Clarity Widget Catalog Admin API

openapi: 3.2.0
info:
  title: Fast Widget Catalog Admin API
  version: 0.1.0
tags:
- name: widget_catalog_admin
paths:
  /api/v1/admin/projects/{project_id}/widget-catalog:
    get:
      tags:
      - widget_catalog_admin
      summary: List Widgets
      description: The project's catalog, newest first.
      operationId: list_widgets_api_v1_admin_projects__project_id__widget_catalog_get
      security:
      - HTTPBearer: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WidgetListResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
      - widget_catalog_admin
      summary: Create Widget
      description: 'Create a widget from raw HTML.


        The server wraps the markup in the shared figure shell (CSP deny-all network, design

        tokens, resize bridge and the ``window.voc.*`` SDK — every widget is live). Content

        rules are enforced with actionable 400s (size cap, credentials scan, navigation lint)

        — fix the markup and retry, exactly like copilot''s ``update_canvas`` loop.'
      operationId: create_widget_api_v1_admin_projects__project_id__widget_catalog_post
      security:
      - HTTPBearer: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdminCreateWidgetRequest'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WidgetResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v1/admin/projects/{project_id}/widget-catalog/{widget_id}:
    get:
      tags:
      - widget_catalog_admin
      summary: Get Widget
      description: One widget with a fresh signed ``render_url`` (admin preview / verification).
      operationId: get_widget_api_v1_admin_projects__project_id__widget_catalog__widget_id__get
      security:
      - HTTPBearer: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      - name: widget_id
        in: path
        required: true
        schema:
          type: integer
          title: Widget Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WidgetRenderResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
      - widget_catalog_admin
      summary: Update Widget
      description: 'Partial update. New ``html`` re-validates, re-wraps and bumps ``version`` — every

        report element pinning this widget follows on its next render (no re-pin needed).'
      operationId: update_widget_api_v1_admin_projects__project_id__widget_catalog__widget_id__put
      security:
      - HTTPBearer: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      - name: widget_id
        in: path
        required: true
        schema:
          type: integer
          title: Widget Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdminUpdateWidgetRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WidgetResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - widget_catalog_admin
      summary: Delete Widget
      description: 'Soft-delete. Elements still pinning the widget render the "Figure unavailable"

        notice (same fallback as an orphaned canvas figure).'
      operationId: delete_widget_api_v1_admin_projects__project_id__widget_catalog__widget_id__delete
      security:
      - HTTPBearer: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: integer
          title: Project Id
      - name: widget_id
        in: path
        required: true
        schema:
          type: integer
          title: Widget Id
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    WidgetListResponse:
      properties:
        widgets:
          items:
            $ref: '#/components/schemas/WidgetResponse'
          type: array
          title: Widgets
      type: object
      required:
      - widgets
      title: WidgetListResponse
    WidgetResponse:
      properties:
        id:
          type: integer
          title: Id
        kind:
          type: string
          title: Kind
        name:
          type: string
          title: Name
        description:
          anyOf:
          - type: string
          - type: 'null'
          title: Description
        mode:
          type: string
          title: Mode
        version:
          type: integer
          title: Version
        sha256:
          type: string
          title: Sha256
        size_bytes:
          type: integer
          title: Size Bytes
        wrapper_version:
          anyOf:
          - type: integer
          - type: 'null'
          title: Wrapper Version
        source_artifact_id:
          anyOf:
          - type: integer
          - type: 'null'
          title: Source Artifact Id
        created_by:
          anyOf:
          - type: integer
          - type: 'null'
          title: Created By
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
      - id
      - kind
      - name
      - mode
      - version
      - sha256
      - size_bytes
      - created_at
      - updated_at
      title: WidgetResponse
    WidgetRenderResponse:
      properties:
        widget_id:
          type: integer
          title: Widget Id
        mode:
          type: string
          title: Mode
        version:
          type: integer
          title: Version
        sha256:
          type: string
          title: Sha256
        size_bytes:
          type: integer
          title: Size Bytes
        render_url:
          type: string
          title: Render Url
      type: object
      required:
      - widget_id
      - mode
      - version
      - sha256
      - size_bytes
      - render_url
      title: WidgetRenderResponse
      description: 'A short-lived signed URL for the wrapped document — the iframe ``src``.


        Field names mirror the copilot ``HtmlArtifactResponse`` (``render_url`` is what the

        frontend figure component consumes) so the report renderer treats both sources alike.'
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    AdminUpdateWidgetRequest:
      properties:
        name:
          anyOf:
          - type: string
            maxLength: 200
            minLength: 1
          - type: 'null'
          title: Name
        description:
          anyOf:
          - type: string
            maxLength: 2000
          - type: 'null'
          title: Description
        html:
          anyOf:
          - type: string
          - type: 'null'
          title: Html
      type: object
      title: AdminUpdateWidgetRequest
      description: 'Partial update. New ``html`` re-validates, re-wraps with the live shell and bumps

        ``version`` — every pinned copy follows on its next render. That is also how a legacy

        static widget becomes live; there is no ``mode`` field.'
    AdminCreateWidgetRequest:
      properties:
        name:
          type: string
          maxLength: 200
          minLength: 1
          title: Name
          description: Catalog display name
        html:
          type: string
          title: Html
          description: Raw figure HTML; wrapped server-side (never pre-wrap it)
        description:
          anyOf:
          - type: string
            maxLength: 2000
          - type: 'null'
          title: Description
        user:
          anyOf:
          - type: string
          - type: 'null'
          title: User
          description: Owner's email for audit (`created_by`), same contract as report creation; 404 when unknown
        file_name:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: File Name
          description: S3 object name; default widget.html
      type: object
      required:
      - name
      - html
      title: AdminCreateWidgetRequest
      description: 'Create a catalog widget from raw HTML (admin contour).


        ``html`` is the RAW figure markup — the server wraps it in the shared shell (CSP,

        design tokens, resize bridge and the ``window.voc.*`` SDK). Every widget is live;

        there is no ``mode`` field (a stale client still sending one is ignored). Authoring

        contract (limits, the voc.* method list, the D3 asset rule) is the same as the

        copilot canvas figure contract.'
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
    HTTPBasic:
      type: http
      scheme: basic