Prewave Collections - Management API
Public API for managing collections in Prewave's supply chain network. Collections are used to organize and group suppliers (targets) in your supply chain.
OpenAPI Specification
openapi: 3.0.1
info:
title: Public Prewave Actions Collections - Management API
description: 'Documentation of the Public Prewave API.
## What''s New
### Q1 2026 — Supplier Management, User Management, Actions and Feed
This quarter introduces major v2 upgrades, expanded administrative capabilities, and the new Actions API.
- **Core Releases:** Deployed Supplier Management API v2 and Feed API v2, alongside the all-new Actions API.
- **Enhanced Functionality:** Added robust identifier management, granular user and role configuration, and endpoints for managing supplier connection contacts.
- ⚠️ **Required Migration:** Legacy v1 endpoints for Suppliers and Sites Upsert have been deprecated. Developers must migrate existing integrations to v2 by **May 31, 2027** (original deadline was December 31, 2026).
📖 **[Read the Q1 2026 changelog](https://docs.prewave.com/en/articles/699847-q1-2026-public-api-updates)**
### Q2 2026 — Supplier Screening and External Scores
We have expanded our v2 documentation to include comprehensive integration guidance for supplier screening and validation workflows and identifier-based external score ingestion.
- **New Capabilities:** Added support for optional post-onboarding screening and validation during the create event.
- **External Scores:** Batch POST for multiple supplier sites, per-site history GET, and event-type discovery GET (`/public/v1/scores/externals` and `/public/v1/scores/externals/event-types`). Documented in OpenAPI when enabled for your organization.
- **Developer Resources:** Published new integration examples and detailed identifier validation rules to streamline your implementation process.
📖 **[Read the Q2 2026 changelog](https://docs.prewave.com/en/articles/699849-q2-2026-public-api-updates)**
### Q3 2026 — Scores Webhooks
To support event-driven architectures and eliminate the need for continuous API polling, we are introducing webhooks for score state changes later this year.
- **Event-Driven Architecture:** Register webhook URLs to receive real-time HTTP payloads whenever a supplier''s score updates, so you can drive immediate mitigation responses without polling the API.
- **Availability:** Comprehensive OpenAPI specifications and payload schemas will be published closer to the release date.
- **Note:** Schemas and behaviors are subject to refinement prior to general availability.
Documentation updates will be provided prior to release.
### Q4 2026 — Feed V2
We are enhancing Feed API v2 with additional capabilities on top of the existing `GET /public/v2/feed` contract (see Q1 changelog and OpenAPI for the current Feed v2 integration).
- **Availability:** Details will be announced before release.
- **Note:** Schemas and behaviors are subject to refinement prior to the official release.
Documentation updates will be provided prior to release.
---
## Authentication
Prewave’s public api uses *API tokens* to authenticate against our RESTful service. We’ll provide you an *API-token* that each
endpoint needs present as a http header.
To pass the token in a request, simply add it as a header-parameter with
* key = X-Auth-Token
* value = api-token
See an example in curl below where the api-token would be 12345678-90ab-cdef-1234-567890abcdef
```
curl --request GET \
--url https://REPLACE_WITH_SERVER/public/v1/target/prewave/3975230/alerts \
--header ''X-Auth-Token: 12345678-90ab-cdef-1234-567890abcdef''
```
---
## Manage API Tokens
Before you can obtain your API token, you''ll need the credentials for your API user. These credentials will be
sent to you as part of the company-onboarding. If you haven''t got your credentials yet, please reach out to
your sales-contact at Prewave or contact us via info@prewave.ai
To generate an API Token, navigate to https://www.prewave.com/management/api and log in with the
credentials of your API user. Then click at the button "Create New" and use your new api-token authentication as a header parameter.
You can create multiple API tokens and also remove existing API tokens on https://www.prewave.com/management/api.
API tokens do not expire, therefore you have to maintain the list of API tokens you are using manually.
---
## Default Rate Limits
We have two types of default rate limits. For increased access, please contact customer success.
| Type | Requests per 10 seconds | Requests per Minute |
|-----------------------------------|-------------------------|---------------------|
| GET requests | 100 | 500 |
| POST, PUT, PATCH, DELETE requests | 20 | 100 |
'
version: '1.0'
servers:
- url: https://api.prewave.com
description: Production Environment
security:
- Token authentication: []
tags:
- name: Collections - Management
description: Public API for managing collections in Prewave's supply chain network. Collections are used to organize and group suppliers (targets) in your supply chain.
paths:
/public/v1/collections/{collectionId}:
get:
tags:
- Collections - Management
summary: Get collection by ID
description: "\nRetrieve a specific collection by its unique identifier.\n\nThe collection must be accessible to the authenticated user and must be active (not deactivated). This includes:\n- Collections owned by the user\n- Collections shared with the user's teams\n- Organization-wide collections (if user has appropriate permissions)\n\n**Note**: Inactive (deactivated) collections will return `404 Not Found`, even if you have `READ` permission on them.\n\n**Response:**\nReturns a collection object with full details including nested child collections. The response includes the same fields as the list endpoint, but with the complete collection tree structure recursively populated. See the `PublicCollectionDTO` schema for complete field definitions.\n\n**Response Details:**\n- The response includes the full collection tree structure with all child collections recursively populated\n- Child collections have the same structure as the parent collection, allowing for nested hierarchies\n- Only active collections are returned (inactive/deactivated collections are filtered out)\n- Fields with null values (`parentId`, `updatedAt`) are omitted from the JSON response. This is standard JSON serialization behavior.\n\n**Required Permissions**: `ACCESS_COLLECTION` and `READ` on the collection.\n "
operationId: getCollectionById
parameters:
- name: collectionId
in: path
description: The unique identifier (ID) of the collection to retrieve. This is the same identifier returned in the `id` field when retrieving collections via GET /public/v1/collections.
required: true
schema:
type: integer
format: int32
example: 123
responses:
'200':
description: 200 OK - Collection found and returned successfully
content:
application/json:
schema:
$ref: '#/components/schemas/PublicCollectionDTO'
examples:
Collection - Single Result:
summary: Sample collection response
description: 'Note: Fields with null values (such as `updatedAt`) are omitted from the JSON response. The `parentId` field is included when it has a value.'
value: '{"id":123,"uuid":"550e8400-e29b-41d4-a716-446655440000","scope":"User","type":"Default","name":"European Suppliers","count":15,"lanes":true,"tiersEnabled":true,"parentId":100,"children":[{"id":124,"uuid":"660e8400-e29b-41d4-a716-446655440001","scope":"Customer","type":"Default","name":"Tier 1 Suppliers","count":8,"lanes":false,"tiersEnabled":true,"parentId":123,"children":[],"updatedAt":null}],"updatedAt":null}'
Collection - No Children:
summary: Collection without child collections
description: 'Note: Fields with null values (such as `parentId` and `updatedAt`) are omitted from the JSON response.'
value: '{"id":125,"uuid":"770e8400-e29b-41d4-a716-446655440002","scope":"Customer","type":"Default","name":"My Suppliers","count":45,"lanes":false,"tiersEnabled":false,"parentId":null,"children":[],"updatedAt":null}'
'404':
description: '404 Not Found - The collection with the specified ID was not found, is inactive (deactivated), or is not accessible to your organization. This may occur if: (1) the collection ID doesn''t exist, (2) the collection was deactivated (soft-deleted), (3) the collection was never accessible to your organization, or (4) the collection is inactive and filtered out by the system.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Collection not found:
summary: Collection ID does not exist or is not accessible
description: Collection not found
value: '{"code":"resource_not_found","message":"Collection with id 123 not found","solution":"Verify the collection ID and ensure it belongs to your organization"}'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 100,\n \"requestCount\": 100,\n \"limits\": [\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 500,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
put:
tags:
- Collections - Management
summary: Update an existing collection
description: "\nUpdate an existing collection's name and lanes settings.\n\nOnly active collections that the user has update permissions for can be modified. Only the collection name and lanes setting can be updated through this endpoint. Other properties like `scope` and `tiersEnabled` cannot be changed after creation.\n\n**Note**: Inactive (deactivated) collections will return `404 Not Found`, even if you have `UPDATE` permission on them.\n\n**Request:**\nOnly `name` (required) and `lanes` (optional) fields can be updated. All other fields (`scope`, `tiersEnabled`, `parentId`) cannot be changed through this endpoint. See the `PublicCollectionUpdatePayload` schema for complete field definitions.\n\n**Validation Rules:**\n- Collection names must be unique within the user's scope (duplicate names will result in `409 Conflict`)\n- The collection must exist, be active (not deactivated), and be accessible to the user\n- The user must have `UPDATE` permission on the collection\n- The user must be the collection creator OR have been granted access to the collection\n\n**What happens when you update a collection:**\n\n1. **Collection Update**: The collection's name and/or lanes setting are updated\n2. **Audit Trail**: The update is recorded in the audit log with:\n - The user who updated the collection\n - Timestamp of the operation\n - Previous and new values for changed fields\n - Reference to the public API endpoint used\n - Audit comment: \"Collection name and lanes updated via Public API\"\n\n**Important Notes:**\n\n- Collection names must be unique within the user's scope - attempting to use a duplicate name will result in `409 Conflict`\n- Only `name` and `lanes` can be updated through this endpoint - all other fields (`scope`, `type`, `tiersEnabled`, `parentId`) are preserved from the existing collection\n- The `scope` and `tiersEnabled` fields are immutable after creation\n- Inactive (deactivated) collections cannot be updated and will return `404 Not Found`\n- All collection operations are audited for compliance and tracking purposes\n\n**Required Permissions**: `MANAGE_COLLECTION` and `UPDATE` on the collection.\n "
operationId: updateCollection
parameters:
- name: collectionId
in: path
description: The unique identifier (ID) of the collection to update. This is the same identifier returned in the `id` field when retrieving collections via GET /public/v1/collections.
required: true
schema:
type: integer
format: int32
example: 123
requestBody:
description: Collection update payload. Content-Type must be `application/json`. Only `name` and `lanes` fields can be updated. All other fields (`scope`, `tiersEnabled`, `parentId`) cannot be changed through this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/PublicCollectionUpdatePayload'
examples:
Update Collection - Name and Lanes:
summary: Example updating both name and lanes
description: Update Collection - Name and Lanes
value: '{"name":"Updated Supplier Collection","lanes":false}'
Update Collection - Name Only:
summary: Example updating only the name
description: Update Collection - Name Only
value: '{"name":"Renamed Collection","lanes":false}'
Update Collection - Lanes Only:
summary: Example updating only lanes setting
description: Update Collection - Lanes Only
value: '{"name":"My Suppliers","lanes":true}'
required: true
responses:
'200':
description: 200 OK - Collection updated successfully. The update has been audited with the comment 'Collection name and lanes updated via Public API'.
content:
application/json:
schema:
$ref: '#/components/schemas/PublicCollectionDTO'
examples:
Updated collection response:
summary: Example of an updated collection
description: 'Note: Fields with null values (such as `updatedAt`) are omitted from the JSON response. The `parentId` field is included when it has a value.'
value: '{"id":123,"uuid":"550e8400-e29b-41d4-a716-446655440000","scope":"User","type":"Default","name":"Updated Supplier Collection","count":15,"lanes":false,"tiersEnabled":true,"parentId":100,"children":[],"updatedAt":null}'
'400':
description: 400 Bad Request - Invalid request payload or validation errors. The request body is malformed or contains invalid data.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Missing required field:
summary: Required field is missing
description: Missing required field
value: '{"code":"invalid_request","message":"Name is required","solution":"Fix the request"}'
Blank field validation:
summary: Required field is blank or contains only whitespace
description: Blank field validation
value: '{"code":"invalid_request","message":"Name is required","solution":"Fix the request"}'
Invalid JSON:
summary: Request body is not valid JSON
description: Invalid JSON
value: '{"code":"invalid_request","message":"Name is required","solution":"Fix the request"}'
'404':
description: '404 Not Found - The collection with the specified ID was not found, is inactive (deactivated), or is not accessible to your organization. This may occur if: (1) the collection ID doesn''t exist, (2) the collection was deactivated (soft-deleted), (3) the collection was never accessible to your organization, (4) you don''t have update access (you must be the collection creator OR have been granted access), or (5) the collection is inactive and filtered out by the system.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Collection not found:
summary: Collection ID does not exist or is not accessible
description: Collection not found
value: '{"code":"resource_not_found","message":"Collection with id 123 not found or access denied","solution":"Verify the collection ID and ensure you have the required permission on the collection"}'
'409':
description: 409 Conflict - A collection with the same name already exists in the user's scope. Collection names must be unique within each scope.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Duplicate collection name:
summary: Collection name already exists in scope
description: Duplicate collection name
value: '{"code":"duplicate_resource","message":"Collection with name ''New Supplier Collection'' already exists in Customer scope","solution":"Use a different collection name or a different scope"}'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 20,\n \"requestCount\": 20,\n \"limits\": [\n {\n \"requestLimit\": 20,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
delete:
tags:
- Collections - Management
summary: Deactivate a collection
description: "\nDeactivate (soft delete) an existing collection.\n\nThis operation performs a **soft deletion** by marking the collection as inactive. The collection data remains in the database but is no longer accessible through the API.\n\n**Parameter:**\n- `{collectionId}` (path parameter): The unique identifier of the collection to deactivate.\n\n**What happens when you deactivate a collection:**\n\n1. **Collection Deactivation**: The collection is soft-deleted (marked as inactive)\n2. **API Visibility**: The collection will no longer appear in collection list queries (`GET /public/v1/collections`) or be accessible via `GET /public/v1/collections/{collectionId}`\n3. **Target Relationships**: Target-collection relationships remain in the database, but since the collection is inactive, targets linked to this collection become inaccessible through the API. The targets themselves are not deleted.\n4. **Cleanup**: Collection filters and tree filters associated with the collection are removed\n5. **User Default Collection**: If this collection was set as the user's default collection, it will be cleared\n6. **Audit Trail**: The deactivation is recorded in the audit log with:\n - The user who deactivated the collection\n - Timestamp of the operation\n - Collection details (name, scope, type, ID)\n - Reference to the public API endpoint used\n - Audit comment: \"Collection deleted via Public API\"\n\n**Important Notes:**\n\n- This is a **soft delete** - the collection is marked as inactive but data remains in the database\n- Deactivated collections are filtered out from all API queries automatically\n- **Only the creator of the collection can deactivate it** - even if you have `DELETE` permission through a role, you must be the collection creator\n- Target-collection relationships remain in the database, but targets become inaccessible through the API since the collection is inactive\n- The targets themselves are not deleted - only the collection becomes inactive\n- The collection cannot be reactivated through this API (no reactivation endpoint is available)\n- All collection operations are audited for compliance and tracking purposes\n\n**Required Permissions**:\n- `MANAGE_COLLECTION` permission\n- `DELETE` permission on the collection\n- **You must be the creator of the collection** (collection.userId must match your user ID)\n "
operationId: deleteCollection
parameters:
- name: collectionId
in: path
description: The unique identifier (ID) of the collection to deactivate. This is the same identifier returned in the `id` field when retrieving collections via GET /public/v1/collections.
required: true
schema:
type: integer
format: int32
example: 123
responses:
'204':
description: 204 No Content - Collection deactivated successfully. The collection has been soft-deleted (marked as inactive), and the deactivation has been audited with the comment 'Collection deleted via Public API'. The collection will no longer appear in API queries. Target-collection relationships remain in the database but become inaccessible since the collection is inactive.
content:
application/json:
examples:
Success response:
summary: Collection successfully deactivated
description: The response body is empty (204 No Content). The collection has been soft-deleted (marked as inactive) and all changes have been audited. The collection will no longer be accessible through the API.
value: null
'400':
description: '400 Bad Request - Invalid request. This status code is returned when the request is malformed or validation fails. This may occur if: (1) the collection cannot be deleted due to validation constraints, (2) the request parameters are invalid, or (3) there are other validation errors preventing the deletion.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Invalid request:
summary: Request validation failed
description: Invalid request
value: '{"message":"Invalid request","code":"invalid_request","solution":"Fix the request"}'
'404':
description: '404 Not Found - The collection with the specified ID was not found, is inactive (deactivated), or is not accessible to your organization. This may occur if: (1) the collection ID doesn''t exist, (2) the collection was deactivated (soft-deleted), (3) the collection was never accessible to your organization, or (4) you don''t have read access to the collection.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Collection not found:
summary: Collection ID does not exist or is not accessible
description: Collection not found
value: '{"code":"resource_not_found","message":"Collection with id 123 not found or access denied","solution":"Verify the collection ID and ensure you have the required permission on the collection"}'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 20,\n \"requestCount\": 20,\n \"limits\": [\n {\n \"requestLimit\": 20,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
/public/v1/collections:
get:
tags:
- Collections - Management
summary: List all collections
description: "\nRetrieve all active collections accessible to the authenticated user with pagination support.\n\nThis endpoint returns collections that the user has read access to, including:\n- User-owned collections (`scope: User`)\n- Customer collections (`scope: Customer`) - organization-wide collections accessible to the user\n- Team-shared collections (via collection roles)\n\n**Note**:\n- Only active (non-deactivated) collections are returned\n- Featured collections (`scope: Featured`) are excluded from this endpoint\n- Inactive (deactivated) collections are automatically filtered out\n\n**Response:**\nReturns a paginated list of collection objects. Each collection includes basic information such as id, uuid, scope, type, name, count, lanes, tiersEnabled, and optional parentId and children fields. See the `PublicCollectionDTO` schema for complete field definitions.\n\n**Note**: Fields with null values (`parentId`, `updatedAt`) are omitted from the JSON response. This is standard JSON serialization behavior. In the list endpoint, `children` arrays are typically empty - use `GET /public/v1/collections/{collectionId}` to retrieve a collection with its full children tree populated.\n\n **Pagination:**\n - Results are paginated for efficient data retrieval\n - Use query parameters to control pagination:\n - `page`: Page number (0-indexed, default: 0)\n - `size`: Number of items per page (default: 500)\n - Results are sorted alphabetically by collection name\n - Only active collections are included in pagination (inactive/deactivated collections are filtered out)\n\n**Access Control:**\n- Collections are filtered to include only those accessible to you:\n - Collections owned by you (`scope: User`)\n - Customer collections accessible to your organization (`scope: Customer`)\n - Collections where you have been granted access
# --- truncated at 32 KB (51 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/prewave/refs/heads/main/openapi/prewave-collections-management-api-openapi.yml