openapi: 3.1.0
info:
  title: SecurityTicketRequestProcessor API
  version: 1.0.0
  summary: Fictional API for portfolio demonstration
  description: |
    The SecurityTicketRequestProcessor API allows third-party systems to create,
    manage, and track security issue tickets within the Security Tickets platform.
servers:
  - url: https://api.securitytickets.example.com/v1
    description: Production
  - url: https://sandbox.securitytickets.example.com/v1
    description: Sandbox
security:
  - OAuth2ClientCredentials:
      - tickets:read
      - tickets:write
paths:
  /tickets:
    get:
      summary: List tickets
      operationId: listTickets
      parameters:
        - in: query
          name: status
          schema: { type: string, enum: [open, triaged, in_progress, resolved, closed] }
        - in: query
          name: severity
          schema: { type: string, enum: [low, medium, high, critical] }
        - in: query
          name: limit
          schema: { type: integer, minimum: 1, maximum: 100, default: 25 }
        - in: query
          name: after
          schema: { type: string }
        - in: query
          name: sort
          schema: { type: string, example: -updated_at }
      responses:
        '200':
          description: A paginated ticket collection
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TicketListResponse'
    post:
      summary: Create ticket
      operationId: createTicket
      parameters:
        - in: header
          name: Idempotency-Key
          required: true
          schema: { type: string }
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTicketRequest'
      responses:
        '201':
          description: Ticket created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
  /tickets/{ticket_id}:
    parameters:
      - in: path
        name: ticket_id
        required: true
        schema: { type: string }
    get:
      summary: Get ticket
      operationId: getTicket
      responses:
        '200':
          description: Ticket details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      summary: Update ticket
      operationId: updateTicket
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTicketRequest'
      responses:
        '200':
          description: Updated ticket
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
    delete:
      summary: Delete ticket
      operationId: deleteTicket
      responses:
        '204':
          description: Ticket deleted
  /tickets/{ticket_id}/comments:
    parameters:
      - in: path
        name: ticket_id
        required: true
        schema: { type: string }
    get:
      summary: List comments
      operationId: listComments
      responses:
        '200':
          description: Ticket comments
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Comment'
    post:
      summary: Create comment
      operationId: createComment
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCommentRequest'
      responses:
        '201':
          description: Comment created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Comment'
  /tickets/{ticket_id}/comments/{comment_id}:
    parameters:
      - in: path
        name: ticket_id
        required: true
        schema: { type: string }
      - in: path
        name: comment_id
        required: true
        schema: { type: string }
    delete:
      summary: Delete comment
      operationId: deleteComment
      responses:
        '204':
          description: Comment deleted
  /tickets/{ticket_id}/attachments:
    parameters:
      - in: path
        name: ticket_id
        required: true
        schema: { type: string }
    get:
      summary: List attachments
      operationId: listAttachments
      responses:
        '200':
          description: Attachment metadata
    post:
      summary: Create attachment
      operationId: createAttachment
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAttachmentRequest'
      responses:
        '201':
          description: Attachment created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attachment'
  /tickets/{ticket_id}/attachments/{attachment_id}:
    parameters:
      - in: path
        name: ticket_id
        required: true
        schema: { type: string }
      - in: path
        name: attachment_id
        required: true
        schema: { type: string }
    delete:
      summary: Delete attachment
      operationId: deleteAttachment
      responses:
        '204':
          description: Attachment deleted
  /bulk/tickets/update:
    post:
      summary: Bulk update tickets
      operationId: bulkUpdateTickets
      parameters:
        - in: header
          name: Idempotency-Key
          required: true
          schema: { type: string }
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkUpdateRequest'
      responses:
        '202':
          description: Accepted for processing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkJob'
  /bulk/jobs/{job_id}:
    parameters:
      - in: path
        name: job_id
        required: true
        schema: { type: string }
    get:
      summary: Get bulk job status
      operationId: getBulkJob
      responses:
        '200':
          description: Bulk job status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkJob'
  /audit-events:
    get:
      summary: List audit events
      operationId: listAuditEvents
      parameters:
        - in: query
          name: resource_type
          schema: { type: string, enum: [ticket, comment, attachment, webhook] }
        - in: query
          name: resource_id
          schema: { type: string }
        - in: query
          name: limit
          schema: { type: integer, minimum: 1, maximum: 100, default: 25 }
      responses:
        '200':
          description: Audit event collection
  /oauth2/token:
    post:
      summary: Exchange client credentials for bearer token
      operationId: createAccessToken
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required: [grant_type, client_id, client_secret]
              properties:
                grant_type: { type: string, enum: [client_credentials] }
                client_id: { type: string }
                client_secret: { type: string }
                scope: { type: string }
      responses:
        '200':
          description: Access token
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token: { type: string }
                  token_type: { type: string, example: Bearer }
                  expires_in: { type: integer, example: 3600 }
                  scope: { type: string }
webhooks:
  ticketCreated:
    post:
      requestBody:
        description: Delivered when a ticket is created
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TicketCreatedEvent'
  ticketUpdated:
    post:
      requestBody:
        description: Delivered when a ticket is updated
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TicketUpdatedEvent'
components:
  securitySchemes:
    OAuth2ClientCredentials:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://auth.securitytickets.example.com/oauth2/token
          scopes:
            tickets:read: Read ticket data
            tickets:write: Create, update, and delete tickets
            comments:write: Create and delete comments
            attachments:write: Create and delete attachments
            bulk:write: Run bulk operations
            webhooks:read: Read webhook metadata
  responses:
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Ticket:
      type: object
      properties:
        id: { type: string }
        title: { type: string }
        description: { type: string }
        severity: { type: string, enum: [low, medium, high, critical] }
        priority: { type: string, enum: [p1, p2, p3, p4] }
        status: { type: string, enum: [open, triaged, in_progress, resolved, closed] }
        source: { type: string }
        category: { type: string }
        assigned_team: { type: string, nullable: true }
        affected_product: { type: string }
        affected_versions:
          type: array
          items: { type: string }
        created_at: { type: string, format: date-time }
        updated_at: { type: string, format: date-time }
      required: [id, title, severity, status, created_at, updated_at]
    CreateTicketRequest:
      type: object
      required: [title, description, severity, source, reporter]
      properties:
        title: { type: string }
        description: { type: string }
        severity: { type: string, enum: [low, medium, high, critical] }
        priority: { type: string, enum: [p1, p2, p3, p4] }
        category: { type: string }
        source: { type: string }
        affected_product: { type: string }
        affected_versions:
          type: array
          items: { type: string }
        reporter:
          type: object
          properties:
            name: { type: string }
            email: { type: string, format: email }
            external_reference: { type: string }
        metadata:
          type: object
          additionalProperties: true
    UpdateTicketRequest:
      type: object
      properties:
        status: { type: string, enum: [open, triaged, in_progress, resolved, closed] }
        severity: { type: string, enum: [low, medium, high, critical] }
        priority: { type: string, enum: [p1, p2, p3, p4] }
        assigned_team: { type: string }
    Comment:
      type: object
      properties:
        id: { type: string }
        body: { type: string }
        visibility: { type: string, enum: [internal, external] }
        created_at: { type: string, format: date-time }
    CreateCommentRequest:
      type: object
      required: [body, visibility]
      properties:
        body: { type: string }
        visibility: { type: string, enum: [internal, external] }
    Attachment:
      type: object
      properties:
        id: { type: string }
        filename: { type: string }
        content_type: { type: string }
        size_bytes: { type: integer }
        created_at: { type: string, format: date-time }
    CreateAttachmentRequest:
      type: object
      required: [filename, content_type, content_base64]
      properties:
        filename: { type: string }
        content_type: { type: string }
        content_base64: { type: string }
    BulkUpdateRequest:
      type: object
      required: [ticket_ids, changes]
      properties:
        ticket_ids:
          type: array
          items: { type: string }
        changes:
          type: object
          additionalProperties: true
    BulkJob:
      type: object
      properties:
        id: { type: string }
        status: { type: string, enum: [queued, running, completed, failed] }
        submitted_at: { type: string, format: date-time }
        completed_at: { type: string, format: date-time, nullable: true }
        results:
          type: array
          items:
            type: object
            properties:
              ticket_id: { type: string }
              status: { type: string }
              outcome: { type: string }
    TicketListResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Ticket'
        page:
          type: object
          properties:
            next_cursor: { type: string, nullable: true }
            previous_cursor: { type: string, nullable: true }
            has_more: { type: boolean }
            limit: { type: integer }
    ErrorResponse:
      type: object
      properties:
        error:
          type: object
          properties:
            code: { type: string }
            message: { type: string }
            request_id: { type: string }
            details:
              type: array
              items:
                type: object
                additionalProperties: true
    TicketCreatedEvent:
      type: object
      properties:
        id: { type: string }
        type: { type: string, example: ticket.created }
        created_at: { type: string, format: date-time }
        data:
          type: object
          properties:
            ticket_id: { type: string }
    TicketUpdatedEvent:
      type: object
      properties:
        id: { type: string }
        type: { type: string, example: ticket.updated }
        created_at: { type: string, format: date-time }
        data:
          type: object
          properties:
            ticket_id: { type: string }
            status: { type: string }
            updated_by: { type: string }