{"openapi":"3.1.0","paths":{"/developer/keys":{"get":{"description":"Public (non-secret) representation of every key on the tenant, newest first.","operationId":"ApiKeysController_list","parameters":[],"responses":{"200":{"description":"The tenant's API keys.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ApiKeyPublicDto"}}}}}},"security":[{"bearer":[]}],"summary":"List API keys","tags":["developer"]},"post":{"description":"Mint a key. The plaintext `key` is returned exactly ONCE and is never retrievable again.","operationId":"ApiKeysController_create","parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyDto"}}}},"responses":{"201":{"description":"The plaintext key (shown once) plus its public representation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyResponseDto"}}}},"400":{"description":"A restricted key was requested without at least one scope."},"403":{"description":"A restricted key requested a scope outside the caller's grant or scope (e.g. an ops.* permission)."}},"security":[{"bearer":[]}],"summary":"Create an API key","tags":["developer"]}},"/developer/keys/{id}":{"delete":{"description":"Irreversibly revoke a key. Idempotent — revoking an already-revoked key is a no-op.","operationId":"ApiKeysController_revoke","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":"The now-revoked key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyPublicDto"}}}},"404":{"description":"No such key on this tenant."}},"security":[{"bearer":[]}],"summary":"Revoke an API key","tags":["developer"]}},"/developer/keys/ops/tenants/{tenantId}":{"get":{"operationId":"ApiKeysController_opsList","parameters":[{"name":"tenantId","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"security":[{"bearer":[]}],"tags":["developer"]},"post":{"description":"Plaintext returned exactly ONCE — relay it to the clinic over a secure channel.","operationId":"ApiKeysController_opsCreate","parameters":[{"name":"tenantId","required":true,"in":"path","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiKeyDto"}}}},"responses":{"201":{"description":""}},"security":[{"bearer":[]}],"summary":"Mint an API key for any tenant (ops)","tags":["developer"]}},"/developer/keys/ops/tenants/{tenantId}/{id}":{"delete":{"operationId":"ApiKeysController_opsRevoke","parameters":[{"name":"tenantId","required":true,"in":"path","schema":{"type":"string"}},{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"security":[{"bearer":[]}],"tags":["developer"]}},"/products":{"get":{"operationId":"CatalogController_products","parameters":[],"responses":{"200":{"description":""}},"tags":["Catalog"]},"post":{"operationId":"CatalogController_createProduct","parameters":[],"responses":{"201":{"description":""}},"tags":["Catalog"]}},"/products/{id}":{"patch":{"operationId":"CatalogController_updateProduct","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Catalog"]}},"/protocols":{"get":{"operationId":"CatalogController_protocols","parameters":[],"responses":{"200":{"description":""}},"tags":["Catalog"]},"post":{"operationId":"CatalogController_createProtocol","parameters":[],"responses":{"201":{"description":""}},"tags":["Catalog"]}},"/protocols/{id}":{"patch":{"operationId":"CatalogController_updateProtocol","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Catalog"]}},"/catalogs/upload":{"post":{"operationId":"CatalogIngestionController_uploadCatalog","parameters":[{"name":"pharmacyConnectionId","required":true,"in":"query","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"tags":["CatalogIngestion"]}},"/catalogs/{id}":{"get":{"operationId":"CatalogIngestionController_getCatalog","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["CatalogIngestion"]}},"/catalogs":{"get":{"operationId":"CatalogIngestionController_listCatalogs","parameters":[],"responses":{"200":{"description":""}},"tags":["CatalogIngestion"]}},"/catalogs/{id}/approve":{"patch":{"operationId":"CatalogIngestionController_approveCatalog","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["CatalogIngestion"]}},"/catalogs/{id}/reject":{"patch":{"operationId":"CatalogIngestionController_rejectCatalog","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["CatalogIngestion"]}},"/patients":{"get":{"operationId":"PatientsController_list","parameters":[],"responses":{"200":{"description":""}},"tags":["Patients"]},"post":{"operationId":"PatientsController_create","parameters":[],"responses":{"201":{"description":""}},"tags":["Patients"]},"x-neolife-phi":true},"/patients/{id}":{"get":{"operationId":"PatientsController_get","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Patients"]},"patch":{"operationId":"PatientsController_update","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Patients"]},"x-neolife-phi":true},"/orders/routing/plan":{"post":{"operationId":"OrdersController_routingPlan","parameters":[],"responses":{"201":{"description":""}},"security":[{"bearer":[]}],"tags":["orders"]},"x-neolife-phi":true},"/orders/{id}/reroute":{"post":{"operationId":"OrdersController_reroute","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"security":[{"bearer":[]}],"tags":["orders"]},"x-neolife-phi":true},"/orders":{"get":{"description":"The tenant's orders, newest first. Cursor-paginated. Objects carry PHI.","operationId":"OrdersController_list","parameters":[{"name":"status","required":false,"in":"query","description":"Filter to a single lifecycle status.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","description":"Page size (1–100, default 100).","schema":{"type":"string"}},{"name":"starting_after","required":false,"in":"query","description":"Cursor: an order id to page after.","schema":{"type":"string"}}],"responses":{"200":{"description":"A page of order objects.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/OrderDto"}}}}}},"security":[{"bearer":[]}],"summary":"List orders","tags":["orders"]},"x-neolife-phi":true},"/orders/reconciliation":{"get":{"operationId":"OrdersController_reconciliation","parameters":[],"responses":{"200":{"description":""}},"security":[{"bearer":[]}],"tags":["orders"]},"x-neolife-phi":true},"/orders/{id}":{"get":{"description":"Fetch a single order (with patient, prescriptions, shipment, timeline). Carries PHI.","operationId":"OrdersController_get","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":"The order.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrderDto"}}}},"404":{"description":"No such order on this tenant."}},"security":[{"bearer":[]}],"summary":"Get an order","tags":["orders"]},"x-neolife-phi":true},"/orders/{id}/resolve":{"post":{"operationId":"OrdersController_resolve","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"security":[{"bearer":[]}],"tags":["orders"]},"x-neolife-phi":true},"/orders/{id}/approve":{"post":{"description":"THE gate: only a licensed provider can approve. On approval the order auto-submits to the pharmacy.","operationId":"OrdersController_approve","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":"The approved (and submitted) order.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrderDto"}}}},"403":{"description":"Caller is not a provider authorized to approve."}},"security":[{"bearer":[]}],"summary":"Approve an order","tags":["orders"]},"x-neolife-phi":true},"/orders/{id}/submit":{"post":{"description":"Submit an already-provider-approved order to the pharmacy. Refuses any order not yet approved.","operationId":"OrdersController_submit","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":"The submitted order.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrderDto"}}}}},"security":[{"bearer":[]}],"summary":"Submit an order","tags":["orders"]},"x-neolife-phi":true},"/orders/{id}/cancel":{"post":{"description":"Cancel an order that hasn't been delivered or already cancelled.","operationId":"OrdersController_cancel","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":"The cancelled order.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrderDto"}}}},"400":{"description":"Order is delivered or already cancelled."}},"security":[{"bearer":[]}],"summary":"Cancel an order","tags":["orders"]},"x-neolife-phi":true},"/developer/webhooks/events":{"get":{"description":"The catalog of event types a webhook endpoint can subscribe to.","operationId":"DevWebhooksController_events","parameters":[],"responses":{"200":{"description":"Event-type keys.","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"},"example":["order.shipped","intake.submission.created"]}}}}},"security":[{"bearer":[]}],"summary":"List subscribable event types","tags":["developer"]}},"/developer/webhooks":{"get":{"description":"Every configured outbound endpoint for the tenant, oldest first.","operationId":"DevWebhooksController_list","parameters":[],"responses":{"200":{"description":"The tenant's webhook endpoints.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/WebhookEndpointDto"}}}}}},"security":[{"bearer":[]}],"summary":"List webhook endpoints","tags":["developer"]},"post":{"description":"Register an https endpoint. The signing `secret` is returned exactly ONCE — store it now.","operationId":"DevWebhooksController_create","parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWebhookEndpointDto"}}}},"responses":{"201":{"description":"The created endpoint, including its full signing secret.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedWebhookEndpointDto"}}}},"400":{"description":"Invalid URL, non-https host, or unknown event type."}},"security":[{"bearer":[]}],"summary":"Create a webhook endpoint","tags":["developer"]}},"/developer/webhooks/{id}":{"patch":{"description":"Partially update an endpoint's URL, subscribed events, or enabled/disabled status.","operationId":"DevWebhooksController_update","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWebhookEndpointDto"}}}},"responses":{"200":{"description":"The updated endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookEndpointDto"}}}},"404":{"description":"No such endpoint on this tenant."}},"security":[{"bearer":[]}],"summary":"Update a webhook endpoint","tags":["developer"]},"delete":{"operationId":"DevWebhooksController_remove","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":"Deletion confirmation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteResultDto"}}}},"404":{"description":"No such endpoint on this tenant."}},"security":[{"bearer":[]}],"summary":"Delete a webhook endpoint","tags":["developer"]}},"/developer/webhooks/{id}/test":{"post":{"description":"Fire a sample signed event at the endpoint and report the live delivery result.","operationId":"DevWebhooksController_test","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":"The result of the test delivery attempt.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookTestResultDto"}}}},"404":{"description":"No such endpoint on this tenant."}},"security":[{"bearer":[]}],"summary":"Send a test event","tags":["developer"]}},"/developer/webhooks/{id}/deliveries":{"get":{"description":"The last 50 delivery attempts for the endpoint, newest first.","operationId":"DevWebhooksController_deliveries","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":"Delivery-attempt records.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/WebhookDeliveryDto"}}}}}},"security":[{"bearer":[]}],"summary":"List recent deliveries","tags":["developer"]}},"/developer/events":{"get":{"description":"The tenant's durable, PHI-free event log, newest first. Cursor-paginated.","operationId":"EventsController_list","parameters":[{"name":"type","required":false,"in":"query","description":"Filter to a single event type.","schema":{"type":"string"}},{"name":"limit","required":false,"in":"query","description":"Page size (1–100, default 50).","schema":{"type":"string"}},{"name":"starting_after","required":false,"in":"query","description":"Cursor: an event id to page after.","schema":{"type":"string"}}],"responses":{"200":{"description":"A cursor-paginated list of events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventListDto"}}}}},"security":[{"bearer":[]}],"summary":"List events","tags":["developer"]}},"/developer/events/stream":{"get":{"operationId":"EventsController_stream","parameters":[],"responses":{"200":{"description":""}},"security":[{"bearer":[]}],"tags":["developer"]}},"/developer/events/{id}":{"get":{"description":"Fetch a single event by id.","operationId":"EventsController_get","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":"The event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventDto"}}}},"404":{"description":"No such event on this tenant."}},"security":[{"bearer":[]}],"summary":"Get an event","tags":["developer"]}},"/developer/events/{id}/replay":{"post":{"description":"Re-deliver an event to currently-subscribed endpoints (or one endpoint). Safe: receivers dedupe on webhook-id.","operationId":"EventsController_replay","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":"How many endpoints the event was re-delivered to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReplayResultDto"}}}},"404":{"description":"No such event on this tenant."}},"security":[{"bearer":[]}],"summary":"Replay an event","tags":["developer"]}},"/intake/questionnaires":{"get":{"operationId":"IntakeController_questionnaires","parameters":[],"responses":{"200":{"description":""}},"tags":["Intake"]},"post":{"operationId":"IntakeController_publish","parameters":[],"responses":{"201":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/questionnaires/ai-draft":{"post":{"operationId":"IntakeController_aiDraft","parameters":[],"responses":{"201":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/questionnaires/drafts":{"get":{"operationId":"IntakeController_drafts","parameters":[],"responses":{"200":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/questionnaires/{id}/approve":{"post":{"operationId":"IntakeController_approve","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/questionnaires/{key}":{"get":{"operationId":"IntakeController_questionnaire","parameters":[{"name":"key","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/submissions":{"get":{"operationId":"IntakeController_submissions","parameters":[{"name":"status","required":true,"in":"query","schema":{"type":"string"}},{"name":"sandbox","required":true,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Intake"]},"post":{"operationId":"IntakeController_submitInApp","parameters":[],"responses":{"201":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/submissions/{id}":{"get":{"operationId":"IntakeController_submission","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/intake/submissions/{id}/review":{"post":{"operationId":"IntakeController_review","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"tags":["Intake"]},"x-neolife-phi":true},"/public/intake/{embedKey}/questionnaires/{key}":{"get":{"operationId":"PublicIntakeController_questionnaire","parameters":[{"name":"embedKey","required":true,"in":"path","schema":{"type":"string"}},{"name":"key","required":true,"in":"path","schema":{"type":"string"}},{"name":"origin","required":true,"in":"header","schema":{"type":"string"}},{"name":"referer","required":true,"in":"header","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["PublicIntake"]}},"/public/intake/{embedKey}/submissions":{"post":{"operationId":"PublicIntakeController_submit","parameters":[{"name":"embedKey","required":true,"in":"path","schema":{"type":"string"}},{"name":"origin","required":true,"in":"header","schema":{"type":"string"}},{"name":"referer","required":true,"in":"header","schema":{"type":"string"}},{"name":"idempotency-key","required":true,"in":"header","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"tags":["PublicIntake"]}},"/public/intake/hosted/{token}":{"get":{"operationId":"PublicIntakeController_hosted","parameters":[{"name":"token","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["PublicIntake"]}},"/embed/intake.js":{"get":{"operationId":"EmbedController_widgetJs","parameters":[],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/embed/v1/intake.js":{"get":{"operationId":"EmbedController_widgetJsV1","parameters":[],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/embed/flow.js":{"get":{"operationId":"EmbedController_flowJs","parameters":[],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/embed/v1/flow.js":{"get":{"operationId":"EmbedController_flowJsV1","parameters":[],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/embed/frame":{"get":{"operationId":"EmbedController_frame","parameters":[{"name":"k","required":true,"in":"query","schema":{"type":"string"}},{"name":"q","required":true,"in":"query","schema":{"type":"string"}},{"name":"t","required":true,"in":"query","schema":{"type":"string"}},{"name":"theme","required":true,"in":"query","schema":{"type":"string"}},{"name":"shop","required":true,"in":"query","schema":{"type":"string"}},{"name":"cid","required":true,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/embed/demo":{"get":{"operationId":"EmbedController_demo","parameters":[{"name":"mode","required":true,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Embed"]}},"/pharmacies":{"get":{"operationId":"PharmaciesController_list","parameters":[],"responses":{"200":{"description":""}},"tags":["Pharmacies"]},"post":{"operationId":"PharmaciesController_create","parameters":[],"responses":{"201":{"description":""}},"tags":["Pharmacies"]}},"/pharmacies/{id}":{"patch":{"operationId":"PharmaciesController_update","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"200":{"description":""}},"tags":["Pharmacies"]}},"/pharmacies/{id}/sync-catalog":{"post":{"operationId":"PharmaciesController_sync","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"responses":{"201":{"description":""}},"tags":["Pharmacies"]}},"/pharmacies/routing-policy":{"get":{"operationId":"PharmaciesController_getRouting","parameters":[],"responses":{"200":{"description":""}},"tags":["Pharmacies"]},"post":{"operationId":"PharmaciesController_setRouting","parameters":[],"responses":{"201":{"description":""}},"tags":["Pharmacies"]}},"/developer/usage":{"get":{"description":"This billing period's routed-order volume against the plan (and Rail cap), plus developer-object counts.","operationId":"UsageController_usage","parameters":[],"responses":{"200":{"description":"The current period's usage and quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageDto"}}}}},"security":[{"bearer":[]}],"summary":"Get usage + quota","tags":["developer"]}}},"info":{"title":"neolife API","description":"The compliant fulfillment rail for telehealth Rx. Authenticate with a machine API key (Authorization: Bearer nk_live_… / nk_sandbox_…) or a session JWT. **Sandbox keys resolve only to synthetic patients** — build the whole integration before a BAA is signed. **PHI never rides in webhook payloads** (events are ids + status); hydrate PHI over authenticated, RBAC/BAA-covered GETs. Retries are safe with an Idempotency-Key (UUID) header.","version":"2026-07-05","contact":{}},"tags":[{"name":"orders","description":"Create, route, and track fulfillment orders"},{"name":"intake","description":"Compliance questionnaires + provider approval"},{"name":"catalog","description":"Products / formulary"},{"name":"developer","description":"API keys, webhooks, events"},{"name":"pharmacies","description":"Pharmacy connections + routing"}],"servers":[{"url":"https://api.neolife.health","description":"Live"}],"components":{"securitySchemes":{"bearer":{"scheme":"bearer","bearerFormat":"JWT","type":"http","description":"API key (nk_… / rk_…) or session JWT"}},"schemas":{"ApiKeyPublicDto":{"type":"object","properties":{"id":{"type":"string","example":"ak_01H..."},"name":{"type":"string","example":"Production server"},"mode":{"type":"string","enum":["sandbox","live"],"example":"sandbox"},"keyType":{"type":"string","enum":["secret","restricted"],"example":"secret"},"prefix":{"type":"string","description":"Non-secret key prefix","example":"nk_sandbox_"},"last4":{"type":"string","description":"Last 4 chars of the secret, for identification","example":"9f2a"},"scopes":{"description":"RBAC permission keys (restricted keys only)","example":[],"type":"array","items":{"type":"string"}},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time","example":null},"expiresAt":{"type":"string","nullable":true,"format":"date-time","example":null},"revokedAt":{"type":"string","nullable":true,"format":"date-time","example":null},"createdAt":{"type":"string","format":"date-time","example":"2026-07-05T00:00:00.000Z"}},"required":["id","name","mode","keyType","prefix","last4","scopes","lastUsedAt","expiresAt","revokedAt","createdAt"]},"CreateApiKeyDto":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":120,"example":"Production server"},"mode":{"type":"string","enum":["sandbox","live"],"default":"sandbox"},"keyType":{"type":"string","enum":["secret","restricted"],"default":"secret"},"scopes":{"default":[],"description":"RBAC permission keys for a restricted key (>=1 required for restricted; ignored for secret).","type":"array","items":{"type":"string"}},"expiresInDays":{"type":"number","nullable":true,"default":null,"description":"Days until the key expires; null = never.","example":90}},"required":["name"]},"CreateApiKeyResponseDto":{"type":"object","properties":{"key":{"type":"string","description":"The PLAINTEXT key — shown only once, never retrievable again.","example":"nk_sandbox_..."},"apiKey":{"$ref":"#/components/schemas/ApiKeyPublicDto"}},"required":["key","apiKey"]},"LoginDto":{"type":"object","properties":{}},"MagicRequestDto":{"type":"object","properties":{}},"MagicCodeDto":{"type":"object","properties":{}},"MfaVerifyDto":{"type":"object","properties":{}},"RefreshDto":{"type":"object","properties":{}},"PatientLoginDto":{"type":"object","properties":{}},"OrderDto":{"type":"object","properties":{"id":{"type":"string","example":"ord_01H..."},"status":{"type":"string","description":"Fulfillment lifecycle state.","enum":["draft","pending_approval","approved","submitting","submitted","accepted","shipped","delivered","rejected","cancelled"],"example":"submitted"},"source":{"type":"string","description":"Where the order originated.","example":"shopify"},"priority":{"type":"string","example":"normal"},"foreignOrderId":{"type":"object","nullable":true,"description":"Originating store's order id (e.g. Shopify)."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"approvedAt":{"type":"object","nullable":true,"format":"date-time"},"amberFields":{"description":"Amber (low-confidence) fields awaiting human confirmation.","example":[],"type":"array","items":{"type":"string"}}},"required":["id","status","createdAt"]},"BillingHealthDto":{"type":"object","properties":{"stage":{"type":"string","description":"Dunning stage.","enum":["healthy","grace","warning","restricted","suspended","recovered"],"example":"healthy"},"decision":{"type":"string","description":"Routing decision the stage implies — the customer app shows a banner when this is not ROUTE.","enum":["ROUTE","DEGRADE","SOFT_BLOCK","BLOCK"],"example":"ROUTE"},"amountDueCents":{"type":"number","description":"Amount currently past due, in cents (0 when healthy). PHI-free.","example":0},"nextActionAt":{"type":"object","description":"When the next dunning action / Stripe retry is due (ISO-8601), or null.","nullable":true,"example":null},"attemptCount":{"type":"number","description":"Failed payment attempt count on the current invoice.","example":0},"graceExtended":{"type":"boolean","description":"Whether a one-time support grace extension has already been used.","example":false}},"required":["stage","decision","amountDueCents","attemptCount","graceExtended"]},"CheckoutDto":{"type":"object","properties":{"plan":{"type":"string","description":"The self-serve plan tier to subscribe to. Only starter/growth/scale are checkout-able; rail/pilot are free and enterprise is arranged with sales.","enum":["starter","growth","scale"],"example":"starter"},"couponCode":{"type":"string","description":"Optional coupon code to pin at checkout. If it resolves to a synced Stripe promotion code the discount is pre-applied; otherwise the customer can enter any active code on the checkout page.","example":"LAUNCH20"}},"required":["plan"]},"CheckoutUrlDto":{"type":"object","properties":{"url":{"type":"string","description":"The Stripe Checkout (or Customer Portal) URL to redirect the tenant to.","example":"https://checkout.stripe.com/c/pay/cs_test_..."}},"required":["url"]},"WebhookLastDeliveryDto":{"type":"object","properties":{"eventType":{"type":"string","example":"intake.submission.created"},"status":{"type":"string","example":"delivered"},"at":{"type":"string","format":"date-time"},"responseCode":{"type":"number","nullable":true,"example":200}},"required":["eventType","status","at","responseCode"]},"WebhookEndpointDto":{"type":"object","properties":{"id":{"type":"string","example":"whe_01H..."},"url":{"type":"string","format":"uri","example":"https://example.com/webhooks/neolife"},"events":{"description":"Subscribed event types ([] = all).","example":["order.shipped"],"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["enabled","disabled"],"example":"enabled"},"secretHint":{"type":"string","description":"Masked signing secret (full value returned only on create).","example":"whsec_…9f2a"},"createdAt":{"type":"string","format":"date-time"},"lastDelivery":{"nullable":true,"type":"object","allOf":[{"$ref":"#/components/schemas/WebhookLastDeliveryDto"}]}},"required":["id","url","events","status","secretHint","createdAt","lastDelivery"]},"CreateWebhookEndpointDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Must be https:// (http allowed for localhost only).","example":"https://example.com/webhooks/neolife"},"events":{"default":[],"description":"Event types to subscribe to ([] = all).","example":["order.shipped"],"type":"array","items":{"type":"string"}}},"required":["url"]},"CreatedWebhookEndpointDto":{"type":"object","properties":{"id":{"type":"string","example":"whe_01H..."},"url":{"type":"string","format":"uri"},"events":{"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["enabled","disabled"],"example":"enabled"},"secret":{"type":"string","description":"Full signing secret — shown only once. Store it now.","example":"whsec_..."}},"required":["id","url","events","status","secret"]},"UpdateWebhookEndpointDto":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Must be https:// (http allowed for localhost only). SSRF-validated identically to create — a host resolving to a private/loopback/link-local IP or the cloud metadata endpoint is rejected."},"events":{"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["enabled","disabled"]}}},"DeleteResultDto":{"type":"object","properties":{"deleted":{"type":"boolean","example":true}},"required":["deleted"]},"WebhookTestResultDto":{"type":"object","properties":{"status":{"type":"string","example":"delivered"},"responseCode":{"type":"number","nullable":true,"example":200},"lastError":{"type":"string","nullable":true}}},"WebhookDeliveryDto":{"type":"object","properties":{"id":{"type":"string"},"eventId":{"type":"string"},"eventType":{"type":"string","example":"order.shipped"},"status":{"type":"string","enum":["pending","failed","delivered","dead"],"example":"delivered"},"attempts":{"type":"number","example":1},"responseCode":{"type":"number","nullable":true,"example":200},"lastError":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"deliveredAt":{"type":"string","nullable":true,"format":"date-time"},"nextAttemptAt":{"type":"string","format":"date-time"}},"required":["id","eventId","eventType","status","attempts","responseCode","lastError","createdAt","deliveredAt","nextAttemptAt"]},"EventDto":{"type":"object","properties":{"id":{"type":"string","example":"evt_01H..."},"type":{"type":"string","description":"Event type","example":"intake.submission.created"},"data":{"type":"object","additionalProperties":true,"description":"PHI-free payload (ids + verdicts/status).","example":{"submissionId":"sub_123","verdict":"eligible"}},"createdAt":{"type":"string","format":"date-time","example":"2026-07-05T00:00:00.000Z"}},"required":["id","type","data","createdAt"]},"EventListDto":{"type":"object","properties":{"object":{"type":"string","example":"list"},"data":{"type":"array","items":{"$ref":"#/components/schemas/EventDto"}},"has_more":{"type":"boolean","description":"True if more events exist beyond this page.","example":false}},"required":["object","data","has_more"]},"ReplayResultDto":{"type":"object","properties":{"replayedTo":{"type":"number","description":"Number of endpoints the event was re-delivered to.","example":1},"note":{"type":"string","description":"Present when nothing was replayed.","example":"No enabled endpoint is subscribed to this event type."}},"required":["replayedTo"]},"UpdatePatientDto":{"type":"object","properties":{}},"VerifyEmailDto":{"type":"object","properties":{}},"UsagePeriodDto":{"type":"object","properties":{"start":{"type":"string","format":"date-time","example":"2026-07-01T00:00:00.000Z"},"end":{"type":"string","format":"date-time","example":"2026-07-05T00:00:00.000Z"}},"required":["start","end"]},"UsageDto":{"type":"object","properties":{"object":{"type":"string","example":"usage"},"period":{"$ref":"#/components/schemas/UsagePeriodDto"},"plan":{"type":"string","description":"The tenant's plan tier key.","example":"starter"},"ordersRouted":{"type":"number","description":"Orders neolife routed this period (the billable metric).","example":12},"orderCapPerMonth":{"type":"number","description":"Monthly order cap (present only on capped tiers, e.g. Rail).","example":50},"ordersRemaining":{"type":"number","description":"Orders remaining under the cap (present only on capped tiers).","example":38},"activeApiKeys":{"type":"number","description":"Count of non-revoked API keys.","example":2},"enabledWebhookEndpoints":{"type":"number","description":"Count of enabled webhook endpoints.","example":1},"eventsThisPeriod":{"type":"number","description":"Events recorded this period.","example":340}},"required":["object","period","plan","ordersRouted","activeApiKeys","enabledWebhookEndpoints","eventsThisPeriod"]}}}}