openapi: 3.2.0
info:
  title: LDM v3 Admin RPA API
  description: 'Multi-tenant B2B outreach automation platform. Auth: JWT Bearer (15-min) or tenant API key (ldm_*) managed in CRM Settings → API Keys. All tenant-scoped endpoints require the X-Tenant-Id header.'
  version: 1.0.0
  contact: {}
servers:
- url: https://api.live-direct-marketing.online
  description: Production
- url: https://api.dev.live-direct-marketing.online
  description: Development
- url: http://127.0.0.1:3000
  description: Local
tags:
- name: Admin RPA
paths:
  /api/admin/rpa:
    get:
      operationId: RpaAdminController_overview
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: RPA service keys (redacted), tenant opt-ins, queue readiness and legacy drain…
      tags:
      - Admin RPA
  /api/admin/rpa/keys:
    post:
      operationId: RpaAdminController_create
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RpaCreateKeyDto'
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Create a dedicated RPA service key
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/rotate:
    post:
      operationId: RpaAdminController_rotate
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Rotate a dedicated RPA key, invalidating the previous secret
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/reveal:
    get:
      operationId: RpaAdminController_reveal
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Reveal an encrypted current RPA key for SUPER; legacy hash-only keys cannot be…
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/global-access:
    put:
      operationId: RpaAdminController_globalAccess
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RpaGlobalAccessDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Explicitly allow an RPA key to claim work for all active tenant users
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/revoke:
    post:
      operationId: RpaAdminController_revoke
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Revoke RPA service access immediately; started sends remain for reconciliation
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/trace:
    post:
      operationId: RpaAdminController_trace
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RpaTraceDto'
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Enable detailed heartbeat/poll trace for one hour, or disable it
      tags:
      - Admin RPA
  /api/admin/rpa/keys/{id}/grants:
    put:
      operationId: RpaAdminController_grant
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RpaGrantDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Explicit tenant and user opt-in for a service key
      tags:
      - Admin RPA
  /api/admin/rpa/logs:
    get:
      operationId: RpaAdminController_logs
      parameters:
      - name: tenantId
        required: true
        in: query
        schema:
          type: string
      - name: taskId
        required: true
        in: query
        schema:
          type: string
      - name: reasonCode
        required: true
        in: query
        schema:
          type: string
      - name: limit
        required: true
        in: query
        schema:
          type: string
      - name: cursor
        required: true
        in: query
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Correlated RPA history; allowlisted metadata only, bounded keyset pagination
      tags:
      - Admin RPA
  /api/admin/rpa/task-history:
    get:
      operationId: RpaAdminController_taskHistory
      parameters:
      - name: tenantId
        required: true
        in: query
        schema:
          type: string
      - name: taskId
        required: true
        in: query
        schema:
          type: string
      - name: reasonCode
        required: true
        in: query
        schema:
          type: string
      - name: limit
        required: true
        in: query
        schema:
          type: string
      - name: cursor
        required: true
        in: query
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Alias for bounded cross-tenant RPA task history
      tags:
      - Admin RPA
  /api/admin/rpa/protocol:
    get:
      operationId: RpaAdminController_protocol
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: RPA protocol endpoints and retry/lease rules
      tags:
      - Admin RPA
components:
  schemas:
    RpaTraceDto:
      type: object
      properties:
        enabled:
          type: boolean
      required:
      - enabled
    RpaCreateKeyDto:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 100
      required:
      - name
    RpaGlobalAccessDto:
      type: object
      properties:
        enabled:
          type: boolean
      required:
      - enabled
    RpaGrantDto:
      type: object
      properties:
        tenantId:
          type: string
          minLength: 1
          maxLength: 128
        userId:
          type: string
          minLength: 1
          maxLength: 128
        enabled:
          type: boolean
      required:
      - tenantId
      - userId
      - enabled
  securitySchemes:
    jwt:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: JWT access token from /auth/login (Bearer <token>)
    tenant-api-key:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Tenant API key (Bearer ldm_*) for MCP/A2A clients. Issued via CRM Settings → API Keys.
    rpa-service:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Dedicated RPA service key. No tenant API-key or query-key authentication.