openapi: 3.1.0
info:
  title: Portal Reseller API
  version: "3.0"
  description: |
    The Portal Reseller API lets approved reseller custodians create and manage
    sub-custodians. Reseller API keys are environment-agnostic and authenticate
    the reseller custodian. Sub-custodian Portal API keys created through this API
    are scoped to a specific sub-custodian environment.

    ## Base URL
    `https://api.portalhq.io/api/v3`

    ## Authentication
    Include your Reseller API key as a Bearer token in the `Authorization` header
    of every request.
servers:
  - url: https://api.portalhq.io/api/v3
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Reseller Statistics
    description: View aggregate and per-sub-custodian usage statistics
  - name: Sub-Custodians
    description: Create, list, suspend, and reactivate sub-custodians
  - name: Sub-Custodian Environments
    description: View environments for sub-custodians
  - name: Sub-Custodian API Keys
    description: Create and delete sub-custodian Portal API keys

paths:
  /resellers/stats:
    get:
      operationId: getResellerStatistics
      summary: Get reseller statistics
      description: |
        Returns all-time wallet generation and completed signature statistics
        for the authenticated reseller. `totals` summarizes usage across all
        owned sub-custodians, while `custodians` provides the same metrics for
        each sub-custodian. Sub-custodians without activity are included with
        zero values.
      tags:
        - Reseller Statistics
      responses:
        "200":
          description: Reseller statistics retrieved successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResellerStatisticsResponse"
              example:
                totals:
                  signaturesCompleted: 24
                  walletsGenerated: 10
                custodians:
                  - custodianId: custodian_123
                    signaturesCompleted: 17
                    walletsGenerated: 6
                  - custodianId: custodian_456
                    signaturesCompleted: 7
                    walletsGenerated: 4
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"

  /resellers/custodians:
    post:
      operationId: createSubCustodian
      summary: Create a sub-custodian
      description: |
        Creates a sub-custodian owned by the authenticated reseller. The new
        custodian is active, non-reseller, assigned the Start-Up plan, created
        with Development and Production environments, and has Portal backup and
        Alert webhooks enabled.
      tags:
        - Sub-Custodians
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateSubCustodianRequest"
            example:
              custodian:
                name: Acme Payments
              user:
                email: admin@acmepayments.com
                firstName: Avery
                lastName: Stone
      responses:
        "200":
          description: Sub-custodian created successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SubCustodianResponse"
              example:
                custodian:
                  id: custodian_123
                  name: Acme Payments
                  slug: acme-payments
                  billingStatus: ACTIVE
                  isReseller: false
                  resellerParentId: reseller_custodian_123
                  sessionTokensEnabled: true
                  createdAt: "2026-07-08T18:00:00.000Z"
                  updatedAt: "2026-07-08T18:00:00.000Z"
                  billingPlan:
                    name: Start-Up
                  environments:
                    - id: env_dev_123
                      name: Development
                      alertWebhooksEnabled: true
                      createdAt: "2026-07-08T18:00:00.000Z"
                      updatedAt: "2026-07-08T18:00:00.000Z"
                    - id: env_prod_123
                      name: Production
                      alertWebhooksEnabled: true
                      createdAt: "2026-07-08T18:00:00.000Z"
                      updatedAt: "2026-07-08T18:00:00.000Z"
                  users:
                    - id: user_123
                      email: admin@acmepayments.com
                      firstName: Avery
                      lastName: Stone
                      createdAt: "2026-07-08T18:00:00.000Z"
                      updatedAt: "2026-07-08T18:00:00.000Z"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "409":
          description: Unable to create custodian with the provided details
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ErrorResponse"

    get:
      operationId: listSubCustodians
      summary: List sub-custodians
      description: |
        Lists sub-custodians owned by the authenticated reseller. Each
        custodian includes environments, users, billing plan, billing status, and
        Portal API key metadata.
      tags:
        - Sub-Custodians
      responses:
        "200":
          description: Sub-custodians retrieved successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SubCustodiansResponse"
              example:
                custodians:
                  - id: custodian_123
                    name: Acme Payments
                    slug: acme-payments
                    billingStatus: ACTIVE
                    isReseller: false
                    resellerParentId: reseller_custodian_123
                    sessionTokensEnabled: true
                    createdAt: "2026-07-08T18:00:00.000Z"
                    updatedAt: "2026-07-08T18:00:00.000Z"
                    billingPlan:
                      name: Start-Up
                    environments:
                      - id: env_prod_123
                        name: Production
                        createdAt: "2026-07-08T18:00:00.000Z"
                        updatedAt: "2026-07-08T18:00:00.000Z"
                    users:
                      - id: user_123
                        email: admin@acmepayments.com
                        firstName: Avery
                        lastName: Stone
                        createdAt: "2026-07-08T18:00:00.000Z"
                        updatedAt: "2026-07-08T18:00:00.000Z"
                    apiKeys:
                      - id: api_key_123
                        custodianId: custodian_123
                        environmentId: env_prod_123
                        name: Production API key
                        createdAt: "2026-07-08T18:00:00.000Z"
                        updatedAt: "2026-07-08T18:00:00.000Z"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"

  /resellers/custodians/{custodianId}/environments:
    get:
      operationId: listSubCustodianEnvironments
      summary: List sub-custodian environments
      description: Lists environments for a sub-custodian owned by the authenticated reseller.
      tags:
        - Sub-Custodian Environments
      parameters:
        - $ref: "#/components/parameters/custodianId"
      responses:
        "200":
          description: Sub-custodian environments retrieved successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EnvironmentsResponse"
              example:
                environments:
                  - id: env_dev_123
                    name: Development
                    createdAt: "2026-07-08T18:00:00.000Z"
                    updatedAt: "2026-07-08T18:00:00.000Z"
                  - id: env_prod_123
                    name: Production
                    createdAt: "2026-07-08T18:00:00.000Z"
                    updatedAt: "2026-07-08T18:00:00.000Z"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "404":
          $ref: "#/components/responses/NotFound"

  /resellers/custodians/{custodianId}/suspend:
    put:
      operationId: suspendSubCustodian
      summary: Suspend a sub-custodian
      description: |
        Suspends a sub-custodian owned by the authenticated reseller.
        Suspension blocks that custodian's Portal dashboard users, Portal API keys,
        client API keys, client session tokens, and service-authenticated requests.
      tags:
        - Sub-Custodians
      parameters:
        - $ref: "#/components/parameters/custodianId"
      responses:
        "200":
          description: Sub-custodian suspended successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SubCustodian"
              example:
                id: custodian_123
                name: Acme Payments
                slug: acme-payments
                billingStatus: SUSPENDED
                isReseller: false
                resellerParentId: reseller_custodian_123
                sessionTokensEnabled: true
                createdAt: "2026-07-08T18:00:00.000Z"
                updatedAt: "2026-07-08T18:15:00.000Z"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "404":
          $ref: "#/components/responses/NotFound"

  /resellers/custodians/{custodianId}/activate:
    put:
      operationId: activateSubCustodian
      summary: Activate a sub-custodian
      description: |
        Reactivates a suspended sub-custodian owned by the authenticated reseller
        by setting its billing status to ACTIVE.
      tags:
        - Sub-Custodians
      parameters:
        - $ref: "#/components/parameters/custodianId"
      responses:
        "200":
          description: Sub-custodian activated successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SubCustodian"
              example:
                id: custodian_123
                name: Acme Payments
                slug: acme-payments
                billingStatus: ACTIVE
                isReseller: false
                resellerParentId: reseller_custodian_123
                sessionTokensEnabled: true
                createdAt: "2026-07-08T18:00:00.000Z"
                updatedAt: "2026-07-08T18:20:00.000Z"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "404":
          $ref: "#/components/responses/NotFound"

  /resellers/custodians/{custodianId}/environments/{environmentId}/api-keys:
    post:
      operationId: createSubCustodianApiKey
      summary: Create a sub-custodian API key
      description: |
        Creates an environment-scoped Portal API key for a sub-custodian owned
        by the authenticated reseller. The raw API key value is returned only in
        this creation response.
      tags:
        - Sub-Custodian API Keys
      parameters:
        - $ref: "#/components/parameters/custodianId"
        - $ref: "#/components/parameters/environmentId"
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateSubCustodianApiKeyRequest"
            example:
              name: Production API key
      responses:
        "200":
          description: Sub-custodian API key created successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SubCustodianApiKeyResponse"
              example:
                apiKey:
                  id: api_key_123
                  custodianId: custodian_123
                  environmentId: env_prod_123
                  name: Production API key
                  value: 7b7f27c4-6a73-4d93-a703-0d2f22b63e64
                  createdAt: "2026-07-08T18:00:00.000Z"
                  updatedAt: "2026-07-08T18:00:00.000Z"
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "404":
          $ref: "#/components/responses/NotFound"
        "409":
          $ref: "#/components/responses/Conflict"

  /resellers/custodians/{custodianId}/environments/{environmentId}/api-keys/{apiKeyId}:
    delete:
      operationId: deleteSubCustodianApiKey
      summary: Delete a sub-custodian API key
      description: Deletes an environment-scoped Portal API key for a sub-custodian owned by the authenticated reseller.
      tags:
        - Sub-Custodian API Keys
      parameters:
        - $ref: "#/components/parameters/custodianId"
        - $ref: "#/components/parameters/environmentId"
        - $ref: "#/components/parameters/apiKeyId"
      responses:
        "204":
          description: Sub-custodian API key deleted successfully
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "404":
          $ref: "#/components/responses/NotFound"

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Reseller API Key
      description: Reseller API key created in the Portal dashboard.

  parameters:
    custodianId:
      name: custodianId
      in: path
      required: true
      description: The ID of a sub-custodian owned by the authenticated reseller.
      schema:
        type: string
    environmentId:
      name: environmentId
      in: path
      required: true
      description: The ID of an environment that belongs to the sub-custodian.
      schema:
        type: string
    apiKeyId:
      name: apiKeyId
      in: path
      required: true
      description: The ID of a sub-custodian Portal API key.
      schema:
        type: string

  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
    Unauthorized:
      description: Unauthorized - invalid or missing Reseller API key
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
    Forbidden:
      description: Forbidden - the authenticated custodian is not allowed to perform this action
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
    Conflict:
      description: Resource conflict
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"

  schemas:
    ResellerStatisticsResponse:
      type: object
      required:
        - totals
        - custodians
      properties:
        totals:
          $ref: "#/components/schemas/ResellerStatisticsMetrics"
        custodians:
          type: array
          items:
            $ref: "#/components/schemas/SubCustodianStatistics"

    ResellerStatisticsMetrics:
      type: object
      required:
        - signaturesCompleted
        - walletsGenerated
      properties:
        signaturesCompleted:
          type: integer
          minimum: 0
          description: Number of successfully completed signature operations.
        walletsGenerated:
          type: integer
          minimum: 0
          description: Number of wallets generated across supported curves.

    SubCustodianStatistics:
      allOf:
        - $ref: "#/components/schemas/ResellerStatisticsMetrics"
        - type: object
          required:
            - custodianId
          properties:
            custodianId:
              type: string
              description: Sub-custodian ID.

    CreateSubCustodianRequest:
      type: object
      required:
        - custodian
        - user
      properties:
        custodian:
          type: object
          required:
            - name
          properties:
            name:
              type: string
              description: Sub-custodian name.
        user:
          type: object
          required:
            - email
          properties:
            email:
              type: string
              format: email
              description: Email address for the sub-custodian's initial user.
            firstName:
              type: string
              description: Initial user's first name.
            lastName:
              type: string
              description: Initial user's last name.

    CreateSubCustodianApiKeyRequest:
      type: object
      properties:
        name:
          type: string
          description: Optional name for the sub-custodian Portal API key.

    SubCustodianResponse:
      type: object
      required:
        - custodian
      properties:
        custodian:
          $ref: "#/components/schemas/SubCustodian"

    SubCustodiansResponse:
      type: object
      required:
        - custodians
      properties:
        custodians:
          type: array
          items:
            $ref: "#/components/schemas/SubCustodian"

    EnvironmentsResponse:
      type: object
      required:
        - environments
      properties:
        environments:
          type: array
          items:
            $ref: "#/components/schemas/Environment"

    SubCustodianApiKeyResponse:
      type: object
      required:
        - apiKey
      properties:
        apiKey:
          $ref: "#/components/schemas/SubCustodianApiKey"

    SubCustodian:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        slug:
          type: string
        billingStatus:
          type: string
          enum:
            - ACTIVE
            - HACKATHON
            - INACTIVE
            - INTERNAL
            - SUSPENDED
            - TRIAL
        isReseller:
          type: boolean
        resellerParentId:
          type: string
          nullable: true
        sessionTokensEnabled:
          type: boolean
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        billingPlan:
          $ref: "#/components/schemas/BillingPlan"
        environments:
          type: array
          items:
            $ref: "#/components/schemas/Environment"
        users:
          type: array
          items:
            $ref: "#/components/schemas/User"
        apiKeys:
          type: array
          items:
            $ref: "#/components/schemas/SubCustodianApiKeyMetadata"

    BillingPlan:
      type: object
      properties:
        name:
          type: string

    Environment:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
          enum:
            - Development
            - Production
        alertWebhooksEnabled:
          type: boolean
          description: Whether Alert webhooks are enabled for the environment.
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

    User:
      type: object
      properties:
        id:
          type: string
        email:
          type: string
          format: email
        firstName:
          type: string
          nullable: true
        lastName:
          type: string
          nullable: true
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

    SubCustodianApiKey:
      type: object
      properties:
        id:
          type: string
        custodianId:
          type: string
        environmentId:
          type: string
        name:
          type: string
        value:
          type: string
          description: Raw Portal API key value. Returned only when the key is created.
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

    SubCustodianApiKeyMetadata:
      type: object
      properties:
        id:
          type: string
        custodianId:
          type: string
        environmentId:
          type: string
        name:
          type: string
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

    ErrorResponse:
      type: object
      properties:
        error:
          type: string