openapi: 3.0.1
info:
  title: Evolution Foundation - Auth Service - Permissions
  description: Authentication and user and account management
  version: v1.0.0
servers:
- url: https://api.evoai.app
  description: Production server
- url: http://localhost:3001
  description: Development server
  variables:
    port:
      default: '3001'
- url: '{customUrl}'
  description: Custom server
  variables:
    customUrl:
      default: https://your-instance.com
      description: Enter your server URL
paths:
  /api/v1/permissions:
    get:
      summary: List user permissions
      description: Get permissions for current user (account-scoped or global)
      operationId: listPermissions
      security:
      - ApiAccessTokenAuth: []
      parameters:
      - name: account-id
        in: header
        description: Account ID for account-scoped permissions
        schema:
          type: string
          format: uuid
      - name: account_id
        in: query
        description: Account ID for account-scoped permissions
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Permissions retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  data:
                    type: object
                    properties:
                      permissions:
                        type: array
                        items:
                          type: string
                        description: Array of permission keys
                        example:
                        - users.read
                        - users.create
                        - accounts.read
                      role_data:
                        type: object
                        properties:
                          id:
                            type: string
                            format: uuid
                            description: Role ID
                          key:
                            type: string
                            description: Role key identifier
                            example: account_owner
                          name:
                            type: string
                            description: Role display name
                            example: Account Owner
                  meta:
                    type: object
                    properties:
                      timestamp:
                        type: string
                        format: date-time
                        description: Response timestamp
                        example: '2026-01-28T21:34:06Z'
                  message:
                    type: string
                    description: Success message
                    example: User permissions retrieved successfully
              example:
                success: true
                data:
                  permissions:
                  - users.read
                  - users.create
                  - accounts.read
                  role_data:
                    id: 8cb4a5d9-51a1-4370-8bc0-33a27960d019
                    key: account_owner
                    name: Account Owner
                meta:
                  timestamp: '2026-01-28T21:34:06Z'
                message: User permissions retrieved successfully
        '400':
          description: Bad Request (invalid data)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                validation_error:
                  summary: Invalid request parameters
                  value:
                    success: false
                    error:
                      code: VALIDATION_ERROR
                      message: Invalid request parameters
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: GET
        '401':
          description: Unauthorized (invalid or missing token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                unauthorized:
                  summary: Unauthorized access
                  value:
                    success: false
                    error:
                      code: INVALID_TOKEN
                      message: Invalid token
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: GET
        '403':
          description: Forbidden (insufficient permissions)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                forbidden:
                  summary: Access forbidden
                  value:
                    success: false
                    error:
                      code: FORBIDDEN
                      message: You do not have permission to access this resource
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: GET
        '404':
          description: Not Found (resource not found)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                not_found:
                  summary: Account not found
                  value:
                    success: false
                    error:
                      code: NOT_FOUND
                      message: Account not found
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: GET
        '500':
          description: Internal Server Error (server error)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                internal_error:
                  summary: Internal server error
                  value:
                    success: false
                    error:
                      code: INTERNAL_ERROR
                      message: An unexpected error occurred
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: GET
    post:
      summary: Check permission
      description: Check if user has a specific permission
      operationId: checkPermission
      security:
      - ApiAccessTokenAuth: []
      parameters:
      - name: account-id
        in: header
        description: Account ID for account-scoped check
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Permission check result
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: true
                  data:
                    type: object
                    properties:
                      has_permission:
                        type: boolean
                        description: Whether the user has the requested permission
                        example: true
                      permission_key:
                        type: string
                        description: The permission key that was checked
                        example: users.read
                      is_super_admin:
                        type: boolean
                        description: Whether the user is a super admin
                        example: false
                  meta:
                    type: object
                    properties:
                      timestamp:
                        type: string
                        format: date-time
                        description: Response timestamp
                        example: '2026-01-28T21:34:06Z'
                  message:
                    type: string
                    description: Success message
                    example: Permission check completed
              example:
                success: true
                data:
                  has_permission: true
                  permission_key: users.read
                  is_super_admin: false
                meta:
                  timestamp: '2026-01-28T21:34:06Z'
                message: Permission check completed
        '400':
          description: Bad Request (invalid data)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                validation_error:
                  summary: Permission key required
                  value:
                    success: false
                    error:
                      code: VALIDATION_ERROR
                      message: Permission key is required
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: POST
        '401':
          description: Unauthorized (invalid or missing token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                unauthorized:
                  summary: Unauthorized access
                  value:
                    success: false
                    error:
                      code: INVALID_TOKEN
                      message: Invalid token
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: POST
        '403':
          description: Forbidden (insufficient permissions)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                forbidden:
                  summary: Access forbidden
                  value:
                    success: false
                    error:
                      code: FORBIDDEN
                      message: You do not have permission to access this resource
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: POST
        '404':
          description: Not Found (resource not found)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                not_found:
                  summary: Account not found
                  value:
                    success: false
                    error:
                      code: NOT_FOUND
                      message: Account not found
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: POST
        '500':
          description: Internal Server Error (server error)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                internal_error:
                  summary: Internal server error
                  value:
                    success: false
                    error:
                      code: INTERNAL_ERROR
                      message: An unexpected error occurred
                    meta:
                      timestamp: '2024-01-15T10:30:00Z'
                      path: /api/v1/permissions
                      method: POST
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                permission_key:
                  type: string
                  description: The permission key to check
                  example: users.read
              required:
              - permission_key
components:
  schemas:
    ErrorResponse:
      type: object
      required:
      - success
      - error
      - meta
      properties:
        success:
          type: boolean
          example: false
        error:
          type: object
          required:
          - code
          - message
          properties:
            code:
              type: string
              example: VALIDATION_ERROR
            message:
              type: string
              example: Validation failed
            details:
              type: object
              additionalProperties: true
              nullable: true
        meta:
          type: object
          required:
          - timestamp
          - path
          - method
          properties:
            timestamp:
              type: string
              format: date-time
              example: '2024-01-15T10:30:00Z'
            path:
              type: string
              example: /api/v1/super_admin/accounts/123
            method:
              type: string
              example: POST
  securitySchemes:
    DeviseTokenAuth:
      type: apiKey
      in: header
      name: access-token
      description: Devise Token Auth - requires access-token, client, and uid headers
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    SuperAdminAuth:
      type: apiKey
      in: header
      name: api_access_token
      description: Super Admin authentication token
    ApiAccessTokenAuth:
      type: apiKey
      in: header
      name: api_access_token
      description: API access token authentication