openapi: 3.1.0
info:
  title: Yonek Brief API
  version: '1.2'
  description: >-
    API für On-Demand-Briefbestellungen. Eine erfolgreiche Annahme startet weder
    Produktion noch Versand automatisch; jede Bestellung wird von Yonek geprüft.
  contact:
    name: Yonek API Support
    email: kontakt@yonek.de
    url: https://yonek.de/entwickler/brief-api
servers:
  - url: https://yonek.de/api/brief/v1
security:
  - bearerAuth: []
paths:
  /info:
    get:
      operationId: getApiInfo
      summary: Version, Endpunkte und kundenspezifische Limits abrufen
      responses:
        '200':
          description: Integrationsinformationen
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiInfo'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/RateLimited'
  /orders:
    post:
      operationId: createOrder
      summary: Briefbestellung anlegen
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrderRequest'
      responses:
        '201':
          description: Bestellung wurde angelegt
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateOrderResponse'
        '200':
          description: Bereits mit demselben Idempotency-Key angelegte Bestellung
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DuplicateOrderResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '408':
          $ref: '#/components/responses/RequestTimeout'
        '415':
          $ref: '#/components/responses/UnsupportedMediaType'
        '422':
          $ref: '#/components/responses/ValidationFailed'
        '429':
          $ref: '#/components/responses/RateLimited'
  /orders/{order_id}:
    get:
      operationId: getOrderStatus
      summary: Status einer eigenen Bestellung abrufen
      parameters:
        - name: order_id
          in: path
          required: true
          schema:
            type: string
            pattern: '^bo_[a-z0-9_]+$'
      responses:
        '200':
          description: Aktueller Bestellstatus
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrderStatusResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: Bestellung nicht gefunden oder gehört zu einem anderen API-Key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          $ref: '#/components/responses/RateLimited'
webhooks:
  orderEvent:
    post:
      summary: Ereignis order.created oder order.status_changed
      description: >-
        Optionaler, signierter Webhook. Der Header Yonek-Signature enthält
        t=<unix>,v1=<hmac-sha256 über t.rawBody>. Fehlgeschlagene Zustellungen
        werden mit exponentiellem Backoff bis zu zehnmal wiederholt.
      parameters:
        - name: Yonek-Event
          in: header
          required: true
          schema: { type: string, enum: [order.created, order.status_changed] }
        - name: Yonek-Delivery
          in: header
          required: true
          schema: { type: string }
        - name: Yonek-Signature
          in: header
          required: true
          schema: { type: string }
      requestBody:
        required: true
        content:
          application/json:
            schema: { $ref: '#/components/schemas/WebhookPayload' }
      responses:
        '200': { description: Webhook angenommen }
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Yonek API key
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      description: Stabiler Schlüssel pro logischer Bestellung.
      schema:
        type: string
        minLength: 8
        maxLength: 128
        pattern: '^[a-zA-Z0-9._:-]+$'
  schemas:
    OrderStatus:
      type: string
      enum: [received, in_review, accepted, production, sent, delivered, rejected, cancelled]
    Recipient:
      type: object
      additionalProperties: false
      required: [address_line1, postal_code, city]
      anyOf:
        - required: [name]
        - required: [company]
      properties:
        name: { type: string, maxLength: 160 }
        company: { type: string, maxLength: 160 }
        address_line1: { type: string, maxLength: 180 }
        address_line2: { type: string, maxLength: 180 }
        postal_code: { type: string, maxLength: 20 }
        city: { type: string, maxLength: 120 }
        country: { type: string, maxLength: 80, default: DE }
    Letter:
      type: object
      additionalProperties: false
      required: [text]
      properties:
        text: { type: string, minLength: 10, maxLength: 10000 }
        salutation: { type: string, maxLength: 160 }
    CreateOrderRequest:
      type: object
      additionalProperties: false
      required: [external_id, recipient, letter]
      properties:
        external_id: { type: string, maxLength: 100 }
        recipient: { $ref: '#/components/schemas/Recipient' }
        letter: { $ref: '#/components/schemas/Letter' }
        sender_reference: { type: string, maxLength: 160 }
        context:
          type: string
          maxLength: 3000
          description: Unvertrauenswürdige Zusatzinformation; keine automatische LLM-Verarbeitung.
        metadata:
          type: object
          maxProperties: 20
          additionalProperties: { type: string, maxLength: 500 }
    CreateOrderResponse:
      type: object
      required: [order_id, status, status_url, duplicate]
      properties:
        order_id: { type: string }
        status: { $ref: '#/components/schemas/OrderStatus' }
        status_url: { type: string }
        duplicate: { type: boolean, const: false }
        request_id: { type: string }
    DuplicateOrderResponse:
      type: object
      required: [order_id, status, duplicate]
      properties:
        order_id: { type: string }
        status: { $ref: '#/components/schemas/OrderStatus' }
        duplicate: { type: boolean, const: true }
        request_id: { type: string }
    OrderStatusResponse:
      type: object
      required: [order_id, external_id, status, status_text, created_at, updated_at]
      properties:
        order_id: { type: string }
        external_id: { type: string }
        status: { $ref: '#/components/schemas/OrderStatus' }
        status_text: { type: string }
        created_at: { type: string, format: date-time }
        updated_at: { type: string, format: date-time }
        sent_at: { type: [string, 'null'], format: date-time }
        estimated_delivery_at: { type: [string, 'null'], format: date-time }
        delivered_at: { type: [string, 'null'], format: date-time }
        delivery_estimate_passed: { type: boolean }
        request_id: { type: string }
    ApiInfo:
      type: object
      properties:
        name: { type: string }
        version: { type: string }
        customer: { type: string }
        description: { type: string }
        endpoints: { type: object, additionalProperties: { type: string } }
        limits: { type: object }
        price_per_letter_eur: { type: [number, 'null'] }
        status_values:
          type: array
          items: { $ref: '#/components/schemas/OrderStatus' }
        webhooks_enabled: { type: boolean }
        request_id: { type: string }
    WebhookPayload:
      type: object
      required: [id, event, created_at, data]
      properties:
        id: { type: string }
        event: { type: string, enum: [order.created, order.status_changed] }
        created_at: { type: string, format: date-time }
        data:
          type: object
          required: [order_id, external_id, status, created_at, updated_at]
          properties:
            order_id: { type: string }
            external_id: { type: string }
            status: { $ref: '#/components/schemas/OrderStatus' }
            created_at: { type: string, format: date-time }
            updated_at: { type: string, format: date-time }
            sent_at: { type: [string, 'null'], format: date-time }
            estimated_delivery_at: { type: [string, 'null'], format: date-time }
            delivered_at: { type: [string, 'null'], format: date-time }
    Error:
      type: object
      required: [error]
      properties:
        error: { type: string }
        message: { type: string }
        details:
          type: array
          items: { type: string }
        request_id: { type: string }
  responses:
    BadRequest:
      description: Ungültiges JSON oder ungültiger Idempotency-Key
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    Unauthorized:
      description: API-Key fehlt, ist ungültig oder wurde widerrufen
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    PayloadTooLarge:
      description: Request größer als 32 KB
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    RequestTimeout:
      description: Request-Body nicht innerhalb von zehn Sekunden übertragen
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    UnsupportedMediaType:
      description: Content-Type ist nicht application/json
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    ValidationFailed:
      description: Nutzdaten konnten nicht validiert werden
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }
    RateLimited:
      description: Minuten- oder Tageslimit erreicht
      headers:
        Retry-After:
          description: Bei Minutenlimits die Wartezeit in Sekunden.
          schema: { type: integer }
      content: { application/json: { schema: { $ref: '#/components/schemas/Error' } } }