openapi: 3.0.3
info:
  title: Bloomerang REST API v2 Constituents Webhooks API
  description: The Bloomerang REST API v2 is a private-key, server-to-server API for reading and writing data in a Bloomerang donor management CRM account - constituents, transactions (donations, pledges, recurring donations), interactions, notes, relationships, and webhook subscriptions. Requests are authenticated with either a private API key sent in the X-Api-Key header (generated by an Administrator user under User Settings) or an OAuth 2.0 access token for third-party applications. Bloomerang does not offer a sandbox environment - all requests operate against production data. Endpoints for Constituents, Transactions, and Interactions are directly confirmed in Bloomerang's public documentation and third-party integration guides; endpoints for Households, Notes, Relationships, Custom Fields, Webhooks, Users, Funds, Campaigns, and Appeals are modeled from Bloomerang's REST API v1 resource parity, community client libraries, and CRM feature documentation, since Bloomerang does not publish a complete, versioned OpenAPI/Swagger document for v2. See review.yml in this repository for the endpointsConfirmed vs endpointsModeled breakdown.
  version: '2.0'
  contact:
    name: Bloomerang
    url: https://bloomerang.com/api/rest-api
servers:
- url: https://api.bloomerang.co/v2
  description: Bloomerang REST API v2 (production - no sandbox is offered)
security:
- apiKeyAuth: []
- oauth2Bearer: []
tags:
- name: Webhooks
  description: Webhook subscriptions for event notifications.
paths:
  /webhooks:
    get:
      operationId: listWebhooks
      tags:
      - Webhooks
      summary: List webhook subscriptions
      description: Lists the webhook subscriptions registered for the account.
      responses:
        '200':
          description: A list of webhook subscriptions.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      operationId: createWebhook
      tags:
      - Webhooks
      summary: Register a webhook subscription
      description: Registers a webhook subscription that receives an HTTP callback, signed with an x-bloomerang-signature header, when the given event occurs.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookInput'
      responses:
        '200':
          description: The created webhook subscription.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          $ref: '#/components/responses/ValidationError'
  /webhooks/{id}:
    parameters:
    - name: id
      in: path
      required: true
      description: The ID of the webhook subscription.
      schema:
        type: string
    delete:
      operationId: deleteWebhook
      tags:
      - Webhooks
      summary: Delete a webhook subscription
      description: Removes a webhook subscription.
      responses:
        '200':
          description: Deletion confirmation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    DeleteResponse:
      type: object
      properties:
        Id:
          type: string
        Deleted:
          type: boolean
    WebhookInput:
      type: object
      required:
      - url
      - event
      properties:
        url:
          type: string
          format: uri
          description: The HTTPS endpoint Bloomerang will POST the event payload to.
        event:
          type: string
          description: The event type to subscribe to, e.g. constituent.created.
          enum:
          - constituent.created
          - constituent.updated
          - transaction.created
          - interaction.created
        active:
          type: boolean
          default: true
    Webhook:
      allOf:
      - $ref: '#/components/schemas/WebhookInput'
      - type: object
        properties:
          id:
            type: string
    Error:
      type: object
      properties:
        Message:
          type: string
        Errors:
          type: array
          items:
            type: string
  responses:
    Unauthorized:
      description: Missing or invalid API key / access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ValidationError:
      description: The request payload failed validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Private API key generated by an Administrator user in Bloomerang under User Settings > Edit My User. Grants full read/write access - keep it secret.
    oauth2Bearer:
      type: oauth2
      description: 'OAuth 2.0 access token for third-party applications, presented as `Authorization: Bearer {access_token}`.'
      flows:
        authorizationCode:
          authorizationUrl: https://crm.bloomerang.co/oauth/authorize
          tokenUrl: https://api.bloomerang.co/v2/oauth/token
          scopes:
            api: Full read/write access to account data.