FX valuation metadata. Active product-listings use the latest persisted

    snapshot; sold product-listings use their immutable sale snapshot. Product history preserves immutable source values and accepts optional `currency` for historical FX display projections. History text is not localized. - Request-wide REST errors are returned as **`application/problem+json`** using a consistent RFC 9457-style structure

    with `status`, `title`, `error`, optional `source`, and optional `detail`.'
  version: 1.0.0
  contact:
    name: Aura-Historia Team
    url: https://aura-historia.com/
  license:
    name: License
    url: https://github.com/aura-historia/backend/blob/develop/LICENSE
servers:
- url: https://api.stage.aura-historia.com
  description: Development environment
- url: https://api.aura-historia.com
  description: Production environment
tags:
- name: Overview
  description: Public aggregate catalogue statistics.
paths:
  /v1/overview:
    get:
      summary: Get public catalogue statistics
      description: 'Anonymous aggregate statistics for the public catalogue. Hourly maintenance recalculates

        every count together from authoritative PostgreSQL about every six hours, and reads return

        that stored calculation; `asOf` is its time. Including the 15-minute shared edge cache,

        figures are normally at most about seven hours old; a failed refresh keeps the previous

        calculation.

        There are no filters, personalization, or per-source, per-partner or per-user details.

        Credentials are neither required nor evaluated, and query strings never change the

        representation; send none, because each distinct query string is cached separately.

        Clients should not attach a bearer token; any `Authorization` header makes the response

        private.


        Counts cover ProductListings with lifecycle `ACTIVE`, whatever their availability.

        `sourcesIndexed` counts distinct ListingSources with at least one counted listing.

        `countries` counts distinct countries in the counted listings'' effective advertised-inventory

        geography; business association and shipping destinations do not establish inventory location.

        `languages` counts the union of original title and description languages; generated

        translations and presentation fallbacks are excluded. `newObjectsLast7Days` counts listings

        whose `created` timestamp lies in the 168 hours ending at `asOf` (start exclusive, end inclusive).

        Effective geography and OpenSearch projections may lag PostgreSQL while they catch up.'
      operationId: getPublicOverview
      tags:
      - Overview
      security: []
      responses:
        '200':
          description: Anonymous successful 200 responses without Authorization use `public, max-age=0, s-maxage=900, stale-if-error=0`; any request with Authorization uses `private, no-store`.
          headers:
            Cache-Control:
              schema:
                type: string
              example: public, max-age=0, s-maxage=900, stale-if-error=0
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicOverviewData'
        '500':
          description: The aggregate read model is invalid. Cache-Control is no-store.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 500
                title: Internal Server Error
                error: OVERVIEW_INTERNAL_ERROR
        '503':
          description: PostgreSQL is temporarily unavailable, or no calculation has been stored yet. Cache-Control is no-store.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiError'
              example:
                status: 503
                title: Service Unavailable
                error: OVERVIEW_TEMPORARILY_UNAVAILABLE
components:
  schemas:
    PublicOverviewData:
      type: object
      description: Aggregate public-catalogue statistics from the latest scheduled calculation. Contains counts only.
      required:
      - asOf
      - sourcesIndexed
      - liveObjects
      - countries
      - languages
      - newObjectsLast7Days
      properties:
        asOf:
          type: string
          format: date-time
          description: UTC database timestamp at which the stored calculation counted every value.
          example: '2026-10-19T12:00:00.123456Z'
        sourcesIndexed:
          type: integer
          format: int64
          minimum: 0
          description: Distinct ListingSources represented by at least one counted live listing.
          example: 124
        liveObjects:
          type: integer
          format: int64
          minimum: 0
          description: ProductListings with lifecycle `ACTIVE`, including sold-out and unspecified availability.
          example: 182450
        countries:
          type: integer
          format: int64
          minimum: 0
          description: Distinct countries in the counted listings' effective advertised-inventory geography.
          example: 18
        languages:
          type: integer
          format: int64
          minimum: 0
          description: Distinct original title and description languages of the counted listings.
          example: 9
        newObjectsLast7Days:
          type: integer
          format: int64
          minimum: 0
          description: Counted listings created in the 168 hours ending at `asOf`.
          example: 3120
    ApiErrorSource:
      type: object
      description: Information about the source of the error
      required:
      - field
      - type
      properties:
        field:
          type: string
          description: Name of the field that caused the error
          example: listingSourceId
        type:
          type: string
          enum:
          - QUERY
          - PATH
          - HEADER
          - BODY
          description: Type of parameter that caused the error
          example: PATH
    ApiError:
      type: object
      description: Standard error response format (RFC 9457)
      required:
      - status
      - title
      - error
      properties:
        status:
          type: integer
          description: HTTP status code
          example: 400
        title:
          type: string
          description: HTTP status code in human-readable form
          example: Bad Request
        error:
          type: string
          description: Error code identifier
          example: BAD_PARAMETER
        source:
          $ref: '#/components/schemas/ApiErrorSource'
        detail:
          type: string
          description: Human-readable error message
          example: 'Expected any of: ''true'' or ''false''. Got: ''invalid'''
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Cognito access JWT bearer token. Signature, issuer, client, token use and expiry

        are validated locally. Signed integer `auth_time` and `iat` claims are required;

        sessions authenticated at or before the persisted local revocation cutoff are rejected.

        This check shares the existing identity lookup and makes no live Cognito status request.

        Revocation requested only in Cognito is not observed immediately; already-issued JWTs

        can remain accepted until expiry. Use the administrator session-revocation endpoint

        for immediate local enforcement. Database authentication failures return

        `503 AUTH_TEMPORARILY_UNAVAILABLE`.

        This scheme is used for authenticated user routes and for partner routes that accept Cognito user tokens.

        '
    AccessTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: opaque
      description: 'Aura Historia bearer access token created through `/v1/me/access-tokens`.

        Tokens are sent as standard bearer authorization headers.

        Selected partner routes accept this scheme instead of the removed partner API-key flow.

        '
x-tagGroups:
- name: Operations
  tags:
  - Operations
- name: Discovery
  tags:
  - ProductListings
  - ListingSources
  - Auctions
- name: User Experience
  tags:
  - Search Filters
  - Watchlist
  - Notifications
  - User Account
  - Billing
  - Newsletter
- name: Partner & Platform Integrations
  tags:
  - Partnerships
  - PartnershipApplications
  - OAuth