{"openapi":"3.1.0","info":{"title":"CodeMerchant intake workflow","version":"1.0.0"},"servers":[{"url":"https://codemerchant.ai"}],"paths":{"/api/v1/reports/{owner}/{name}":{"get":{"operationId":"get_repository_report","description":"Read the latest source-free report and scan status for a connected repository.","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","required":true,"schema":{"type":"string"}}],"security":[{"bearerAuth":[]}],"x-required-scope":"reports:read","responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/scans":{"post":{"operationId":"scan_repositories","description":"Run an owner-selected bounded batch using saved completed context applicable to each repository. Inspect scanned, failed and remaining. On data_license_required, follow the returned message: show the owner the terms and accept only after their explicit yes.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"scans:write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"mode":{"type":"string","enum":["all","selected"]},"repositories":{"maxItems":3,"type":"array","items":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"}}},"required":["mode"]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/data-license":{"get":{"operationId":"get_data_license","description":"Read the current Data License version, summary, acknowledgements, agreement link and whether the owner has accepted it.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"reports:read","responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}},"post":{"operationId":"accept_data_license","description":"Accept the Data License for the owner. First show the owner the summary, agreement link and every acknowledgement word for word from get_data_license and ask whether they accept. Call this only after they explicitly say yes, passing that version, every acknowledgement true, and their reply quoted as ownerConfirmation. Never accept without their explicit yes.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"license:accept","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"version":{"type":"string","const":"2026-10-16.1"},"agreement":{"type":"boolean","const":true},"ownership":{"type":"boolean","const":true},"ownerConfirmation":{"type":"string","minLength":1,"maxLength":500,"description":"The owner’s own reply agreeing to the Data License, quoted"}},"required":["version","agreement","ownership","ownerConfirmation"]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/repositories":{"get":{"operationId":"list_repositories","description":"Read the saved connected repository inventory.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"reports:read","responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}},"post":{"operationId":"refresh_inventory","description":"Refresh connected repositories and report unavailable installations.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"reports:read","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{}}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/context-uploads":{"post":{"operationId":"context_upload","description":"Initiate, complete, check, list or change the scope of uploads. Transfer file bytes to the returned uploadUrl using HTTP PUT.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"context:write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","oneOf":[{"type":"object","properties":{"action":{"type":"string","const":"initiate"},"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"organizationWide":{"type":"boolean"},"filename":{"type":"string","minLength":1,"maxLength":300},"size":{"type":"integer","exclusiveMinimum":0,"maximum":500000000}},"required":["action","repository","filename","size"]},{"type":"object","properties":{"action":{"type":"string","const":"complete"},"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"id":{"type":"string","minLength":1,"maxLength":300}},"required":["action","repository","id"]},{"type":"object","properties":{"action":{"type":"string","const":"scope"},"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"id":{"type":"string","minLength":1,"maxLength":300},"organizationWide":{"type":"boolean"}},"required":["action","repository","id","organizationWide"]},{"type":"object","properties":{"action":{"type":"string","const":"status"},"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"id":{"type":"string","minLength":1,"maxLength":300}},"required":["action","repository","id"]},{"type":"object","properties":{"action":{"type":"string","const":"list"},"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"organizationOnly":{"type":"boolean"},"cursor":{"type":"string","maxLength":2000}},"required":["action","repository"]}]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/context-scans":{"post":{"operationId":"scan_with_context","description":"Scan one selected repository. Omit contextIds or send an empty array to reuse all saved completed context applicable to it; nonempty IDs select specific uploads. Use refresh true after reviewed fixes. Requires owner Data License acceptance.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"scans:write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"},"contextIds":{"default":[],"type":"array","items":{"type":"string","minLength":1,"maxLength":300}},"refresh":{"default":false,"type":"boolean"}},"required":["repository"]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/submissions":{"get":{"operationId":"list_submissions","description":"Read saved submission IDs and review stages.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"reports:read","responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}},"post":{"operationId":"submit_repositories","description":"Submit the owner-authorized repository selection with completed analyses. Requires owner Data License acceptance. Does not approve a sale or payout. A saved response means the selection is stored; listing \"unavailable\" means only the read-back failed, so re-read list_submissions instead of resubmitting. On github_rate_limited, wait retryAfterSeconds before retrying.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"submissions:write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"repositories":{"minItems":1,"type":"array","items":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"}}},"required":["repositories"]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}},"/api/v1/submissions/refresh":{"post":{"operationId":"refresh_submission","description":"Refresh the analysis of one existing submission after fixes.","parameters":[],"security":[{"bearerAuth":[]}],"x-required-scope":"scans:write","requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"repository":{"type":"string","minLength":1,"maxLength":300,"description":"Connected GitHub owner/name"}},"required":["repository"]}}}},"responses":{"200":{"description":"Completed control operation; inspect returned status before claiming success."},"400":{"description":"Invalid request or unavailable context"},"401":{"description":"Missing or insufficient bearer credential"},"403":{"description":"Owner license or permission required"}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}}}}