openapi: 3.0.3
info:
  title: SmartHR Business Establishments Webhooks API
  description: 'The SmartHR API is a per-tenant REST API for the SmartHR cloud HR / labor and personnel management platform (smarthr.jp). It exposes an organization''s employee ("crew") records and the master data around them - departments, employment types, custom field templates, business establishments - plus webhook subscriptions for change notifications. The API is served from each customer''s own tenant subdomain (https://{tenant}.smarthr.jp/api) and all resources live under the /v1 path. Authentication is a per-tenant access token passed as a Bearer token (or via HTTP Basic with the token as the username).

    This document models a representative, grounded subset of the API. The endpoints below are confirmed against SmartHR''s published API reference and the community Go SDK (github.com/ktsujichan/smarthr-sdk-go). SmartHR''s full API reference documents additional resources (dependents, bank accounts, payrolls, positions, job titles, tags, companies, and more) that are not modeled here.'
  version: '1.0'
  contact:
    name: SmartHR for Developers
    url: https://developer.smarthr.jp/
  termsOfService: https://developer.smarthr.jp/terms/index.html
servers:
- url: https://{tenant}.smarthr.jp/api
  description: Production tenant. Replace {tenant} with your SmartHR subdomain. Each customer has their own subdomain; there is no single shared host.
  variables:
    tenant:
      default: your-subdomain
      description: The customer's SmartHR tenant subdomain.
security:
- bearerAuth: []
tags:
- name: Webhooks
  description: Webhook subscriptions that notify external systems of changes.
paths:
  /v1/webhooks:
    get:
      operationId: listWebhooks
      tags:
      - Webhooks
      summary: List webhooks
      description: Lists webhook subscriptions configured for the tenant.
      parameters:
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PerPage'
      responses:
        '200':
          description: A page of webhook subscriptions.
          headers:
            x-total-count:
              $ref: '#/components/headers/XTotalCount'
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    post:
      operationId: createWebhook
      tags:
      - Webhooks
      summary: Create a webhook
      description: Creates a webhook subscription. SmartHR will POST an event notification to the configured URL when subscribed events occur.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookInput'
      responses:
        '201':
          description: The created webhook subscription.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /v1/webhooks/{id}:
    parameters:
    - $ref: '#/components/parameters/Id'
    get:
      operationId: getWebhook
      tags:
      - Webhooks
      summary: Get a webhook
      description: Retrieves a single webhook subscription by ID.
      responses:
        '200':
          description: The requested webhook subscription.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateWebhook
      tags:
      - Webhooks
      summary: Update a webhook
      description: Updates an existing webhook subscription.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookInput'
      responses:
        '200':
          description: The updated webhook subscription.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    delete:
      operationId: deleteWebhook
      tags:
      - Webhooks
      summary: Delete a webhook
      description: Deletes a webhook subscription.
      responses:
        '204':
          description: The webhook subscription was deleted.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
components:
  schemas:
    WebhookInput:
      type: object
      required:
      - url
      properties:
        url:
          type: string
          format: uri
          description: Destination URL SmartHR POSTs event notifications to.
        description:
          type: string
        secret_token:
          type: string
          description: Shared secret used to sign webhook payloads.
        crew_payload_version:
          type: string
          description: Payload schema version for crew events.
        disabled:
          type: boolean
    Webhook:
      allOf:
      - $ref: '#/components/schemas/WebhookInput'
      - type: object
        properties:
          id:
            type: string
          created_at:
            type: string
            format: date-time
          updated_at:
            type: string
            format: date-time
    Error:
      type: object
      properties:
        code:
          type: integer
        type:
          type: string
        message:
          type: string
        errors:
          type: array
          items:
            type: object
            additionalProperties: true
  parameters:
    Page:
      name: page
      in: query
      required: false
      description: Page number, starting at 1.
      schema:
        type: integer
        minimum: 1
        default: 1
    Id:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource.
      schema:
        type: string
    PerPage:
      name: per_page
      in: query
      required: false
      description: Number of records per page (max 100).
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 10
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing or invalid access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ValidationError:
      description: The request payload failed validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    TooManyRequests:
      description: Rate limit exceeded. SmartHR allows 5,000 requests/hour and 10 requests/second per access token, and 50,000 requests/minute per subdomain.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  headers:
    XTotalCount:
      description: Total number of records matching the query.
      schema:
        type: integer
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Per-tenant access token issued from the SmartHR admin console (or obtained via OAuth2 for registered apps), passed as `Authorization: Bearer ACCESS_TOKEN`. HTTP Basic auth with the access token as the username (`curl -u ACCESS_TOKEN`) is also accepted.'