iZap.ai API Tokens API

openapi: 3.2.0
info:
  contact:
    email: support@izap.ai
    name: iZap API Support
  description: Public REST API for the iZap WhatsApp business messaging platform.
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  title: iZap API Tokens API
  version: v1
servers:
- description: Production
  url: https://api.izap.ai
- description: Staging
  url: https://api-staging.izap.ai
tags:
- description: Personal access tokens for calling this API, plus introspection of the token presented on a request.
  name: API Tokens
paths:
  /api/v1/auth/token/introspect:
    get:
      description: Resolves the credential on the request to its principal, or returns `401` if it is not valid. Accepts a JWT, a session cookie, a personal access token or a business API key — use it to confirm that a token is still good and who it belongs to.
      operationId: introspectToken
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PrincipalResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Introspect the presented credential
      tags:
      - API Tokens
  /api/v1/me/api-tokens:
    get:
      description: Returns the personal access tokens belonging to the authenticated user. Only metadata is returned; a token's value is never readable after it is created.
      operationId: listApiTokens
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/TokenResponse'
                title: Response List Personal Access Tokens Api V1 Me Api Tokens Get
                type: array
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: List personal access tokens
      tags:
      - API Tokens
    post:
      description: Issues a new personal access token for the authenticated user. The token value appears exactly once, in this response — store it before discarding the response, because it cannot be retrieved again.
      operationId: createApiToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTokenRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenCreatedResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Create a personal access token
      tags:
      - API Tokens
  /api/v1/me/api-tokens/{token_id}:
    delete:
      description: Revokes the token immediately. Every later request presenting it is rejected.
      operationId: revokeApiToken
      parameters:
      - in: path
        name: token_id
        required: true
        schema:
          format: uuid
          title: Token Id
          type: string
      responses:
        '204':
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Revoke a personal access token
      tags:
      - API Tokens
components:
  schemas:
    ApiError:
      description: 'The response body of a handled API error.


        ``detail`` is either a plain string (FastAPI''s default for an

        ``HTTPException`` raised with a string, and for the ``default`` fastapi-users

        messages like ``"Not authenticated"``) or the structured

        :class:`ApiErrorDetail` object described above. ``code`` is present only on

        the top-level shape ``aizap.core.exceptions.AppException`` produces for its

        own 5xx responses (``"INTERNAL_ERROR"`` / ``"DB_ERROR"``); it does not

        duplicate the ``code`` nested inside a structured ``detail``.'
      properties:
        code:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Code
        detail:
          anyOf:
          - type: string
          - $ref: '#/components/schemas/ApiErrorDetail'
          title: Detail
      required:
      - detail
      title: ApiError
      type: object
    PrincipalResponse:
      description: 'Introspection result: who the presented credential authenticates as.'
      properties:
        business_id:
          anyOf:
          - format: uuid
            type: string
          - type: 'null'
          description: Set when authenticated as a business API key.
          title: Business Id
        kind:
          description: '''user'' or ''business_api_key''.'
          title: Kind
          type: string
        token_id:
          anyOf:
          - format: uuid
            type: string
          - type: 'null'
          description: Id of the token row used, if any.
          title: Token Id
        user_id:
          anyOf:
          - format: uuid
            type: string
          - type: 'null'
          description: Set when authenticated as a user.
          title: User Id
      required:
      - kind
      title: PrincipalResponse
      type: object
    CreateTokenRequest:
      description: Mint a new token. ``expires_in_days`` omitted/null means it never expires.
      properties:
        expires_in_days:
          anyOf:
          - exclusiveMinimum: 0.0
            maximum: 3650.0
            type: integer
          - type: 'null'
          description: Days until the token expires. Null for a non-expiring token.
          title: Expires In Days
        name:
          description: Human-readable label for the token.
          maxLength: 200
          minLength: 1
          title: Name
          type: string
        scopes:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          description: Optional permission scopes (``Permission`` enum values). Omitted or empty means full access within the credential's normal permissions.
          title: Scopes
      required:
      - name
      title: CreateTokenRequest
      type: object
    ApiErrorDetail:
      additionalProperties: true
      description: 'The structured ``detail`` object some error responses carry.


        Several handlers (the REST API plan gate, the free-tier limits, the

        webhooks entitlement gate, the closed customer-service window) raise

        ``HTTPException(detail={"code": ..., "message": ..., ...})`` — a fixed

        ``code``/``message`` pair plus extra fields specific to that error.

        ``extra="allow"`` keeps those fields in the documented shape instead of

        dropping them.'
      properties:
        code:
          title: Code
          type: string
        message:
          title: Message
          type: string
      required:
      - code
      - message
      title: ApiErrorDetail
      type: object
    TokenResponse:
      description: Non-secret view of a token, safe to list.
      properties:
        created:
          format: date-time
          title: Created
          type: string
        expires_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Expires At
        id:
          format: uuid
          title: Id
          type: string
        last_four:
          anyOf:
          - type: string
          - type: 'null'
          description: Last four chars of the token, for recognition.
          title: Last Four
        last_used_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Last Used At
        name:
          title: Name
          type: string
        revoked:
          title: Revoked
          type: boolean
        scopes:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          description: Permission scopes. Null means full access within the credential's normal permissions.
          title: Scopes
        token_prefix:
          description: Non-secret leading chars, e.g. 'izap_pat_AbC'.
          title: Token Prefix
          type: string
      required:
      - id
      - name
      - token_prefix
      - expires_at
      - revoked
      - last_used_at
      - created
      title: TokenResponse
      type: object
    TokenCreatedResponse:
      description: Returned once at creation — the only time the plaintext ``token`` is exposed.
      properties:
        created:
          format: date-time
          title: Created
          type: string
        expires_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Expires At
        id:
          format: uuid
          title: Id
          type: string
        last_four:
          anyOf:
          - type: string
          - type: 'null'
          description: Last four chars of the token, for recognition.
          title: Last Four
        last_used_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Last Used At
        name:
          title: Name
          type: string
        revoked:
          title: Revoked
          type: boolean
        scopes:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          description: Permission scopes. Null means full access within the credential's normal permissions.
          title: Scopes
        token:
          description: The plaintext token. Store it now; it cannot be retrieved again.
          title: Token
          type: string
        token_prefix:
          description: Non-secret leading chars, e.g. 'izap_pat_AbC'.
          title: Token Prefix
          type: string
      required:
      - id
      - name
      - token_prefix
      - expires_at
      - revoked
      - last_used_at
      - created
      - token
      title: TokenCreatedResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
      - loc
      - msg
      - type
      title: ValidationError
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Personal access token (izap_pat_…) sent as Authorization: Bearer <token>; dashboard session JWTs are also accepted.'
      scheme: bearer
      type: http