{
  "openapi": "3.1.0",
  "info": {
    "title": "Centroq Workspace API",
    "version": "1.2.0",
    "description": "Tenant-bound REST API with scoped reads, idempotent submitted time and browser-approved time previews. Personal tokens intersect current active membership and restricted role profiles. API and MCP briefs are deterministic and never spend AI credits. Browser-only connector consent, directory changes, invoice checkout and optional AI generation are separate workflows."
  },
  "servers": [
    {
      "url": "/api/v1"
    }
  ],
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "paths": {
    "/workspace": {
      "get": {
        "operationId": "workspace",
        "summary": "Read Workspace",
        "description": "Requires workspace.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "$ref": "#/components/schemas/Workspace"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/projects": {
      "get": {
        "operationId": "projects",
        "summary": "List Project",
        "description": "Requires projects.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": {
                        "$ref": "#/components/schemas/Project"
                      }
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "next_page_url": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/projects/{id}": {
      "get": {
        "operationId": "projects_id",
        "summary": "Read Project",
        "description": "Requires projects.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "integer",
              "minimum": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "$ref": "#/components/schemas/Project"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/projects/{id}/tasks": {
      "get": {
        "operationId": "projects_id_tasks",
        "summary": "List Task",
        "description": "Requires projects.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "integer",
              "minimum": 1
            }
          },
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": {
                        "$ref": "#/components/schemas/Task"
                      }
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "next_page_url": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/timesheets": {
      "get": {
        "operationId": "timesheets",
        "summary": "List TimeEntry",
        "description": "Requires time.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": {
                        "$ref": "#/components/schemas/TimeEntry"
                      }
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "next_page_url": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      },
      "post": {
        "operationId": "submit_time",
        "summary": "Submit time for approval",
        "description": "Requires time.write on both the current membership and bearer token. Identical requests with the same key return the original result; keys remain reserved until the company is deleted.",
        "parameters": [
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "minLength": 16,
              "maxLength": 100,
              "pattern": "^[A-Za-z0-9_.:-]+$"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "project_id",
                  "date",
                  "minutes",
                  "is_billable"
                ],
                "properties": {
                  "project_id": {
                    "type": "integer"
                  },
                  "task_id": {
                    "type": [
                      "integer",
                      "null"
                    ]
                  },
                  "date": {
                    "type": "string",
                    "format": "date"
                  },
                  "minutes": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 1440
                  },
                  "description": {
                    "type": [
                      "string",
                      "null"
                    ],
                    "maxLength": 2000
                  },
                  "is_billable": {
                    "type": "boolean"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Time entry submitted, or original result replayed",
            "headers": {
              "Idempotency-Replayed": {
                "schema": {
                  "type": "string"
                },
                "description": "true when returning a stored result"
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "object",
                      "properties": {
                        "id": {
                          "type": "integer"
                        },
                        "approval_status": {
                          "const": "submitted"
                        },
                        "time": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid token"
          },
          "402": {
            "description": "Subscription is read-only"
          },
          "403": {
            "description": "Insufficient scope or role"
          },
          "404": {
            "description": "Project/task not accessible"
          },
          "409": {
            "description": "Key already used with a different body"
          },
          "422": {
            "description": "Invalid input or missing key"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        }
      }
    },
    "/leads": {
      "get": {
        "operationId": "leads",
        "summary": "List Lead",
        "description": "Requires crm.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": {
                        "$ref": "#/components/schemas/Lead"
                      }
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "next_page_url": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/invoices": {
      "get": {
        "operationId": "invoices",
        "summary": "List Invoice",
        "description": "Requires finance.read in both the bearer token and the current role. Token is bound to one workspace.",
        "parameters": [
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "data": {
                      "type": "array",
                      "items": {
                        "$ref": "#/components/schemas/Invoice"
                      }
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "next_page_url": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, workspace, membership, or insufficient role/token scope"
          },
          "404": {
            "description": "Record not found in the authorized workspace"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "User rate limit exceeded (60 requests/minute)"
          }
        }
      }
    },
    "/integrations": {
      "get": {
        "operationId": "integration_status",
        "summary": "List authorized connector statuses",
        "description": "Requires integrations.manage plus each provider data permission on both the bearer token and current membership. No provider request is made.",
        "responses": {
          "200": {
            "description": "Company connector status filtered by each provider permission. Tokens and cached provider content are never returned.",
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "data": {
                      "items": {
                        "$ref": "#/components/schemas/IntegrationStatus"
                      },
                      "type": "array"
                    }
                  },
                  "type": "object"
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, company, membership, or insufficient current role/profile/token scope"
          },
          "404": {
            "description": "Record not found in the authorized company and assignment scope"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        }
      }
    },
    "/projects/{id}/files": {
      "get": {
        "operationId": "project_files",
        "summary": "List reviewed project file links",
        "description": "Requires projects.read on both token and membership, accessible project assignment, and a connected source. Reads metadata only.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "integer",
              "minimum": 1
            }
          },
          {
            "name": "per_page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 25
            }
          },
          {
            "name": "page",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Paginated reviewed Drive links for an accessible project. Google enforces access when opening a file.",
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "data": {
                      "items": {
                        "$ref": "#/components/schemas/LinkedFile"
                      },
                      "type": "array"
                    },
                    "total": {
                      "type": "integer"
                    },
                    "per_page": {
                      "type": "integer"
                    },
                    "current_page": {
                      "type": "integer"
                    },
                    "last_page": {
                      "type": "integer"
                    }
                  },
                  "type": "object"
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, company, membership, or insufficient current role/profile/token scope"
          },
          "404": {
            "description": "Record not found in the authorized company and assignment scope"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        }
      }
    },
    "/brief": {
      "get": {
        "operationId": "company_brief",
        "summary": "Read permitted company summary",
        "description": "Requires workspace.read. Each fact additionally requires its own projects.read, time.read, crm.read or finance.read scope on both token and current membership/profile. Assignment filters apply. Never calls an AI provider.",
        "responses": {
          "200": {
            "description": "Count-only deterministic summary with evidence links. Empty facts is valid when no additional data scopes are granted.",
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "data": {
                      "$ref": "#/components/schemas/Brief"
                    }
                  },
                  "type": "object"
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "403": {
            "description": "Inactive account, company, membership, or insufficient current role/profile/token scope"
          },
          "404": {
            "description": "Record not found in the authorized company and assignment scope"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        }
      }
    },
    "/actions/time/preview": {
      "post": {
        "summary": "Prepare time for browser review",
        "responses": {
          "201": {
            "description": "Expiring preview created or original result replayed. No time entry is posted until this same actor approves the preview in the browser.",
            "headers": {
              "Idempotency-Replayed": {
                "description": "true when replaying the stored result",
                "schema": {
                  "type": "string"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "properties": {
                    "data": {
                      "$ref": "#/components/schemas/TimePreview"
                    }
                  },
                  "type": "object"
                }
              }
            }
          },
          "401": {
            "description": "Invalid or expired token"
          },
          "402": {
            "description": "Company subscription is read-only"
          },
          "403": {
            "description": "Inactive account, company, membership, or insufficient current role/profile/token scope"
          },
          "404": {
            "description": "Record not found in the authorized company and assignment scope"
          },
          "409": {
            "description": "Idempotency key already used with another body"
          },
          "422": {
            "description": "Invalid parameters"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        },
        "operationId": "prepare_time",
        "parameters": [
          {
            "name": "Idempotency-Key",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "minLength": 16,
              "maxLength": 100,
              "pattern": "^[A-Za-z0-9_.:-]+$"
            }
          }
        ],
        "description": "Requires time.write on token and membership. Preview is bound to company and actor and expires after fifteen minutes. The browser rechecks membership, permissions, entitlement and project/task access; approved time is submitted for normal review. API and MCP cannot approve this preview.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "project_id",
                  "date",
                  "minutes",
                  "is_billable"
                ],
                "properties": {
                  "project_id": {
                    "type": "integer"
                  },
                  "task_id": {
                    "type": [
                      "integer",
                      "null"
                    ]
                  },
                  "date": {
                    "type": "string",
                    "format": "date"
                  },
                  "minutes": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 1440
                  },
                  "description": {
                    "type": [
                      "string",
                      "null"
                    ],
                    "maxLength": 2000
                  },
                  "is_billable": {
                    "type": "boolean"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "description": "Personal access token; permissions are the intersection of token scopes and current workspace role."
      }
    },
    "schemas": {
      "Workspace": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        }
      },
      "Project": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "project_name": {
            "type": "string"
          },
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "status": {
            "type": "string"
          },
          "start_date": {
            "type": [
              "string",
              "null"
            ]
          },
          "end_date": {
            "type": [
              "string",
              "null"
            ]
          },
          "estimated_hrs": {
            "type": [
              "string",
              "number",
              "null"
            ]
          }
        }
      },
      "Task": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "project_id": {
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "priority": {
            "type": [
              "string",
              "number"
            ]
          },
          "start_date": {
            "type": [
              "string",
              "null"
            ]
          },
          "end_date": {
            "type": [
              "string",
              "null"
            ]
          },
          "is_complete": {
            "type": [
              "integer",
              "boolean"
            ]
          }
        }
      },
      "TimeEntry": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "project_id": {
            "type": "integer"
          },
          "task_id": {
            "type": [
              "integer",
              "null"
            ]
          },
          "date": {
            "type": "string"
          },
          "time": {
            "type": "string"
          },
          "description": {
            "type": [
              "string",
              "null"
            ]
          },
          "created_by": {
            "type": "integer"
          }
        }
      },
      "Lead": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "name": {
            "type": "string"
          },
          "email": {
            "type": [
              "string",
              "null"
            ]
          },
          "phone": {
            "type": [
              "string",
              "null"
            ]
          },
          "subject": {
            "type": [
              "string",
              "null"
            ]
          },
          "stage_id": {
            "type": [
              "integer",
              "null"
            ]
          }
        }
      },
      "Invoice": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "invoice_id": {
            "type": "integer"
          },
          "customer_id": {
            "type": "integer"
          },
          "issue_date": {
            "type": "string"
          },
          "due_date": {
            "type": "string"
          },
          "status": {
            "type": [
              "integer",
              "string"
            ]
          },
          "ref_number": {
            "type": [
              "string",
              "null"
            ]
          }
        }
      },
      "IntegrationStatus": {
        "properties": {
          "snapshot_completed_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "next_attempt_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "provider": {
            "type": "string"
          },
          "last_error": {
            "type": [
              "string",
              "null"
            ]
          },
          "last_synced_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          },
          "mode": {
            "enum": [
              "live",
              "sample"
            ],
            "type": "string"
          },
          "id": {
            "type": "integer"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "LinkedFile": {
        "properties": {
          "status": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "source": {
            "const": "Google Drive"
          },
          "url": {
            "type": [
              "string",
              "null"
            ]
          },
          "id": {
            "type": "integer"
          },
          "last_seen_at": {
            "format": "date-time",
            "type": [
              "string",
              "null"
            ]
          }
        },
        "type": "object"
      },
      "BriefFact": {
        "required": [
          "id",
          "label",
          "count",
          "evidence"
        ],
        "type": "object",
        "properties": {
          "id": {
            "enum": [
              "projects",
              "time",
              "leads",
              "invoices"
            ],
            "type": "string"
          },
          "count": {
            "minimum": 0,
            "type": "integer"
          },
          "label": {
            "type": "string"
          },
          "evidence": {
            "format": "uri",
            "type": "string"
          }
        }
      },
      "Brief": {
        "properties": {
          "ai_cost": {
            "const": 0
          },
          "generated_at": {
            "format": "date-time",
            "type": "string"
          },
          "facts": {
            "items": {
              "$ref": "#/components/schemas/BriefFact"
            },
            "type": "array"
          },
          "method": {
            "const": "deterministic_database_summary"
          }
        },
        "type": "object"
      },
      "TimePreview": {
        "properties": {
          "summary": {
            "type": "string"
          },
          "expires_at": {
            "format": "date-time",
            "type": "string"
          },
          "input": {
            "type": "object"
          },
          "approval_url": {
            "format": "uri",
            "type": "string"
          },
          "preview_id": {
            "format": "uuid",
            "type": "string"
          },
          "requires_browser_approval": {
            "const": true
          }
        },
        "type": "object"
      }
    }
  }
}