{
  "openapi": "3.1.0",
  "info": {
    "title": "IntakeRows preview API",
    "version": "0.1.0",
    "description": "Implemented preview endpoints only. Live extraction is planned."
  },
  "servers": [
    {
      "url": "/"
    }
  ],
  "paths": {
    "/v1/health": {
      "get": {
        "operationId": "getHealth",
        "summary": "Inspect preview health",
        "responses": {
          "200": {
            "description": "Preview is responding",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "status",
                    "mode"
                  ],
                  "properties": {
                    "status": {
                      "const": "ok"
                    },
                    "mode": {
                      "const": "demonstration"
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "/v1/account": {
      "get": {
        "operationId": "getAccount",
        "summary": "Inspect login availability and current account",
        "responses": {
          "200": {
            "description": "Anonymous status, or current user, tenant, expiry and CSRF token. Never cached."
          },
          "403": {
            "description": "Wrong application origin"
          },
          "503": {
            "description": "Account storage temporarily unavailable"
          }
        }
      }
    },
    "/auth/login": {
      "post": {
        "operationId": "startLogin",
        "summary": "Start GitHub login using a same-origin browser form",
        "responses": {
          "303": {
            "description": "Redirect to provider with PKCE and browser-bound state"
          },
          "403": {
            "description": "Foreign or missing Origin"
          },
          "429": {
            "description": "Login limit reached; Retry-After header supplied"
          },
          "503": {
            "description": "Login unavailable"
          }
        }
      }
    },
    "/auth/logout": {
      "post": {
        "operationId": "logout",
        "summary": "Revoke current browser session",
        "parameters": [
          {
            "in": "header",
            "name": "X-CSRF-Token",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Session revoked; browser cookie cleared"
          },
          "401": {
            "description": "No valid session"
          },
          "403": {
            "description": "Invalid origin or CSRF token"
          },
          "503": {
            "description": "Login unavailable"
          }
        }
      }
    }
  }
}