openapi: 3.2.0
info:
  title: Monid Identities API
  version: 0.1.0
  description: Agentic payment platform for data — agents discover and buy data on demand. Authenticated `/v1/*` routes accept a Monid API key or Clerk JWT as a Bearer token. All errors return `{ code, message }`. List endpoints use cursor pagination; consult each operation schema for its last-page cursor encoding.
servers:
- url: https://api.monid.ai
  description: Production
- url: https://monid.ai
  description: Public registry alias (public/v1 only)
tags:
- name: Identities
paths:
  /v1/identities/{provider}/link/complete:
    post:
      tags:
      - Identities
      summary: Complete linking an external identity
      description: Exchanges the provider's authorization `code` (using the pending link identified by `state`) and links the verified identity to the signed-in user. The pending link is single-use and expires 10 minutes after it was started.
      security:
      - Bearer: []
      parameters:
      - schema:
          type: string
          example: world-sandbox
        required: true
        name: provider
        in: path
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdentityLinkCompleteRequest'
      responses:
        '200':
          description: Identity linked (or re-verified)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentityLinkCompleteResponse'
        '400':
          description: Bad request — input failed validation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized — missing or invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Not a session credential (`IDENTITY_LINK_REQUIRES_SESSION`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Unknown or disabled provider (`IDENTITY_PROVIDER_UNKNOWN`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Identity belongs to another user (`IDENTITY_ALREADY_LINKED`) or the user already holds a different identity from this provider (`IDENTITY_USER_ALREADY_LINKED`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limit exceeded (errorCode `RATE_LIMITED`) — the `Retry-After` header carries whole seconds until the caller may retry; `RateLimit-Limit/-Remaining/-Reset` and `X-RateLimit-Rule` name the binding rule (also sent on allowed responses that matched a rule; responses that matched no rule, or an `unlimited` exemption, carry none of them). Applies to every authenticated `/v1` route (per API key / user / origin / workspace); POST /v1/run additionally enforces per-provider/endpoint run limits.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Identity provider unavailable (`IDENTITY_PROVIDER_UNAVAILABLE`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postV1IdentitiesByProviderLinkComplete
      x-operation-id-source: derived
  /v1/identities/{provider}/link:
    post:
      tags:
      - Identities
      summary: Start linking an external identity
      description: Begins the OpenID Connect authorization-code flow for `provider` and returns the URL to send the browser to. The flow is completed by `POST /v1/identities/{provider}/link/complete` with the `code` and `state` the provider redirects back with. Requires a signed-in session (not an API key).
      security:
      - Bearer: []
      parameters:
      - schema:
          type: string
          description: Identity provider key, e.g. `world-sandbox`.
          example: world-sandbox
        required: true
        description: Identity provider key, e.g. `world-sandbox`.
        name: provider
        in: path
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdentityLinkStartRequest'
      responses:
        '201':
          description: Pending link created; redirect the browser
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentityLinkStartResponse'
        '400':
          description: Bad request — input failed validation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized — missing or invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Not a session credential (`IDENTITY_LINK_REQUIRES_SESSION`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Unknown or disabled provider (`IDENTITY_PROVIDER_UNKNOWN`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too many link attempts (`IDENTITY_LINK_RATE_LIMITED`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Identity provider unavailable (`IDENTITY_PROVIDER_UNAVAILABLE`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postV1IdentitiesByProviderLink
      x-operation-id-source: derived
components:
  schemas:
    IdentityLinkCompleteRequest:
      type: object
      properties:
        state:
          type: string
          minLength: 1
          maxLength: 256
        code:
          type: string
          minLength: 1
          maxLength: 4096
      required:
      - state
      - code
    IdentityLinkStartResponse:
      type: object
      properties:
        authorizationUrl:
          type: string
          format: uri
          description: Send the browser here to authenticate at the provider.
        expiresAt:
          type: string
          format: date-time
          description: The pending link must be completed before this instant.
      required:
      - authorizationUrl
      - expiresAt
    Error:
      type: object
      properties:
        code:
          type: integer
          description: HTTP status code, duplicated in the body.
          example: 400
        message:
          type: string
          description: Human-readable error description.
          example: Bad Request
        errorCode:
          type: string
          enum:
          - RATE_LIMITED
          - X402_WORKSPACE_RESOURCES
          - X402_ACCRUING_COST
          - X402_EXCEEDS_SETTLEMENT_WINDOW
          - X402_VALIDITY_WINDOW_TOO_SHORT
          - X402_UNBOUNDED_PRICE
          - INSUFFICIENT_SCOPE
          - WALLET_INSUFFICIENT_FUNDS
          - IDENTITY_PROVIDER_UNKNOWN
          - IDENTITY_LINK_REQUIRES_SESSION
          - IDENTITY_LINK_STATE_INVALID
          - IDENTITY_VERIFICATION_FAILED
          - IDENTITY_PROVIDER_UNAVAILABLE
          - IDENTITY_ALREADY_LINKED
          - IDENTITY_USER_ALREADY_LINKED
          - IDENTITY_LINK_RATE_LIMITED
          - IDENTITY_REQUIRED
          - PROMO_IDENTITY_REDEEMED
          - PROMO_REDEEM_REQUIRES_SESSION
          - PROMO_REDEEM_DISABLED
          description: OPTIONAL machine-readable discriminant from the documented `ApiErrorCode` registry. Absent on legacy errors; clients MUST treat unknown values as absent.
      required:
      - code
      - message
    IdentityLinkStartRequest:
      type: object
      properties:
        returnTo:
          type: string
          maxLength: 512
          description: Dashboard path to return to after the link completes (same-origin path only, e.g. `/wallet?promoResume=1`).
          example: /wallet
    IdentityLinkCompleteResponse:
      type: object
      properties:
        provider:
          type: string
          enum:
          - clerk
          - aep
          - world
          - world-sandbox
        verified:
          type: boolean
        firstLink:
          type: boolean
          description: True when this call created the identity link.
        returnTo:
          type: string
          description: The `returnTo` supplied when the link was started.
      required:
      - provider
      - verified
      - firstLink
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      description: 'Monid API key (`Authorization: Bearer mk_...`) or Clerk-issued JWT.'