openapi: 3.0.3
info:
  title: Friendbuy Merchant Analytics Authorization API
  description: 'The Friendbuy Merchant API is the server-to-server REST interface for Friendbuy''s referral and loyalty marketing platform. Merchants use it to sync customer records, generate personal referral links, track conversion events (purchases, sign-ups, and custom events), pull campaign analytics, and manage loyalty ledger balances and reward redemptions. The base URL is https://mapi.fbot.me/v1 (the fbot.me host is Friendbuy''s Merchant API origin). Authentication is a two-step flow: exchange an account key and secret at POST /authorization for a short-lived Bearer JWT, then send that token as `Authorization: Bearer <token>` on every subsequent request.

    Endpoint paths in this document are grounded in Friendbuy''s public developer documentation at developers.friendbuy.com. Request and response schemas are honestly modeled from the documented behavior and common Friendbuy payload fields; exact field-level shapes should be reconciled against the live reference before production use.'
  version: '1.0'
  contact:
    name: Friendbuy
    url: https://friendbuy.com
  license:
    name: Proprietary
    url: https://friendbuy.com/terms
servers:
- url: https://mapi.fbot.me/v1
  description: Friendbuy Merchant API
security:
- bearerAuth: []
tags:
- name: Authorization
  description: Exchange account key and secret for a Bearer token.
paths:
  /authorization:
    post:
      operationId: createAuthorization
      tags:
      - Authorization
      summary: Obtain a Bearer token
      description: Exchanges an account key and secret (from the Friendbuy Developer Center) for a short-lived Bearer JWT used to authorize all other Merchant API calls.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizationRequest'
      responses:
        '200':
          description: A Bearer token and its expiration.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Missing or invalid Bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
    AuthorizationRequest:
      type: object
      required:
      - key
      - secret
      properties:
        key:
          type: string
          description: Your Merchant API access key.
        secret:
          type: string
          description: Your Merchant API secret.
    AuthorizationResponse:
      type: object
      properties:
        tokenType:
          type: string
          example: Bearer
        token:
          type: string
          description: The Bearer JWT.
        expires:
          type: string
          format: date-time
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Bearer JWT obtained from POST /authorization by exchanging your account key and secret. Passed as `Authorization: Bearer <token>`.'