{
  "openapi": "3.1.0",
  "info": {
    "title": "Webhooks API",
    "version": "1.0",
    "description": "A real webhook dispatcher. Register a subscription, trigger an event, and the backend sends an actual HTTP POST to your URL (try https://webhook.site). Inspect delivery attempts, replay failures, and verify the real HMAC-SHA256 payload signature sent in the X-FunAPI-Signature header."
  },
  "servers": [
    {
      "url": "https://funapi.dev/api/webhooks/v1"
    }
  ],
  "tags": [
    {
      "name": "subscriptions",
      "description": "who gets notified, and for what"
    },
    {
      "name": "deliveries",
      "description": "attempts, replays, and signature checks"
    }
  ],
  "paths": {
    "/subscriptions": {
      "post": {
        "tags": [
          "subscriptions"
        ],
        "summary": "Register a webhook subscription",
        "operationId": "wh-sub-post",
        "responses": {
          "201": {
            "description": "Registered, includes a signingSecret",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            },
            "headers": {
              "Location": {
                "schema": {
                  "type": "string",
                  "format": "uri-reference"
                }
              }
            }
          },
          "400": {
            "description": "Missing/invalid url or empty events array",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  },
                  "events": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                }
              },
              "example": {
                "url": "https://example.com/webhook-receiver",
                "events": [
                  "order.created",
                  "order.delivered"
                ]
              }
            }
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ]
      },
      "get": {
        "tags": [
          "subscriptions"
        ],
        "summary": "List webhook subscriptions (secrets redacted)",
        "operationId": "wh-sub-list",
        "responses": {
          "200": {
            "description": "Subscription list",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ]
      }
    },
    "/subscriptions/{id}": {
      "delete": {
        "tags": [
          "subscriptions"
        ],
        "summary": "Unsubscribe",
        "operationId": "wh-sub-del",
        "responses": {
          "204": {
            "description": "Unsubscribed"
          },
          "401": {
            "description": "Missing or invalid token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Viewer token not allowed",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Unknown id",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "Subscription id. Viewer token → 403.",
            "schema": {
              "type": "integer",
              "format": "int32"
            },
            "example": 1
          }
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ]
      }
    },
    "/trigger": {
      "post": {
        "tags": [
          "deliveries"
        ],
        "summary": "Fire an event to all matching subscriptions (real HTTP POST)",
        "operationId": "wh-trigger",
        "responses": {
          "200": {
            "description": "No subscriptions matched this event",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "201": {
            "description": "Dispatched to one or more subscriptions — check each delivery status",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            },
            "headers": {
              "Location": {
                "schema": {
                  "type": "string",
                  "format": "uri-reference"
                }
              }
            }
          },
          "400": {
            "description": "Missing event",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "event": {
                    "type": "string"
                  },
                  "payload": {
                    "type": "object",
                    "properties": {
                      "orderId": {
                        "type": "number"
                      }
                    }
                  }
                }
              },
              "example": {
                "event": "order.created",
                "payload": {
                  "orderId": 501
                }
              }
            }
          }
        },
        "security": [
          {
            "bearerAuth": []
          }
        ]
      }
    },
    "/deliveries": {
      "get": {
        "tags": [
          "deliveries"
        ],
        "summary": "List delivery attempts, filter by status or subscription",
        "operationId": "wh-deliveries-list",
        "responses": {
          "200": {
            "description": "Delivery list",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "400": {
            "description": "Invalid status value",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "status",
            "in": "query",
            "required": false,
            "description": "\"delivered\" or \"failed\".",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "subscriptionId",
            "in": "query",
            "required": false,
            "description": "Filter by subscription id.",
            "schema": {
              "type": "integer",
              "format": "int32"
            }
          }
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ]
      }
    },
    "/deliveries/{id}/replay": {
      "post": {
        "tags": [
          "deliveries"
        ],
        "summary": "Replay a delivery attempt — re-sends the real HTTP POST (409 after 3 attempts)",
        "operationId": "wh-replay",
        "responses": {
          "200": {
            "description": "Replayed — the POST was re-sent, status reflects the receiver's response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "Unknown delivery",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "409": {
            "description": "Max attempts (3) already reached",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "Delivery id from POST /trigger.",
            "schema": {
              "type": "integer",
              "format": "int32"
            },
            "example": 1
          }
        ],
        "security": [
          {
            "bearerAuth": []
          }
        ]
      }
    },
    "/verify-signature": {
      "post": {
        "tags": [
          "deliveries"
        ],
        "summary": "Verify a payload signature (real HMAC-SHA256)",
        "operationId": "wh-verify",
        "responses": {
          "200": {
            "description": "Whether the signature matches",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "additionalProperties": true
                }
              }
            }
          },
          "400": {
            "description": "Missing secret",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "payload": {
                    "type": "object",
                    "properties": {
                      "orderId": {
                        "type": "number"
                      }
                    }
                  },
                  "signature": {
                    "type": "string"
                  },
                  "secret": {
                    "type": "string"
                  }
                }
              },
              "example": {
                "payload": {
                  "orderId": 501
                },
                "signature": "sha256=0000000000000000000000000000000000000000000000000000000000000000",
                "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx"
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "Use qa-admin-token / qa-viewer-token, or a JWT from POST /auth/v1/login."
      },
      "apiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "Cargo demo key: cargo-key-123."
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "error",
          "message"
        ],
        "properties": {
          "error": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "requestId": {
            "type": "string"
          }
        },
        "additionalProperties": true
      }
    }
  }
}