openapi: 3.0.3
info:
  title: SOAT Projects API
  version: 1.0.0
  description: API for managing projects (Projects resource)
  contact:
    name: SOAT Team
    url: https://github.com/ttoss/soat
servers:
  - url: '{baseUrl}'
    description: Base URL of your SOAT deployment (e.g. https://your-soat.com or http://localhost:5047)
    variables:
      baseUrl:
        description: The base URL of your SOAT deployment
        default: http://localhost:5047
tags:
  - name: Projects
    description: Manage projects
security:
  - bearerAuth: []
paths:
  /api/v1/projects:
    get:
      tags:
        - Projects
      summary: List projects
      description: >
        Lists projects accessible to the caller.
        - JWT admin: returns all projects.
        - JWT regular user: returns only projects granted by the user's policies.
        - API key scoped to a project: returns only that project.
      operationId: listProjects
      security:
        - bearerAuth: []
      responses:
        '200':
          description: List of projects
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ProjectRecord'
        '401':
          description: Unauthorized
    post:
      tags:
        - Projects
      summary: Create a project
      description: Creates a new project. Requires admin role.
      operationId: createProject
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
                  example: My Project
      responses:
        '201':
          description: Project created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: proj_V1StGXR8Z5jdHi6B
                  name:
                    type: string
                  created_at:
                    type: string
                    format: date-time
        '401':
          description: Unauthorized
        '403':
          description: Forbidden (non-admin user)
        '500':
          description: Internal server error
  /api/v1/projects/{project_id}:
    get:
      tags:
        - Projects
      summary: Get a project
      description: Returns details of a specific project.
      operationId: getProject
      parameters:
        - name: project_id
          in: path
          required: true
          description: Project public ID (proj_ prefix)
          schema:
            type: string
            example: proj_V1StGXR8Z5jdHi6B
      responses:
        '200':
          description: Project details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProjectRecord'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Project not found
    patch:
      tags:
        - Projects
      summary: Rename a project
      description: Updates a project's name. Requires admin role.
      operationId: updateProject
      parameters:
        - name: project_id
          in: path
          required: true
          description: Project public ID (proj_ prefix)
          schema:
            type: string
            example: proj_V1StGXR8Z5jdHi6B
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
              properties:
                name:
                  type: string
                  example: Renamed Project
      responses:
        '200':
          description: Project updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProjectRecord'
        '400':
          description: Invalid request body
        '401':
          description: Unauthorized
        '403':
          description: Forbidden (non-admin user)
        '404':
          description: Project not found
    delete:
      tags:
        - Projects
      summary: Delete a project
      description: >
        Deletes a project. Requires admin role. Fails with `409` if the
        project has any dependent resources (agents, ai providers, tools,
        conversations, chats, formations, memories, actors, webhooks,
        secrets, sessions, files, traces, generations, orchestrations, etc.),
        unless `force=true` is passed, in which case those resources are
        deleted along with the project.
      operationId: deleteProject
      parameters:
        - name: project_id
          in: path
          required: true
          description: Project public ID (proj_ prefix)
          schema:
            type: string
            example: proj_V1StGXR8Z5jdHi6B
        - name: force
          in: query
          required: false
          description: >
            When `true`, deletes all of the project's dependent resources
            instead of returning `409 PROJECT_HAS_DEPENDENTS`.
          schema:
            type: boolean
            default: false
      responses:
        '204':
          description: Project deleted successfully
        '401':
          description: Unauthorized
        '403':
          description: Forbidden (non-admin user)
        '404':
          description: Project not found
        '409':
          description: Project has dependent resources (pass `force=true` to delete anyway)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /api/v1/projects/{project_id}/prices:
    get:
      tags:
        - Projects
      summary: List a project's price rows
      description: >
        Returns the project's per-provider-slug price rows — the middle pricing
        tier that covers every one of the project's instances of a given
        provider slug. At cost time a per-provider-instance override wins over
        these, and these win over the global default. Authorized by the caller's
        access to the project.
      operationId: getProjectPrices
      parameters:
        - name: project_id
          in: path
          required: true
          description: Project public ID (proj_ prefix)
          schema:
            type: string
            example: proj_V1StGXR8Z5jdHi6B
      responses:
        '200':
          description: The project's price rows
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProjectPricesResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Project not found
    put:
      tags:
        - Projects
      summary: Upsert a project's price rows
      description: >
        Upserts project + provider-slug price rows, keyed on
        (provider, model, effective_from). A row covers all of the project's
        instances of that provider slug. Authorized by the caller's access to
        the project. `effective_from` must be in the future — past prices are
        immutable, so ship corrections as new future-dated rows.
      operationId: updateProjectPrices
      parameters:
        - name: project_id
          in: path
          required: true
          description: Project public ID (proj_ prefix)
          schema:
            type: string
            example: proj_V1StGXR8Z5jdHi6B
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertProjectPricesRequest'
      responses:
        '200':
          description: The upserted price rows
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProjectPricesResponse'
        '400':
          description: Bad Request (e.g. non-future effective_from)
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Project not found
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: JWT token or sk_ api key
  schemas:
    ProjectRecord:
      type: object
      properties:
        id:
          type: string
          description: Public project ID (proj_ prefix)
          example: proj_V1StGXR8Z5jdHi6B
        name:
          type: string
          example: My Project
        created_at:
          type: string
          format: date-time
          example: '2024-01-01T00:00:00.000Z'
        updated_at:
          type: string
          format: date-time
          example: '2024-01-01T00:00:00.000Z'
    ProjectPrice:
      type: object
      properties:
        id:
          type: string
          description: Public ID of the price row
          example: price_V1StGXR8Z5jdHi6B
        project_id:
          x-soat-ref: projects
          type: string
          description: The project this price is scoped to
          example: proj_V1StGXR8Z5jdHi6B
        ai_provider_id:
          type: string
          nullable: true
          description: Always null for a project + provider-slug price
        provider:
          type: string
          example: openai
        model:
          type: string
          example: gpt-4o
        input_price_per_m:
          type: number
          description: USD per one million input (prompt) tokens
        output_price_per_m:
          type: number
          description: USD per one million output (completion) tokens
        cached_price_per_m:
          type: number
          nullable: true
          description: USD per one million cached input tokens; null falls back to the input price
        effective_from:
          type: string
          format: date-time
          description: The row with the latest effective_from <= now() prices a call
        created_at:
          type: string
          format: date-time
    ProjectPricesResponse:
      type: object
      properties:
        prices:
          type: array
          items:
            $ref: '#/components/schemas/ProjectPrice'
    UpsertProjectPricesRequest:
      type: object
      required:
        - prices
      properties:
        prices:
          type: array
          items:
            type: object
            required:
              - provider
              - model
              - input_price_per_m
              - output_price_per_m
              - effective_from
            properties:
              provider:
                type: string
                example: openai
              model:
                type: string
                example: gpt-4o
              input_price_per_m:
                type: number
              output_price_per_m:
                type: number
              cached_price_per_m:
                type: number
                nullable: true
              effective_from:
                type: string
                format: date-time
                description: Must be in the future; past prices are immutable
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          oneOf:
            - type: string
              description: Generic error message (e.g. "Unauthorized" or "Internal Server Error")
              example: Unauthorized
            - type: object
              description: Structured domain error
              properties:
                code:
                  type: string
                  example: PROJECT_HAS_DEPENDENTS
                message:
                  type: string
                  example: Project 'proj_V1StGXR8Z5jdHi6B' has dependent resources and cannot be deleted.
                meta:
                  type: object