openapi: 3.0.3
info:
  title: Bonusly Analytics Redemptions API
  description: The Bonusly API is the REST interface behind the Bonusly employee recognition and rewards platform. It exposes bonuses (peer-to-peer recognition posts that carry points), users, the reward catalog, redemptions, awards, company settings, and analytics. All endpoints are served under the base https://bonus.ly/api/v1 and authenticated with a Bearer personal access token (PAT) minted by a Global or Tech admin, with fine-grained read / write / administer scopes per resource. A token that lacks the required scope returns 403 Forbidden. A newer public surface is also available under https://bonus.ly/api/public. API access is available on paid Bonusly plans. This description models the publicly documented endpoints; verify exact request and response shapes against the live reference at https://docs.bonus.ly.
  version: '1.0'
  contact:
    name: Bonusly
    url: https://docs.bonus.ly/
servers:
- url: https://bonus.ly/api/v1
  description: Bonusly REST API (v1)
- url: https://bonus.ly/api/public
  description: Bonusly public API surface
security:
- bearerAuth: []
tags:
- name: Redemptions
  description: Conversions of earned points into rewards.
paths:
  /redemptions:
    get:
      operationId: listRedemptions
      tags:
      - Redemptions
      summary: List redemptions
      description: Lists redemptions across the company, with optional pagination and filters.
      parameters:
      - name: limit
        in: query
        schema:
          type: integer
          default: 20
      - name: skip
        in: query
        schema:
          type: integer
      responses:
        '200':
          description: A list of redemptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Redemption'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /redemptions/{id}:
    parameters:
    - name: id
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: retrieveRedemption
      tags:
      - Redemptions
      summary: Retrieve a redemption
      description: Retrieves a single redemption by its ID.
      responses:
        '200':
          description: The requested redemption.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  result:
                    $ref: '#/components/schemas/Redemption'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /user_redemptions:
    post:
      operationId: createUserRedemption
      tags:
      - Redemptions
      summary: Create a user redemption
      description: Redeems a reward on behalf of a user, spending earned points from their balance.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                user_id:
                  type: string
                reward_request:
                  type: string
                denomination:
                  type: number
      responses:
        '200':
          description: The created redemption.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  result:
                    $ref: '#/components/schemas/Redemption'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
  /custom_reward_redemptions:
    get:
      operationId: listCustomRewardRedemptions
      tags:
      - Redemptions
      summary: List custom reward redemptions
      description: Lists redemptions of custom company rewards, which follow an approve-and-fulfill workflow.
      responses:
        '200':
          description: A list of custom reward redemptions.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Redemption'
  /custom_reward_redemptions/approve:
    post:
      operationId: approveCustomRewardRedemptions
      tags:
      - Redemptions
      summary: Approve custom reward redemptions
      description: Approves one or more pending custom reward redemptions. Requires an administrator-scoped token.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  items:
                    type: string
      responses:
        '200':
          description: The redemptions were approved.
        '403':
          $ref: '#/components/responses/Forbidden'
  /custom_reward_redemptions/fulfill:
    post:
      operationId: fulfillCustomRewardRedemptions
      tags:
      - Redemptions
      summary: Fulfill custom reward redemptions
      description: Marks one or more approved custom reward redemptions as fulfilled. Requires an administrator-scoped token.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  items:
                    type: string
      responses:
        '200':
          description: The redemptions were fulfilled.
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  responses:
    NotFound:
      description: The requested resource was not found.
    Forbidden:
      description: The token lacks the scope required for this operation.
    Unauthorized:
      description: The access token is missing or invalid.
    UnprocessableEntity:
      description: The request was well-formed but could not be processed.
  schemas:
    User:
      type: object
      properties:
        id:
          type: string
        short_name:
          type: string
        display_name:
          type: string
        username:
          type: string
        email:
          type: string
        full_name:
          type: string
        first_name:
          type: string
        last_name:
          type: string
        path:
          type: string
        full_pic_url:
          type: string
        profile_pic_url:
          type: string
        can_give:
          type: boolean
        earning_balance:
          type: integer
        earning_balance_with_currency:
          type: string
        giving_balance:
          type: integer
        giving_balance_with_currency:
          type: string
        can_receive:
          type: boolean
        department:
          type: string
        country:
          type: string
        time_zone:
          type: string
        user_mode:
          type: string
    Redemption:
      type: object
      properties:
        id:
          type: string
        created_at:
          type: string
          format: date-time
        display_name:
          type: string
        amount:
          type: integer
        amount_with_currency:
          type: string
        reward_amount:
          type: number
        currency_code:
          type: string
        reward_type:
          type: string
        status:
          type: string
        user:
          $ref: '#/components/schemas/User'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: A Bonusly personal access token (PAT) passed as a Bearer token in the Authorization header. Tokens carry read / write / administer scopes per resource and are minted by a Global or Tech admin. A token that lacks the required scope returns 403 Forbidden.