BuildWorkPro Comments API

openapi: 3.2.0
info:
  title: BuildWorkPro Comments API
  version: 1.0.0
  description: Construction project management, CRM, and workflows — public REST API.
  contact:
    name: BuildWorkPro Developers
    email: developers@buildworkpro.com
  license:
    name: Proprietary
    url: https://buildworkpro.com/terms
servers:
- url: https://app.buildworkpro.com/api/v1
  description: Production
security:
- bearerAuth: []
tags:
- name: Comments
  description: Discussion threads attached to records. Visibility follows the record commented on.
paths:
  /comments/{entityType}/{entityId}:
    get:
      summary: List comments on a record
      description: Returns the comment thread attached to a record. Requires access to the record itself — comments inherit the visibility of what they hang on.
      security:
      - bearerAuth:
        - comments:read
      tags:
      - Comments
      parameters:
      - schema:
          type: string
          description: Record type, e.g. `project`, `bid`, `change_order`.
        required: true
        description: Record type, e.g. `project`, `bid`, `change_order`.
        name: entityType
        in: path
      - schema:
          type: integer
        required: true
        name: entityId
        in: path
      responses:
        '200':
          description: Comment thread
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Comment'
                required:
                - data
        '403':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      operationId: getCommentsByEntityTypeByEntityId
      x-rate-limit-cost: 1
  /comments:
    post:
      summary: Post a comment
      description: Creates a comment on a record and fans out @mention and thread notifications (in-app only, never email).
      security:
      - bearerAuth:
        - comments:write
      tags:
      - Comments
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entityType:
                  type: string
                entityId:
                  type: integer
                content:
                  type: string
                  minLength: 1
                  maxLength: 10000
                parentId:
                  type:
                  - integer
                  - 'null'
              required:
              - entityType
              - entityId
              - content
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Comment'
                required:
                - data
        '403':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      operationId: postComments
      x-rate-limit-cost: 5
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
  /comments/{id}:
    patch:
      summary: Edit a comment
      description: Edits a comment. Non-elevated roles may only edit their own.
      security:
      - bearerAuth:
        - comments:write
      tags:
      - Comments
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      - schema:
          type: integer
        required: true
        name: id
        in: path
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                content:
                  type: string
                  minLength: 1
                  maxLength: 10000
              required:
              - content
      responses:
        '200':
          description: Updated
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Comment'
                required:
                - data
        '403':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      operationId: patchCommentsById
      x-rate-limit-cost: 5
    delete:
      summary: Delete a comment
      description: Soft-deletes a comment. Non-elevated roles may only delete their own.
      security:
      - bearerAuth:
        - comments:delete
      tags:
      - Comments
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      - schema:
          type: integer
        required: true
        name: id
        in: path
      responses:
        '200':
          description: Deleted
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      id:
                        type: integer
                      deleted:
                        type: boolean
                    required:
                    - id
                    - deleted
                required:
                - data
        '403':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      operationId: deleteCommentsById
      x-rate-limit-cost: 5
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: 'Idempotent retry key for mutating operations. The first request with a given key executes normally and BuildWorkPro caches the response. Replaying the same key with the same request body (method + path + JSON body, SHA-256 hashed) returns the cached response without re-executing the mutation. Replaying with a DIFFERENT body returns `409 idempotency_key_reused`. The cache TTL is 24 hours; after expiry the key is treated as a new operation. Keys are tenant-scoped. Recommended: a fresh UUID v4 per logical operation.'
      schema:
        type: string
        format: uuid
        maxLength: 255
  schemas:
    Comment:
      type: object
      properties:
        id:
          type: integer
        entityType:
          type: string
        entityId:
          type: integer
        userId:
          type:
          - integer
          - 'null'
        content:
          type: string
        parentId:
          type:
          - integer
          - 'null'
        createdAt:
          anyOf:
          - type: string
          - type: string
          - type: 'null'
        updatedAt:
          anyOf:
          - type: string
          - type: string
          - type: 'null'
      required:
      - id
      - entityType
      - entityId
      - userId
      - content
      - parentId
      - createdAt
      - updatedAt
    ProblemDetails:
      type: object
      properties:
        type:
          type: string
          format: uri
          description: URL identifying the problem type
        title:
          type: string
          description: Short human-readable summary
        status:
          type: integer
          description: HTTP status code
        detail:
          type: string
          description: Human-readable explanation
        request_id:
          type: string
          description: Server-generated request identifier
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
                description: Field path that failed validation
              code:
                type: string
                description: Validation error code
              message:
                type: string
                description: Human-readable validation message
            required:
            - field
            - code
            - message
          description: Validation error array (422 only)
      required:
      - type
      - title
      - status
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: bwp_live_... or bwp_test_...
      description: Long-lived tenant-wide API key. Provision in Settings → Developer → API Keys.
    oauth2:
      type: oauth2
      description: OAuth 2.1 per-user token. Available in Phase 4.
      flows:
        authorizationCode:
          authorizationUrl: https://app.buildworkpro.com/api/v1/oauth/authorize
          tokenUrl: https://app.buildworkpro.com/api/v1/oauth/token
          refreshUrl: https://app.buildworkpro.com/api/v1/oauth/token
          scopes: {}