openapi: 3.1.0
info:
  title: Aldenburg Protocol Playground
  description: >
    Developer flow inspector, tamper lab, SD-JWT workbench, and conformance
    runner for the Aldenburg ecosystem. Mock wallet, mock issuer, and mock
    verifier use @credo-ts 0.7. JWT iss is the HTTP(S) credential-issuer URL
    matching the leaf SAN, never did:web.
  version: 0.1.0
paths:
  /:
    get:
      summary: Playground UI (flow inspector, tamper lab, workbench, conformance)
      responses:
        '200':
          description: HTML
  /openapi.yaml:
    get:
      summary: This OpenAPI document
      responses:
        '200':
          description: YAML
  /api/sessions:
    post:
      summary: Create a mock-wallet session (Credo holder)
      responses:
        '200':
          description: session_id
  /api/inspector/issuance:
    post:
      summary: Drive OpenID4VCI issuance against any offer URI and capture protocol messages
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [offer_uri]
              properties:
                offer_uri: { type: string }
                tx_code: { type: string }
                session_id: { type: string }
      responses:
        '200':
          description: Captured issuance flow (raw JWT, decoded header/payload, signature status)
  /api/inspector/presentation:
    post:
      summary: Drive OpenID4VP presentation from a mock-wallet session
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [authorization_request, session_id]
              properties:
                authorization_request: { type: string }
                session_id: { type: string }
                extra_disclosed: { type: object }
      responses:
        '200':
          description: Captured presentation flow
  /api/mock-issuer/offers:
    post:
      summary: Emit a credential offer, including misconfigurations
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                misconfig:
                  type: string
                  enum:
                    - none
                    - missing_pre_authorized_code
                    - mdoc_format
                    - did_web_credential_issuer
                    - unknown_vct
                    - tx_code_required
                require_tx_code: { type: boolean }
      responses:
        '200':
          description: Offer URI, QR, warnings
  /api/mock-verifier/requests:
    post:
      summary: Emit an OpenID4VP authorization request, including misconfigurations
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                misconfig:
                  type: string
                  enum: [none, missing_nonce, untrusted_client_id, over_request_claims, expired]
      responses:
        '200':
          description: Authorization request URI, QR, warnings
  /api/workbench:
    post:
      summary: Inspect a compact dc+sd-jwt and verify disclosure hashes for a subset
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [compact]
              properties:
                compact: { type: string }
                selected:
                  type: array
                  items: { type: string }
      responses:
        '200':
          description: Payload, disclosures, subset hash verification
  /api/inspect-jwt:
    post:
      summary: Decode a JWT and report signature status when x5c is present
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [jwt]
              properties:
                jwt: { type: string }
      responses:
        '200':
          description: Header, payload, annotations, signature status
  /api/conformance:
    post:
      summary: Run conformance checks against an issuer/verifier base URL
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [base_url]
              properties:
                base_url: { type: string }
                trust_list_url: { type: string }
                trust_list_jwt: { type: string }
      responses:
        '200':
          description: JSON report plus shareable HTML
  /api/tamper/run:
    post:
      summary: Demonstrate a standing-20 reject path against Pulse Arena
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [mode, registry_url, arena_url]
              properties:
                mode:
                  type: string
                  enum:
                    - untrusted_issuer
                    - revoked
                    - wrong_nonce
                    - wrong_audience
                    - over_disclosure
                    - expired
                registry_url: { type: string }
                arena_url: { type: string }
      responses:
        '200':
          description: Reject code from the Pulse Arena verifier module
  /.well-known/openid-credential-issuer/oid4vci/playground:
    get:
      summary: Mock issuer OpenID4VCI metadata (Credo)
      responses:
        '200':
          description: Credential issuer metadata
  /api/mock-issuer/certificate:
    get:
      summary: PEM of the mock issuer leaf certificate (opt-in trust for lab issuance)
      responses:
        '200':
          description: pem + issuer_url (HTTP(S) SAN, not did:web)
