Prewave Scores - Externals API

Upload and read custom supplier scores from your systems (e.g. SAP). Bulk upload, list event types, and view history per supplier. Available from June 2026.

OpenAPI Specification

prewave-scores-externals-api-openapi.yml Raw ↑
openapi: 3.0.1
info:
  title: Public Prewave Actions Scores - Externals API
  description: 'Documentation of the Public Prewave API.


    ## What''s New


    ### Q1 2026 — Supplier Management, User Management, Actions and Feed


    This quarter introduces major v2 upgrades, expanded administrative capabilities, and the new Actions API.


    - **Core Releases:** Deployed Supplier Management API v2 and Feed API v2, alongside the all-new Actions API.

    - **Enhanced Functionality:** Added robust identifier management, granular user and role configuration, and endpoints for managing supplier connection contacts.

    - ⚠️ **Required Migration:** Legacy v1 endpoints for Suppliers and Sites Upsert have been deprecated. Developers must migrate existing integrations to v2 by **May 31, 2027** (original deadline was December 31, 2026).


    📖 **[Read the Q1 2026 changelog](https://docs.prewave.com/en/articles/699847-q1-2026-public-api-updates)**


    ### Q2 2026 — Supplier Screening and External Scores


    We have expanded our v2 documentation to include comprehensive integration guidance for supplier screening and validation workflows and identifier-based external score ingestion.


    - **New Capabilities:** Added support for optional post-onboarding screening and validation during the create event.

    - **External Scores:** Batch POST for multiple supplier sites, per-site history GET, and event-type discovery GET (`/public/v1/scores/externals` and `/public/v1/scores/externals/event-types`). Documented in OpenAPI when enabled for your organization.

    - **Developer Resources:** Published new integration examples and detailed identifier validation rules to streamline your implementation process.


    📖 **[Read the Q2 2026 changelog](https://docs.prewave.com/en/articles/699849-q2-2026-public-api-updates)**


    ### Q3 2026 — Scores Webhooks


    To support event-driven architectures and eliminate the need for continuous API polling, we are introducing webhooks for score state changes later this year.


    - **Event-Driven Architecture:** Register webhook URLs to receive real-time HTTP payloads whenever a supplier''s score updates, so you can drive immediate mitigation responses without polling the API.

    - **Availability:** Comprehensive OpenAPI specifications and payload schemas will be published closer to the release date.

    - **Note:** Schemas and behaviors are subject to refinement prior to general availability.


    Documentation updates will be provided prior to release.


    ### Q4 2026 — Feed V2


    We are enhancing Feed API v2 with additional capabilities on top of the existing `GET /public/v2/feed` contract (see Q1 changelog and OpenAPI for the current Feed v2 integration).


    - **Availability:** Details will be announced before release.

    - **Note:** Schemas and behaviors are subject to refinement prior to the official release.


    Documentation updates will be provided prior to release.


    ---


    ## Authentication

    Prewave’s public api uses *API tokens* to authenticate against our RESTful service. We’ll provide you an *API-token* that each

    endpoint needs present as a http header.


    To pass the token in a request, simply add it as a header-parameter with

    * key = X-Auth-Token

    * value = api-token


    See an example in curl below where the api-token would be 12345678-90ab-cdef-1234-567890abcdef

    ```

    curl --request GET \

    --url https://REPLACE_WITH_SERVER/public/v1/target/prewave/3975230/alerts \

    --header ''X-Auth-Token: 12345678-90ab-cdef-1234-567890abcdef''

    ```


    ---


    ## Manage API Tokens


    Before you can obtain your API token, you''ll need the credentials for your API user. These credentials will be

    sent to you as part of the company-onboarding. If you haven''t got your credentials yet, please reach out to

    your sales-contact at Prewave or contact us via info@prewave.ai


    To generate an API Token, navigate to https://www.prewave.com/management/api and log in with the

    credentials of your API user. Then click at the button "Create New" and use your new api-token authentication as a header parameter.


    You can create multiple API tokens and also remove existing API tokens on https://www.prewave.com/management/api.

    API tokens do not expire, therefore you have to maintain the list of API tokens you are using manually.


    ---


    ## Default Rate Limits


    We have two types of default rate limits. For increased access, please contact customer success.


    | Type                              | Requests per 10 seconds | Requests per Minute |

    |-----------------------------------|-------------------------|---------------------|

    | GET requests                      | 100                     | 500                 |

    | POST, PUT, PATCH, DELETE requests | 20                      | 100                 |


    '
  version: '1.0'
servers:
- url: https://api.prewave.com
  description: Production Environment
security:
- Token authentication: []
tags:
- name: Scores - Externals
  description: Upload and read custom supplier scores from your systems (e.g. SAP). Bulk upload, list event types, and view history per supplier. Available from June 2026.
paths:
  /public/v1/scores/externals:
    get:
      tags:
      - Scores - Externals
      summary: Get external score history for one supplier
      description: "\nReturns score history per event type for one supplier. Identify the supplier using query parameters such as supplier ID, customer ID, own site ID, or Prewave ID — the same identifiers you use elsewhere in the public supplier APIs.\n\n**When to use this**\n- Auditing what scores are stored for one supplier after an integration run.\n- Showing score history in a customer-facing report or internal dashboard.\n- Verifying that an upload landed as expected for a given supplier.\n\n**Optional filters**\n- `perspectiveId` — limit results to a specific perspective (defaults to your account’s default).\n- `groupId` — narrow results to a score group when needed.\n\n**If something goes wrong**\n- **400** — No supplier identifier was provided, or more than one supplier matched. Add or refine identifiers (for example include `source`).\n- **404** — No supplier matched the identifiers you sent.\n\n**Required permission:** `access_public_internal_score`\n        "
      operationId: getExternalScoresForTargetByIdentifier
      parameters:
      - name: supplierId
        in: query
        description: Supplier ID of the target. Can be combined with customerId, ownId, and/or prewaveId.
        required: false
        schema:
          type: string
          description: Supplier ID of the target. Can be combined with customerId, ownId, and/or prewaveId.
          example: SAP-12345
        example: SAP-12345
      - name: customerId
        in: query
        description: Customer ID of the target. Can be combined with supplierId, ownId, and/or prewaveId.
        required: false
        schema:
          type: string
          description: Customer ID of the target. Can be combined with supplierId, ownId, and/or prewaveId.
          example: CRM-67890
        example: CRM-67890
      - name: ownId
        in: query
        description: Own site ID of the target. Can be combined with supplierId, customerId, and/or prewaveId.
        required: false
        schema:
          type: string
          description: Own site ID of the target. Can be combined with supplierId, customerId, and/or prewaveId.
          example: OWN-SITE-01
        example: OWN-SITE-01
      - name: prewaveId
        in: query
        description: Prewave ID of the target. Can be combined with supplierId, customerId, and/or ownId.
        required: false
        schema:
          type: integer
          description: Prewave ID of the target. Can be combined with supplierId, customerId, and/or ownId.
          format: int32
          example: 102006215
        example: 102006215
      - name: source
        in: query
        description: Optional source system to filter by. Applies to supplierId, customerId, and ownId (not prewaveId).
        required: false
        schema:
          type: string
          description: Optional source system to filter by. Applies to supplierId, customerId, and ownId (not prewaveId).
          example: SAP
        example: SAP
      - name: perspectiveId
        in: query
        description: Optional. Perspective to filter scores by. If omitted, your account default is used.
        required: false
        schema:
          type: integer
          format: int32
        example: 1
      - name: groupId
        in: query
        description: Optional. Score group to filter results by.
        required: false
        schema:
          type: integer
          format: int32
        example: 10
      responses:
        '200':
          description: Score history for the supplier that matched your identifiers.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicExternalScoreResponse'
              examples:
                Score history for one supplier:
                  summary: Multiple event types with revision history
                  description: Score history for one supplier
                  value: '{"identifier":{"supplierId":"SAP-12345","customerId":null,"ownId":null,"prewaveId":null,"source":"SAP"},"scores":[{"group":{"id":10,"name":"Environmental","sname":"env"},"eventTypeKey":"carbon","score":{"value":85,"risk":"Low"},"comment":"Q1 2026 sustainability review — improved emissions tracking","updatedAt":"2026-01-15T10:30:00Z","validFrom":"2026-01-15T00:00:00Z","validTo":null,"history":[{"group":{"id":10,"name":"Environmental","sname":"env"},"eventTypeKey":"carbon","score":{"value":78,"risk":"Mid"},"comment":"Initial Q4 2025 assessment","updatedAt":"2025-10-01T09:00:00Z","validFrom":"2025-10-01T00:00:00Z","validTo":"2025-12-31T23:59:59Z","history":[]},{"group":{"id":10,"name":"Environmental","sname":"env"},"eventTypeKey":"carbon","score":{"value":82,"risk":"Low"},"comment":"Revised after on-site supplier audit","updatedAt":"2025-12-15T14:00:00Z","validFrom":"2026-01-01T00:00:00Z","validTo":"2026-01-14T23:59:59Z","history":[]}]},{"group":{"id":20,"name":"Physical Risk","sname":"physical"},"eventTypeKey":"flood","score":{"value":42,"risk":"Mid"},"comment":"Primary site located in a medium flood-risk zone","updatedAt":"2026-02-01T08:00:00Z","validFrom":"2026-02-01T00:00:00Z","validTo":null,"history":[]},{"group":{"id":30,"name":"Financial Risk","sname":"financial"},"eventTypeKey":"credit_risk","score":{"value":72,"risk":"Mid"},"comment":"Credit rating imported from external risk platform","updatedAt":"2026-01-20T16:45:00Z","validFrom":"2026-01-20T00:00:00Z","validTo":"2026-07-19T23:59:59Z","history":[]}]}'
        '400':
          description: Supplier could not be identified uniquely — provide at least one identifier or narrow the match (for example with `source`).
          content:
            application/json: {}
        '404':
          description: No supplier found for the identifiers provided, or you do not have access to that supplier.
          content:
            application/json: {}
        '403':
          description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedErrorDTO'
              examples:
                Access denied example:
                  summary: User lacks necessary permissions or authentication
                  value: "{\n        \"loggedIn\": true,\n        \"code\": \"access_denied\",\n        \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n        \"solution\": \"Contact support for appropriate permissions\"\n    }"
        '500':
          description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDTO'
              examples:
                Error - Server Error:
                  summary: Unexpected server error
                  value: "{\n        \"code\": \"internal_error\",\n        \"message\": \"An unexpected error occurred\",\n        \"solution\": \"Please try again later or contact support\"\n    }"
        '429':
          description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiRateLimitResponse'
              examples:
                Rate limit exceeded example:
                  summary: API rate limit exceeded
                  value: "{\n        \"error\": \"API rate limit exceeded\",\n        \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n        \"requestLimit\": 100,\n        \"requestCount\": 100,\n        \"limits\": [\n            {\n                \"requestLimit\": 100,\n                \"timeInSeconds\": 10\n            },\n            {\n                \"requestLimit\": 500,\n                \"timeInSeconds\": 60\n            }\n        ],\n        \"currentTime\": \"2026-01-15T10:30:00\",\n        \"nextResetAt\": \"2026-01-15T10:30:10\"\n    }"
    post:
      tags:
      - Scores - Externals
      summary: Upload external scores for one or more suppliers
      description: "\nUploads scores per supplier and event type. Event types are the risk dimensions you score for a supplier (e.g. Carbon, Flood).\n\n**What you send**\n- A list of suppliers, each with how to find that supplier in Prewave and one or more scores.\n- At most 100 supplier entries in `data` per request.\n- At most 50 score rows per supplier in `scores` (one per event type).\n- Each score needs an event type key (`eventTypeKey`), a value from 1 to 100, and an optional comment.\n\n**Recommended workflow**\n1. Call **List event types for a perspective** to see which event type keys are set up for your perspective.\n2. Send this request with those keys where possible.\n3. Review the response: if `success` is false, open `errors` to see which suppliers or scores failed and why.\n\n**How to read the response**\n- The request is accepted even when some rows fail. Check `success` for an all-clear result.\n- Counters show how many suppliers were received, matched, and saved (`totalCount`, `validCount`, `resolvedCount`, `writtenCount`, `skippedCount`).\n- Problems (unknown supplier, unknown event type key, and similar) are listed in `errors`, not only as an HTTP error.\n\n**Required permission:** `access_public_internal_score`\n        "
      operationId: createExternalScoresBulk
      requestBody:
        description: 'List of suppliers and their scores. Limits are enforced at validation time: at most 100 suppliers and at most 50 scores per supplier. See the request schema and examples for the expected shape.'
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PublicExternalScoreCreationRequest'
            examples:
              Multiple suppliers:
                summary: Three suppliers with multiple scores and identifier types
                description: Multiple suppliers
                value: '{"data":[{"identifier":{"supplierId":"SAP-12345","customerId":null,"ownId":null,"prewaveId":null,"source":"SAP"},"scores":[{"eventTypeKey":"carbon","scoreValue":24,"comment":"Scope 1 and 2 emissions review — Q1 2026"},{"eventTypeKey":"flood","scoreValue":5,"comment":"Low flood exposure at primary manufacturing site"}]},{"identifier":{"supplierId":null,"customerId":null,"ownId":null,"prewaveId":102006215,"source":null},"scores":[{"eventTypeKey":"credit_risk","scoreValue":72,"comment":"Credit rating imported from external risk platform"}]},{"identifier":{"supplierId":null,"customerId":"CRM-67890","ownId":null,"prewaveId":null,"source":"SAP"},"scores":[{"eventTypeKey":"carbon","scoreValue":55,"comment":null}]}]}'
        required: true
      responses:
        '200':
          description: Upload finished. Check `success`, the counters, and `errors` to see whether every supplier and score was saved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicExternalScoreCreationResponse'
              examples:
                Bulk write result — all succeeded:
                  summary: Every supplier and score was saved
                  description: Bulk write result — all succeeded
                  value: '{"success":true,"totalCount":3,"validCount":3,"resolvedCount":3,"writtenCount":4,"skippedCount":0,"errors":[]}'
                Bulk write result — partial success:
                  summary: Some scores saved; check errors for failed rows
                  description: Bulk write result — partial success
                  value: '{"success":false,"totalCount":3,"validCount":3,"resolvedCount":2,"writtenCount":3,"skippedCount":1,"errors":[{"entryIndex":2,"scoreIndex":0,"identifier":{"supplierId":null,"customerId":"CRM-UNKNOWN","ownId":null,"prewaveId":null,"source":"SAP"},"eventTypeKey":"carbon","reason":"TARGET_NOT_FOUND","message":"No supplier found matching customerId=CRM-UNKNOWN, source=SAP"},{"entryIndex":0,"scoreIndex":1,"identifier":{"supplierId":"SAP-12345","customerId":null,"ownId":null,"prewaveId":null,"source":"SAP"},"eventTypeKey":"unknown_event","reason":"UNKNOWN_EVENT_TYPE","message":"Event type key ''unknown_event'' is not configured"}]}'
        '400':
          description: The request could not be processed — for example the supplier list was empty, more than 100 suppliers were sent, more than 50 scores were sent for one supplier, a score was outside 1–100, or an event type key was missing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDTO'
        '403':
          description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedErrorDTO'
              examples:
                Access denied example:
                  summary: User lacks necessary permissions or authentication
                  value: "{\n        \"loggedIn\": true,\n        \"code\": \"access_denied\",\n        \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n        \"solution\": \"Contact support for appropriate permissions\"\n    }"
        '500':
          description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDTO'
              examples:
                Error - Server Error:
                  summary: Unexpected server error
                  value: "{\n        \"code\": \"internal_error\",\n        \"message\": \"An unexpected error occurred\",\n        \"solution\": \"Please try again later or contact support\"\n    }"
        '429':
          description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiRateLimitResponse'
              examples:
                Rate limit exceeded example:
                  summary: API rate limit exceeded
                  value: "{\n        \"error\": \"API rate limit exceeded\",\n        \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n        \"requestLimit\": 20,\n        \"requestCount\": 20,\n        \"limits\": [\n            {\n                \"requestLimit\": 20,\n                \"timeInSeconds\": 10\n            },\n            {\n                \"requestLimit\": 100,\n                \"timeInSeconds\": 60\n            }\n        ],\n        \"currentTime\": \"2026-01-15T10:30:00\",\n        \"nextResetAt\": \"2026-01-15T10:30:10\"\n    }"
  /public/v1/scores/externals/event-types:
    get:
      tags:
      - Scores - Externals
      summary: List event types for a perspective
      description: "\nLists event types configured for a perspective—the risk dimensions you can score (e.g. Carbon, Flood). Use this before a bulk upload so your integration sends event type keys that match what customers see in the product.\n\n**When to use this**\n- Planning a score import: see which event types apply before building the file or API payload.\n- Explaining to stakeholders which risk dimensions external scores can refer to for that perspective.\n- Troubleshooting failed uploads: compare your source data with the keys returned here.\n\n**Typical workflow**\n1. Call this endpoint with a `perspectiveId` your API token can access.\n2. Use the returned `eventTypeKey` values when uploading scores.\n3. If some rows fail on upload, check whether the event type key exists in this list.\n\n**Note:** Upload may still accept event type keys that exist globally but are not listed here. Keys that do not exist at all are reported in the upload response `errors`.\n\n**Required permission:** `access_public_internal_score`\n        "
      operationId: listExternalScoreEventTypes
      parameters:
      - name: perspectiveId
        in: query
        description: Perspective to list event types for. Use the same perspective as your uploads or reads when possible. Your API token must have access to this perspective.
        required: true
        schema:
          type: integer
          format: int32
        example: 5484774
      responses:
        '200':
          description: Event types configured for this perspective. Each row includes an event type key (`eventTypeKey`) and a display name.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PublicExternalScoreEventTypeDTO'
              examples:
                Event types — sample:
                  summary: Event types configured for the perspective
                  description: Event types — sample
                  value: '[{"id":101,"eventTypeKey":"carbon","name":"Carbon"},{"id":102,"eventTypeKey":"flood","name":"Flood"},{"id":103,"eventTypeKey":"credit_risk","name":"Credit Risk"},{"id":104,"eventTypeKey":"water_stress","name":"Water Stress"}]'
                Event types - empty:
                  summary: No event types configured for this perspective
                  description: Empty list — no event types are set up for this perspective in Prewave.
                  value: '[]'
        '400':
          description: Perspective ID is missing — add `perspectiveId` to the request.
          content:
            application/json: {}
        '403':
          description: This perspective is not available for your account.
          content:
            application/json: {}
        '500':
          description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDTO'
              examples:
                Error - Server Error:
                  summary: Unexpected server error
                  value: "{\n        \"code\": \"internal_error\",\n        \"message\": \"An unexpected error occurred\",\n        \"solution\": \"Please try again later or contact support\"\n    }"
        '429':
          description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiRateLimitResponse'
              examples:
                Rate limit exceeded example:
                  summary: API rate limit exceeded
                  value: "{\n        \"error\": \"API rate limit exceeded\",\n        \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n        \"requestLimit\": 100,\n        \"requestCount\": 100,\n        \"limits\": [\n            {\n                \"requestLimit\": 100,\n                \"timeInSeconds\": 10\n            },\n            {\n                \"requestLimit\": 500,\n                \"timeInSeconds\": 60\n            }\n        ],\n        \"currentTime\": \"2026-01-15T10:30:00\",\n        \"nextResetAt\": \"2026-01-15T10:30:10\"\n    }"
components:
  schemas:
    PublicExternalTargetScoreCollection:
      required:
      - identifier
      - scores
      type: object
      properties:
        identifier:
          $ref: '#/components/schemas/PublicExternalTargetIdentifier'
        scores:
          maxItems: 50
          minItems: 0
          type: array
          description: Scores for this supplier, one per event type. At most 50 per supplier.
          items:
            $ref: '#/components/schemas/PublicExternalTargetScore'
          example: null
      description: Suppliers and their scores. At most 100 suppliers per request.
      example: null
    Score:
      required:
      - risk
      - value
      type: object
      properties:
        value:
          type: integer
          format: int32
          example: null
        risk:
          type: string
          enum:
          - NA
          - 'No'
          - Low
          - Mid
          - High
          - Critical
          example: null
      example: null
    PublicExternalTargetIdentifier:
      type: object
      properties:
        supplierId:
          type: string
          description: Supplier ID of the target. Can be combined with customerId, ownId, and/or prewaveId.
          nullable: true
          example: SAP-12345
        customerId:
          type: string
          description: Customer ID of the target. Can be combined with supplierId, ownId, and/or prewaveId.
          nullable: true
          example: CRM-67890
        ownId:
          type: string
          description: Own site ID of the target. Can be combined with supplierId, customerId, and/or prewaveId.
          nullable: true
          example: OWN-SITE-01
        prewaveId:
          type: integer
          description: Prewave ID of the target. Can be combined with supplierId, customerId, and/or ownId.
          format: int32
          nullable: true
          example: 102006215
        source:
          type: string
          description: Optional source system to filter by. Applies to supplierId, customerId, and ownId (not prewaveId).
          nullable: true
          example: SAP
      description: Supplier site identifier. At least one lookup key (`supplierId`, `customerId`, `ownId`, or `prewaveId`) should be set; `source` optionally narrows text identifiers.
      example: swagger.example.external-score.target-identifier
    PublicExternalTargetScore:
      required:
      - eventTypeKey
      - scoreValue
      type: object
      properties:
        eventTypeKey:
          minLength: 1
          type: string
          example: null
        scoreValue:
          maximum: 100
          minimum: 1
          type: integer
          format: int32
          example: null
        comment:
          type: string
          nullable: true
          example: null
      description: Scores for this supplier, one per event type. At most 50 per supplier.
      example: null
    PublicExternalScoreEventTypeDTO:
      required:
      - eventTypeKey
      - id
      - name
      type: object
      properties:
        id:
          type: integer
          format: int32
          example: null
        eventTypeKey:
          type: string
          example: null
        name:
          type: string
          example: null
      example: null
    AccessDeniedErrorDTO:
      required:
      - code
      - loggedIn
      - message
      type: object
      properties:
        loggedIn:
          type: boolean
          example: null
        permission:
          type: string
          nullable: true
          example: null
        code:
          type: string
          description: Error code
          example: null
        message:
          type: string
          description: Error message
          example: null
        solution:
          type: string
          description: Possible solution to the error
          nullable: true
          example: null
      example: null
    ErrorDTO:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: null
        message:
          type: string
          description: Error message
          example: null
        solution:
          type: string
          description: Possible solution to the error
          nullable: true
          example: null
      description: Error response
      example: null
    PublicExternalScoreCreationRequest:
      required:
      - data
      type: object
      properties:
        data:
          maxItems: 100
          minItems: 0
          type: array
          description: Suppliers and their scores. At most 100 suppliers per request.
          items:
            $ref: '#/components/schemas/PublicExternalTargetScoreCollection'
          example: null
      example: null
    PublicExternalScoreResponse:
      required:
      - identifier
      - scores
      type: object
      properties:
        identifier:
          $ref: '#/components/schemas/PublicExternalTargetIdentifier'
        scores:
          type: array
          items:
            $ref: '#/components/schemas/PublicExtScoreHistory'
          example: null
      example: null
    PublicExtScoreHistory:
      required:
      - eventTypeKey
      - group
      - history
      - score
      - updatedAt
      type: object
      properties:
        group:
          $ref: '#/components/schemas/PublicInfotagGroup'
        eventTypeKey:
          type: string
          example: null
        score:
          $ref: '#/components/schemas/Score'
        comment:
          type: string
          nullable: true
          example: null
        updatedAt:
          type: string
          description: Last update. Timestamp (ISO 8601 UTC)
          format: date-time
          example: '2026-01-15T10:30:00Z'
        validFrom:
          type: string
          description: Start of validity period. Timestamp (ISO 8601 UTC)
          format: date-time
          nullable: true
          example: '2026-01-01T00:00:00Z'
        validTo:
          type: string
          description: End of validity period. Timestamp (ISO 8601 UTC)
          format: date-time
          nullable: true
          example: '2026-12-31T23:59:59Z'
        history:
          type: array
          items:
            $ref: '#/components/schemas/PublicExtScoreHistory'
          example: null
      example: null
    PublicInfotagGroup:

# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/prewave/refs/heads/main/openapi/prewave-scores-externals-api-openapi.yml