API Evangelist enhancements for the Airtm Enterprise API V1

overlay: 1.0.0
info:
  title: API Evangelist enhancements for the Airtm Enterprise API V1
  version: 1.0.0
extends: openapi/airtm-enterprise-v1-openapi.json
x-generated: '2026-08-06'
x-method: generated
x-source: API Evangelist enrichment pass 2026-08-06.
actions:
- target: $.info
  update:
    x-apievangelist-enriched: '2026-08-06'
    x-lifecycle: lifecycle/airtm-lifecycle.yml
    x-superseded-by: openapi/airtm-enterprise-v2-openapi.json
- target: $.info
  description: >-
    LEGACY. This is the first-generation Airtm payments API, still served from payments.air-pay.io and
    still published as OpenAPI 3.1.0. Airtm publishes no sunset date or deprecation notice for it;
    new integrations should use the Enterprise API V2.
- target: $.servers
  update:
  - url: https://payments.air-pay.io
    description: Production (legacy)
  - url: https://payments.static-stg.tests.airtm.org
    description: Sandbox (legacy)
- target: $
  update:
    x-apievangelist-gaps:
      no_component_schemas: >-
        components.schemas is empty — all 18 operations inline their shapes, so nothing is reusable
        and no generated client produces shared models.
      operation_id_quality: >-
        operationIds are path-derived strings containing spaces, slashes and underscores (e.g.
        "Purchases _ Payins_purchases-payins/create-purchase"). They are unique but are not valid
        identifiers in most target languages, so generators must mangle them.
      paths_not_rooted: >-
        Path keys are relative ("purchases", "payouts/{payoutId}/commit") rather than rooted with a
        leading slash as OpenAPI requires.
      colon_style_path_param: >-
        One path uses Express-style syntax ("payouts/events/:payoutId") instead of OpenAPI's
        {payoutId} template, so that parameter is not machine-readable.
      no_error_responses: No 4xx/5xx or default responses are declared anywhere in the document.
      no_security_requirement: >-
        basicAuth is defined in components.securitySchemes but never applied at root or operation level.