API Evangelist enhancements for Hometrack API Public

overlay: 1.0.0
info:
  title: API Evangelist enhancements for Hometrack API Public
  version: 1.0.0
extends: openapi/hometrack-api-public-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-provider: hometrack
    x-apievangelist-generated: '2026-07-26'
    x-apievangelist-source: https://developer.hometrack.com/apis (Azure API Management OpenAPI export)
    x-apievangelist-operations: 20
    x-apievangelist-access:
      pricing: paid
      onboarding: partner
      public: false
      trial: false
      note: Contracts are public; the data plane returns HTTP 401 without a Hometrack-issued credential.
    x-apievangelist-notes: Named 'public' but nothing is callable without a Hometrack-issued key. Carries
      a scheduled-task endpoint (ReportingApi_MoveToBlobStorage) and two operations Hometrack itself labels
      'For test purpose' — an internal API published to the catalogue as-is. Exchange tokens are passed
      as URL PATH segments, which leaks credentials into intermediary logs.
- target: $.components.securitySchemes
  update:
    OAuth2ClientCredentials:
      type: oauth2
      description: Documented on https://developer.hometrack.com/api-authentication but absent from the
        Azure API Management export. Added here as an overlay, not a change to the harvested spec.
      flows:
        clientCredentials:
          tokenUrl: https://hometrack-prod.eu.auth0.com/oauth/token
          scopes:
            read:valuations: Read access to valuations.
            write:valuations: Write access to valuations.
- target: $.servers
  update:
    x-apievangelist-server-note: The second declared server, api.hometrack.local, is an internal development
      hostname that does not resolve publicly. Only https://api.hometrack.com is usable.