openapi: 3.0.3
info:
  title: Quanon API Gateway
  version: 1.0.0
  description: Credential-gated authorize decisions, catalog, and admin audit.
servers:
  - url: http://localhost:4040
paths:
  /api/gateway/authorize:
    post:
      summary: Authorize API credential against scopes and entitlements
      parameters:
        - name: X-Product-Api-Key
          in: header
          required: false
          schema:
            type: string
        - name: X-Gateway-Service-Token
          in: header
          required: false
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                apiKey:
                  type: string
                scope:
                  type: string
                feature:
                  type: string
                product:
                  type: string
                decisionToken:
                  type: string
                capability:
                  type: string
      responses:
        "200":
          description: Decision token payload
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
  /api/gateway/catalog:
    get:
      summary: Gateway route catalog
      responses:
        "200":
          description: Catalog
  /api/admin/gateway/audit:
    get:
      summary: Paginated gateway authorize audit (admin session)
      parameters:
        - name: x-auth-session-id
          in: header
          required: true
          schema:
            type: string
        - name: organization
          in: query
          schema:
            type: string
        - name: limit
          in: query
          schema:
            type: integer
      responses:
        "200":
          description: Audit entries
  /api/webhooks/fulfillment:
    post:
      summary: Channel fulfillment webhook (offer to provision + entitlement)
      security:
        - bearerAuth: []
      responses:
        "202":
          description: Accepted
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer