OpenGov Co Terms API

openapi: 3.2.0
info:
  title: OpenGov Purchase Order Co Terms API
  version: 1.0.0
  description: API for managing purchase orders, line items, splits, and vendors.
servers:
- url: https://api-purchase-order.procurement.opengov.com
  description: Production
- url: https://api-purchase-order.procurement.ogstaging.us
  description: Staging
- url: https://api-purchase-order.procurement.ogintegration.us
  description: Integration
security:
- platformApiKey: []
- platformBearerToken: []
tags:
- name: coTerms
paths:
  /api/v1/po/entities/{entityId}/change-orders/{coId}/terms:
    get:
      tags:
      - coTerms
      operationId: coTerms.getCoTerms
      parameters:
      - name: entityId
        in: path
        schema:
          type: string
          description: The UUID of the Platform entity
          default: 04eb277c-f9cd-42b0-9610-0f068f6aaea1
          format: uuid
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        required: true
        description: The UUID of the Platform entity
      - name: coId
        in: path
        schema:
          $ref: '#/components/schemas/NumberFromString'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                properties:
                  data:
                    type: object
                    required:
                    - terms
                    - attachmentIds
                    - attachments
                    - baselineBodyHtml
                    - baselineBodyPlain
                    properties:
                      terms:
                        anyOf:
                        - $ref: '#/components/schemas/PoTermsModel.json'
                        - type: 'null'
                      attachmentIds:
                        type: array
                        items:
                          type: number
                      attachments:
                        type: array
                        items:
                          type: object
                          required:
                          - id
                          - fileName
                          - mimeType
                          - sizeBytes
                          properties:
                            id:
                              type: number
                            fileName:
                              type: string
                            mimeType:
                              type: string
                            sizeBytes:
                              type: number
                          additionalProperties: false
                      baselineBodyHtml:
                        type: string
                      baselineBodyPlain:
                        type: string
                    additionalProperties: false
                additionalProperties: false
        '400':
          description: The request did not match the expected schema
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 400
                  code:
                    type: string
                    description: Machine-readable error code
                    example: ValidationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: The request body failed validation.
                  fieldErrors:
                    type: array
                    description: Per-field validation errors (present for 400 validation errors)
                    items:
                      type: object
                      properties:
                        parameter:
                          type: string
                          description: Dot-path to the field
                          example: lineItems.0.lineItemSplits.1
                        detail:
                          type: string
                          description: Human-readable validation message
                          example: 'Account 101-5100 has insufficient budget: requested 500.00, available 200.00'
                        code:
                          type: string
                          description: Machine-readable rule identifier
                          example: BUDGET_INSUFFICIENT
                        data:
                          type: object
                          description: Structured context for the error (account codes, amounts, IDs, etc.)
                          additionalProperties: true
                          example:
                            accountNumber: 101-5100
                            accountPseudoKey: GF-101-5100
                            requestedAmount: 500
                            availableAmount: 200
                      required:
                      - parameter
                      - detail
                required:
                - status
                - code
                - detail
        '401':
          description: AuthError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 401
                  code:
                    type: string
                    description: Machine-readable error code
                    example: AuthenticationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: Authentication is required to access this resource.
                required:
                - status
                - code
                - detail
        '403':
          description: UnauthorizedError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 403
                  code:
                    type: string
                    description: Machine-readable error code
                    example: AuthorizationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: You do not have permission to perform this action.
                required:
                - status
                - code
                - detail
        '404':
          description: EntityNotFoundError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 404
                  code:
                    type: string
                    description: Machine-readable error code
                    example: PurchaseOrderNotFound
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: Purchase order with id 123 was not found.
                required:
                - status
                - code
                - detail
        '500':
          description: InfrastructureError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 500
                  code:
                    type: string
                    description: Machine-readable error code
                    example: InternalServerError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: An unexpected error occurred while processing your request. Please try again later.
                required:
                - status
                - code
                - detail
      description: 'Returns the CO-scoped Terms & Conditions snapshot (body + selected attachments) plus the baseline body captured from the parent PO at CO-create time. Returns `terms: null` only for COs created before the snapshot feature shipped.'
      summary: Get Terms & Conditions for a Change Order
    put:
      tags:
      - coTerms
      operationId: coTerms.upsertCoTerms
      parameters:
      - name: entityId
        in: path
        schema:
          type: string
          description: The UUID of the Platform entity
          default: 04eb277c-f9cd-42b0-9610-0f068f6aaea1
          format: uuid
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        required: true
        description: The UUID of the Platform entity
      - name: coId
        in: path
        schema:
          $ref: '#/components/schemas/NumberFromString'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                properties:
                  data:
                    type: object
                    required:
                    - terms
                    - attachmentIds
                    - attachments
                    - baselineBodyHtml
                    - baselineBodyPlain
                    properties:
                      terms:
                        $ref: '#/components/schemas/PoTermsModel.json'
                      attachmentIds:
                        type: array
                        items:
                          type: number
                      attachments:
                        type: array
                        items:
                          type: object
                          required:
                          - id
                          - fileName
                          - mimeType
                          - sizeBytes
                          properties:
                            id:
                              type: number
                            fileName:
                              type: string
                            mimeType:
                              type: string
                            sizeBytes:
                              type: number
                          additionalProperties: false
                      baselineBodyHtml:
                        type: string
                      baselineBodyPlain:
                        type: string
                    additionalProperties: false
                additionalProperties: false
        '400':
          description: The request did not match the expected schema
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 400
                  code:
                    type: string
                    description: Machine-readable error code
                    example: ValidationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: The request body failed validation.
                  fieldErrors:
                    type: array
                    description: Per-field validation errors (present for 400 validation errors)
                    items:
                      type: object
                      properties:
                        parameter:
                          type: string
                          description: Dot-path to the field
                          example: lineItems.0.lineItemSplits.1
                        detail:
                          type: string
                          description: Human-readable validation message
                          example: 'Account 101-5100 has insufficient budget: requested 500.00, available 200.00'
                        code:
                          type: string
                          description: Machine-readable rule identifier
                          example: BUDGET_INSUFFICIENT
                        data:
                          type: object
                          description: Structured context for the error (account codes, amounts, IDs, etc.)
                          additionalProperties: true
                          example:
                            accountNumber: 101-5100
                            accountPseudoKey: GF-101-5100
                            requestedAmount: 500
                            availableAmount: 200
                      required:
                      - parameter
                      - detail
                required:
                - status
                - code
                - detail
        '401':
          description: AuthError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 401
                  code:
                    type: string
                    description: Machine-readable error code
                    example: AuthenticationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: Authentication is required to access this resource.
                required:
                - status
                - code
                - detail
        '403':
          description: UnauthorizedError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 403
                  code:
                    type: string
                    description: Machine-readable error code
                    example: AuthorizationError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: You do not have permission to perform this action.
                required:
                - status
                - code
                - detail
        '404':
          description: EntityNotFoundError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 404
                  code:
                    type: string
                    description: Machine-readable error code
                    example: PurchaseOrderNotFound
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: Purchase order with id 123 was not found.
                required:
                - status
                - code
                - detail
        '500':
          description: InfrastructureError
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: HTTP status code
                    example: 500
                  code:
                    type: string
                    description: Machine-readable error code
                    example: InternalServerError
                  detail:
                    type: string
                    description: Human-readable error description. For 400 ValidationError with exactly one field issue, matches that field's `detail`; otherwise a summary (e.g. multiple validation issues).
                    example: An unexpected error occurred while processing your request. Please try again later.
                required:
                - status
                - code
                - detail
      description: Updates the CO-scoped T&C body and replaces its attachment selection atomically. Only allowed while the CO is in Draft. Attachment IDs must be CO-scoped T&C attachments (same PO and `poChangeOrderId` = this CO). Enforces 5-attachment cap, 2MB per-file limit, and MIME allow-list.
      summary: Upsert Terms & Conditions for a Change Order
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - bodyHtml
              - attachmentIds
              properties:
                bodyHtml:
                  type: string
                attachmentIds:
                  type: array
                  items:
                    type: number
              additionalProperties: false
        required: true
components:
  schemas:
    DateTimeUtc:
      type: string
      description: a string to be decoded into a DateTime.Utc
    PoTermsModel.json:
      type: object
      required:
      - id
      - poPurchaseOrderId
      - createdAt
      - createdBy
      - updatedAt
      - updatedBy
      properties:
        id:
          type: number
        poPurchaseOrderId:
          type: number
        poChangeOrderId:
          anyOf:
          - type: number
          - type: 'null'
        bodyHtml:
          type: string
        bodyPlain:
          type: string
        baselineBodyHtml:
          type: string
        baselineBodyPlain:
          type: string
        source:
          $ref: '#/components/schemas/PoTermsSource'
        createdAt:
          $ref: '#/components/schemas/DateTimeUtc'
        createdBy:
          type: string
          description: a Universally Unique Identifier
          format: uuid
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        updatedAt:
          $ref: '#/components/schemas/DateTimeUtc'
        updatedBy:
          type: string
          description: a Universally Unique Identifier
          format: uuid
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        deletedAt:
          anyOf:
          - type: string
          - type: 'null'
        deletedBy:
          anyOf:
          - type: string
            description: a Universally Unique Identifier
            format: uuid
            pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
          - type: 'null'
      additionalProperties: false
      title: PoTermsModel.json
    PoTermsSource:
      type: string
      enum:
      - USER
      - ATLAS
      title: Provenance of a PO terms row
    NumberFromString:
      type: string
      description: a string to be decoded into a number
  securitySchemes:
    platformApiKey:
      description: OpenGov Platform API Key
      type: apiKey
      name: Authorization
      in: header
    platformBearerToken:
      type: http
      scheme: bearer