openapi: 3.1.0
info:
  title: Highlight Session Ingestion API
  description: >
    GraphQL-over-HTTP session replay ingestion endpoint used by the
    `highlight.run` browser SDK. Receives rrweb DOM snapshots, console and
    network recordings, custom events, identify payloads, and frontend errors.
    Authenticated by project verbose ID (public); no user secrets required.
  version: '1.0'
  contact:
    name: Highlight Support
    url: https://www.highlight.io/community
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
  - url: https://pub.highlight.io
    description: Highlight public ingestion endpoint
  - url: http://localhost:8082
    description: Self-hosted public ingestion endpoint
tags:
  - name: Sessions
    description: Browser session ingestion mutations
paths:
  /:
    post:
      summary: Execute Public Graph Mutation
      description: >
        Single GraphQL endpoint that accepts the SDK mutations
        `initializeSession`, `pushPayload`, `identifySession`, `addSessionFeedback`,
        `addSessionProperties`, `addTrackProperties`, `pushBackendPayload`, and
        `markBackendSetup`. Operation is determined by the `operationName` field
        in the JSON body.
      operationId: executePublicGraphMutation
      tags:
        - Sessions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GraphQLRequest'
      responses:
        '200':
          description: GraphQL response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GraphQLResponse'
        '400':
          description: Invalid GraphQL payload.
        '429':
          description: Rate limited.
components:
  schemas:
    GraphQLRequest:
      type: object
      required: [query]
      properties:
        operationName:
          type: string
          description: >
            One of `initializeSession`, `pushPayload`, `identifySession`,
            `addSessionFeedback`, `addSessionProperties`, `addTrackProperties`,
            `pushBackendPayload`, `markBackendSetup`.
        query:
          type: string
        variables:
          type: object
          additionalProperties: true
          description: >
            Mutation variables. For `initializeSession` includes
            `organization_verbose_id`, `enable_strict_privacy`, `client_version`,
            `firstload_version`, `client_config`, `environment`, `appversion`,
            `fingerprint`, `client_id`, `network_recording_domains`. For
            `pushPayload` includes `session_secure_id`, `events`,
            `messages`, `resources`, `errors`, `payload_id`.
    GraphQLResponse:
      type: object
      properties:
        data:
          type: object
          additionalProperties: true
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
              path:
                type: array
                items:
                  type: string
              extensions:
                type: object
                additionalProperties: true