medianfi-com Metrics API

openapi: 3.2.0
info:
  title: Median Metrics API
  version: 0.1.0
  description: Production-grade Node.js + Express API starter template
  license:
    name: Proprietary
servers:
- url: /api/v1
security: []
tags:
- name: Metrics
paths:
  /companies/{companyId}/metrics/cac:
    parameters:
    - $ref: '#/components/parameters/companyId'
    get:
      operationId: getCacDetail
      summary: Entity-scoped CAC detail for an analysis period
      description: 'Customer acquisition cost for one concrete legal entity and an explicit analysis period (default: year to date). The numerator is explicit CAC-tagged sales & marketing spend (GL classification is reconciliation evidence, never a tag); the denominator is canonical new paying customers, available only with continuous subscription history from before the period start. When `available` is false, `reason` names why and no numeric zero is fabricated. The top-level `available` always equals `metric.available`: a snapshot can compute and still have no ratio (`insufficient_inputs`), in which case `period` and `breakdown` are still returned as evidence while `metric.value` is null.'
      tags:
      - Metrics
      security:
      - bearerAuth: []
      parameters:
      - name: entityId
        in: query
        description: Concrete legal entity; defaults to the caller's single authorized entity.
        schema:
          type: string
          format: uuid
      - name: period
        in: query
        description: Named analysis period (default ytd). Mutually exclusive with startDate/endDate.
        schema:
          type: string
          enum:
          - ytd
          - month
      - name: startDate
        in: query
        schema:
          type: string
          format: date
      - name: endDate
        in: query
        schema:
          type: string
          format: date
      responses:
        '200':
          description: Availability-discriminated CAC detail payload
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    type: object
                    required:
                    - enabled
                    - entityId
                    - available
                    - reason
                    - metric
                    - trend
                    properties:
                      enabled:
                        type: boolean
                        description: 'Rollout stamp for saas_metrics_engines. Informational ONLY: metric bodies are identical at any flag state (F07). It does not gate the correction write path.

                          '
                      entityId:
                        type: string
                        format: uuid
                      available:
                        type: boolean
                      reason:
                        oneOf:
                        - $ref: '#/components/schemas/CacUnavailableReason'
                        - type: 'null'
                      metric:
                        $ref: '#/components/schemas/CacMetric'
                      period:
                        oneOf:
                        - $ref: '#/components/schemas/CacAnalysisPeriod'
                        - type: 'null'
                      breakdown:
                        oneOf:
                        - $ref: '#/components/schemas/CacBreakdown'
                        - type: 'null'
                      trend:
                        type: array
                        description: 'Up to 12 persisted snapshots for this entity, newest first. DENSITY IS A ROLLOUT ARTIFACT, not a claim: the complete-month rows come from the CAC backfill worker, which only visits companies the saas_metrics_engines candidate list names, so a company outside it carries only the windows that were actually requested.

                          '
                        items:
                          $ref: '#/components/schemas/CacTrendRow'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          $ref: '#/components/responses/ValidationError'
  /companies/{companyId}/metrics/cac/classifications:
    parameters:
    - $ref: '#/components/parameters/companyId'
    post:
      operationId: recordCacClassification
      summary: Record an is/is-not sales & marketing correction
      description: Teaches the CAC tagger whether a vendor is sales & marketing spend for one concrete legal entity. Requires the founder/admin capability (company role admin or owner). Writes an entity-scoped cac_vendor_rule (confidence drifts on repeat corrections) plus a durable append-only audit event. Provide a merchant or a transactionId; the entity resolves from the entityId query parameter or the caller's single authorized entity.
      tags:
      - Metrics
      security:
      - bearerAuth: []
      parameters:
      - name: entityId
        in: query
        description: Concrete legal entity; defaults to the caller's single authorized entity.
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - isSm
              properties:
                isSm:
                  type: boolean
                merchant:
                  type: string
                  minLength: 3
                  maxLength: 500
                transactionId:
                  type: string
                  format: uuid
      responses:
        '200':
          description: The learned or updated entity-scoped vendor rule
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          $ref: '#/components/responses/ValidationError'
components:
  schemas:
    CacUnavailableReason:
      type: string
      description: 'Customer-safe reason for an unavailable CAC. `truncated` (a capped scan) and `failed` (a thrown read, added by the /metrics/saas assembler) are the FAILURE class the UI renders as an explicit unavailable state (master-index pin P4); every other value is honest absence.

        '
      enum:
      - insufficient_history
      - source_not_authorized
      - mixed_currency
      - entity_scope_unavailable
      - insufficient_inputs
      - truncated
      - failed
    ProblemDetail:
      type: object
      properties:
        type:
          type: string
        title:
          type: string
          description: 'For application errors, a stable UPPER_SNAKE machine code (for example `NOT_FOUND`, `FORECAST_NOT_FOUND`, `VALIDATION_ERROR`). Clients branch on this, never on `detail` wording. A few transport level responses use a short human title instead.

            '
        status:
          type: integer
        detail:
          type: string
          description: 'Human-readable explanation; correlate a failure with `traceId`. A NOT_FOUND-family 404 names the resource type (for example "Company not found"), not its id. Some legacy messages still include an id (tracked in #2666).

            '
        instance:
          type: string
        traceId:
          type: string
        retryAfter:
          type: integer
          minimum: 0
          description: Whole seconds until retry is allowed for a 429 response
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
        extensions:
          type: object
          additionalProperties: true
    CacMetric:
      type: object
      description: 'The CAC headline. Served under the `cac` key of GET /metrics/saas and as `metric` on GET /metrics/cac. `value` is the LEGACY major-unit float kept for old clients; new consumers read `cacMoney`, the shared ExactMoney shape (master-index pin P2). The money authority is the ENTITY''s functional currency, which can differ from the envelope''s subscription billing currency — render from `currency`/`minorUnitExponent` here, never from the envelope''s. An unavailable metric carries `reason` and never a numeric zero.

        '
      required:
      - available
      - value
      - smSpendCents
      - newCustomers
      properties:
        available:
          type: boolean
        value:
          type:
          - number
          - 'null'
          description: Legacy major units (cacCents / 100). Prefer `cacMoney`.
        smSpendCents:
          type:
          - integer
          - 'null'
        newCustomers:
          type:
          - integer
          - 'null'
        currency:
          type:
          - string
          - 'null'
          pattern: ^[A-Z]{3}$
        minorUnitExponent:
          type:
          - integer
          - 'null'
        cacMoney:
          oneOf:
          - $ref: '#/components/schemas/ExactMoney'
          - type: 'null'
        smSpendMoney:
          oneOf:
          - $ref: '#/components/schemas/ExactMoney'
          - type: 'null'
        reason:
          oneOf:
          - $ref: '#/components/schemas/CacUnavailableReason'
          - type: 'null'
    ExactMoney:
      type: object
      description: 'Exact money value: signed integer minor units as a string (never a float), with explicit currency and minor-unit exponent.

        '
      required:
      - amountMinor
      - currency
      - minorUnitExponent
      properties:
        amountMinor:
          type: string
          pattern: ^-?\d+$
          description: Signed integer minor units, e.g. "80000" = $800.00 at exponent 2.
        currency:
          type: string
          pattern: ^[A-Z]{3}$
        minorUnitExponent:
          type: integer
    CacBreakdown:
      type: object
      description: 'Evidence behind the headline, all in the entity''s functional currency. `glSmSpendCents` is the naive GL 64xx bucket — EVIDENCE for reconciling against the explicit tags, never itself a tag — and carries the same currency authority and refund sign convention as `smSpendCents`, so `reconciliationDeltaCents` is a comparable figure.

        '
      required:
      - smSpendCents
      - glSmSpendCents
      - newCustomers
      - currency
      - minorUnitExponent
      properties:
        smSpendCents:
          type: integer
        glSmSpendCents:
          type: integer
        reconciliationDeltaCents:
          type: integer
        taggedTxnCount:
          type: integer
        newCustomers:
          type: integer
        cacCents:
          type:
          - integer
          - 'null'
        currency:
          type: string
          pattern: ^[A-Z]{3}$
        minorUnitExponent:
          type: integer
        sourceGeneration:
          type:
          - string
          - 'null'
        evidenceSha256:
          type:
          - string
          - 'null'
        source:
          type: string
        computedAt:
          type: string
          format: date-time
    CacTrendRow:
      type: object
      required:
      - period
      - cacCents
      - smSpendCents
      - newCustomers
      properties:
        period:
          type: string
        cacCents:
          type:
          - integer
          - 'null'
        smSpendCents:
          type: integer
        newCustomers:
          type: integer
    CacAnalysisPeriod:
      type: object
      description: 'The resolved analysis window. `period=month` is CLAMPED to today, so a partial month is never keyed (or served) under the complete-month end.

        '
      required:
      - start
      - end
      - label
      properties:
        start:
          type: string
          format: date
        end:
          type: string
          format: date
        label:
          type: string
  responses:
    Forbidden:
      description: Insufficient permissions or not a company member
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
    Unauthorized:
      description: Authentication required
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
    ValidationError:
      description: Request failed validation
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
  parameters:
    companyId:
      name: companyId
      in: path
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    serviceApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Persistent credential for the configured cloud-bookkeeping service principal. The key must carry accountant:* and is accepted only on accountant operations that explicitly list this scheme. Ordinary API keys, and service keys presented to bearer-only operations, are denied.

        '
    refreshSessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_refresh
      description: 'Exact production HttpOnly refresh-session cookie. Local non-secure development uses median_refresh.

        '
    passkeyEnrollmentGrantCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_passkey_enrollment
      description: 'Exact production HttpOnly passkey-enrollment grant cookie. Local non-secure development uses median_passkey_enrollment.

        '
    webAuthnCeremonyCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_webauthn
      description: 'Exact production HttpOnly WebAuthn ceremony cookie. Local non-secure development uses median_webauthn.

        '
x-median-quarantined-authorities:
  decision: ADR-0001-model-a
  runtimeStatus: unmounted
  description: 'Migrations 267-272 modeled legal entities as separate company tenants. These paths are not runtime API authority while their preserved accounting math is re-keyed to legal entities inside one company workspace.

    '
  paths:
  - /companies/{companyId}/consolidation-groups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups/{rollupId}
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments/{adjustmentId}
x-median-demo-parity-customer-surface:
  runtimeStatus: mounted-lifecycle-only
  description: 'v2 customer-app capabilities available to JWT-authenticated members of any active or test company — the v2 app is the product, not a rollout cohort, so no allowlist applies to the markerless path. Production customer calls omit X-Median-App-Surface. Test-company calls may carry X-Median-App-Surface: qa to select the QA bundle; that marker branch alone still requires membership in CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS. An API key, unknown marker, malformed company id, inactive company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract. The held surfaces riding these prefixes (AR/AP, Forecast, Insights) carry their own additional allowlist gate — see x-median-forecast-hold and x-median-ar-ap-hold.

    '
  headerContract: '#/components/parameters/demoParityCustomerAppSurface'
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
  - /companies/{companyId}/entities
  - /companies/{companyId}/currencies
  - /companies/{companyId}/reporting-scopes
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/rollups
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/translation-adjustments
  - /companies/{companyId}/presentation-report-snapshots
  - /companies/{companyId}/reporting-trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/intercompany
  - /companies/{companyId}/weekly-email
  - /companies/{companyId}/forecast
  - /companies/{companyId}/books
  - /companies/{companyId}/sub-ledgers
x-median-forecast-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Forecast is held. Beyond the lifecycle-only customer surface above, every operation under the prefix below also requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS — the one operator-set list that opens AR/AP, Forecast and Insights (the legacy CUSTOMER_APP_FORECAST_COMPANY_IDS variable is no longer consulted). It is empty by default, so the v2 rollout alone never exposes Forecast. A company off the list receives the same hidden-resource 404 contract as one for which the surface does not exist. The auth-context featureFlags key `forecast` mirrors this verdict for the customer app shell.

    '
  featureFlag: forecast
  routePrefixes:
  - /companies/{companyId}/forecast
x-median-ar-ap-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Receivables/Payables are held behind TWO required authorities. Beyond the lifecycle-only customer surface above, every operation under the prefixes below requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS (requireDemoParityAllowlistedCompany) AND to satisfy the company_subledger_flags conversion chain (requireArApItemsEnabled — the same authority the public /pay page, aging and the accountant portal consult); failing either answers the opaque 404. The auth-context featureFlags key `arApItems` mirrors exactly that conjunction, resolved server-side, so the customer shell hides the Receivables/Payables nav and pages instead of offering menu entries these routes 404. Default is FALSE for every company while the list is empty or the conversion has not run.

    '
  featureFlag: arApItems
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
x-median-demo-parity-qa-only:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Strict test-company-only routes. Every interactive call requires X-Median-App-Surface: qa in addition to JWT authentication, the server allowlist, and persisted client_status=test. A copied header, API key, active company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract.

    '
  headerContract: '#/components/parameters/qaAppSurface'
  routePrefixes:
  - /companies/{companyId}/gl-accounts/{id}/monetary-classification
  - /companies/{companyId}/fx-account-roles
  - /companies/{companyId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/gl-accounts/{id}/monetary-classification
  - /accountant/companies/{customerId}/fx-account-roles
  - /accountant/companies/{customerId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/ar/{id}
  - /accountant/companies/{customerId}/ap/{id}
x-median-onboarding-v3-surface:
  runtimeStatus: promoted
  promotionFlag: ONBOARDING_V3_QA_ONLY=false
  description: 'Promoted. The deployment this contract describes runs ONBOARDING_V3_QA_ONLY=false, so none of the onboarding-v3 auth, pricing, or setup paths below requires X-Median-App-Surface: qa. An unmarked request is served and reaches ordinary authentication, so an unauthenticated call now answers 401 rather than the hidden-resource 404. Mounting is still conditional: with ONBOARDING_V3_ENABLED false every path below returns the hidden-resource 404 before body parsing or authentication. The header stays defined and is still honoured, because a deployment left at ONBOARDING_V3_QA_ONLY=true keeps requiring it on every path below and 404s unmarked traffic; setting that flag back to true is the rollback. On either setting the header is a pre-company bundle marker, never tenant authorization.

    '
  headerContract: '#/components/parameters/onboardingV3QaSurface'
  routePaths:
  - /auth/otp/start
  - /auth/otp/verify
  - /auth/passkeys/register/options
  - /auth/passkeys/register/verify
  - /auth/passkeys/assert/options
  - /auth/passkeys/assert/verify
  - /onboarding/v3/quote
  - /onboarding/v3/offer/resolve
  - /onboarding/v3/flow
  - /onboarding/v3/setup-intent
  - /onboarding/v3/subscribe
  - /onboarding/v3/test-account-activation
  - /onboarding/v3/checkout-session
  - /onboarding/v3/checkout-session/complete
  - /onboarding/v3/setup-state
  - /onboarding/v3/delegate-invites
  - /onboarding/v3/delegate-invites/{inviteId}
  - /onboarding/v3/delegate/resolve
  - /onboarding/v3/delegate
  - /onboarding/v3/task-context
  - /onboarding/v3/delegate/task-context
  - /onboarding/v3/banks/plaid/link-token
  - /onboarding/v3/banks/plaid/exchange
  - /onboarding/v3/banks/commit
  - /onboarding/v3/documents/google-workspace/auth-url
  - /onboarding/v3/documents/google-workspace/callback
  - /onboarding/v3/books/quickbooks/auth-url
  - /onboarding/v3/books/quickbooks/callback
  - /onboarding/v3/books/xero/auth-url
  - /onboarding/v3/books/xero/callback
  - /onboarding/v3/welcome-call
  - /onboarding/v3/welcome-call/embed
  - /onboarding/v3/books-progress
  - /onboarding/v3/books/open
  - /companies/{companyId}/onboarding/v3/questions
  - /companies/{companyId}/onboarding/v3/questions/{questionId}/answer
  - /companies/{companyId}/onboarding/v3/review-items