licensy-ai Me API

openapi: 3.2.0
info:
  title: Fast Me API
  version: 0.1.0
tags:
- name: Me
paths:
  /api/v2/me/mcp-usage:
    get:
      tags:
      - Me
      summary: My MCP usage (logged-in user)
      operationId: my_mcp_usage_api_v2_me_mcp_usage_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MyMcpUsageResponse'
      security:
      - HTTPBearer: []
  /api/v2/me/mcp-usage.csv:
    get:
      tags:
      - Me
      summary: Download my MCP call history as CSV
      description: 'Returns a CSV of every MCP call we have for the authenticated user. Use `days` to limit the window (default 90, max matches retention window). One row per call: timestamp, tool, client hint, tier at time of call, success boolean, latency_ms, error_code.'
      operationId: my_mcp_usage_csv_api_v2_me_mcp_usage_csv_get
      security:
      - HTTPBearer: []
      parameters:
      - name: days
        in: query
        required: false
        schema:
          type: integer
          default: 90
          title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-subscriptions:
    get:
      tags:
      - Me
      summary: My webhook subscriptions
      operationId: my_webhook_subscriptions_api_v2_me_webhook_subscriptions_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WebhookSubscriptionView'
                type: array
                title: Response My Webhook Subscriptions Api V2 Me Webhook Subscriptions Get
      security:
      - HTTPBearer: []
  /api/v2/me/webhook-subscriptions/{subscription_id}:
    patch:
      tags:
      - Me
      summary: Edit one of my webhook subscriptions (npis + events)
      description: Replace the NPI watchlist or event-type filter on a subscription. Owner-checked. webhook_url and signing_secret are NOT editable here — rotate the secret via the dedicated endpoint, or cancel + re-subscribe to change the URL.
      operationId: patch_my_webhook_subscription_api_v2_me_webhook_subscriptions__subscription_id__patch
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookSubscriptionPatch'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSubscriptionView'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - Me
      summary: Cancel one of my webhook subscriptions
      operationId: cancel_my_webhook_subscription_api_v2_me_webhook_subscriptions__subscription_id__delete
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-subscriptions/{subscription_id}/deliveries:
    get:
      tags:
      - Me
      summary: Recent webhook deliveries for one of my subscriptions
      operationId: my_webhook_deliveries_api_v2_me_webhook_subscriptions__subscription_id__deliveries_get
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 50
          title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/WebhookDeliveryView'
                title: Response My Webhook Deliveries Api V2 Me Webhook Subscriptions  Subscription Id  Deliveries Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/allowed-ips:
    get:
      tags:
      - Me
      summary: Get the IP allowlist on my REST API key
      operationId: my_allowed_ips_api_v2_me_allowed_ips_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowedIpsResponse'
      security:
      - HTTPBearer: []
    put:
      tags:
      - Me
      summary: Set the IP allowlist on my REST API key
      description: 'Pass an empty array to disable the allowlist (all IPs allowed). Pass IP literals or CIDR ranges to restrict. Note: this only applies to REST API requests authenticated via the credential_key header. MCP server requests are unaffected.'
      operationId: my_set_allowed_ips_api_v2_me_allowed_ips_put
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AllowedIpsRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowedIpsResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /api/v2/me/email-preferences:
    get:
      tags:
      - Me
      summary: Get my email-channel opt-ins
      operationId: my_email_preferences_api_v2_me_email_preferences_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailPreferences'
      security:
      - HTTPBearer: []
    put:
      tags:
      - Me
      summary: Set my email-channel opt-ins
      description: Toggle non-transactional email channels. Transactional emails (account-security, account-deletion confirmations) are not affected — they always send.
      operationId: set_my_email_preferences_api_v2_me_email_preferences_put
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailPreferences'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailPreferences'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /api/v2/me/audit:
    get:
      tags:
      - Me
      summary: Recent security + preference events on my account
      description: 'Returns the customer''s most recent self-serve actions: IP allowlist edits, email-preference changes, webhook signing-key rotations, license-renewal acknowledgments, account exports + deletion attempts. Useful for credentialing-team compliance reviews — gives the account owner a paper trail of who changed what on the account.'
      operationId: my_audit_log_api_v2_me_audit_get
      security:
      - HTTPBearer: []
      parameters:
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 100
          title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditListResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/reports/health:
    get:
      tags:
      - Me
      summary: My report-portfolio health summary
      description: 'Bird''s-eye view of every license on every report this user owns: totals + counts at 7/30/60-day expiration horizons + count of already-expired licenses + count of records we haven''t refreshed in >14 days. Powers the Overview-page health widget so customers see their portfolio''s state without clicking through every report.'
      operationId: my_reports_health_api_v2_me_reports_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MyReportsHealth'
      security:
      - HTTPBearer: []
  /api/v2/me/feedback:
    post:
      tags:
      - Me
      summary: Submit feedback (free-text → Slack)
      description: Customers can drop a bug report, feature request, or question from anywhere in the app. Always succeeds — failures to ping Slack are logged but the user gets a 200 either way.
      operationId: submit_feedback_api_v2_me_feedback_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FeedbackRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /api/v2/me/account/export:
    get:
      tags:
      - Me
      summary: Download a JSON bundle of all my account data (GDPR-style)
      description: Returns a single JSON document with the authenticated user's profile, plan, MCP usage history (last 365 days), webhook subscriptions, recent webhook deliveries, and reports they own. Streamed with Content-Disposition so it downloads to disk. The complement to /account/delete — gives customers a copy before they leave.
      operationId: export_my_account_api_v2_me_account_export_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
      - HTTPBearer: []
  /api/v2/me/account/delete:
    post:
      tags:
      - Me
      summary: Self-serve account deletion (irreversible)
      description: 'Delete the authenticated user''s account + all associated data. Required: `confirm_email` body field must exactly match the authenticated user''s email — this is the confirm-by-typing guard. Reports, subscriptions, payment history, webhook subscriptions, and the auth user itself are deleted. Licenses (shared data) are preserved. Irreversible.'
      operationId: delete_my_account_api_v2_me_account_delete_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteAccountRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - HTTPBearer: []
  /api/v2/me/webhook-subscriptions/{subscription_id}/test-fire:
    post:
      tags:
      - Me
      summary: Fire a test webhook at my subscription's registered URL
      description: Synthesizes a license-change event payload, signs it with this subscription's current signing_secret, and POSTs it at the subscription's registered webhook_url. Lets customers verify their signature-verification + payload-parsing code end-to-end without waiting for a real license change. Owner-checked. Doesn't touch webhook_deliveries — completely isolated.
      operationId: test_fire_my_webhook_api_v2_me_webhook_subscriptions__subscription_id__test_fire_post
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestFireResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-subscriptions/{subscription_id}/pause:
    post:
      tags:
      - Me
      summary: Pause one of my webhook subscriptions (manual)
      description: Sets status to 'paused' — the dispatcher stops enqueuing new deliveries against this subscription, but all configuration (URL, secret, NPIs, events) is preserved. Use during scheduled maintenance windows; call /resume to bring it back. Owner-checked.
      operationId: pause_my_webhook_api_v2_me_webhook_subscriptions__subscription_id__pause_post
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-subscriptions/{subscription_id}/resume:
    post:
      tags:
      - Me
      summary: Resume a paused webhook subscription
      description: Sets status back to 'active'. Resets consecutive_probe_failures to 0 so the auto-pause threshold starts fresh. Owner-checked.
      operationId: resume_my_webhook_api_v2_me_webhook_subscriptions__subscription_id__resume_post
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-subscriptions/{subscription_id}/rotate-secret:
    post:
      tags:
      - Me
      summary: Rotate the signing secret on one of my webhook subscriptions
      description: Generates a new signing_secret for the subscription and returns it ONCE in the response — you won't see it again. Update your endpoint's signature-verification code with the new secret before the next webhook fires, otherwise deliveries will fail signature check. Owner-checked.
      operationId: rotate_my_webhook_secret_api_v2_me_webhook_subscriptions__subscription_id__rotate_secret_post
      security:
      - HTTPBearer: []
      parameters:
      - name: subscription_id
        in: path
        required: true
        schema:
          type: string
          title: Subscription Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v2/me/webhook-deliveries/{delivery_id}/retry:
    post:
      tags:
      - Me
      summary: Re-queue a failed or dead-lettered webhook delivery
      description: 'Resets the delivery to status=pending and schedules immediate retry. Use this when you''ve fixed the upstream issue (eg restored your endpoint) and want to recover events that were dead-lettered. Owner-checked: you can only retry deliveries on subscriptions you own.'
      operationId: retry_my_webhook_delivery_api_v2_me_webhook_deliveries__delivery_id__retry_post
      security:
      - HTTPBearer: []
      parameters:
      - name: delivery_id
        in: path
        required: true
        schema:
          type: string
          title: Delivery Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    EmailPreferences:
      properties:
        expiration_reminders:
          type: boolean
          title: Expiration Reminders
          default: true
        trial_reminders:
          type: boolean
          title: Trial Reminders
          default: true
        onboarding_nudges:
          type: boolean
          title: Onboarding Nudges
          default: true
        product_announcements:
          type: boolean
          title: Product Announcements
          default: true
      type: object
      title: EmailPreferences
    MyReportsHealth:
      properties:
        total_reports:
          type: integer
          title: Total Reports
        total_licenses_tracked:
          type: integer
          title: Total Licenses Tracked
        active_licenses:
          type: integer
          title: Active Licenses
        expiring_60d:
          type: integer
          title: Expiring 60D
        expiring_30d:
          type: integer
          title: Expiring 30D
        expiring_7d:
          type: integer
          title: Expiring 7D
        already_expired:
          type: integer
          title: Already Expired
        stale_records:
          type: integer
          title: Stale Records
          description: Licenses we haven't refreshed in >14 days (background scrapers may be lagging)
        ambiguous_reports:
          type: integer
          title: Ambiguous Reports
          description: Reports with >75 attached licenses — usually means the search name matched multiple physicians (e.g. "John Smith" with no middle name). Customer can disambiguate by editing the report to add a middle name.
          default: 0
        ambiguous_report_ids:
          items:
            type: string
          type: array
          title: Ambiguous Report Ids
          description: UUIDs of the ambiguous_reports. Lets the dashboard widget link directly to the offending reports with a 'Fix it' CTA.
        needs_review_licenses:
          type: integer
          title: Needs Review Licenses
          description: 'Licenses waiting for an identity check ("Needs review": flagged for review or a name mismatch, not yet approved). Listed on the report with their label but NOT counted in any other figure here (tracked, active, expiring, expired, stale).'
          default: 0
        identity_action_required_reports:
          type: integer
          title: Identity Action Required Reports
          description: 'Reports whose identity is unconfirmed (app/utils/report_identity.py): e.g. no NPI and several same-name physicians, so their same-name licenses are held back. Show ''Identity unconfirmed: add NPI'' for them, not 0.'
          default: 0
        identity_action_required:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Identity Action Required
          description: 'One entry per such report: {report_id, reason (''needs_npi''), action (''add_npi''), message (''Identity unconfirmed: add NPI''), flagged_license_count}. Links the widget to the report''s NPI link flow.'
        last_refreshed_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Refreshed At
      type: object
      required:
      - total_reports
      - total_licenses_tracked
      - active_licenses
      - expiring_60d
      - expiring_30d
      - expiring_7d
      - already_expired
      - stale_records
      title: MyReportsHealth
    AuditListResponse:
      properties:
        events:
          items:
            $ref: '#/components/schemas/AuditEvent'
          type: array
          title: Events
        count:
          type: integer
          title: Count
      type: object
      required:
      - events
      - count
      title: AuditListResponse
    WebhookSubscriptionView:
      properties:
        id:
          type: string
          title: Id
        npis:
          items:
            type: string
          type: array
          title: Npis
        webhook_url:
          type: string
          title: Webhook Url
        events:
          items:
            type: string
          type: array
          title: Events
        status:
          type: string
          title: Status
        created_at:
          type: string
          title: Created At
        expires_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Expires At
        delivery_count:
          type: integer
          title: Delivery Count
          default: 0
        last_delivery_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Delivery At
        last_delivery_success:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Last Delivery Success
        signing_secret_rotated_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Signing Secret Rotated At
      type: object
      required:
      - id
      - npis
      - webhook_url
      - events
      - status
      - created_at
      title: WebhookSubscriptionView
    MyMcpUsageResponse:
      properties:
        tier:
          type: string
          title: Tier
        limits:
          $ref: '#/components/schemas/TierLimits'
        calls_today:
          type: integer
          title: Calls Today
        calls_this_month:
          type: integer
          title: Calls This Month
        calls_last_24h:
          type: integer
          title: Calls Last 24H
        by_tool:
          additionalProperties:
            type: integer
          type: object
          title: By Tool
        by_client:
          additionalProperties:
            type: integer
          type: object
          title: By Client
        last_call_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Call At
        first_call_at:
          anyOf:
          - type: string
          - type: 'null'
          title: First Call At
          description: When you first used the API. Useful for 'using Licensy for N days' messaging.
      type: object
      required:
      - tier
      - limits
      - calls_today
      - calls_this_month
      - calls_last_24h
      - by_tool
      - by_client
      title: MyMcpUsageResponse
    TierLimits:
      properties:
        day:
          anyOf:
          - type: integer
          - type: 'null'
          title: Day
        month:
          anyOf:
          - type: integer
          - type: 'null'
          title: Month
      type: object
      title: TierLimits
    AllowedIpsResponse:
      properties:
        allowed_ips:
          items:
            type: string
          type: array
          title: Allowed Ips
        enabled:
          type: boolean
          title: Enabled
      type: object
      required:
      - enabled
      title: AllowedIpsResponse
    DeleteAccountRequest:
      properties:
        confirm_email:
          type: string
          title: Confirm Email
          description: Type your own account email here. Must match exactly — guards against accidental deletion.
      type: object
      required:
      - confirm_email
      title: DeleteAccountRequest
    TestFireResponse:
      properties:
        delivered:
          type: boolean
          title: Delivered
        status_code:
          type: integer
          title: Status Code
        latency_ms:
          type: integer
          title: Latency Ms
        response_body_snippet:
          anyOf:
          - type: string
          - type: 'null'
          title: Response Body Snippet
        signature_sent:
          type: string
          title: Signature Sent
        payload_sent:
          additionalProperties: true
          type: object
          title: Payload Sent
      type: object
      required:
      - delivered
      - status_code
      - latency_ms
      - signature_sent
      - payload_sent
      title: TestFireResponse
    WebhookSubscriptionPatch:
      properties:
        npis:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Npis
          description: Full replacement list of NPIs to watch (omit to leave unchanged).
        events:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Events
          description: 'Event types to receive. Allowed: status_change, expiration_warning_60d, expiration_warning_30d.'
      type: object
      title: WebhookSubscriptionPatch
    AuditEvent:
      properties:
        id:
          type: string
          title: Id
        type:
          type: string
          title: Type
        description:
          type: string
          title: Description
        details:
          additionalProperties: true
          type: object
          title: Details
        created_at:
          type: string
          title: Created At
      type: object
      required:
      - id
      - type
      - description
      - created_at
      title: AuditEvent
    FeedbackRequest:
      properties:
        kind:
          type: string
          title: Kind
          description: 'One of: bug, feature, question, other'
        body:
          type: string
          maxLength: 5000
          minLength: 4
          title: Body
        surface:
          anyOf:
          - type: string
          - type: 'null'
          title: Surface
          description: Where in the app the feedback was submitted from (e.g. '/dashboard')
      type: object
      required:
      - kind
      - body
      title: FeedbackRequest
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    WebhookDeliveryView:
      properties:
        id:
          type: string
          title: Id
        subscription_id:
          type: string
          title: Subscription Id
        event_type:
          type: string
          title: Event Type
        status:
          type: string
          title: Status
        attempt_count:
          type: integer
          title: Attempt Count
        last_response_status:
          anyOf:
          - type: integer
          - type: 'null'
          title: Last Response Status
        last_attempted_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Attempted At
        delivered_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Delivered At
        next_attempt_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Next Attempt At
        created_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Created At
        last_response_body:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Response Body
      type: object
      required:
      - id
      - subscription_id
      - event_type
      - status
      - attempt_count
      title: WebhookDeliveryView
    AllowedIpsRequest:
      properties:
        allowed_ips:
          items:
            type: string
          type: array
          title: Allowed Ips
          description: 'List of IPs or CIDR ranges. Empty list disables the allowlist. Examples: ''203.0.113.42'', ''10.0.0.0/24'', ''2001:db8::/32''.'
      type: object
      title: AllowedIpsRequest
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer