dnsofmoney-com Xapp API

openapi: 3.2.0
info:
  title: dns://money - Financial Address Resolution Xapp API
  version: 0.3.0
tags:
- name: xapp
paths:
  /xapp/ott:
    post:
      tags:
      - xapp
      summary: Exchange a Xaman OTT for a backend JWT + session context
      description: 'Frontend posts {ott} → we call Xaman''s /platform/xapp/ott/{token} with the

        API secret, then return {jwt, context}. The Xaman API secret NEVER leaves

        this backend.'
      operationId: ott_exchange_xapp_ott_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OttExchangeRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /xapp/me:
    get:
      tags:
      - xapp
      summary: Return the JWT-bound session (smoke-test for the Bearer round-trip)
      description: 'JWT-protected echo. Returns the account, network, and token lifetime —

        useful for confirming the frontend→backend Bearer round-trip works.'
      operationId: xapp_me_xapp_me_get
      parameters:
      - name: authorization
        in: header
        required: false
        schema:
          type: string
          default: ''
          title: Authorization
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /xapp/event:
    post:
      tags:
      - xapp
      summary: Record one client-side xApp sign-funnel event (best-effort telemetry)
      description: 'The xApp posts funnel events the backend/Xaman can''t observe (did the sign

        request surface? rejected? timed out? deeplink fallback used?). Identity

        (account, network) is taken from the verified JWT, never the body. Unknown

        flow/event strings are kept (truncated) rather than rejected — a telemetry

        write must never become a client-facing error.


        Terminal outcomes (signed / rejected / timeout) also push a one-line

        Telegram alert via ALERT_WEBHOOK_URL, queued post-response so it never

        adds latency to the client.'
      operationId: record_xapp_event_xapp_event_post
      parameters:
      - name: authorization
        in: header
        required: false
        schema:
          type: string
          default: ''
          title: Authorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/XappEventIn'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /xapp/events:
    get:
      tags:
      - xapp
      summary: 'Admin-only: recent xApp sign-funnel events (X-Admin-Key = live API key)'
      description: Read the client telemetry funnel, newest first. Read-only, off the money path.
      operationId: list_xapp_events_xapp_events_get
      parameters:
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 100
          title: Limit
      - name: flow
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Flow
      - name: account
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Account
      - name: x-admin-key
        in: header
        required: false
        schema:
          type: string
          default: ''
          title: X-Admin-Key
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    XappEventIn:
      properties:
        flow:
          type: string
          maxLength: 32
          title: Flow
        event:
          type: string
          maxLength: 48
          title: Event
        alias:
          anyOf:
          - type: string
            maxLength: 128
          - type: 'null'
          title: Alias
        payload_uuid:
          anyOf:
          - type: string
            maxLength: 64
          - type: 'null'
          title: Payload Uuid
        detail:
          anyOf:
          - type: string
            maxLength: 512
          - type: 'null'
          title: Detail
      type: object
      required:
      - flow
      - event
      title: XappEventIn
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    OttExchangeRequest:
      properties:
        ott:
          type: string
          maxLength: 128
          minLength: 10
          title: Ott
          description: Raw xAppToken from Xaman boot query string.
      type: object
      required:
      - ott
      title: OttExchangeRequest
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key