{
  "openapi": "3.1.0",
  "info": {
    "title": "Health API",
    "description": "Connectivity and credential validation check.\n\nUse this endpoint to verify that your API credentials are valid and to inspect the bound tenant, environment, and scopes.",
    "version": "1.0.0",
    "x-metadata": {
      "title": "Health API",
      "description": "Connectivity and credential validation check"
    }
  },
  "servers": [
    {
      "url": "https://api.dev.deepcredentials.swiss",
      "description": "Development"
    },
    {
      "url": "https://api.int.deepcredentials.swiss",
      "description": "Integration"
    }
  ],
  "tags": [
    {
      "name": "Health",
      "description": "Validate connectivity and credential metadata."
    }
  ],
  "paths": {
    "/b2b/v1/health": {
      "get": {
        "description": "Returns metadata for the authenticated service user: org, environment, scopes, and label. Useful for testing connectivity and verifying your credentials are valid.\n",
        "operationId": "GET:b2b.Health",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "environment": {
                      "description": "Environment scoping the call (from X-Environment).",
                      "type": "string"
                    },
                    "label": {
                      "description": "Human-readable label sourced from the JWT (e.g. preferred_username for service\naccounts).",
                      "type": "string"
                    },
                    "org_id": {
                      "type": "string",
                      "format": "uuid",
                      "description": "UUID v4 identifier.",
                      "example": "550e8400-e29b-41d4-a716-446655440000"
                    },
                    "scopes": {
                      "items": {
                        "type": "string"
                      },
                      "description": "Scopes granted to this service user (from the JWT `scope` claim).",
                      "type": "array"
                    },
                    "service_user_id": {
                      "type": "string",
                      "format": "uuid",
                      "description": "UUID v4 identifier.",
                      "example": "550e8400-e29b-41d4-a716-446655440000"
                    },
                    "status": {
                      "description": "Always \"ok\" when the request is authenticated.",
                      "type": "string"
                    },
                    "timestamp": {
                      "description": "Response time in RFC3339 UTC (for client logging and skew checks).",
                      "type": "string"
                    }
                  },
                  "required": [
                    "status",
                    "timestamp",
                    "service_user_id",
                    "org_id",
                    "environment",
                    "label",
                    "scopes"
                  ],
                  "type": "object"
                }
              }
            },
            "description": "Success response"
          },
          "400": {
            "description": "Invalid request. Common causes: missing or malformed X-Org-Id / X-Environment headers, or a missing required field in the request body.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "code": "invalid_argument",
                  "message": "X-Org-Id header is required."
                }
              }
            }
          },
          "401": {
            "description": "Unauthenticated. The Bearer token failed validation (signature, issuer, audience, or expiry).",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "code": "unauthenticated",
                  "message": "Missing or invalid Bearer token."
                }
              }
            }
          },
          "403": {
            "description": "Permission denied. The token does not carry the scope required by this endpoint. Check the `scope` claim on the token you received from the DeepCloud SSO token endpoint.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "code": "permission_denied",
                  "message": "Token lacks the required scope."
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "code": "resource_exhausted",
                  "message": "Rate limit exceeded. Retry with backoff."
                }
              }
            }
          },
          "500": {
            "description": "Internal server error.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "code": "internal",
                  "message": "An unexpected error occurred."
                }
              }
            }
          }
        },
        "summary": "Validate API credentials.\n",
        "tags": [
          "Health"
        ],
        "parameters": [
          {
            "$ref": "#/components/parameters/XOrgIdHeader"
          },
          {
            "$ref": "#/components/parameters/XEnvironmentHeader"
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "DeepAdmin-issued Keycloak access token obtained via the OAuth 2.0\nResource Owner Password Credentials grant against the DeepCloud SSO\nrealm. See the Service Users guide for the exchange flow."
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "code",
          "message"
        ],
        "properties": {
          "code": {
            "type": "string",
            "description": "Machine-readable error code."
          },
          "message": {
            "type": "string",
            "description": "Human-readable error description."
          },
          "details": {
            "type": "object",
            "description": "Optional structured data with additional context."
          }
        }
      }
    },
    "parameters": {
      "XOrgIdHeader": {
        "name": "X-Org-Id",
        "in": "header",
        "required": true,
        "schema": {
          "type": "string",
          "format": "uuid"
        },
        "description": "Organization the call is acting on. The authenticated service user must be a member of this organization in DeepAdmin; otherwise the request returns 404."
      },
      "XEnvironmentHeader": {
        "name": "X-Environment",
        "in": "header",
        "required": true,
        "schema": {
          "type": "string",
          "enum": [
            "beta",
            "production"
          ]
        },
        "description": "Environment the call is scoped to. Resources are isolated per environment."
      }
    }
  },
  "security": [
    {
      "BearerAuth": []
    }
  ]
}