openapi: 3.2.0
info:
  title: LDM v3 Users API
  description: 'Multi-tenant B2B outreach automation platform. Auth: JWT Bearer (15-min) or tenant API key (ldm_*) managed in CRM Settings → API Keys. All tenant-scoped endpoints require the X-Tenant-Id header.'
  version: 1.0.0
  contact: {}
servers:
- url: https://api.live-direct-marketing.online
  description: Production
- url: https://api.dev.live-direct-marketing.online
  description: Development
- url: http://127.0.0.1:3000
  description: Local
tags:
- name: Users
paths:
  /api/users/me/accept-terms:
    post:
      operationId: UsersController_acceptTerms
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Accept legal terms for the current user
      tags:
      - Users
      x-required-scope:
      - users:write
  /api/users:
    get:
      operationId: UsersController_findAll
      parameters:
      - name: page
        required: true
        in: query
        schema:
          type: number
      - name: pageSize
        required: true
        in: query
        schema:
          type: number
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: List users (SUPER/MANAGER)
      tags:
      - Users
    post:
      operationId: UsersController_createUser
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserDto'
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Create a user (SUPER only)
      tags:
      - Users
  /api/users/system/stats:
    get:
      operationId: UsersController_systemStats
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Get system stats (SUPER only)
      tags:
      - Users
      x-required-scope:
      - users:read
  /api/users/system/kill-process/{pid}:
    post:
      operationId: UsersController_killProcess
      parameters:
      - name: pid
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Kill a system process by pid (SUPER only)
      tags:
      - Users
  /api/users/system/cleanup-orphans:
    post:
      operationId: UsersController_cleanupOrphans
      parameters:
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Cleanup orphan system resources (SUPER only)
      tags:
      - Users
      x-required-scope:
      - users:write
  /api/users/{id}:
    get:
      operationId: UsersController_findById
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Get a user by id (SUPER/MANAGER)
      tags:
      - Users
    delete:
      operationId: UsersController_deleteUser
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: 'Delete a user with tenant cleanup: sole-member tenants + their DBs are dropped…'
      tags:
      - Users
  /api/users/{id}/role:
    patch:
      operationId: UsersController_updateRole
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Update a user role (SUPER/MANAGER)
      tags:
      - Users
  /api/users/{id}/status:
    patch:
      operationId: UsersController_updateStatus
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateStatusDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Update a user status (SUPER/MANAGER)
      tags:
      - Users
  /api/users/{id}/password:
    patch:
      operationId: UsersController_updatePassword
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePasswordDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Update a user password (SUPER only)
      tags:
      - Users
  /api/users/{id}/profile:
    patch:
      operationId: UsersController_updateProfile
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProfileDto'
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Update a user profile (SUPER only)
      tags:
      - Users
  /api/users/{id}/comments:
    get:
      operationId: UsersController_listComments
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: List admin comments on a user (SUPER/MANAGER)
      tags:
      - Users
    post:
      operationId: UsersController_addComment
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddCommentDto'
      responses:
        '201':
          description: ''
      security:
      - jwt: []
      summary: Add an admin comment on a user (SUPER/MANAGER)
      tags:
      - Users
  /api/users/{id}/comments/{commentId}:
    delete:
      operationId: UsersController_deleteComment
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: commentId
        required: true
        in: path
        schema:
          type: string
      - name: X-Tenant-Id
        in: header
        required: false
        schema:
          type: string
          format: uuid
        description: Tenant UUID — required for all tenant-scoped endpoints
      responses:
        '200':
          description: ''
      security:
      - jwt: []
      summary: Delete an admin comment on a user (SUPER only)
      tags:
      - Users
components:
  schemas:
    UpdateRoleDto:
      type: object
      properties:
        role:
          type: object
      required:
      - role
    UpdateStatusDto:
      type: object
      properties:
        status:
          type: object
      required:
      - status
    UpdateProfileDto:
      type: object
      properties:
        firstName:
          type: string
        lastName:
          type: string
    AddCommentDto:
      type: object
      properties: {}
    UpdatePasswordDto:
      type: object
      properties:
        password:
          type: string
          minLength: 8
      required:
      - password
    CreateUserDto:
      type: object
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          minLength: 8
        firstName:
          type: string
        lastName:
          type: string
        role:
          type: object
      required:
      - email
      - password
  securitySchemes:
    jwt:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: JWT access token from /auth/login (Bearer <token>)
    tenant-api-key:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Tenant API key (Bearer ldm_*) for MCP/A2A clients. Issued via CRM Settings → API Keys.
    rpa-service:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Dedicated RPA service key. No tenant API-key or query-key authentication.