GetMyHotels Consents API

openapi: 3.2.0
info:
  title: GetMyHotels REST Consents API
  version: 1.0.0
  description: REST surface for the native GetMyHotels apps. Every route is a thin transport over the shared tRPC routers — inputs are validated with the same Zod schemas the web client uses, and responses are returned verbatim. Authentication uses Better Auth bearer session tokens issued by the /api/auth/* endpoints (not part of this spec). Native clients send X-GMH-App-Version and X-GMH-Platform on every request; versions below the configured floor receive a typed 426 UpgradeRequiredError.
servers:
- url: https://api.getmyhotels.com
  description: Production API
tags:
- name: Consents
paths:
  /v1/consents:
    post:
      tags:
      - Consents
      summary: Record a batch of consent decisions
      description: Runs `compliance.recordConsentBatch` (public — signup and cookie-banner capture). Anonymous callers MUST send a `cookie:` subjectId and a `cookie_banner` or `signup_form` source; signed-in callers are bound to their own account automatically and the subjectId is ignored.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                subjectId:
                  type: string
                  minLength: 1
                  maxLength: 64
                  pattern: ^(cookie:[a-z0-9]{20,32}|[a-zA-Z0-9_-]{1,64})$
                decisions:
                  type: array
                  items:
                    type: object
                    properties:
                      purpose:
                        type: string
                        enum:
                        - cookies.analytics
                        - cookies.marketing
                        - cookies.preferences
                        - marketing.email
                        - marketing.sms
                        - marketing.push
                        - ai.training
                        - ccpa.do_not_sell
                        - terms
                        - privacy
                        - age_confirmation
                        - auto_rebook
                      granted:
                        type: boolean
                    required:
                    - purpose
                    - granted
                  minItems: 1
                  maxItems: 20
                policyVersion:
                  type: string
                  maxLength: 16
                source:
                  type: string
                  enum:
                  - cookie_banner
                  - signup_form
                  - settings
                  - stop_keyword
                  - unsubscribe_link
                  - admin
              required:
              - decisions
              - source
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                description: Verbatim JSON output of the `compliance.recordConsentBatch` tRPC procedure. Response shapes are intentionally not modeled in this spec; the native client types them by hand.
        '400':
          description: Request validation failed or the router rejected the input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '426':
          description: Reported X-GMH-App-Version is below the supported minimum — the app must update
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpgradeRequiredError'
        '500':
          description: Unexpected server error (opaque; details stay in logs)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      operationId: postV1Consents
      x-operation-id-source: derived
components:
  schemas:
    UpgradeRequiredError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              enum:
              - UPGRADE_REQUIRED
            message:
              type: string
            minVersion:
              type: string
              example: 1.2.0
            platform:
              type:
              - string
              - 'null'
          required:
          - code
          - message
          - minVersion
          - platform
      required:
      - error
    ApiError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: NOT_FOUND
            message:
              type: string
              example: Booking not found
            domainCode:
              type: string
              example: NON_REFUNDABLE_CONSENT_REQUIRED
            issues:
              type: array
              items:
                type: object
                properties:
                  path:
                    type: string
                  message:
                    type: string
                required:
                - path
                - message
          required:
          - code
          - message
      required:
      - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Better Auth session token. Obtain it from the native /api/auth/* endpoints (Better Auth bearer plugin — out of scope for this spec, see #922).'
x-provenance:
  method: harvested
  publisher: GetMyHotels
  source: https://api.getmyhotels.com/v1/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)