Ezoic Subscriptions Server-to-Server REST API

openapi: 3.1.0
info:
  title: Ezoic Subscriptions Server-to-Server REST API
  version: v1
  description: >-
    Server-to-server REST API for Ezoic Subscriptions. Lets a publisher verify a
    reader's paid access and read a reader's subscriptions/purchases from their own
    backend, authenticated through the Ezoic API gateway. Faithfully modeled from the
    public documentation at https://docs.ezoic.com/docs/subscriptions/rest-api/.
  x-apievangelist-method: searched
  x-apievangelist-source: https://docs.ezoic.com/docs/subscriptions/rest-api/
  contact:
    name: Ezoic Support
    url: https://support.ezoic.com/
servers:
  - url: https://api-gateway.ezoic.com/subscriptions/v1
    description: Ezoic API gateway (production)
security:
  - developerKey: []
paths:
  /access:
    get:
      operationId: checkAccess
      summary: Check reader access to a product or item
      description: >-
        Returns an allow/deny access decision for the identified reader against a
        subscription product handle or a one-time item key. Exactly one reader
        identity header must be supplied.
      tags: [Access]
      parameters:
        - $ref: '#/components/parameters/developerKey'
        - $ref: '#/components/parameters/domain'
        - name: product
          in: query
          required: false
          description: Product handle to check access for (supply product OR item).
          schema: { type: string }
        - name: item
          in: query
          required: false
          description: One-time item key to check access for (supply product OR item).
          schema: { type: string }
        - $ref: '#/components/parameters/readerEmail'
        - $ref: '#/components/parameters/readerToken'
      responses:
        '200':
          description: Access decision
          headers:
            Cache-Control:
              description: Responses are not cached.
              schema: { type: string, example: no-store }
          content:
            application/json:
              schema:
                type: object
                properties:
                  success: { type: boolean }
                  data:
                    type: object
                    properties:
                      decision:
                        type: string
                        enum: [allowed, denied, login_required, expired, revoked, unknown_product]
                      reasonCode:
                        type: string
                        enum: [allowed, customer_required, unknown_product, no_entitlement, not_started, expired, revoked, suspended, pending]
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /products:
    get:
      operationId: listProducts
      summary: List product handles for the domain
      description: Returns the list of Ezoic Subscriptions product handles configured for the domain.
      tags: [Products]
      parameters:
        - $ref: '#/components/parameters/developerKey'
        - $ref: '#/components/parameters/domain'
      responses:
        '200':
          description: Product handles
          content:
            application/json:
              schema:
                type: object
                properties:
                  success: { type: boolean }
                  data:
                    type: array
                    items: { type: string }
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
  /purchases:
    get:
      operationId: listPurchases
      summary: List a reader's purchases
      description: >-
        Returns the identified reader's subscriptions and one-time purchases for the
        domain. Exactly one reader identity header must be supplied.
      tags: [Purchases]
      parameters:
        - $ref: '#/components/parameters/developerKey'
        - $ref: '#/components/parameters/domain'
        - $ref: '#/components/parameters/readerEmail'
        - $ref: '#/components/parameters/readerToken'
      responses:
        '200':
          description: Reader purchases
          content:
            application/json:
              schema:
                type: object
                properties:
                  success: { type: boolean }
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        productKey: { type: string }
                        item: { type: string }
                        status: { type: string, example: active }
                        expiresAt: { type: string, format: date-time }
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  securitySchemes:
    developerKey:
      type: apiKey
      in: query
      name: developerKey
      description: Your Ezoic API (developer) key, passed as a query parameter.
  parameters:
    developerKey:
      name: developerKey
      in: query
      required: true
      description: Your Ezoic API key.
      schema: { type: string }
    domain:
      name: domain
      in: query
      required: true
      description: The domain being queried (must belong to your account).
      schema: { type: string }
    readerEmail:
      name: X-Ezoic-Reader-Email
      in: header
      required: false
      description: Reader's email address. Supply exactly one reader identity header.
      schema: { type: string, format: email }
    readerToken:
      name: X-Ezoic-Reader-Token
      in: header
      required: false
      description: Reader's Ezoic Subscriptions session JWT (visitor-account sites). Supply exactly one reader identity header.
      schema: { type: string }
  responses:
    BadRequest:
      description: Missing required parameters or duplicate identity headers.
      content:
        application/json:
          schema: { $ref: '#/components/schemas/Error' }
    Forbidden:
      description: Subscriptions disabled for domain or invalid reader token.
      content:
        application/json:
          schema: { $ref: '#/components/schemas/Error' }
  schemas:
    Error:
      type: object
      properties:
        success: { type: boolean, example: false }
        message: { type: string }