{"openapi":"3.1.0","info":{"title":"AgentConnect API","version":"1.2.0","description":"Unified functional/UI contract 1.2. x-implementation-status distinguishes the working initial slice from remaining MVP release targets. All example entities and prices are demonstration data. The website is for business registration and workspace only; agents use the preserved REST/MCP contract. Human search, ask, HTML docs and developer portal pages are retired."},"servers":[{"url":"https://biznoro.com","description":"Configured public origin"}],"paths":{"/v1/auth/otp/request":{"post":{"summary":"Request a six-digit OTP","operationId":"post__v1_auth_otp_request","x-implementation-status":"implemented","responses":{"202":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OtpChallenge"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"language":{"type":"string","enum":["pt-BR","en","ru"],"description":"Optional email language. Russian messages use ru; omitted preserves the existing Portuguese/English default. Does not affect authentication, expiry or response privacy."}},"additionalProperties":false,"required":["email"]}}}},"security":[],"description":"Expiry10min; <=5attempts; resend>=60s; max5/email/hour and10/IP/hour. Same response for new and existing addresses. Codes only via email, never auth JSON or logs."}},"/v1/auth/otp/verify":{"post":{"summary":"Consume OTP and create a session","operationId":"post__v1_auth_otp_verify","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"user":{"$ref":"#/components/schemas/User"}},"additionalProperties":false,"required":["user"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"challenge_id":{"type":"string","format":"uuid"},"code":{"type":"string","pattern":"^[0-9]{6}$"}},"additionalProperties":false,"required":["challenge_id","code"]}}}},"security":[],"description":"Successful use consumes OTP. Set-Cookie ac_session; Secure,HttpOnly,SameSite=Lax;7days. Loopback development omits Secure; production enforces it. No passwords or links."}},"/v1/auth/me":{"get":{"summary":"Read current business user","operationId":"get__v1_auth_me","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"user":{"$ref":"#/components/schemas/User"}},"additionalProperties":false,"required":["user"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}]}},"/v1/auth/logout":{"post":{"summary":"Revoke current session","operationId":"post__v1_auth_logout","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"}},"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}]}},"/v1/businesses":{"get":{"summary":"Search potential recipients without claiming inventory","operationId":"get__v1_businesses","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Business"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false,"required":["data","next_cursor"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{},{"ApiKeyBearer":[]},{"OAuth2":["businesses:read"]}],"description":"Initial slice normalized category/brand/keyword matching. Full fuzzy synonyms/geospatial ranking are planned. Only published profiles appear.","parameters":[{"in":"query","name":"q","schema":{"type":"string"}},{"in":"query","name":"city","schema":{"type":"string"}},{"in":"query","name":"category","schema":{"type":"string"}},{"in":"query","name":"brand","schema":{"type":"string"}},{"in":"query","name":"cursor","schema":{"type":"string"}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100,"default":30}},{"in":"query","name":"indexable_only","description":"Public directory filter: published, non-demo, search_indexable and supported canonical geography. Default false preserves REST/MCP discovery compatibility.","schema":{"type":"boolean","default":false}}]},"post":{"summary":"Create a company in pending_review","operationId":"post__v1_businesses","x-implementation-status":"implemented","responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Business"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BusinessInput"}}}},"security":[{"SessionCookie":[]}],"description":"Requires verified email session. Assigns contact_verified only. One default branch/card in first slice; data supports multiple branches. Owner cannot self-publish or self-award business_verified."}},"/v1/businesses/{business_id}":{"get":{"summary":"Read public published company","operationId":"get__v1_businesses_business_id","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Business"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[],"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/businesses/{business_id}/availability-policy":{"get":{"summary":"Read accepted inquiry types, response schedule and caps","operationId":"get__v1_businesses_business_id_availability_policy","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"business_id":{"type":"string","format":"uuid"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"daily_quota":{"type":"integer"},"accepting_inquiries":{"type":"boolean"},"timezone":{"type":"string"}},"required":["business_id","capabilities","daily_quota","accepting_inquiries","timezone"],"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[],"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Actual enabled capabilities only; empty array means none. No fabricated defaults. Only published profiles."}},"/internal/businesses":{"get":{"summary":"Read owner or assigned staff businesses","operationId":"get__internal_businesses","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PrivateBusiness"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false,"required":["data","next_cursor"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}]}},"/internal/businesses/{business_id}":{"patch":{"summary":"Update profile; owner-only public consent","operationId":"patch__internal_businesses_business_id","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateBusiness"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":150},"city":{"type":"string","minLength":2,"maxLength":80},"categories":{"type":"array","items":{"type":"string"}},"brands":{"type":"array","items":{"type":"string"}},"product_keywords":{"type":"array","items":{"type":"string"}},"assortment_description":{"type":"string","minLength":5,"maxLength":2000},"service_area":{"type":"object","additionalProperties":true},"public_reuse_allowed":{"type":"boolean"},"accepting_inquiries":{"type":"boolean"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"website_url":{"type":"string","minLength":1,"maxLength":2048,"description":"Public HTTP(S) company website. Leading/trailing whitespace is trimmed; a missing scheme becomes https. Path is preserved, query/fragment removed. Credentials, localhost/private IP destinations and unsupported schemes are rejected. Supplying null or an empty value is invalid; omitting this field on PATCH preserves a legacy profile without a website."},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}]},"logo_data_url":{"anyOf":[{"type":"string","maxLength":350000,"description":"Owner-confirmed bounded base64 raster data URI; PNG, JPEG, WebP or GIF with validated file signature. SVG and other active formats are rejected. This is write/preview data only, never included in company list/profile output."},{"type":"null"}]}},"additionalProperties":false}}}},"security":[{"SessionCookie":[]}],"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Omitted PATCH fields preserve saved values; explicit empty brands/product_keywords arrays clear them. A supplied city updates the MVP branch city atomically while preserving address and opening hours. Website/location/logo are owner-confirmed fields; omitted fields preserve existing values. location:null clears the address and logo_data_url:null removes the logo. Explicit city wins; otherwise a supplied location.city updates company and branch city. Existing profiles without a website remain editable; these fields do not grant publication, indexing or verification."}},"/internal/admin/businesses":{"get":{"summary":"Read the closed company moderation queue","operationId":"get__internal_admin_businesses","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"description":"Requires an active signed-in user whose email is in ADMIN_EMAILS. Ordinary business owners receive403; unauthenticated callers receive401. Ordered by creation time and UUID, oldest first. The cursor is the last returned business UUID and remains valid if that company's moderation status changes. Company profile fields, owner email, contact verification time and the latest owner-facing correction note only; no sessions, credentials, inquiries or private conversations. Defaults to all registered companies, including draft and archived profiles. review_status selects one independent review column; counts cover all four columns for the current q and ignore both status filters and cursor. Non-all publication and review filters cannot be combined.","parameters":[{"in":"query","name":"q","schema":{"type":"string","maxLength":200},"description":"Optional trimmed case-insensitive search over company name, city and owner email."},{"in":"query","name":"status","deprecated":true,"description":"Legacy publication filter. Use review_status for the four-column review workflow.","schema":{"type":"string","enum":["pending_review","published","suspended","all"],"default":"all"}},{"in":"query","name":"review_status","schema":{"type":"string","enum":["new","in_progress","successful","rejected","all"],"default":"all"}},{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100,"default":30}},{"in":"query","name":"cursor","schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"A bounded page of companies available only to the configured administrator.","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AdminReviewBusiness"}},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"counts":{"$ref":"#/components/schemas/BusinessReviewCounts"}},"required":["data","next_cursor","counts"],"additionalProperties":false}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Current user is not an allowlisted administrator","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid filter, page limit or cursor","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/admin/businesses/{business_id}/moderate":{"post":{"summary":"Move a company through the private review workflow as configured platform moderator","operationId":"post__internal_admin_businesses_business_id_moderate","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["published","suspended","pending_review"]},"review_status":{"$ref":"#/components/schemas/BusinessReviewStatus"},"search_indexable":{"type":"boolean"},"moderation_note":{"$ref":"#/components/schemas/ModerationNote"}},"required":["id","status","review_status","search_indexable","moderation_note"],"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","enum":["published","suspended","pending_review"],"description":"Legacy publication alias; optional when review_status is supplied."},"review_status":{"$ref":"#/components/schemas/BusinessReviewStatus"},"search_indexable":{"type":"boolean","description":"Optional moderator-only search visibility. Publication remains the approval gate; false excludes a technical/test profile from sitemap and public directory. True requires published, non-demo and supported city."},"note":{"type":"string","maxLength":1000,"description":"Optional owner-facing correction note, trimmed by the server. Stored in the moderation audit, never in public profile/search responses. Explicit review_status=rejected requires a nonempty reason. Otherwise empty or omitted clears the previous note."}},"additionalProperties":false,"anyOf":[{"required":["review_status"]},{"required":["status"]}],"allOf":[{"if":{"required":["review_status"],"properties":{"review_status":{"enum":["new","in_progress"]}}},"then":{"properties":{"status":{"const":"pending_review"}}}},{"if":{"required":["review_status"],"properties":{"review_status":{"const":"successful"}}},"then":{"properties":{"status":{"const":"published"}}}},{"if":{"required":["review_status"],"properties":{"review_status":{"const":"rejected"}}},"then":{"required":["note"],"properties":{"status":{"const":"suspended"},"note":{"minLength":1,"pattern":"\\S"}}}}]}}}},"security":[{"SessionCookie":[]}],"description":"ADMIN_EMAILS allowlist only. Every moderation write and its owner-facing note are audited atomically. new and in_progress map to pending_review publication; successful maps to published; rejected maps to suspended. Legacy status-only requests remain supported: pending_review maps to new, published to successful and suspended to rejected. When both fields are supplied their mapping must agree. An explicit rejected review status requires a reason, while legacy suspended requests retain their optional-note behavior. Both prior and resulting review/publication states are audited. The latest note is visible in its own business workspace and the closed moderation queue, never public APIs or profiles. Publication does not upgrade identity verification. Administrative MFA and business identity documentary verification remain release requirements, not implemented here.","parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/requests":{"post":{"summary":"Create private request for one to five businesses","operationId":"post__v1_requests","x-implementation-status":"implemented","responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateRequest"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateRequest"}}}},"security":[{"SessionCookie":[]},{"ApiKeyBearer":[]},{},{"OAuth2":["requests:write"]}],"description":"Guest allowed with quotas and random HttpOnly principal cookie; no customer account required. Response issues guest_access_token once (24h, hashed at rest) and request-specific HttpOnly cookie. Idempotency is principal-scoped,24h; same key changed payload409. Replay200 contains no raw secret. Normalized same-recipient query suppression10min. Deadline required, future,max7days; UI defaults24h. Creates pending, independent inquiries. 0recipients422no_recipients. Atomic request, inquiries, audit and durableoutbox.","parameters":[{"in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string","minLength":8,"maxLength":200}}]}},"/v1/requests/{request_id}":{"get":{"summary":"Read private request and each answer immediately","operationId":"get__v1_requests_request_id","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateRequest"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{"GuestRequestCookie":[]},{"OAuth2":["requests:read"]}],"description":"Only requester session, its API application or request-scoped guest secret. Responses available while in_progress. Unrelated callers404; no business can read other businesses' answers.","parameters":[{"in":"path","name":"request_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/requests/{request_id}/cancel":{"post":{"summary":"Cancel own active request","operationId":"post__v1_requests_request_id_cancel","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateRequest"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{"GuestRequestCookie":[]},{"OAuth2":["requests:read","requests:write"]}],"description":"Repeated cancellation is idempotent. Other terminal states409. No terminal-to-active transitions. Integrator writes require requests:write; read-only keys cannot cancel or post messages.","parameters":[{"in":"path","name":"request_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/public/requests/{public_id}":{"get":{"summary":"Read safe anonymized public status","operationId":"get__v1_public_requests_public_id","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicRequest"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[],"description":"public_id is not authorization. Only public_id/status; no request_id, messages, price, contacts, question, query. Cache-Control:no-store; X-Robots-Tag:noindex,nofollow. UI /request/{public_id}.","parameters":[{"in":"path","name":"public_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/public/requests/{public_id}/private":{"get":{"summary":"Authorize request cookie/Bearer and read private details","operationId":"get__v1_public_requests_public_id_private","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateRequest"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{"GuestRequestCookie":[]},{"OAuth2":["requests:read"]}],"description":"Cookie convenience endpoint; public_id alone grants nothing. Same object checks as /requests/{request_id}.","parameters":[{"in":"path","name":"public_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/internal/inquiries":{"get":{"summary":"Read isolated seller inbox","operationId":"get__internal_inquiries","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Inquiry"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false,"required":["data","next_cursor"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}]}},"/internal/inquiries/{inquiry_id}/respond":{"post":{"summary":"Submit substantive manual answer","operationId":"post__internal_inquiries_inquiry_id_respond","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Response"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResponseInput"}}}},"security":[{"SessionCookie":[]}],"description":"Server sets checked_at at confirmation. Availability TTL<=30m; price<=24h, independent and nullable. Price never proves stock. Human source enforced. Text-only answer allowed. At/after request deadline409. Final answer, inquiry transition, audit and outbox are atomic. Public reuse requires owner profile opt-in plus response opt-in and unambiguous item identity.","parameters":[{"in":"path","name":"inquiry_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/internal/inquiries/{inquiry_id}/decline":{"post":{"summary":"Decline taking inquiry; no substantive answer","operationId":"post__internal_inquiries_inquiry_id_decline","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"inquiry_id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["declined"]}},"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}],"parameters":[{"in":"path","name":"inquiry_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/inquiries/{inquiry_id}/messages":{"get":{"summary":"Read authorized private chronological messages","operationId":"get__v1_inquiries_inquiry_id_messages","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Message"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false,"required":["data","next_cursor"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{"GuestRequestCookie":[]},{"OAuth2":["requests:read"]}],"parameters":[{"in":"path","name":"inquiry_id","required":true,"schema":{"type":"string","format":"uuid"}}]},"post":{"summary":"Ask one clarification or reply to the opposite party","operationId":"post__v1_inquiries_inquiry_id_messages","x-implementation-status":"implemented","responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Message"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MessageInput"}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{"GuestRequestCookie":[]},{"OAuth2":["requests:read","requests:write"]}],"description":"One active clarification per inquiry, max30min capped by request deadline; question is not final answer. Reply resolves current opposite-party question; server assigns reply_to. State awaiting/answered/expired. Emits inquiry.message.created resource IDs only; no private text in outbox webhook payload. Integrator writes require requests:write; read-only keys cannot cancel or post messages.","parameters":[{"in":"path","name":"inquiry_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/internal/responses/{response_id}/revoke":{"post":{"summary":"Immediately revoke own confirmation and public offer","operationId":"post__internal_responses_response_id_revoke","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"revoked":{"type":"boolean"}},"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"SessionCookie":[]}],"parameters":[{"in":"path","name":"response_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/internal/responses/{response_id}/correct":{"post":{"summary":"Append corrected response version and revoke old version","operationId":"post__internal_responses_response_id_correct","x-implementation-status":"planned","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Response"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResponseInput"}}}},"security":[{"SessionCookie":[]}],"description":"MVP release target AT14. Initial slice supports revocation; correction version authoring is pending.","parameters":[{"in":"path","name":"response_id","required":true,"schema":{"type":"string","format":"uuid"}}]}},"/v1/offers":{"get":{"summary":"Read opted-in independently fresh public offer fields","operationId":"get__v1_offers","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PublicOffer"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false,"required":["data","next_cursor"]}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[],"description":"Whitelist only brand/model/sku/variant/color/size and branch_id in normalized item identity. Never messages, contacts, inquiry/request IDs or seller private notes. At least one field must be fresh. Stale values null. Revocation/profile opt-out removes offers immediately. Filter support is planned."}},"/v1/developer/apps":{"post":{"summary":"Create an owned developer application","operationId":"post__v1_developer_apps","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeveloperApp"}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":120}},"required":["name"],"additionalProperties":false}}}},"description":"Verified email session. At most10 applications per user. Ownership is checked independently of business tenant membership. Production defaults DEVELOPER_PROVISIONING=operator_only: creation additionally requires the current owner email in INTEGRATION_OPERATOR_EMAILS. Existing owner isolation, keys, list/revoke/usage and agent access remain unchanged. The business website never issues integration keys."},"get":{"summary":"List current user developer applications","operationId":"get__v1_developer_apps","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DeveloperApp"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["data","next_cursor"],"additionalProperties":false}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/developer/keys":{"post":{"summary":"Issue a scoped API key once","operationId":"post__v1_developer_keys","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuedApiKey"}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"app_id":{"type":"string","format":"uuid"},"name":{"type":"string","minLength":2,"maxLength":120},"scopes":{"type":"array","minItems":1,"maxItems":4,"items":{"type":"string","enum":["businesses:read","requests:read","requests:write","webhooks:write"]}},"expires_at":{"type":"string","format":"date-time"}},"required":["app_id","name","scopes"],"additionalProperties":false}}}},"description":"Application owner only. Defaults expiry30days; explicit expiry must be future and at most365days. At most10 active keys/application. Raw secret appears once. Store hash, short prefix and usage metadata. Never in URLs/logs. Requests:write does not imply requests:read. Production defaults DEVELOPER_PROVISIONING=operator_only: creation additionally requires the current owner email in INTEGRATION_OPERATOR_EMAILS. Existing owner isolation, keys, list/revoke/usage and agent access remain unchanged. The business website never issues integration keys."},"get":{"summary":"List masked metadata for owned application keys","operationId":"get__v1_developer_keys","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ApiKeyMetadata"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["data","next_cursor"],"additionalProperties":false}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"query","name":"app_id","schema":{"type":"string","format":"uuid"}}],"description":"No api_key or secret_hash in list. Optional app_id must belong to this user."}},"/v1/developer/keys/{key_id}":{"delete":{"summary":"Revoke an owned API key immediately","operationId":"delete__v1_developer_keys__key_id_","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"revoked":{"type":"boolean","const":true}},"required":["id","revoked"],"additionalProperties":false}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"path","name":"key_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Owner only. Repeated revocation idempotent. Unauthorized modification denied and audited after transaction rollback. Revoked keys cannot connect MCP or access private requests."}},"/v1/me/usage":{"get":{"summary":"Read actual usage and quotas for owned applications","operationId":"get__v1_me_usage","x-implementation-status":"implemented","security":[{"SessionCookie":[]},{"ApiKeyBearer":[]},{"OAuth2":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Usage"}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"query","name":"app_id","schema":{"type":"string","format":"uuid"}}],"description":"Session sees own applications; API key sees only its application. Counts are actual requests and keyed search events over rolling24hours. Search limit10/key/min, requests20/app/day."}},"/v1/webhooks":{"post":{"summary":"Register explicitly subscribed safe HTTPS webhook","operationId":"post__v1_webhooks","x-implementation-status":"implemented","security":[{"SessionCookie":[]},{"ApiKeyBearer":[]}],"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuedWebhook"}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"app_id":{"type":"string","format":"uuid"},"url":{"type":"string","format":"uri","maxLength":2048},"events":{"type":"array","minItems":1,"maxItems":10,"items":{"type":"string","enum":["request.created","request.updated","request.completed","inquiry.delivered","inquiry.opened","inquiry.answered","inquiry.declined","inquiry.expired","inquiry.delivery_failed","inquiry.message.created"]}}},"required":["app_id","url","events"],"additionalProperties":false}}}},"description":"At most10 active destinations/app. Only globally routable public IPs; reject credentials, local/private/reserved DNS/IP, fragments, mixed public/private DNS sets. DNS revalidated every attempt and resolved IP pinned while preserving TLS certificate validation. No redirects. Sender returns signing secret once, encrypted at rest."},"get":{"summary":"List owned webhook metadata and delivery totals","operationId":"get__v1_webhooks","x-implementation-status":"implemented","security":[{"SessionCookie":[]},{"ApiKeyBearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Webhook"}},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["data","next_cursor"],"additionalProperties":false}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"query","name":"app_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Owner session or same application key with webhooks:write. Signing secret never returned after creation."}},"/v1/webhooks/{webhook_id}":{"delete":{"summary":"Disable an owned webhook","operationId":"delete__v1_webhooks__webhook_id_","x-implementation-status":"implemented","security":[{"SessionCookie":[]},{"ApiKeyBearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["disabled"]}},"required":["id","status"],"additionalProperties":false}}}},"400":{"description":"HTTP400","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"HTTP401","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"HTTP403","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"HTTP404","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"HTTP409","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"HTTP422","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"HTTP429","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"HTTP503","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"path","name":"webhook_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Disables future delivery. Owner session or same application key with webhooks:write. Already attempted network delivery cannot be undone."}},"/v1/abuse-reports":{"post":{"summary":"Report spam or inaccurate company","operationId":"post__v1_abuse_reports","x-implementation-status":"planned","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"status":{"type":"string"}},"additionalProperties":false}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"object_id":{"type":"string"},"reason":{"type":"string"}},"additionalProperties":false,"required":["object_id","reason"]}}}},"security":[{"SessionCookie":[]},{"GuestBearer":[]},{"ApiKeyBearer":[]},{}]}},"/mcp":{"post":{"summary":"Remote MCP transport","operationId":"post__mcp","x-implementation-status":"implemented","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"headers":{"WWW-Authenticate":{"description":"Bearer resource_metadata points to configured /.well-known/oauth-protected-resource/mcp.","schema":{"type":"string"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict or terminal resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Quota exceeded; Retry-After response header","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"security":[{"ApiKeyBearer":[]},{"OAuth2":[]}],"description":"Official SDK stateless StreamableHTTP. Requires a scoped integration API key or browser-consented OAuth access token. OAuth private requests are isolated to this connected user and client. Six tools retain their existing names and publish titles, input/output schemas, safety annotations and OAuth securitySchemes mirrored in _meta. get_business_profile accepts exactly one business_id or an AgentConnect passport contact. Search/profile require businesses:read; private reads requests:read; create requests:write; send requests:read and requests:write. Writes require user_confirmed:true based on the actual direct user request, without redundant confirmation. Never buy/reserve/pay. Tools recheck REST authorization, quotas and idempotency. Outer transport holds neither the database queue nor a SQL transaction. Missing/invalid credentials return401 with OAuth discovery; insufficient tool scope returns an MCP auth challenge.","x-tools":[{"name":"search_businesses","input":{"query":"string?","city":"string?","category":"string?","brand":"string?","limit":"1..30(default10)"},"scope":"businesses:read"},{"name":"get_business_profile","input":{"business_id":"uuid"},"scope":"businesses:read"},{"name":"create_inquiry","input":{"business_ids":"uuid[1..5]","type":"inquiry enum","query":"object","question":"string","language":"pt-BR|en|ru(defaultpt-BR)","deadline_at":"ISO datetime(default24h)","idempotency_key":"string8..200","user_confirmed":true},"scope":"requests:write"},{"name":"get_request_status","input":{"request_id":"uuid"},"scope":"requests:read"},{"name":"get_inquiry_messages","input":{"inquiry_id":"uuid"},"scope":"requests:read"},{"name":"send_inquiry_message","input":{"inquiry_id":"uuid","type":"clarification|reply","text":"string","user_confirmed":true},"scope":"requests:write"}]}},"/v1/config":{"get":{"summary":"Read only the actually configured email transport mode","operationId":"get__v1_config","x-implementation-status":"implemented","security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicMailConfiguration"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"description":"Exactly {mail_mode:local|smtp}. No SMTP host/user/password, sender, allowed recipients, OTP or secrets. smtp indicates the configured transport; provider acceptance or inbox delivery is not implied."}},"/internal/businesses/{business_id}/notification-preferences":{"get":{"summary":"Read owner business email notification preferences","operationId":"get__internal_businesses__business_id__notification_preferences","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BusinessNotificationPreferences"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Organization owner with current owner membership only. Defaults true/true/pt-BR. No arbitrary recipient or email list. Notifications go only to the active verified current owner; messages from a business never email the requester."},"patch":{"summary":"Update owner business notification switches and language","operationId":"patch__internal_businesses__business_id__notification_preferences","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BusinessNotificationPreferences"}}}},"401":{"description":"Authentication required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Permission denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Missing or inaccessible resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Validation or policy error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"new_inquiry_email":{"type":"boolean"},"requester_message_email":{"type":"boolean"},"language":{"type":"string","enum":["pt-BR","en","ru"]}},"required":[],"additionalProperties":false,"minProperties":1}}}},"description":"At least one property required; additional fields, including recipient_email, rejected. Audited and atomic. Preferences/access/contact verification/read state are rechecked before each delivery attempt. Language and safe web link are snapshotted at enqueue, so retries keep identical content; future jobs use changed preferences."}},"/robots.txt":{"get":{"summary":"Public crawl policy with dynamic sitemap location","operationId":"get_robots_txt","x-implementation-status":"implemented","security":[],"responses":{"200":{"description":"Robots exclusions for app, private requests and API","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/sitemap.xml":{"get":{"summary":"Dynamic canonical public sitemap","operationId":"get_sitemap_xml","x-implementation-status":"implemented","security":[],"description":"Homepage and published non-demo search-indexable business profiles in supported cities only. Retired human search/docs/developer pages and all private requests are excluded.","responses":{"200":{"description":"XML sitemap","content":{"application/xml":{"schema":{"type":"string"}}}}}}},"/openapi.json":{"get":{"summary":"Read the public machine-readable API contract","operationId":"get_openapi_json","x-implementation-status":"implemented","security":[],"description":"Public metadata only. URLs use configured FRONTEND_ORIGIN, never request Host. No credentials, private records or claim of an official AI-provider integration.","responses":{"200":{"description":"Machine metadata","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/.well-known/agentconnect.json":{"get":{"summary":"Read the AgentConnect-specific machine descriptor","operationId":"get_agentconnect_discovery","x-implementation-status":"implemented","security":[],"description":"Public metadata only. URLs use configured FRONTEND_ORIGIN, never request Host. No credentials, private records or claim of an official AI-provider integration.","responses":{"200":{"description":"Machine metadata","content":{"application/json":{"schema":{"type":"object","properties":{"format":{"type":"string","const":"agentconnect-discovery-v1"},"standard":{"type":"boolean","const":false},"name":{"type":"string"},"version":{"type":"string"},"description":{"type":"string"},"website_url":{"type":"string","format":"uri"},"openapi_url":{"type":"string","format":"uri"},"rest_base_url":{"type":"string","format":"uri"},"mcp":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"transport":{"type":"string","const":"streamable_http"},"method":{"type":"string","const":"POST"},"authentication":{"type":"string","const":"bearer_api_key"},"scopes":{"type":"array","items":{"type":"string","enum":["businesses:read","requests:read","requests:write","webhooks:write"]}},"authentication_methods":{"type":"array","items":{"type":"string","enum":["bearer_api_key","oauth2"]},"minItems":2,"uniqueItems":true},"oauth":{"type":"object","properties":{"resource":{"type":"string","format":"uri"},"resource_metadata_url":{"type":"string","format":"uri"},"authorization_metadata_url":{"type":"string","format":"uri"},"user_and_client_scoped_private_access":{"type":"boolean","const":true},"scopes":{"type":"array","items":{"type":"string"}}},"required":["resource","resource_metadata_url","authorization_metadata_url","user_and_client_scoped_private_access","scopes"],"additionalProperties":false}},"additionalProperties":false,"required":["url","transport","method","authentication","scopes","authentication_methods","oauth"]},"credential_provisioning":{"type":"string","enum":["operator_only","authenticated_owner_api"]},"search":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"does_not_confirm_inventory":{"type":"boolean","const":true}},"additionalProperties":false,"required":["url","does_not_confirm_inventory"]},"tools":{"type":"array","items":{"type":"string","enum":["search_businesses","get_business_profile","create_inquiry","get_request_status","get_inquiry_messages","send_inquiry_message"]}},"rules":{"type":"object","properties":{"explicit_user_confirmation_for_writes":{"type":"boolean","const":true},"application_scoped_private_access":{"type":"boolean","const":true},"rate_limits_apply":{"type":"boolean","const":true},"no_automatic_purchase_reservation_or_payment":{"type":"boolean","const":true}},"additionalProperties":false,"required":["explicit_user_confirmation_for_writes","application_scoped_private_access","rate_limits_apply","no_automatic_purchase_reservation_or_payment"]}},"additionalProperties":false,"required":["format","standard","name","version","description","website_url","openapi_url","rest_base_url","mcp","credential_provisioning","search","tools","rules"]}}}}}}},"/v1/businesses/by-handle/{handle}":{"get":{"summary":"Resolve a published company by its current or historical public handle","operationId":"get__v1_businesses_by_handle_handle","x-implementation-status":"implemented","security":[],"parameters":[{"in":"path","name":"handle","required":true,"schema":{"$ref":"#/components/schemas/PublicHandle"}}],"description":"Returns only the published public profile. Historical aliases stay permanently reserved to their original company and return its latest public_handle/contact_path. Invalid, unknown and unpublished handles all return 404. No owner email, private permissions, review status, moderation notes or conversations are exposed.","responses":{"200":{"description":"Published public company with current primary contact paths.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Business"}}}},"404":{"description":"Invalid, unknown or unpublished public handle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/businesses/{business_id}/public-handle":{"patch":{"summary":"Change a company contact handle as its organization owner","operationId":"patch__internal_businesses_business_id_public_handle","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Active owning-organization owner only; a staff assignment or administrator allowlist membership alone grants no permission. Surrounding whitespace is trimmed, then the lowercase Latin slug is validated. Name edits never change the handle. Previous aliases are permanently reserved to the same company and can be restored by its owner. Primary change and audit are atomic; conflicts preserve the previous primary. The result is the complete private company view, including current permissions and moderation fields.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"handle":{"$ref":"#/components/schemas/PublicHandle"}},"required":["handle"],"additionalProperties":false}}}},"responses":{"200":{"description":"Updated full private company view; a no-op preserves the current handle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivateBusiness"}}}},"401":{"description":"Active verified session required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Assigned staff cannot change the public handle; code public_handle_owner_required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Company missing or outside the user tenant scope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Current or historical handle reserved by another company; code public_handle_taken.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input, reserved name or noncanonical handle; code invalid_public_handle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Change failed atomically; previous primary remains intact.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/@{handle}":{"get":{"summary":"Open a published company contact page","operationId":"get__public_company_contact_page","x-implementation-status":"implemented","security":[],"parameters":[{"in":"path","name":"handle","required":true,"schema":{"$ref":"#/components/schemas/PublicHandle"}}],"description":"Public server-rendered contact page with For AI contact documentation and safe public company fields. The primary short path hydrates the page while SEO canonical URL remains the geographical profile when available. Publication is required; search_indexable affects indexing only, not access. Historical aliases and trailing slashes redirect to the current primary short path.","responses":{"200":{"description":"Server-rendered public contact page.","content":{"text/html":{"schema":{"type":"string"}}}},"308":{"description":"Historical or noncanonical alias; redirects to the same company current primary path.","headers":{"Location":{"schema":{"type":"string"},"description":"Relative current primary contact or descriptor path."}}},"404":{"description":"Unknown or unpublished company.","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/@{handle}/agent.json":{"get":{"summary":"Read public company-specific AI contact documentation","operationId":"get__public_company_agent_descriptor","x-implementation-status":"implemented","security":[],"parameters":[{"in":"path","name":"handle","required":true,"schema":{"$ref":"#/components/schemas/PublicHandle"}}],"description":"Custom informational descriptor, not a standard A2A Agent Card or an automatic AI integration. It describes the existing guest REST flow and separately the existing integrator-key MCP flow. It grants no permission: write actions still require the user company-specific authorization. Contains no private owner data or real credentials. Always no-store and noindex; publication is required. Historical aliases redirect to the current descriptor path.","responses":{"200":{"description":"Public custom contact descriptor; examples are placeholders and must never be sent automatically.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompanyAgentDescriptor"}}}},"308":{"description":"Historical or noncanonical alias; redirects to the same company current primary path.","headers":{"Location":{"schema":{"type":"string"},"description":"Relative current primary contact or descriptor path."}}},"404":{"description":"Invalid, unknown or unpublished handle.","content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string","const":"not_found"},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false}}}}}}},"/internal/website-preview":{"post":{"summary":"Preview company information from a public website for owner confirmation","operationId":"post__internal_website_preview","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"description":"Active signed-in user only, five attempts per minute per user including failed fetches. URL is normalized and public network destinations are checked. Fetches are bounded; no cookies or credentials are forwarded. Returns untrusted suggestions only and writes no company profile, publication, verification or indexing fields. The client must let the owner review/edit before normal create/PATCH persistence.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"website_url":{"type":"string","minLength":1,"maxLength":2048,"description":"Public HTTP(S) company website. Leading/trailing whitespace is trimmed; a missing scheme becomes https. Path is preserved, query/fragment removed. Credentials, localhost/private IP destinations and unsupported schemes are rejected. Supplying null or an empty value is invalid; omitting this field on PATCH preserves a legacy profile without a website."}},"required":["website_url"],"additionalProperties":false}}}},"responses":{"200":{"description":"Suggestions with optional fields represented as null and stable warning codes.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebsiteImportPreview"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Origin forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid or disallowed public website URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Five attempts per minute exceeded; Retry-After applies.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"502":{"description":"Website fetch failed or response too large.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"504":{"description":"Bounded website import timed out.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/v1/businesses/{business_id}/logo":{"get":{"summary":"Read a validated company raster logo","operationId":"get__v1_businesses_business_id_logo","x-implementation-status":"implemented","security":[{},{"SessionCookie":[]}],"parameters":[{"in":"path","name":"business_id","required":true,"schema":{"type":"string","format":"uuid"}}],"description":"Anonymous access only when the company is published. An unpublished logo is available only to an active owning user or assigned manager with access to this company; other callers receive404. Validates the raster file signature before serving. Always no-store and nosniff; no company profile or other private data is returned.","responses":{"200":{"description":"Bounded raw PNG/JPEG/WebP/GIF bytes with matching Content-Type; no-store and X-Content-Type-Options:nosniff.","content":{"image/png":{"schema":{"type":"string","format":"binary"}},"image/jpeg":{"schema":{"type":"string","format":"binary"}},"image/webp":{"schema":{"type":"string","format":"binary"}},"image/gif":{"schema":{"type":"string","format":"binary"}}}},"404":{"description":"Missing logo, invalid raster data, unpublished company or caller outside its authorized tenant scope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/.well-known/oauth-authorization-server":{"get":{"summary":"Read public OAuth discovery metadata","operationId":"get__well_known_oauth_authorization_server","security":[],"x-implementation-status":"implemented","description":"Configured origin only, never request Host. Public metadata contains no users, credentials or private requests.","responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthAuthorizationMetadata"}}}}}}},"/.well-known/oauth-protected-resource":{"get":{"summary":"Read public OAuth discovery metadata","operationId":"get__well_known_oauth_protected_resource","security":[],"x-implementation-status":"implemented","description":"Configured origin only, never request Host. Public metadata contains no users, credentials or private requests.","responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthProtectedResourceMetadata"}}}}}}},"/.well-known/oauth-protected-resource/mcp":{"get":{"summary":"Read public OAuth discovery metadata","operationId":"get__well_known_oauth_protected_resource_mcp","security":[],"x-implementation-status":"implemented","description":"Configured origin only, never request Host. Public metadata contains no users, credentials or private requests.","responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthProtectedResourceMetadata"}}}}}}},"/oauth/authorize":{"get":{"summary":"Start browser-consented ChatGPT account connection","operationId":"get__oauth_authorize","security":[],"x-implementation-status":"implemented","description":"Fixed public client only, authorization_code with S256 PKCE. Exact allowlisted redirect_uri, nonempty state, supported nonempty scopes and resource equal to configured origin + /mcp are mandatory. Issues a short-lived HttpOnly browser-binding cookie and redirects to the first-party login/consent page. No API access is granted before explicit browser consent. Every external OAuth authorization response includes issuer identification.","parameters":[{"in":"query","name":"client_id","required":true,"schema":{"type":"string","const":"agentconnect-chatgpt"}},{"in":"query","name":"redirect_uri","required":true,"schema":{"type":"string","format":"uri"}},{"in":"query","name":"response_type","required":true,"schema":{"type":"string","const":"code"}},{"in":"query","name":"state","required":true,"schema":{"type":"string","minLength":1,"maxLength":2048}},{"in":"query","name":"resource","required":true,"schema":{"type":"string","format":"uri"}},{"in":"query","name":"scope","required":true,"schema":{"type":"string"}},{"in":"query","name":"code_challenge","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$"}},{"in":"query","name":"code_challenge_method","required":true,"schema":{"type":"string","const":"S256"}}],"responses":{"302":{"description":"OAuth error to the validated exact callback; includes original state and iss.","headers":{"Location":{"schema":{"type":"string","format":"uri"}}}},"303":{"description":"First-party browser login/consent; no-store.","headers":{"Location":{"schema":{"type":"string","format":"uri"}},"Set-Cookie":{"description":"Short-lived HttpOnly SameSite=Lax browser binding, not an API credential.","schema":{"type":"string"}}}},"400":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"429":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/oauth/token":{"post":{"summary":"Exchange a PKCE authorization code or rotate a refresh token","operationId":"post__oauth_token","security":[],"x-implementation-status":"implemented","description":"Public client token endpoint: client_id in form, token_endpoint_auth_method=none. No client secret or Authorization header. Exact resource binding is required on both grants. One-time authorization codes and rotating refresh tokens; replay revokes the affected token family. Tokens grant only this user/client application access, never browser owner/admin/developer provisioning. Cross-origin OAuth clients do not use owner cookies.","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"oneOf":[{"type":"object","properties":{"grant_type":{"type":"string","const":"authorization_code"},"client_id":{"type":"string","const":"agentconnect-chatgpt"},"code":{"type":"string"},"code_verifier":{"type":"string","minLength":43,"maxLength":128},"redirect_uri":{"type":"string","format":"uri"},"resource":{"type":"string","format":"uri"}},"required":["grant_type","client_id","code","code_verifier","redirect_uri","resource"],"additionalProperties":false},{"type":"object","properties":{"grant_type":{"type":"string","const":"refresh_token"},"client_id":{"type":"string","const":"agentconnect-chatgpt"},"refresh_token":{"type":"string"},"resource":{"type":"string","format":"uri"},"scope":{"type":"string"}},"required":["grant_type","client_id","refresh_token","resource"],"additionalProperties":false}]}}}},"responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthTokens"}}}},"400":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"429":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/oauth/revoke":{"post":{"summary":"Revoke this OAuth connection using one of its tokens","operationId":"post__oauth_revoke","security":[],"x-implementation-status":"implemented","description":"RFC7009 public-client form endpoint. Revokes only the grant owning the supplied access/refresh token and its token families. Other users and legacy API keys are unaffected. Unknown tokens receive the same successful empty response.","requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"client_id":{"type":"string","const":"agentconnect-chatgpt"},"token":{"type":"string"},"token_type_hint":{"type":"string","enum":["access_token","refresh_token"]}},"required":["client_id","token"],"additionalProperties":false}}}},"responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"type":"object","properties":{},"required":[],"additionalProperties":false}}}},"400":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"429":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/oauth/authorization":{"get":{"summary":"Read this browser-bound pending OAuth consent","operationId":"get__internal_oauth_authorization","security":[{"SessionCookie":[]}],"x-implementation-status":"implemented","description":"Authenticated active verified user plus matching ac_oauth_browser HttpOnly cookie and unconsumed flow. Includes account email for the human consent screen only, never an MCP model tool. Terms requirement persists if a newly registered OAuth user previously cancelled before accepting terms. No tokens returned.","parameters":[{"in":"query","name":"flow","required":true,"schema":{"type":"string","pattern":"^oaf_[A-Za-z0-9_-]{43}$"}}],"responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthAuthorization"}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/oauth/authorize":{"post":{"summary":"Explicitly allow or deny this pending OAuth connection","operationId":"post__internal_oauth_authorize","security":[{"SessionCookie":[]}],"x-implementation-status":"implemented","description":"Exact configured Origin plus active verified session, matching browser-bound flow/user and server-issued CSRF token required. decision=allow atomically creates or reconnects this user/client application and one-time code; deny grants nothing. New OAuth registrations must explicitly accept current terms when terms_required=true. Returns only the validated external callback URL for browser navigation, with state and iss.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"flow":{"type":"string"},"decision":{"type":"string","enum":["allow","deny"]},"csrf_token":{"type":"string"},"accept_terms":{"type":"boolean"}},"required":["flow","decision","csrf_token"],"additionalProperties":false}}}},"responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"type":"object","properties":{"redirect_url":{"type":"string","format":"uri"}},"required":["redirect_url"],"additionalProperties":false}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/oauth/connections":{"get":{"summary":"List only your connected OAuth applications","operationId":"get__internal_oauth_connections","security":[{"SessionCookie":[]}],"x-implementation-status":"implemented","description":"Browser session only. Returns safe connection metadata without token values, API credential rows or other users.","responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/OAuthConnection"}},"next_cursor":{"type":"null"}},"required":["data","next_cursor"],"additionalProperties":false}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/oauth/connections/{id}/revoke":{"post":{"summary":"Disconnect one of your own OAuth applications","operationId":"post__internal_oauth_connections_id_revoke","security":[{"SessionCookie":[]}],"x-implementation-status":"implemented","description":"Requires exact configured Origin and owning active browser session. Atomically revokes this grant and its access/refresh token families. Historical app-scoped requests remain private. Other connections and legacy keys remain usable.","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string","format":"uuid"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{},"required":[],"additionalProperties":false}}}},"responses":{"200":{"description":"Success; no-store.","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","const":true}},"required":["ok"],"additionalProperties":false}}}},"401":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Request rejected; no-store.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/internal/admin/mail":{"get":{"summary":"Read private administrator-composed support mail history","operationId":"get_internal_admin_mail","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"description":"Configured active administrator browser session only. Any Authorization header is rejected, including OAuth and developer API keys alongside cookies. History includes the single recipient, subject and plain-text body; no SMTP credentials, provider receipt IDs, claim tokens or idempotency hashes. Fixed sender capability is returned for the UI. Newest first, ordered by created_at then id descending. Always no-store.","parameters":[{"in":"query","name":"limit","schema":{"type":"integer","minimum":1,"maximum":100,"default":30}},{"in":"query","name":"cursor","schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"Success; private no-store response.","content":{"application/json":{"schema":{"type":"object","properties":{"sender":{"$ref":"#/components/schemas/AdminMailSender"},"data":{"type":"array","items":{"$ref":"#/components/schemas/AdminMail"}},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]}},"required":["sender","data","next_cursor"],"additionalProperties":false}}}},"401":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"summary":"Queue one explicit administrator support email from help@biznoro.com","operationId":"post_internal_admin_mail","x-implementation-status":"implemented","security":[{"SessionCookie":[]}],"description":"Active configured administrator browser session and exact configured Origin required; no bearer/API/OAuth authentication. SUPPORT_MAIL_ENABLED plus the existing validated Resend transport must enable this feature. Fixed From AgentConnect <help@biznoro.com> and Reply-To help@biznoro.com; service noreply OTP/notification identity is unchanged. Single recipient and plain text only, no HTML/attachments/cc/bcc/custom headers. Canonicalization: recipient trimmed/lowercased, subject trimmed, body CRLF and standalone CR normalized to LF while retaining other whitespace. Same user + Idempotency-Key + same canonical payload returns current immutable row; changed payload409. The committed queue reserves caps:5/minute per admin,10/hour and50/day globally. Worker sends outside SQL/global request queue after durable claim. SMTP accepted is sent, not confirmed inbox delivery; local tests are captured. Only definite non-acceptance can retry, max3attempts. Ambiguous SMTP, expired sending lease or post-acceptance persistence failure becomes unknown and is not automatically resent. failed means definite non-acceptance and may be explicitly composed again with a new key.","parameters":[{"in":"header","name":"Idempotency-Key","required":true,"schema":{"type":"string","minLength":8,"maxLength":200,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]*$"}},{"in":"header","name":"Origin","required":true,"schema":{"type":"string","format":"uri"},"description":"Must equal the configured public frontend origin."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"to":{"type":"string","format":"email","maxLength":254},"subject":{"type":"string","minLength":1,"maxLength":200,"description":"Nonblank, no CR/LF or control characters."},"text":{"type":"string","minLength":1,"maxLength":12000,"description":"Nonblank plain text; no NUL/unsupported control characters."}},"required":["to","subject","text"],"additionalProperties":false}}}},"responses":{"200":{"description":"Idempotent replay of the existing immutable message and its latest state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminMailEnqueueResult"}}}},"202":{"description":"Durably queued; this does not claim SMTP acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminMailEnqueueResult"}}}},"401":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Authentication, role, validation, idempotency, quota or sender configuration failure; never includes SMTP errors or secrets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}},"components":{"securitySchemes":{"SessionCookie":{"type":"apiKey","in":"cookie","name":"ac_session"},"GuestBearer":{"type":"http","scheme":"bearer","bearerFormat":"opaque request-scoped secret"},"ApiKeyBearer":{"type":"http","scheme":"bearer","bearerFormat":"opaque scoped API credential"},"GuestRequestCookie":{"type":"apiKey","in":"header","name":"Cookie","description":"Browser sends a request-specific HttpOnly cookie named ac_request_<public_id>. The public identifier alone grants no authorization."},"OAuth2":{"type":"oauth2","description":"Browser-consented public client authorization-code + S256 PKCE. Access is bound to the configured /mcp resource and this connected user/client. No business-owner, admin, developer-key provisioning or other user access.","flows":{"authorizationCode":{"authorizationUrl":"https://biznoro.com/oauth/authorize","tokenUrl":"https://biznoro.com/oauth/token","refreshUrl":"https://biznoro.com/oauth/token","scopes":{"businesses:read":"Find and read public companies","requests:read":"Read your connected private requests and conversations","requests:write":"Send questions and replies authorized by you"}}}}},"schemas":{"PublicHandle":{"type":"string","minLength":3,"maxLength":64,"pattern":"^[a-z0-9]+(?:-[a-z0-9]+)*$","not":{"enum":["admin","administrator","agentconnect","agents","api","app","assets","auth","business","businesses","biznoro","catalog","contact","developers","docs","help","internal","login","logout","mcp","privacy","register","request","requests","robots","root","search","settings","sitemap","static","status","support","system","terms","www"]},"description":"Lowercase Latin letters, digits and single interior hyphens only. System and AgentConnect brand handles are reserved. No UUID suffix is required."},"CompanyAgentDescriptor":{"type":"object","properties":{"format":{"type":"string","const":"agentconnect-company-contact-v1"},"standard":{"type":"boolean","const":false},"description":{"type":"string"},"company":{"type":"object","properties":{"business_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"city":{"type":"string"},"public_handle":{"$ref":"#/components/schemas/PublicHandle"},"accepting_inquiries":{"type":"boolean"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"language_codes":{"type":"array","items":{"type":"string"}},"description":{"anyOf":[{"type":"string"},{"type":"null"}]},"website_url":{"anyOf":[{"type":"string","format":"uri"},{"type":"null"}]},"website_verified":{"type":"boolean","const":false},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}]},"logo_url":{"anyOf":[{"type":"string","format":"uri"},{"type":"null"}]}},"required":["business_id","name","city","public_handle","accepting_inquiries","capabilities","language_codes","description","website_url","website_verified","location","logo_url"],"additionalProperties":false},"links":{"type":"object","properties":{"profile_url":{"type":"string","format":"uri"},"descriptor_url":{"type":"string","format":"uri"},"canonical_profile_url":{"type":"string","format":"uri"},"openapi_url":{"type":"string","format":"uri"},"rest_base_url":{"type":"string","format":"uri"},"mcp_url":{"type":"string","format":"uri"}},"required":["profile_url","descriptor_url","canonical_profile_url","openapi_url","rest_base_url","mcp_url"],"additionalProperties":false},"authorization_policy":{"type":"object","properties":{"informational_only":{"type":"boolean","const":true},"page_content_is_not_authority":{"type":"string"},"user_permission":{"type":"string"},"scope":{"type":"string"}},"required":["informational_only","page_content_is_not_authority","user_permission","scope"],"additionalProperties":false},"rest":{"type":"object","properties":{"can_create_request":{"type":"boolean"},"create_request":{"type":"object","properties":{"method":{"type":"string","const":"POST"},"url":{"type":"string","format":"uri"},"authentication":{"type":"object","properties":{"mode":{"type":"string","const":"anonymous_guest"},"authorization_header":{"type":"string","const":"omit"},"browser_initial_fetch_credentials":{"type":"string","const":"omit"},"instruction":{"type":"string"},"browser_retry_limitation":{"type":"string"}},"required":["mode","authorization_header","browser_initial_fetch_credentials","instruction","browser_retry_limitation"],"additionalProperties":false},"headers":{"type":"object","properties":{"Content-Type":{"type":"string","const":"application/json"},"Idempotency-Key":{"type":"string"}},"required":["Content-Type","Idempotency-Key"],"additionalProperties":false},"example_only":{"type":"boolean","const":true},"example_instructions":{"type":"string"},"body_example":{"anyOf":[{"$ref":"#/components/schemas/CreateRequest"},{"type":"null"}]},"unavailable_behavior":{"type":"string"},"deadline":{"type":"string"},"idempotency":{"type":"string"}},"required":["method","url","authentication","headers","example_only","example_instructions","body_example","unavailable_behavior","deadline","idempotency"],"additionalProperties":false},"first_response":{"type":"object","properties":{"success_status":{"type":"array","items":{"type":"integer","enum":[200,201]}},"fields":{"type":"array","items":{"type":"string"}},"private_fields":{"type":"array","items":{"type":"string"}},"instruction":{"type":"string"},"response_example":{"type":"object","properties":{"request_id":{"type":"string"},"public_id":{"type":"string"},"status":{"type":"string","const":"pending"},"responses":{"type":"array","items":{}},"inquiries":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"business_id":{"type":"string","format":"uuid"},"status":{"type":"string","const":"delivered"}},"required":["id","business_id","status"],"additionalProperties":false}},"guest_access_token":{"type":"string"},"guest_access_expires_at":{"type":"string"}},"required":["request_id","public_id","status","responses","inquiries","guest_access_token","guest_access_expires_at"],"additionalProperties":false}},"required":["success_status","fields","private_fields","instruction","response_example"],"additionalProperties":false},"private_request":{"type":"object","properties":{"method":{"type":"string","const":"GET"},"url_template":{"type":"string"},"alternative_url_template":{"type":"string"},"authentication":{"type":"string"},"expiry":{"type":"string"},"poll_interval_ms":{"type":"integer","const":5000},"terminal_statuses":{"type":"array","items":{"type":"string","enum":["completed","partially_completed","expired","failed","cancelled"]}},"instruction":{"type":"string"}},"required":["method","url_template","alternative_url_template","authentication","expiry","poll_interval_ms","terminal_statuses","instruction"],"additionalProperties":false},"public_status":{"type":"object","properties":{"method":{"type":"string","const":"GET"},"url_template":{"type":"string"},"authentication":{"type":"string","const":"none"},"fields":{"type":"array","items":{"type":"string"}},"instruction":{"type":"string"}},"required":["method","url_template","authentication","fields","instruction"],"additionalProperties":false},"messages":{"type":"object","properties":{"read_method":{"type":"string","const":"GET"},"send_method":{"type":"string","const":"POST"},"url_template":{"type":"string"},"authentication":{"type":"string"},"poll_interval_ms":{"type":"integer","const":5000},"reply_body_example":{"type":"object","properties":{"type":{"type":"string","const":"reply"},"text":{"type":"string"}},"required":["type","text"],"additionalProperties":false},"clarification_body_example":{"type":"object","properties":{"type":{"type":"string","const":"clarification"},"text":{"type":"string"}},"required":["type","text"],"additionalProperties":false},"rules":{"type":"string"}},"required":["read_method","send_method","url_template","authentication","poll_interval_ms","reply_body_example","clarification_body_example","rules"],"additionalProperties":false},"response_freshness":{"type":"object","properties":{"fields":{"type":"array","items":{"type":"string"}},"instruction":{"type":"string"}},"required":["fields","instruction"],"additionalProperties":false}},"required":["can_create_request","create_request","first_response","private_request","public_status","messages","response_freshness"],"additionalProperties":false},"mcp":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"transport":{"type":"string","const":"streamable_http"},"authentication":{"type":"string","const":"existing_integrator_bearer_key"},"instruction":{"type":"string"},"scopes":{"type":"object","properties":{"read":{"type":"array","items":{"type":"string"}},"write":{"type":"array","items":{"type":"string"}}},"required":["read","write"],"additionalProperties":false},"tools":{"type":"array","items":{"type":"string"}},"explicit_user_confirmed_required_for_writes":{"type":"boolean","const":true},"create_inquiry_example":{"anyOf":[{"type":"object","properties":{"example_only":{"type":"boolean","const":true},"tool":{"type":"string","const":"create_inquiry"},"arguments":{"type":"object","properties":{"business_ids":{"type":"array","minItems":1,"maxItems":5,"uniqueItems":true,"items":{"type":"string","format":"uuid"}},"type":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]},"query":{"type":"object","description":"Private query payload. Only whitelisted product identity fields may enter public offers.","additionalProperties":true},"question":{"type":"string","minLength":3,"maxLength":4000},"language":{"type":"string","enum":["pt-BR","en","ru"]},"deadline_at":{"type":"string","format":"date-time"},"idempotency_key":{"type":"string","minLength":8,"maxLength":200},"user_confirmed":{"type":"boolean","const":true}},"required":["business_ids","type","query","question","language","deadline_at","idempotency_key","user_confirmed"],"additionalProperties":false},"instruction":{"type":"string"}},"required":["example_only","tool","arguments","instruction"],"additionalProperties":false},{"type":"null"}]},"authentication_methods":{"type":"array","items":{"type":"string","enum":["bearer_api_key","oauth2"]},"minItems":2,"uniqueItems":true},"oauth":{"type":"object","properties":{"resource":{"type":"string","format":"uri"},"resource_metadata_url":{"type":"string","format":"uri"},"authorization_metadata_url":{"type":"string","format":"uri"},"user_and_client_scoped_private_access":{"type":"boolean","const":true}},"required":["resource","resource_metadata_url","authorization_metadata_url","user_and_client_scoped_private_access"],"additionalProperties":false}},"required":["url","transport","authentication","instruction","scopes","tools","explicit_user_confirmed_required_for_writes","create_inquiry_example","authentication_methods","oauth"],"additionalProperties":false}},"required":["format","standard","description","company","links","authorization_policy","rest","mcp"],"additionalProperties":false},"BusinessLocation":{"type":"object","properties":{"street_address":{"type":"string","minLength":1,"maxLength":300},"city":{"type":"string","minLength":2,"maxLength":80},"region":{"type":"string","minLength":1,"maxLength":100},"postal_code":{"type":"string","minLength":1,"maxLength":40},"country":{"type":"string","minLength":1,"maxLength":100,"description":"Actual owner-confirmed ISO country code or country name; no default."}},"additionalProperties":false},"WebsiteImportPreview":{"type":"object","properties":{"website_url":{"type":"string","format":"uri"},"source_url":{"type":"string","format":"uri"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":{"anyOf":[{"type":"string"},{"type":"null"}]},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}]},"logo_data_url":{"anyOf":[{"type":"string","maxLength":350000,"description":"Owner-confirmed bounded base64 raster data URI; PNG, JPEG, WebP or GIF with validated file signature. SVG and other active formats are rejected. This is write/preview data only, never included in company list/profile output."},{"type":"null"}]},"fetched_at":{"type":"string","format":"date-time"},"warnings":{"type":"array","items":{"type":"string"},"description":"Stable warning codes only. Missing/partial fields must be checked by the owner; external content is untrusted data."}},"required":["website_url","source_url","name","description","location","logo_data_url","fetched_at","warnings"],"additionalProperties":false},"Error":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"},"request_id":{"type":"string"},"details":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string"},"code":{"type":"string"}},"additionalProperties":false}}},"additionalProperties":false,"required":["code","message","request_id"]},"User":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"email":{"type":"string","format":"email"},"contact_verified":{"type":"boolean"},"is_admin":{"type":"boolean","readOnly":true,"description":"Present on GET /v1/auth/me; derived only from the current active user's ADMIN_EMAILS membership. Optional because the OTP verification response does not currently include this field."}},"additionalProperties":false,"required":["id","email","contact_verified"]},"OtpChallenge":{"type":"object","properties":{"challenge_id":{"type":"string","format":"uuid"},"expires_in":{"type":"integer","const":600}},"additionalProperties":false,"required":["challenge_id","expires_in"]},"BusinessInput":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":150},"city":{"type":"string","minLength":2,"maxLength":80},"categories":{"type":"array","items":{"type":"string"}},"brands":{"type":"array","items":{"type":"string"}},"product_keywords":{"type":"array","items":{"type":"string"}},"assortment_description":{"type":"string","minLength":5,"maxLength":2000},"service_area":{"type":"object","additionalProperties":true},"public_reuse_allowed":{"type":"boolean","default":false},"accepting_inquiries":{"type":"boolean","default":true},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"website_url":{"type":"string","minLength":1,"maxLength":2048,"description":"Public HTTP(S) company website. Leading/trailing whitespace is trimmed; a missing scheme becomes https. Path is preserved, query/fragment removed. Credentials, localhost/private IP destinations and unsupported schemes are rejected. Supplying null or an empty value is invalid; omitting this field on PATCH preserves a legacy profile without a website."},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}]},"logo_data_url":{"anyOf":[{"type":"string","maxLength":350000,"description":"Owner-confirmed bounded base64 raster data URI; PNG, JPEG, WebP or GIF with validated file signature. SVG and other active formats are rejected. This is write/preview data only, never included in company list/profile output."},{"type":"null"}]}},"additionalProperties":false,"required":["name","city","categories","assortment_description","website_url"]},"Business":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"},"slug":{"type":"string"},"city":{"type":"string"},"categories":{"type":"array","items":{"type":"string"}},"brands":{"type":"array","items":{"type":"string"}},"product_keywords":{"type":"array","items":{"type":"string"}},"assortment_description":{"type":"string"},"service_area":{"type":"object"},"verification":{"type":"string","enum":["unverified","contact_verified","business_verified"]},"status":{"type":"string","enum":["draft","pending_review","published","suspended","archived"]},"accepting_inquiries":{"type":"boolean"},"public_reuse_allowed":{"type":"boolean"},"branch_id":{"type":"string","format":"uuid"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"demo_data":{"type":"boolean"},"language_codes":{"type":"array","items":{"type":"string"}},"canonical_path":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Correct legacy geographical canonical where supported; /@handle for a published company with a confirmed matching worldwide location, or null when unavailable."},"search_indexable":{"type":"boolean","description":"Effective public search eligibility. Signup/profile edits cannot assign this flag; moderator publication and demo/geography checks apply."},"public_handle":{"anyOf":[{"$ref":"#/components/schemas/PublicHandle"},{"type":"null"}],"readOnly":true,"description":"Stable readable contact name. Display-name edits preserve it; owner changes permanently reserve all earlier aliases for the same company."},"contact_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Current primary /@handle contact path. Historical HTML paths redirect here; independent of the geographical SEO canonical_path."},"agent_descriptor_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Public custom contact documentation at /@handle/agent.json. This is informational documentation, not an integration authorization or a standard A2A Agent Card."},"website_url":{"anyOf":[{"type":"string","format":"uri"},{"type":"null"}],"readOnly":true},"website_verified":{"type":"boolean","const":false,"readOnly":true,"description":"Informational website supplied by the owner; domain ownership has not been verified."},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}],"description":"Owner-confirmed address fields only; missing values remain absent, with no inferred country."},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Same-origin /v1/businesses/{business_id}/logo path when logo data exists; never a base64 data URI. Unpublished logos require an authorized owner/manager session."}},"additionalProperties":false,"required":["id","name","city","verification","status","demo_data","website_url","website_verified","location","logo_url"]},"ModerationNote":{"description":"Latest owner-facing moderation note; available only through authorized private company/admin views.","anyOf":[{"type":"string","maxLength":1000},{"type":"null"}]},"BusinessReviewStatus":{"type":"string","enum":["new","in_progress","successful","rejected"],"description":"Private review workflow only; separate from public publication and identity verification."},"BusinessReviewCounts":{"type":"object","properties":{"all":{"type":"integer","minimum":0},"new":{"type":"integer","minimum":0},"in_progress":{"type":"integer","minimum":0},"successful":{"type":"integer","minimum":0},"rejected":{"type":"integer","minimum":0}},"required":["all","new","in_progress","successful","rejected"],"additionalProperties":false,"description":"All registrations matching q, independent of selected review/publication filters and cursor."},"PrivateBusiness":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"},"slug":{"type":"string"},"city":{"type":"string"},"categories":{"type":"array","items":{"type":"string"}},"brands":{"type":"array","items":{"type":"string"}},"product_keywords":{"type":"array","items":{"type":"string"}},"assortment_description":{"type":"string"},"service_area":{"type":"object"},"verification":{"type":"string","enum":["unverified","contact_verified","business_verified"]},"status":{"type":"string","enum":["draft","pending_review","published","suspended","archived"]},"accepting_inquiries":{"type":"boolean"},"public_reuse_allowed":{"type":"boolean"},"branch_id":{"type":"string","format":"uuid"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"demo_data":{"type":"boolean"},"language_codes":{"type":"array","items":{"type":"string"}},"canonical_path":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Correct legacy geographical canonical where supported; /@handle for a published company with a confirmed matching worldwide location, or null when unavailable."},"search_indexable":{"type":"boolean","description":"Effective public search eligibility. Signup/profile edits cannot assign this flag; moderator publication and demo/geography checks apply."},"moderation_note":{"$ref":"#/components/schemas/ModerationNote"},"review_status":{"$ref":"#/components/schemas/BusinessReviewStatus"},"public_handle":{"anyOf":[{"$ref":"#/components/schemas/PublicHandle"},{"type":"null"}],"readOnly":true,"description":"Stable readable contact name. Display-name edits preserve it; owner changes permanently reserve all earlier aliases for the same company."},"contact_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Current primary /@handle contact path. Historical HTML paths redirect here; independent of the geographical SEO canonical_path."},"agent_descriptor_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Public custom contact documentation at /@handle/agent.json. This is informational documentation, not an integration authorization or a standard A2A Agent Card."},"can_manage_public_handle":{"type":"boolean","readOnly":true,"description":"Private permission for the current active user: true only for the owning organization owner. Assigned staff and unrelated administrators cannot change this handle."},"website_url":{"anyOf":[{"type":"string","format":"uri"},{"type":"null"}],"readOnly":true},"website_verified":{"type":"boolean","const":false,"readOnly":true,"description":"Informational website supplied by the owner; domain ownership has not been verified."},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}],"description":"Owner-confirmed address fields only; missing values remain absent, with no inferred country."},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Same-origin /v1/businesses/{business_id}/logo path when logo data exists; never a base64 data URI. Unpublished logos require an authorized owner/manager session."}},"additionalProperties":false,"required":["id","name","city","verification","status","demo_data","moderation_note","review_status","can_manage_public_handle","website_url","website_verified","location","logo_url"]},"AdminReviewBusiness":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"},"slug":{"type":"string"},"city":{"type":"string"},"categories":{"type":"array","items":{"type":"string"}},"brands":{"type":"array","items":{"type":"string"}},"product_keywords":{"type":"array","items":{"type":"string"}},"assortment_description":{"type":"string"},"service_area":{"type":"object"},"verification":{"type":"string","enum":["unverified","contact_verified","business_verified"]},"status":{"type":"string","enum":["draft","pending_review","published","suspended","archived"]},"accepting_inquiries":{"type":"boolean"},"public_reuse_allowed":{"type":"boolean"},"branch_id":{"type":"string","format":"uuid"},"capabilities":{"type":"array","items":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]}},"demo_data":{"type":"boolean"},"language_codes":{"type":"array","items":{"type":"string"}},"canonical_path":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Correct legacy geographical canonical where supported; /@handle for a published company with a confirmed matching worldwide location, or null when unavailable."},"search_indexable":{"type":"boolean","description":"Effective public search eligibility. Signup/profile edits cannot assign this flag; moderator publication and demo/geography checks apply."},"moderation_note":{"$ref":"#/components/schemas/ModerationNote"},"review_status":{"$ref":"#/components/schemas/BusinessReviewStatus"},"owner_email":{"type":"string","format":"email"},"contact_verified_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"},"public_handle":{"anyOf":[{"$ref":"#/components/schemas/PublicHandle"},{"type":"null"}],"readOnly":true,"description":"Stable readable contact name. Display-name edits preserve it; owner changes permanently reserve all earlier aliases for the same company."},"contact_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Current primary /@handle contact path. Historical HTML paths redirect here; independent of the geographical SEO canonical_path."},"agent_descriptor_path":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Public custom contact documentation at /@handle/agent.json. This is informational documentation, not an integration authorization or a standard A2A Agent Card."},"can_manage_public_handle":{"type":"boolean","readOnly":true,"description":"Private permission for the current active user: true only for the owning organization owner. Assigned staff and unrelated administrators cannot change this handle."},"website_url":{"anyOf":[{"type":"string","format":"uri"},{"type":"null"}],"readOnly":true},"website_verified":{"type":"boolean","const":false,"readOnly":true,"description":"Informational website supplied by the owner; domain ownership has not been verified."},"location":{"anyOf":[{"$ref":"#/components/schemas/BusinessLocation"},{"type":"null"}],"description":"Owner-confirmed address fields only; missing values remain absent, with no inferred country."},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"readOnly":true,"description":"Same-origin /v1/businesses/{business_id}/logo path when logo data exists; never a base64 data URI. Unpublished logos require an authorized owner/manager session."}},"additionalProperties":false,"required":["id","name","city","verification","status","demo_data","moderation_note","review_status","owner_email","contact_verified_at","created_at","can_manage_public_handle","website_url","website_verified","location","logo_url"]},"CreateRequest":{"type":"object","properties":{"business_ids":{"type":"array","minItems":1,"maxItems":5,"uniqueItems":true,"items":{"type":"string","format":"uuid"}},"type":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]},"query":{"type":"object","description":"Private query payload. Only whitelisted product identity fields may enter public offers.","additionalProperties":true},"question":{"type":"string","minLength":3,"maxLength":4000},"language":{"type":"string","enum":["pt-BR","en","ru"]},"deadline_at":{"type":"string","format":"date-time"}},"additionalProperties":false,"required":["business_ids","type","query","question","deadline_at"]},"Inquiry":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"inquiry_id":{"type":"string","format":"uuid"},"request_id":{"type":"string","format":"uuid"},"business_id":{"type":"string","format":"uuid"},"branch_id":{"type":"string","format":"uuid"},"business_name":{"type":"string"},"status":{"type":"string","enum":["queued","delivered","opened","awaiting_clarification","answered","declined","expired","delivery_failed","cancelled"]},"question":{"type":"string"},"query":{"type":"object"},"type":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]},"deadline_at":{"type":"string","format":"date-time"},"created_at":{"type":"string","format":"date-time"},"delivered_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"opened_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"answered_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"response":{"anyOf":[{"$ref":"#/components/schemas/Response"},{"type":"null"}]},"unread_requester_messages":{"type":"integer","minimum":0,"readOnly":true,"description":"Seller inbox only: unread requester messages in an active request/inquiry, excluding expired clarifications. An unread reply is included. Computed only after business authorization; no message body is added. Seller GET messages marks them read; requester reads do not."}},"additionalProperties":true,"required":["id","business_id","status"]},"ResponseInput":{"type":"object","properties":{"availability":{"anyOf":[{"type":"string","enum":["in_stock","out_of_stock","unknown","not_offered"]},{"type":"null"}],"description":"unknown is normalized to null/unverified and never confirms stock. unknown-only without price or meaningful note is422; use clarification instead."},"availability_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"price_minor":{"anyOf":[{"type":"integer","minimum":0,"maximum":9007199254740991},{"type":"null"}]},"currency":{"anyOf":[{"type":"string","enum":["BRL"]},{"type":"null"}]},"price_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"seller_note":{"anyOf":[{"type":"string","maxLength":2000},{"type":"null"}]},"public_reuse_allowed":{"type":"boolean","default":false}},"additionalProperties":false},"Response":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"inquiry_id":{"type":"string","format":"uuid"},"business_id":{"type":"string","format":"uuid"},"branch_id":{"type":"string","format":"uuid"},"version":{"type":"integer","minimum":1},"availability":{"anyOf":[{"type":"string","enum":["in_stock","out_of_stock","unknown","not_offered"]},{"type":"null"}]},"availability_checked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"description":"Independent availability group max30m; price group max24h. Server sets checked_at at real confirmation, not question creation."},"availability_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"description":"Independent availability group max30m; price group max24h. Server sets checked_at at real confirmation, not question creation."},"availability_freshness":{"type":"string","enum":["fresh","stale","unverified"]},"price_minor":{"anyOf":[{"type":"integer","minimum":0},{"type":"null"}]},"currency":{"anyOf":[{"type":"string","enum":["BRL"]},{"type":"null"}]},"price_checked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"description":"Independent availability group max30m; price group max24h. Server sets checked_at at real confirmation, not question creation."},"price_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"description":"Independent availability group max30m; price group max24h. Server sets checked_at at real confirmation, not question creation."},"price_freshness":{"type":"string","enum":["fresh","stale","unverified"]},"source_type":{"type":"string","enum":["human","business_system","ai"]},"operator_id":{"type":"string","format":"uuid"},"seller_note":{"anyOf":[{"type":"string"},{"type":"null"}]},"public_reuse_allowed":{"type":"boolean"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"}},"additionalProperties":true,"required":["id","inquiry_id","availability_freshness","price_freshness","source_type"]},"PrivateRequest":{"type":"object","properties":{"request_id":{"type":"string","format":"uuid"},"public_id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["pending","in_progress","completed","partially_completed","expired","failed","cancelled"]},"failure_reason":{"anyOf":[{"type":"string","enum":["all_declined","delivery_failed","mixed_non_answer"]},{"type":"null"}]},"type":{"type":"string","enum":["product_availability","service_availability","price_quote","general"]},"query":{"type":"object"},"question":{"type":"string"},"language":{"type":"string","enum":["pt-BR","en","ru"]},"deadline_at":{"type":"string","format":"date-time"},"created_at":{"type":"string","format":"date-time"},"demo_data":{"type":"boolean"},"responses":{"type":"array","items":{"$ref":"#/components/schemas/Response"}},"inquiries":{"type":"array","items":{"$ref":"#/components/schemas/Inquiry"}},"pending_business_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"guest_access_token":{"type":"string","description":"Present once only on guest creation. Never returned on idempotent replay. Never put in URLs, logs, analytics or webhooks.","readOnly":true},"guest_access_expires_at":{"type":"string","format":"date-time"},"idempotent_replay":{"type":"boolean"},"deduplicated":{"type":"boolean"}},"additionalProperties":false,"required":["request_id","public_id","status","responses","inquiries"]},"PublicRequest":{"type":"object","properties":{"public_id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["pending","in_progress","completed","partially_completed","expired","failed","cancelled"]}},"additionalProperties":false,"required":["public_id","status"]},"MessageInput":{"type":"object","properties":{"type":{"type":"string","enum":["clarification","reply"]},"text":{"type":"string","minLength":1,"maxLength":4000}},"additionalProperties":false,"required":["type","text"]},"Message":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"business_id":{"type":"string","format":"uuid"},"sender_type":{"type":"string","enum":["business","requester"]},"sender_id":{"type":"string"},"type":{"type":"string","enum":["clarification","reply"]},"text":{"type":"string"},"state":{"type":"string","enum":["awaiting","answered","expired"]},"reply_to":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"}},"additionalProperties":false,"required":["id","business_id","sender_type","type","text","state","created_at"]},"PublicOffer":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"business_id":{"type":"string","format":"uuid"},"branch_id":{"type":"string","format":"uuid"},"normalized_item_key":{"type":"string","description":"Whitelisted brand/model/sku/variant/color/size plus branch_id; never raw query/question."},"availability":{"anyOf":[{"type":"string"},{"type":"null"}]},"availability_checked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"availability_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"availability_freshness":{"type":"string","enum":["fresh","stale","unverified"]},"price_minor":{"anyOf":[{"type":"integer"},{"type":"null"}]},"currency":{"anyOf":[{"type":"string","enum":["BRL"]},{"type":"null"}]},"price_checked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"price_valid_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"price_freshness":{"type":"string","enum":["fresh","stale","unverified"]},"source_type":{"type":"string","enum":["human","business_system","ai"]}},"additionalProperties":false,"required":["id","business_id","branch_id","source_type"]},"WebhookEvent":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"type":{"type":"string","enum":["request.created","request.updated","request.completed","inquiry.delivered","inquiry.opened","inquiry.answered","inquiry.declined","inquiry.expired","inquiry.delivery_failed","inquiry.message.created"]},"created_at":{"type":"string","format":"date-time"},"data":{"type":"object","properties":{"request_id":{"type":"string","format":"uuid"},"inquiry_id":{"type":"string","format":"uuid"},"response_id":{"type":"string","format":"uuid"},"message_id":{"type":"string","format":"uuid"},"status":{"type":"string","enum":["pending","in_progress","completed","partially_completed","expired","failed","cancelled"]}},"required":["request_id"],"additionalProperties":false}},"required":["id","type","created_at","data"],"additionalProperties":false},"DeveloperApp":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"},"status":{"type":"string","enum":["active","suspended"]},"created_at":{"type":"string","format":"date-time"}},"required":["id","name","status","created_at"],"additionalProperties":false},"ApiKeyMetadata":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"app_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"prefix":{"type":"string","description":"Short display prefix only; never the entire secret."},"scopes":{"type":"array","items":{"type":"string","enum":["businesses:read","requests:read","requests:write","webhooks:write"]}},"created_at":{"type":"string","format":"date-time"},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_used_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["id","app_id","name","prefix","scopes","created_at","expires_at","revoked_at"],"additionalProperties":false},"IssuedApiKey":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"app_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"prefix":{"type":"string","description":"Short display prefix only; never the entire secret."},"scopes":{"type":"array","items":{"type":"string","enum":["businesses:read","requests:read","requests:write","webhooks:write"]}},"created_at":{"type":"string","format":"date-time"},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_used_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"api_key":{"type":"string","readOnly":true,"description":"Returned only at creation, retained only as SHA256 hash on server. Never logged or put in URLs."}},"required":["id","app_id","name","prefix","scopes","created_at","expires_at","revoked_at","api_key"],"additionalProperties":false},"UsageQuota":{"type":"object","properties":{"requests_per_day":{"type":"integer","const":20},"searches_per_minute":{"type":"integer","const":10}},"required":["requests_per_day","searches_per_minute"],"additionalProperties":false},"Usage":{"type":"object","properties":{"period":{"type":"string","enum":["24h"]},"window_start":{"type":"string","format":"date-time"},"apps":{"type":"array","items":{"type":"object","properties":{"app_id":{"type":"string","format":"uuid"},"name":{"type":"string"},"requests_created":{"type":"integer"},"searches":{"type":"integer"},"api_keys_active":{"type":"integer"},"quota":{"$ref":"#/components/schemas/UsageQuota"}},"required":["app_id","name","requests_created","searches","api_keys_active","quota"],"additionalProperties":false}},"totals":{"type":"object","properties":{"requests_created":{"type":"integer"},"searches":{"type":"integer"}},"required":["requests_created","searches"],"additionalProperties":false},"quota":{"$ref":"#/components/schemas/UsageQuota"}},"required":["period","window_start","apps","totals","quota"],"additionalProperties":false},"Webhook":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"app_id":{"type":"string","format":"uuid"},"url":{"type":"string","format":"uri"},"status":{"type":"string","enum":["active","disabled"]},"events":{"type":"array","items":{"type":"string","enum":["request.created","request.updated","request.completed","inquiry.delivered","inquiry.opened","inquiry.answered","inquiry.declined","inquiry.expired","inquiry.delivery_failed","inquiry.message.created"]}},"signing_secret_masked":{"type":"string"},"deliveries":{"type":"object","properties":{"total":{"type":"integer"},"succeeded":{"type":"integer"},"retrying":{"type":"integer"},"dead_letter":{"type":"integer"}},"required":[],"additionalProperties":false}},"required":["id","app_id","url","status","events"],"additionalProperties":false},"IssuedWebhook":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"app_id":{"type":"string","format":"uuid"},"url":{"type":"string","format":"uri"},"status":{"type":"string","enum":["active","disabled"]},"events":{"type":"array","items":{"type":"string","enum":["request.created","request.updated","request.completed","inquiry.delivered","inquiry.opened","inquiry.answered","inquiry.declined","inquiry.expired","inquiry.delivery_failed","inquiry.message.created"]}},"signing_secret_masked":{"type":"string"},"deliveries":{"type":"object","properties":{"total":{"type":"integer"},"succeeded":{"type":"integer"},"retrying":{"type":"integer"},"dead_letter":{"type":"integer"}},"required":[],"additionalProperties":false},"signing_secret":{"type":"string","readOnly":true,"description":"Shown once; encrypted AES256GCM at rest with a domain-separated key derived from server secret."}},"required":["id","app_id","url","status","events","signing_secret"],"additionalProperties":false},"PublicMailConfiguration":{"type":"object","properties":{"mail_mode":{"type":"string","enum":["local","smtp"]}},"required":["mail_mode"],"additionalProperties":false},"BusinessNotificationPreferences":{"type":"object","properties":{"business_id":{"type":"string","format":"uuid"},"new_inquiry_email":{"type":"boolean","default":true},"requester_message_email":{"type":"boolean","default":true},"language":{"type":"string","enum":["pt-BR","en","ru"],"default":"pt-BR"}},"required":["business_id","new_inquiry_email","requester_message_email","language"],"additionalProperties":false},"OAuthAuthorizationMetadata":{"type":"object","properties":{"issuer":{"type":"string","format":"uri"},"authorization_endpoint":{"type":"string","format":"uri"},"token_endpoint":{"type":"string","format":"uri"},"revocation_endpoint":{"type":"string","format":"uri"},"response_types_supported":{"type":"array","items":{"type":"string"}},"grant_types_supported":{"type":"array","items":{"type":"string"}},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string"}},"revocation_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string"}},"code_challenge_methods_supported":{"type":"array","items":{"type":"string"}},"scopes_supported":{"type":"array","items":{"type":"string"}},"authorization_response_iss_parameter_supported":{"type":"boolean","const":true},"service_documentation":{"type":"string","format":"uri"}},"required":["issuer","authorization_endpoint","token_endpoint","revocation_endpoint","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","revocation_endpoint_auth_methods_supported","code_challenge_methods_supported","scopes_supported","authorization_response_iss_parameter_supported","service_documentation"],"additionalProperties":false},"OAuthProtectedResourceMetadata":{"type":"object","properties":{"resource":{"type":"string","format":"uri"},"authorization_servers":{"type":"array","items":{"type":"string","format":"uri"}},"scopes_supported":{"type":"array","items":{"type":"string"}},"resource_name":{"type":"string"}},"required":["resource","authorization_servers","scopes_supported","resource_name"],"additionalProperties":false},"OAuthError":{"type":"object","properties":{"error":{"type":"string"},"error_description":{"type":"string"}},"required":["error"],"additionalProperties":false},"OAuthTokens":{"type":"object","properties":{"access_token":{"type":"string"},"token_type":{"type":"string","const":"Bearer"},"expires_in":{"type":"integer","minimum":1},"refresh_token":{"type":"string"},"scope":{"type":"string"}},"required":["access_token","token_type","expires_in","refresh_token","scope"],"additionalProperties":false},"OAuthAuthorization":{"type":"object","properties":{"flow":{"type":"string"},"client":{"type":"object","properties":{"id":{"type":"string","const":"agentconnect-chatgpt"},"name":{"type":"string","const":"ChatGPT"}},"required":["id","name"],"additionalProperties":false},"resource":{"type":"string","format":"uri"},"scopes":{"type":"array","items":{"type":"string"}},"expires_at":{"type":"string","format":"date-time"},"user":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"email":{"type":"string","format":"email"}},"required":["id","email"],"additionalProperties":false},"csrf_token":{"type":"string"},"terms_required":{"type":"boolean"}},"required":["flow","client","resource","scopes","expires_at","user","csrf_token","terms_required"],"additionalProperties":false},"OAuthConnection":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"client_id":{"type":"string","const":"agentconnect-chatgpt"},"client_name":{"type":"string","const":"ChatGPT"},"scopes":{"type":"array","items":{"type":"string"}},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"last_used_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["id","client_id","client_name","scopes","created_at","updated_at","last_used_at","revoked_at"],"additionalProperties":false},"AdminMailSender":{"type":"object","properties":{"from":{"type":"string","const":"AgentConnect <help@biznoro.com>"},"reply_to":{"type":"string","const":"help@biznoro.com"},"enabled":{"type":"boolean"}},"required":["from","reply_to","enabled"],"additionalProperties":false},"AdminMail":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"to":{"type":"string","format":"email"},"subject":{"type":"string","minLength":1,"maxLength":200},"text":{"type":"string","minLength":1,"maxLength":12000},"status":{"type":"string","enum":["queued","sending","sent","failed","unknown","captured"]},"attempts":{"type":"integer","minimum":0,"maximum":3},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"sent_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_error_code":{"anyOf":[{"type":"string"},{"type":"null"}]},"transport":{"anyOf":[{"type":"string","enum":["smtp","local"]},{"type":"null"}]}},"required":["id","to","subject","text","status","attempts","created_at","updated_at","sent_at","last_error_code","transport"],"additionalProperties":false},"AdminMailEnqueueResult":{"type":"object","properties":{"id":{"type":"string","format":"uuid"},"to":{"type":"string","format":"email"},"subject":{"type":"string","minLength":1,"maxLength":200},"text":{"type":"string","minLength":1,"maxLength":12000},"status":{"type":"string","enum":["queued","sending","sent","failed","unknown","captured"]},"attempts":{"type":"integer","minimum":0,"maximum":3},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"sent_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_error_code":{"anyOf":[{"type":"string"},{"type":"null"}]},"transport":{"anyOf":[{"type":"string","enum":["smtp","local"]},{"type":"null"}]},"idempotent_replay":{"type":"boolean"}},"required":["id","to","subject","text","status","attempts","created_at","updated_at","sent_at","last_error_code","transport","idempotent_replay"],"additionalProperties":false}}},"x-status-rules":{"request":["pending","in_progress","completed","partially_completed","expired","failed","cancelled"],"inquiry":["queued","delivered","opened","awaiting_clarification","answered","declined","expired","delivery_failed","cancelled"],"failed":"No substantive answers and all children declined/delivery_failed before deadline; all_declined|delivery_failed|mixed_non_answer.","deadline":"At now>=deadline expire active inquiries first. Late responses409; terminals frozen.","no_stock":"Substantive answer, unlike decline.","partial_answers":"Immediately returned while remaining businesses are active."},"x-webhook-authentication":{"headers":["X-AgentConnect-Signature","X-AgentConnect-Timestamp","X-AgentConnect-Event-Id"],"signature":"v1=hex(HMAC-SHA256(secret, unixTimestampSeconds + \".\" + exact UTF8 raw body))","payload_schema":"#/components/schemas/WebhookEvent","delivery":"Durable outbox and unique(webhook_id,event_id); at-least-once semantics. Initial attempt plus retries60s,300s,1800s,7200s,28800s; dead letter after6failedattempts. Leases recover after process restart.5second DNS+HTTPS budget; no redirects. Worker default10seconds.","receiver":"Verify signature with constant-time comparison, reject timestamps outside5minutes and persistently deduplicate event IDs before side effects. Never treat the timestamp as sufficient replay protection."},"x-business-email-notifications":{"implementation":"Durable email_deliveries from committed outbox_events, unique(event_id,recipient_user_id); SMTP accepted is separate from inquiry delivery/answer status.","events":["inquiry.delivered","inquiry.message.created only when sender_type=requester"],"recipient":"Current organization owner only, active user, contact_verified_at present, current owner membership. No buyer/unverified business_channels contacts. No arbitrary recipient API.","privacy":"Static pt-BR/en/ru body with FRONTEND_ORIGIN/app/inquiries/{inquiry_id}; no private question/message text, product details, buyer contacts, OTP or guest secrets. Skip demo_data, closed/expired/read, changed recipient/access, disabled preference and stale events.","delivery":"Initial attempt plus backoff60s,300s,1800s,7200s,28800s; durable lease60s, at most6 attempts then dead letter. SMTP validates accepted recipient and rejected list. No guarantee of inbox delivery or exactly-once for a generic SMTP provider.","idempotency":"Stable Message-ID and Resend-Idempotency-Key per durable delivery. Immutable language/link snapshots; sender/transport identity change skips pending job instead of changing content under the same key.","transport":"SMTP_URL or discrete SMTP_HOST/PORT/SECURE/USER/PASS, MAIL_FROM. TLS required; certificate verification, bounded timeouts, SMTP debug disabled. MAIL_ALLOWED_RECIPIENTS enforced for OTP/notification/test before network; required for resend.dev test sender.","local":"CaptureMailer.messages holds OTP tests; notifications captured separately. Captured notification is not recorded as SMTP accepted.","migration":"003_business_email_notifications adds preferences, durable delivery state and messages.business_read_at. Authorized business reads mark requester messages read; requester reads do not."},"x-website-boundary":{"retired_html_status":410,"retired_html_paths":["/search","/catalog","/docs","/developers","/dev/*","/ask"],"business_registration":"/app/onboarding","registration_alias":"/for-business","readonly_profiles":"/br/pb/{city}/{slug}","legacy_private_request_page":"/request/{public_id}","machine_contract":"/openapi.json","descriptor":"/.well-known/agentconnect.json"},"x-admin-support-mail":{"sender":"AgentConnect <help@biznoro.com>","reply_to":"help@biznoro.com","feature_flag":"SUPPORT_MAIL_ENABLED=true","authorization":"Active configured admin browser session, exact Origin; no OAuth/API keys. Worker rechecks author active/admin and immutable sender identity before transport.","queue":"010_admin_mail: durable immutable outbox, per-admin idempotency key and canonical payload hash; atomic enqueue/quota/redacted audit; SMTP outside request queue and SQL transaction.","deduplication":"Stable Message-ID and Resend-Idempotency-Key admin-mail/<delivery_id>. Known non-acceptance retries after60s/300s, at most3attempts. Ambiguous outcomes and expired sending leases remain unknown with no blind automatic retry.","privacy":"History recipient/subject/body is admin-only; audits contain only IDs/status/attempt count/safe error code. No incoming mailbox ingestion or forwarding destination access.","acceptance":"sent means accepted by the SMTP provider, not inbox delivery; CaptureMailer records captured separately."}}