Coldrig Bootstrap API

openapi: 3.2.0
info:
  title: Coldrig Dev Bootstrap API
  version: 0.3.0
  contact:
    name: EpiphanyMade
    email: support@coldrig.dev
  license:
    name: MIT
  description: 'Operations tagged bootstrap across 2 of this provider''s published API definitions: coldrig-dev-openapi.yaml, coldrig-dev-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.coldrig.dev
  description: Production API host.
security:
- bearerAuth: []
tags:
- name: Bootstrap
paths:
  /signup:
    post:
      operationId: signup
      tags:
      - Bootstrap
      summary: Create an account and mint a bearer token
      description: Unauthenticated bootstrap call. Always mints a demo-plan account — a demo account is structurally incapable of reaching a real vendor adapter. The returned token is the account's API key and stays the same when the account goes live. Upgrade to the paid `managed` plan via POST /checkout (`{ mailboxes, interval }`), billed at $49 a month for the first 3 mailboxes and $5 a month for each extra mailbox (3-mailbox minimum; no setup fee, no domain fee).
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignupInput'
      responses:
        '201':
          description: Account created.
          content:
            application/json:
              schema:
                type: object
                properties:
                  tenantId:
                    type: string
                    example: ten_a1b2c3
                  token:
                    type: string
                    description: Bearer token — store securely, shown once.
                required:
                - tenantId
                - token
        '400':
          $ref: '#/components/responses/ValidationError'
    servers:
    - url: https://api.coldrig.dev
      description: Production API host.
components:
  schemas:
    SignupInput:
      type: object
      required:
      - brand
      - contactEmail
      properties:
        brand:
          type: string
          minLength: 1
          maxLength: 200
          description: 'One line of plain text: a line break, tab, control character or invisible text-direction mark is refused (400) naming this field.'
        contactEmail:
          type: string
          format: email
        vertical:
          type: string
          enum:
          - crowdfunding
          description: 'Optional. Set once at signup, never changed; absent = none. crowdfunding joins this account to the shared bounce list: addresses that hard-bounced or complained on another crowdfunding account''s real (not test-mode) sends (stored as hashes) are skipped, and a send skipped this way shows as a failed event with reason pool_bounce or pool_complaint. It is not copied into your own suppression list.'
  responses:
    ValidationError:
      description: Request body failed schema validation.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Token returned by POST /signup. One token = one separate account. An app connected with "Sign in with Coldrig" (OAuth) holds its own short-lived token for the same account: it is accepted on the hosted MCP endpoint (/mcp) only, and on no REST route.

        '
    dashboardSessionCookie:
      type: apiKey
      in: cookie
      name: cs_dashboard_session
      description: 'httpOnly session cookie minted by POST /dashboard/session (30-day TTL). Alternative to bearerAuth for /dashboard/* routes only, used by the optional human dashboard SPA. A cookie-authed mutating request (any method other than GET/HEAD) must also send the `X-Coldstart-Client: dashboard` header (global CSRF guard) — bearer-authed requests are exempt.

        '
x-refined-from:
- coldrig-dev-openapi.yaml
- coldrig-dev-openapi.yml