openapi: 3.1.0
info:
  title: FlipDepix API
  version: 1.0.0
  description: |
    Non-custodial PIX ↔ DePix gateway on the Liquid Network.
    DePix is sent directly to the merchant's Liquid wallet — FlipDepix never custodies funds.

    - Authentication: Bearer token (`fdpx_*`)
    - Idempotency: `Idempotency-Key` header required on mutating POST requests
    - Webhooks: HMAC-SHA256 via `X-Webhook-Signature`

    Full docs: https://flipdepix.net/docs/api
  contact:
    name: FlipDepix
    url: https://flipdepix.net
  license:
    name: Proprietary
servers:
  - url: https://flipdepix.net
    description: Production
  - url: http://localhost:8080
    description: Local backend (dev)

tags:
  - name: Deposits
    description: PIX charges that settle as DePix
  - name: Withdrawals
    description: DePix → PIX withdrawals
  - name: Wallets
    description: Liquid wallet addresses
  - name: Webhooks
    description: Webhook endpoint management
  - name: Payment Links
    description: Shareable checkout links
  - name: Account
    description: Fees and account data

paths:
  /v1/api/deposit:
    post:
      tags: [Deposits]
      summary: Create PIX charge
      description: Creates a PIX QR code. Upon confirmation, DePix is sent to the specified Liquid wallet.
      operationId: createDeposit
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/IdempotencyKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateDepositRequest"
      responses:
        "201":
          description: Deposit created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Deposit"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"

  /v1/api/deposit/{id}/status:
    get:
      tags: [Deposits]
      summary: Get deposit status
      operationId: getDepositStatus
      security:
        - bearerAuth: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        "200":
          description: Deposit status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DepositStatus"

  /v1/api/withdraw:
    post:
      tags: [Withdrawals]
      summary: Create DePix → PIX withdrawal
      operationId: createWithdrawal
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/IdempotencyKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateWithdrawRequest"
      responses:
        "201":
          description: Withdrawal created
        "400":
          $ref: "#/components/responses/BadRequest"

  /v1/api/wallets:
    get:
      tags: [Wallets]
      summary: List Liquid wallets
      operationId: listWallets
      security:
        - bearerAuth: []
      responses:
        "200":
          description: Wallet list
    post:
      tags: [Wallets]
      summary: Register Liquid address
      operationId: createWallet
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [address]
              properties:
                address:
                  type: string
                  description: Liquid address (lq1…)
                label:
                  type: string
      responses:
        "201":
          description: Wallet registered

  /v1/api/webhook-endpoints:
    post:
      tags: [Webhooks]
      summary: Register webhook endpoint
      operationId: createWebhookEndpoint
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [url, events]
              properties:
                url:
                  type: string
                  format: uri
                events:
                  type: array
                  items:
                    type: string
                    enum:
                      - deposit.confirmed
                      - deposit.refunded
                      - deposit.failed
                      - withdrawal.completed
                      - withdrawal.failed
      responses:
        "201":
          description: Webhook registered

  /v1/api/payment-links:
    post:
      tags: [Payment Links]
      summary: Create payment link
      operationId: createPaymentLink
      security:
        - bearerAuth: []
      parameters:
        - $ref: "#/components/parameters/IdempotencyKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [amountCents]
              properties:
                amountCents:
                  type: integer
                  minimum: 200
                description:
                  type: string
      responses:
        "201":
          description: Payment link created

  /v1/api/fees:
    get:
      tags: [Account]
      summary: Get account fee schedule
      operationId: getFees
      security:
        - bearerAuth: []
      responses:
        "200":
          description: Fee schedule

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API key prefixed with fdpx_

  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      schema:
        type: string
        format: uuid
      description: Unique key per logical operation — retries with same key are idempotent

  schemas:
    CreateDepositRequest:
      type: object
      required: [amountCents, payerTaxId, liquidAddressId]
      properties:
        amountCents:
          type: integer
          description: Amount in centavos (BRL)
        payerTaxId:
          type: string
          description: Payer CPF (11 digits) or CNPJ (14 digits)
        liquidAddressId:
          type: string
          format: uuid
        passFeesToPayer:
          type: boolean
          default: true

    Deposit:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          type: string
          enum: [pending, confirmed, failed, refunded]
        pixCopyPaste:
          type: string
        pixQrCode:
          type: string

    DepositStatus:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          type: string

    CreateWithdrawRequest:
      type: object
      required: [amountCents, pixKey, pixKeyType]
      properties:
        amountCents:
          type: integer
        pixKey:
          type: string
        pixKeyType:
          type: string
          enum: [cpf, cnpj, email, phone, random]

    Error:
      type: object
      properties:
        error:
          type: string
        message:
          type: string

  responses:
    BadRequest:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/Error"
    Unauthorized:
      description: Missing or invalid API key
    Forbidden:
      description: Insufficient scope or feature disabled
