components:
  schemas:
    AddSpecialtyDto:
      properties:
        specialtySlug:
          description: Specialty slug to attach to the provider.
          example: adipositas
          type: string
        specialtySlugs:
          description: Specialty slugs to attach to the provider in one request.
          example:
            - adipositas
            - diabetes
          items:
            type: string
          type: array
      type: object
    ApiError:
      properties:
        correlationId:
          description: Optional request correlation ID when supplied by the client.
          example: local-smoke-001
          type: string
        error:
          description: HTTP error class.
          example: Unauthorized
          type: string
        message:
          description: Human-readable error message.
          example: Missing API key
          type: string
        statusCode:
          description: HTTP status code.
          example: 401
          type: integer
      required:
        - statusCode
        - message
        - error
      type: object
    AppointmentTypeIntakeFieldDto:
      properties:
        helpText:
          description: Optional helper text.
          example: Bitte beschreiben Sie kurz Ihr Anliegen.
          type: string
        key:
          description: Stable custom intake field key.
          example: visit-reason
          type: string
        label:
          description: Patient-facing question label.
          example: Besuchergrund
          type: string
        options:
          description: Select options when type is select.
          example:
            - label: Gesetzlich versichert
              value: gesetzlich
          items:
            $ref: "#/components/schemas/AppointmentTypeIntakeOptionDto"
          type: array
        required:
          description: Whether this answer is required for booking.
          example: true
          type: boolean
        type:
          description: Input control type.
          enum:
            - text
            - textarea
            - select
            - boolean
            - number
          example: textarea
          type: string
      required:
        - key
        - label
        - type
        - required
      type: object
    AppointmentTypeIntakeOptionDto:
      properties:
        label:
          description: Human-readable option label.
          example: Gesetzlich versichert
          type: string
        value:
          description: Option value submitted by the client.
          example: gesetzlich
          type: string
      required:
        - value
        - label
      type: object
    AppointmentTypeStandardFieldDto:
      properties:
        key:
          description: Standard patient field key controlled by appointment-type configuration.
          enum:
            - salutation
            - firstName
            - lastName
            - birthDate
            - street
            - postalCode
            - city
            - email
            - phone
            - insuranceKind
            - insuranceName
            - insurerId
            - insurerIkNumber
            - insuranceMemberId
            - insuranceStatus
          example: phone
          type: string
        required:
          description: Whether public booking must provide this visible field.
          example: false
          type: boolean
        visible:
          description: Whether Booking Web should render this standard field.
          example: true
          type: boolean
      required:
        - key
        - visible
        - required
      type: object
    CancelPartnerAppointmentDto:
      additionalProperties: false
      properties:
        reasonCode:
          description: Required closed PHI-free cancellation reason code. Free-text reasons, diagnoses, medical notes and patient contact data are rejected.
          enum:
            - PATIENT_REQUEST
            - PROVIDER_UNAVAILABLE
            - DUPLICATE
            - ADMINISTRATIVE
          example: ADMINISTRATIVE
          type: string
      required:
        - reasonCode
      type: object
    CreateAvailabilityRuleDto:
      properties:
        dayOfWeek:
          description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
          example: 1
          maximum: 6
          minimum: 0
          type: integer
        endTime:
          description: End time in HH:mm.
          example: 12:00
          type: string
        generateFrom:
          description: First date for slot generation.
          example: 2026-05-13
          format: date
          type: string
        generateTo:
          description: Last date for slot generation.
          example: 2026-06-12
          format: date
          type: string
        slotDuration:
          description: Slot duration in minutes.
          example: 30
          type: integer
        specialtySlug:
          description: Specialty slug.
          example: adipositas
          type: string
        startTime:
          description: Start time in HH:mm.
          example: 08:30
          type: string
        timezone:
          description: IANA timezone.
          example: Europe/Berlin
          type: string
      required:
        - specialtySlug
        - dayOfWeek
        - startTime
        - endTime
        - generateFrom
        - generateTo
      type: object
    CreateBookingDto:
      properties:
        appointmentTypeSlug:
          description: Optional selected appointment type slug. When supplied, it must be active for the selected slot provider organization and specialty.
          example: adipositas-erstberatung
          type: string
        externalPatientRef:
          description: External patient reference from the integrating system.
          example: patient-12345
          type: string
        intakeResponses:
          additionalProperties:
            oneOf:
              - type: string
              - type: number
              - type: boolean
          description: Appointment-type-specific intake answers keyed by custom intake field key. Required custom fields are validated against the selected appointment type.
          example:
            companion-count: 1
            visit-reason: Erstberatung zur Adipositas-Therapie
          type: object
        patientEmail:
          description: Optional patient email.
          format: email
          type: string
        patientName:
          description: Optional patient display name.
          type: string
        patientPhone:
          description: Optional patient phone.
          type: string
        slotId:
          description: Slot to book.
          example: 0d6b61b1-a99e-480c-878f-b8f5d1be0983
          format: uuid
          type: string
      required:
        - slotId
        - externalPatientRef
      type: object
    CreateOrganizationDto:
      properties:
        email:
          description: Optional public email.
          example: kontakt@mvz-preview.example.org
          format: email
          type: string
        name:
          description: Organization display name.
          example: MVZ Preview
          type: string
        parentOrgId:
          description: "Optional parent organization. Required pattern: a PHARMACY organization may reference a PHARMACY_CHAIN parent."
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
        phone:
          description: Optional public phone.
          example: +49 30 123456
          type: string
        slug:
          description: Organization slug.
          example: mvz-preview
          type: string
        type:
          description: Organization type.
          enum:
            - SOLO_PRACTICE
            - MVZ
            - CLINIC
            - PHARMACY
            - PHARMACY_CHAIN
          example: MVZ
          type: string
      required:
        - slug
        - name
        - type
      type: object
    CreatePartnerAvailabilityRuleDto:
      oneOf:
        - properties:
            dayOfWeek:
              description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
              example: 1
              maximum: 6
              minimum: 0
              type: integer
            endTime:
              description: End time in HH:mm.
              example: 12:00
              type: string
            generateFrom:
              description: First date for slot generation.
              example: 2026-05-13
              format: date
              type: string
            generateTo:
              description: Last date for slot generation.
              example: 2026-06-12
              format: date
              type: string
            slotDuration:
              description: Slot duration in minutes.
              example: 30
              type: integer
            specialtySlug:
              description: Specialty slug.
              example: adipositas
              type: string
            startTime:
              description: Start time in HH:mm.
              example: 08:30
              type: string
            timezone:
              description: IANA timezone.
              example: Europe/Berlin
              type: string
          required:
            - specialtySlug
            - dayOfWeek
            - startTime
            - endTime
            - generateFrom
            - generateTo
          type: object
        - properties:
            rules:
              description: Availability rules to create in one transaction.
              example:
                - dayOfWeek: 1
                  endTime: 12:00
                  generateFrom: 2026-07-01
                  generateTo: 2026-07-31
                  slotDuration: 30
                  specialtySlug: adipositas
                  startTime: 08:30
                  timezone: Europe/Berlin
                - dayOfWeek: 3
                  endTime: 17:00
                  generateFrom: 2026-07-01
                  generateTo: 2026-07-31
                  slotDuration: 30
                  specialtySlug: adipositas
                  startTime: 14:00
                  timezone: Europe/Berlin
              items:
                properties:
                  dayOfWeek:
                    description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
                    example: 1
                    maximum: 6
                    minimum: 0
                    type: integer
                  endTime:
                    description: End time in HH:mm.
                    example: 12:00
                    type: string
                  generateFrom:
                    description: First date for slot generation.
                    example: 2026-05-13
                    format: date
                    type: string
                  generateTo:
                    description: Last date for slot generation.
                    example: 2026-06-12
                    format: date
                    type: string
                  slotDuration:
                    description: Slot duration in minutes.
                    example: 30
                    type: integer
                  specialtySlug:
                    description: Specialty slug.
                    example: adipositas
                    type: string
                  startTime:
                    description: Start time in HH:mm.
                    example: 08:30
                    type: string
                  timezone:
                    description: IANA timezone.
                    example: Europe/Berlin
                    type: string
                required:
                  - specialtySlug
                  - dayOfWeek
                  - startTime
                  - endTime
                  - generateFrom
                  - generateTo
                type: object
              type: array
          required:
            - rules
          type: object
      properties: {}
      type: object
    CreatePartnerLoginLinkDto:
      properties:
        userRef:
          description: Optional partner-stable user reference (max 128 chars, charset A-Za-z0-9._:@-). Without userRef the link targets the pharmacy owner backoffice user. An unknown userRef creates a restricted PHARMACY_STAFF backoffice user just in time (never an admin); the raw value is never persisted, only a hash.
          example: portal-user-77
          type: string
      type: object
    CreatePartnerOffboardingRequestDto:
      properties:
        effectiveAt:
          description: Optional requested effective date.
          example: 2026-08-01T00:00:00.000Z
          format: date-time
          type: string
        reason:
          description: Optional PHI-free termination reason from the partner system.
          example: Vertrag beendet
          type: string
      type: object
    CreatePartnerPharmacyDto:
      properties:
        acceptedDataProcessing:
          description: "Must be true: the partner confirms the pharmacy accepted the data processing terms."
          example: true
          type: boolean
        partner:
          description: Partner channel identifier.
          enum:
            - gedisa
          example: gedisa
          type: string
        partnerOrgId:
          description: Partner-controlled pharmacy identifier in the partner namespace. Registrations are idempotent per (partner, partnerOrgId).
          example: pharmacy-4711
          type: string
        pharmacy:
          description: Pharmacy master data. All fields are required (AF-189) so the tenant is fully usable without manual follow-up.
          properties:
            address:
              description: Pharmacy address.
              properties:
                city:
                  description: City.
                  example: Hamburg
                  type: string
                postalCode:
                  description: Postal code.
                  example: "20457"
                  type: string
                street:
                  description: Street and number.
                  example: Musterstr. 1
                  type: string
              required:
                - street
                - postalCode
                - city
              type: object
            desiredSlug:
              description: Desired tenant slug.
              example: beispiel-apotheke-4711
              type: string
            organizationDisplayName:
              description: Pharmacy display name.
              example: Beispiel Apotheke
              type: string
            organizationLegalName:
              description: Legal name of the pharmacy.
              example: Beispiel Apotheke e.K.
              type: string
            primaryContactEmail:
              description: Owner contact email.
              example: kontakt@example.test
              format: email
              type: string
            primaryContactName:
              description: Owner contact of the pharmacy.
              example: Synthetischer Kontakt
              type: string
            primaryContactPhone:
              description: Owner contact phone.
              example: +49 40 123456
              type: string
          required:
            - organizationDisplayName
            - organizationLegalName
            - desiredSlug
            - primaryContactName
            - primaryContactEmail
            - primaryContactPhone
            - address
          type: object
      required:
        - partner
        - partnerOrgId
        - pharmacy
        - acceptedDataProcessing
      type: object
    CreatePartnerPharmacyRoomDto:
      properties:
        availability:
          description: Initial weekly room availability rule. The room is created with this active rule.
          properties:
            dayOfWeek:
              description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
              example: 1
              maximum: 6
              minimum: 0
              type: integer
            endTime:
              description: End time in HH:mm.
              example: 12:00
              type: string
            startTime:
              description: Start time in HH:mm.
              example: 08:00
              type: string
            timezone:
              description: Optional IANA timezone.
              example: Europe/Berlin
              type: string
            validFrom:
              description: Optional first local date on which this room rule is valid.
              example: 2026-06-01
              format: date
              nullable: true
              type: string
            validUntil:
              description: Optional last local date on which this room rule is valid. Null means open-ended.
              example: 2026-12-31
              format: date
              nullable: true
              type: string
          required:
            - dayOfWeek
            - startTime
            - endTime
          type: object
        name:
          description: Room display name.
          example: Beratungsraum 1
          type: string
        pharmacyOrgId:
          description: Pharmacy organization identifier that owns the consultation room.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
      required:
        - pharmacyOrgId
        - name
        - availability
      type: object
    CreatePartnerWebhookDto:
      properties:
        auth:
          description: Optional OAuth2 client-credentials configuration for receivers that expect bearer-authenticated deliveries instead of the default HMAC-signed mode. Omit entirely to keep HMAC signing.
          properties:
            clientId:
              description: OAuth2 client identifier.
              example: akflow-webhook-client
              type: string
            clientSecret:
              description: "OAuth2 client secret. Write-only: accepted on creation, stored encrypted, and never included in any response."
              example: <CLIENT_SECRET>
              type: string
              writeOnly: true
            mode:
              description: Fixed delivery auth mode discriminator.
              enum:
                - OAUTH2_CLIENT_CREDENTIALS
              example: OAUTH2_CLIENT_CREDENTIALS
              type: string
            scope:
              description: Optional OAuth2 scope sent as the `scope` form parameter on the token request. Set it when the partner channel requires a specific scope value for webhook deliveries.
              example: webhooks:deliver
              type: string
            tokenUrl:
              description: HTTPS token endpoint for the client-credentials grant. Subject to the same SSRF host restrictions as the webhook url.
              example: https://auth.partner.example/oauth2/token
              type: string
          required:
            - mode
            - tokenUrl
            - clientId
            - clientSecret
          type: object
        events:
          description: Subscribed partner events. This enum is derived from the authoritative ALLOWED_PARTNER_WEBHOOK_EVENTS constant (partner-webhooks.service.ts), so it cannot drift from the values the API actually accepts.
          example:
            - appointment.created
            - appointment.cancelled
          items:
            enum:
              - appointment.created
              - appointment.updated
              - appointment.cancelled
              - appointment.completed
              - appointment.failed
              - assessment.completed
              - partner_onboarding.completed
              - partner_onboarding.failed
              - partner_offboarding.completed
              - partner_offboarding.failed
            type: string
          type: array
        url:
          description: HTTPS receiver URL. IP literals, localhost and cluster-internal hosts are rejected.
          example: https://webhooks.partner.example/akflow
          type: string
      required:
        - url
        - events
      type: object
    CreateProviderDto:
      properties:
        authIssuer:
          description: Optional provider auth issuer. Omit with externalId to create an unlinked pending provider identity.
          example: https://login.example.org/realms/partner
          format: uri
          type: string
        availabilityRules:
          description: Optional availability rules to create and generate slots for during provider creation. Referenced specialties are attached to the provider before rule creation.
          example:
            - dayOfWeek: 1
              endTime: 12:00
              generateFrom: 2026-07-01
              generateTo: 2026-07-31
              slotDuration: 30
              specialtySlug: adipositas
              startTime: 08:30
              timezone: Europe/Berlin
          items:
            properties:
              dayOfWeek:
                description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
                example: 1
                maximum: 6
                minimum: 0
                type: integer
              endTime:
                description: End time in HH:mm.
                example: 12:00
                type: string
              generateFrom:
                description: First date for slot generation.
                example: 2026-05-13
                format: date
                type: string
              generateTo:
                description: Last date for slot generation.
                example: 2026-06-12
                format: date
                type: string
              slotDuration:
                description: Slot duration in minutes.
                example: 30
                type: integer
              specialtySlug:
                description: Specialty slug.
                example: adipositas
                type: string
              startTime:
                description: Start time in HH:mm.
                example: 08:30
                type: string
              timezone:
                description: IANA timezone.
                example: Europe/Berlin
                type: string
            required:
              - specialtySlug
              - dayOfWeek
              - startTime
              - endTime
              - generateFrom
              - generateTo
            type: object
          type: array
        bio:
          description: Optional public profile bio.
          example: Facharzt für Innere Medizin.
          type: string
        email:
          description: Provider email.
          example: ben.koch@example.org
          format: email
          type: string
        externalId:
          description: Optional external identity subject or email. Must be supplied together with authIssuer when linking an IdP identity.
          example: ben.koch@example.org
          type: string
        firstName:
          description: First name.
          example: Ben
          type: string
        lastName:
          description: Last name.
          example: Koch
          type: string
        organizationId:
          description: Organization identifier.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
        phone:
          description: Optional phone.
          example: +49 151 12345678
          type: string
        photoUrl:
          description: Optional profile photo URL.
          example: https://example.com/ben-koch.jpg
          format: uri
          type: string
        role:
          description: Provider role.
          enum:
            - DOCTOR
            - ORG_ADMIN
            - PHARMACY_STAFF
          example: DOCTOR
          type: string
        salutation:
          description: Optional provider salutation code.
          enum:
            - MR
            - MS
            - MX
            - NONE
          example: MR
          type: string
        specialtySlugs:
          description: Optional specialty slugs to attach during provider creation.
          example:
            - adipositas
            - diabetes
          items:
            type: string
          type: array
        title:
          description: Optional controlled provider title.
          enum:
            - Dr.
            - Dr. med.
            - Dr. medic
            - Dr. med. dent.
            - Dr. rer. nat.
            - Dr. Dr.
            - Prof.
            - Prof. Dr.
            - Prof. Dr. med.
            - PD Dr.
            - Priv.-Doz. Dr.
          example: Dr. med.
          type: string
      required:
        - organizationId
        - email
        - role
        - firstName
        - lastName
      type: object
    PartnerAppointmentDto:
      properties:
        appointmentId:
          description: Tenant-local appointment identifier.
          example: 8cb6d8b8-a582-4cd2-8095-f60537a0d3dc
          format: uuid
          type: string
        appointmentTypeName:
          description: Appointment type display name, or null when absent.
          example: Partner Check
          nullable: true
          type: string
        appointmentTypeSlug:
          description: Appointment type slug, or null when the booking has no selected type.
          example: partner-check
          nullable: true
          type: string
        cancelledAt:
          description: UTC cancellation timestamp, or null when not cancelled.
          example: null
          format: date-time
          nullable: true
          type: string
        caseId:
          description: Partner case reference (the case id supplied by the partner platform) present when the booking was created with one, or null when absent. Correlation-only; never exposed in patient-facing responses.
          example: CASE-2026-000123
          nullable: true
          type: string
        endTime:
          description: UTC appointment end timestamp.
          example: 2026-06-03T08:30:00.000Z
          format: date-time
          type: string
        externalPatientRef:
          description: Partner-controlled external patient reference. This is the only patient reference exposed by the partner Appointment API.
          example: partner-patient-1
          nullable: true
          type: string
        organization:
          description: Provider organization.
          properties:
            id:
              description: Organization identifier.
              example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
              format: uuid
              type: string
            name:
              description: Organization display name.
              example: Partner Apotheke
              type: string
            slug:
              description: Organization slug.
              example: partner-apotheke
              type: string
          type: object
        organizationId:
          description: Provider organization identifier.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
        providerId:
          description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          format: uuid
          type: string
        providerName:
          description: Provider display name.
          example: Dr. med. Ada Partner
          type: string
        source:
          description: Booking source.
          example: S2S
          type: string
        specialtyName:
          description: Specialty display name.
          example: Adipositas
          type: string
        specialtySlug:
          description: Specialty slug.
          example: adipositas
          type: string
        startTime:
          description: UTC appointment start timestamp.
          example: 2026-06-03T08:00:00.000Z
          format: date-time
          type: string
        status:
          description: Appointment status.
          enum:
            - CONFIRMED
            - COMPLETED
            - NO_SHOW
            - CANCELLED
          example: CONFIRMED
          type: string
        video:
          description: Optional video session state.
          properties:
            sessionRef:
              description: Opaque video session reference.
              example: ak-123
              type: string
            status:
              description: Video session status.
              example: REQUESTED
              type: string
          type: object
      required:
        - appointmentId
        - status
        - source
        - providerId
        - providerName
        - organizationId
        - organization
        - specialtySlug
        - specialtyName
        - appointmentTypeSlug
        - appointmentTypeName
        - externalPatientRef
        - caseId
        - startTime
        - endTime
        - cancelledAt
        - video
      type: object
    PartnerAppointmentsResponseDto:
      properties:
        appointments:
          description: Tenant-local appointments sorted by start time.
          items:
            $ref: "#/components/schemas/PartnerAppointmentDto"
          type: array
        range:
          description: Requested local date range.
          properties:
            from:
              description: Start date.
              example: 2026-06-01
              format: date
              type: string
            to:
              description: End date.
              example: 2026-06-07
              format: date
              type: string
          type: object
      required:
        - range
        - appointments
      type: object
    PartnerAppointmentTypesResponseDto:
      properties:
        allowedSpecialties:
          description: Specialties enabled for the authenticated consumer tenant.
          items:
            properties:
              name:
                description: Specialty display name.
                example: Adipositas
                type: string
              slug:
                description: Specialty slug.
                example: adipositas
                type: string
            required:
              - slug
              - name
            type: object
          type: array
        appointmentTypes:
          description: Tenant-local appointment types. Required and optional booking keys are described by requiredFields, standardFields and customIntakeFields.
          items:
            description: Appointment type.
            properties:
              bookingWebVisible:
                description: Whether this appointment type is visible in Booking Web.
                example: true
                type: boolean
              bufferMinutes:
                description: Buffer after appointment in minutes.
                example: 0
                type: integer
              consentVersionLabel:
                description: Consent version label.
                example: v1
                type: string
              currency:
                description: Optional ISO 4217 currency.
                example: EUR
                nullable: true
                type: string
              customIntakeFields:
                description: Custom intake fields accepted as intakeResponses keys during booking.
                items:
                  $ref: "#/components/schemas/AppointmentTypeIntakeFieldDto"
                type: array
              durationMinutes:
                description: Appointment duration in minutes.
                example: 30
                type: integer
              id:
                description: Appointment type identifier.
                example: 0d316943-1a82-4c6f-8b6d-72f0fc823c8b
                format: uuid
                type: string
              isActive:
                description: Whether this appointment type is active.
                example: true
                type: boolean
              mode:
                description: Appointment mode.
                enum:
                  - IN_PERSON
                  - VIDEO
                example: IN_PERSON
                type: string
              name:
                description: Appointment type display name.
                example: Partner Check
                type: string
              organization:
                description: Owning organization.
                properties:
                  id:
                    description: Organization identifier.
                    example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
                    format: uuid
                    type: string
                  name:
                    description: Organization display name.
                    example: Partner Apotheke
                    type: string
                  slug:
                    description: Organization slug.
                    example: partner-apotheke
                    type: string
                type: object
              organizationId:
                description: Organization identifier.
                example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
                format: uuid
                type: string
              paymentMode:
                description: Payment mode.
                enum:
                  - NONE
                  - SELF_PAY
                example: NONE
                type: string
              priceCents:
                description: Optional price in cents.
                example: 9900
                nullable: true
                type: integer
              requiredFields:
                description: Compatibility list of required standard patient field keys.
                example:
                  - firstName
                  - lastName
                  - email
                items:
                  type: string
                type: array
              slug:
                description: Appointment type slug.
                example: partner-check
                type: string
              specialtyName:
                description: Specialty display name.
                example: Adipositas
                type: string
              specialtySlug:
                description: Specialty slug.
                example: adipositas
                type: string
              standardFields:
                description: Standard patient fields controlled by this appointment type.
                items:
                  $ref: "#/components/schemas/AppointmentTypeStandardFieldDto"
                type: array
            type: object
          type: array
      required:
        - allowedSpecialties
        - appointmentTypes
      type: object
    PartnerAvailabilityRuleResponseDto:
      properties:
        dayOfWeek:
          description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
          example: 1
          maximum: 6
          minimum: 0
          type: integer
        endTime:
          description: End time in HH:mm.
          example: 12:00
          type: string
        isActive:
          description: Whether the rule is active.
          example: true
          type: boolean
        organization:
          description: Provider organization.
          properties:
            id:
              description: Organization identifier.
              example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
              format: uuid
              type: string
            name:
              description: Organization display name.
              example: MVZ Preview
              type: string
            slug:
              description: Organization slug.
              example: mvz-preview
              type: string
          type: object
        organizationId:
          description: Provider organization identifier.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
        providerId:
          description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          format: uuid
          type: string
        ruleId:
          description: Availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          format: uuid
          type: string
        slotDuration:
          description: Slot duration in minutes.
          example: 30
          type: integer
        slotsCreated:
          description: Number of slots generated by create/update operations.
          example: 12
          type: integer
        slotsRemoved:
          description: Number of unbooked slots removed by deactivate operations.
          example: 12
          type: integer
        specialtyName:
          description: Specialty display name.
          example: Adipositas
          type: string
        specialtySlug:
          description: Specialty slug.
          example: adipositas
          type: string
        startTime:
          description: Start time in HH:mm.
          example: 09:00
          type: string
        timezone:
          description: IANA timezone.
          example: Europe/Berlin
          type: string
        validFrom:
          description: First local date on which this rule is valid.
          example: 2026-06-01
          format: date
          nullable: true
          type: string
        validUntil:
          description: Last local date on which this rule is valid.
          example: 2026-06-30
          format: date
          nullable: true
          type: string
      required:
        - ruleId
        - providerId
        - organizationId
        - organization
        - specialtySlug
        - specialtyName
        - dayOfWeek
        - startTime
        - endTime
        - slotDuration
        - timezone
        - validFrom
        - validUntil
        - isActive
      type: object
    PartnerAvailabilityRulesResponseDto:
      properties:
        rules:
          description: Provider availability rules sorted by weekday and start time.
          items:
            $ref: "#/components/schemas/PartnerAvailabilityRuleResponseDto"
          type: array
        totalSlotsCreated:
          description: Total number of slots generated by a batch create operation.
          example: 24
          type: integer
      required:
        - rules
      type: object
    PartnerLoginLinkDto:
      properties:
        expiresAt:
          description: Token expiry (120 seconds after issuance).
          example: 2026-07-21T09:17:00.000Z
          format: date-time
          type: string
        loginUrl:
          description: One-time login URL for the pharmacy backoffice. The token is carried exclusively in the URL fragment (#token=...), is valid for 120 seconds, single use, and is shown exactly once in this response - it is never retrievable again and must not be cached or logged.
          example: https://beispiel-apotheke-4711.sandbox.arztkonsultation.io/app/magic-login#token=<OPAQUE_ONE_TIME_TOKEN>
          readOnly: true
          type: string
          x-akflow-one-time-credential: true
      required:
        - loginUrl
        - expiresAt
      type: object
    PartnerOffboardingRequestedDto:
      properties:
        offboardingRequestId:
          description: Offboarding request identifier.
          example: c0d13fd1-f37a-4537-9841-4d4ee0e3f6b8
          format: uuid
          type: string
        status:
          description: "Offboarding status. Since 2026-07-29 the partner request itself executes the deactivation: the request starts as EXECUTING (never PENDING_REVIEW), COMPLETED/COMPLETED_WITH_ERRORS once the tenant is closed, BLOCKED when cancellation work got stuck (audited admin intervention). PENDING_REVIEW, REJECTED and CONFIRMED only appear on legacy requests created before 2026-07-29 under the former admin-confirmation flow."
          enum:
            - PENDING_REVIEW
            - REJECTED
            - CANCELLED
            - EXECUTING
            - BLOCKED
            - COMPLETED
            - COMPLETED_WITH_ERRORS
            - CONFIRMED
          example: EXECUTING
          type: string
      required:
        - offboardingRequestId
        - status
      type: object
    PartnerPharmacyRegistrationDto:
      properties:
        companyId:
          description: akflow organization identifier of the pharmacy (company_id in webhook payloads).
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          format: uuid
          type: string
        consumerId:
          description: akflow tenant identifier.
          example: 54eab075-ceac-40e1-9ea7-f83a4cf89d06
          format: uuid
          type: string
        partner:
          description: Partner channel identifier.
          enum:
            - gedisa
          example: gedisa
          type: string
        partnerOrgId:
          description: Partner-controlled pharmacy identifier.
          example: pharmacy-4711
          type: string
        slug:
          description: Tenant slug.
          example: beispiel-apotheke-4711
          type: string
        ssoProvisioning:
          description: SSO/IdP provisioning state for the pharmacy realm.
          enum:
            - PENDING
            - READY
            - FAILED
          example: PENDING
          type: string
        status:
          description: Tenant lifecycle status. The tenant API key becomes usable once the status reaches ACTIVE (asynchronous provisioning).
          enum:
            - PROVISIONING_PENDING
            - ACTIVE
            - PROVISIONING_FAILED
            - DEACTIVATED
          example: PROVISIONING_PENDING
          type: string
        tenantApiKey:
          description: Tenant-scoped API key, returned exactly once in the 201 creation response. Store it securely; it cannot be retrieved again.
          properties:
            apiKey:
              description: The API key secret (shown once).
              example: <ONE_TIME_API_KEY>
              readOnly: true
              type: string
              x-akflow-one-time-credential: true
            keyId:
              description: Key identifier.
              example: ak_test_ab12cd34
              type: string
            scopes:
              description: Tenant key scopes.
              example:
                - appointments:read
                - appointments:cancel
                - rooms:read
                - rooms:write
              items:
                type: string
              type: array
          type: object
      type: object
    PartnerPharmacyRoomAvailabilityRuleDto:
      properties:
        dayOfWeek:
          description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
          example: 1
          maximum: 6
          minimum: 0
          type: integer
        endTime:
          description: End time in HH:mm.
          example: 12:00
          type: string
        startTime:
          description: Start time in HH:mm.
          example: 08:00
          type: string
        timezone:
          description: Optional IANA timezone.
          example: Europe/Berlin
          type: string
        validFrom:
          description: Optional first local date on which this room rule is valid.
          example: 2026-06-01
          format: date
          nullable: true
          type: string
        validUntil:
          description: Optional last local date on which this room rule is valid. Null means open-ended.
          example: 2026-12-31
          format: date
          nullable: true
          type: string
      required:
        - dayOfWeek
        - startTime
        - endTime
      type: object
    PartnerPharmacyRoomDto:
      properties:
        availabilityRules:
          description: Active room availability rules.
          items:
            $ref: "#/components/schemas/PartnerRoomAvailabilityRuleDto"
          type: array
        id:
          description: Pharmacy room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          format: uuid
          type: string
        isActive:
          description: Whether the room is active.
          example: true
          type: boolean
        name:
          description: Room display name.
          example: Beratungsraum 1
          type: string
      required:
        - id
        - name
        - isActive
        - availabilityRules
      type: object
    PartnerPharmacyRoomsResponseDto:
      properties:
        pharmacy:
          description: Pharmacy organization owning the rooms.
          properties:
            id:
              description: Pharmacy organization identifier.
              example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
              format: uuid
              type: string
            name:
              description: Pharmacy organization display name.
              example: Kaiser Apotheke
              type: string
          type: object
        rooms:
          description: Pharmacy rooms sorted by active state and display name.
          items:
            $ref: "#/components/schemas/PartnerPharmacyRoomDto"
          type: array
      required:
        - pharmacy
        - rooms
      type: object
    PartnerRoomAvailabilityRuleDto:
      properties:
        dayOfWeek:
          description: "Weekday in JS/cron convention: 0 Sunday, 6 Saturday."
          example: 1
          maximum: 6
          minimum: 0
          type: integer
        endTime:
          description: End time in HH:mm.
          example: 12:00
          type: string
        id:
          description: Room availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          format: uuid
          type: string
        isActive:
          description: Whether the rule is active.
          example: true
          type: boolean
        startTime:
          description: Start time in HH:mm.
          example: 08:00
          type: string
        timezone:
          description: IANA timezone.
          example: Europe/Berlin
          type: string
        validFrom:
          description: First local date on which this rule is valid.
          example: 2026-06-01
          format: date
          nullable: true
          type: string
        validUntil:
          description: Last local date on which this rule is valid.
          example: null
          format: date
          nullable: true
          type: string
      required:
        - id
        - dayOfWeek
        - startTime
        - endTime
        - timezone
        - validFrom
        - validUntil
        - isActive
      type: object
    PartnerWebhookDto:
      properties:
        createdAt:
          description: Creation timestamp.
          example: 2026-07-03T10:00:00.000Z
          format: date-time
          type: string
        events:
          description: Subscribed partner events.
          example:
            - appointment.created
            - appointment.cancelled
          items:
            type: string
          type: array
        id:
          description: Webhook identifier.
          example: c0d13fd1-f37a-4537-9841-4d4ee0e3f6b8
          format: uuid
          type: string
        isActive:
          description: Whether the webhook is active.
          example: true
          type: boolean
        secret:
          description: Signing secret, returned exactly once in the creation response. Verify x-akflow-signature = sha256 HMAC over `${x-akflow-timestamp}.${body}`.
          example: <ONE_TIME_SIGNING_SECRET>
          readOnly: true
          type: string
          x-akflow-one-time-credential: true
        url:
          description: Receiver URL.
          example: https://webhooks.partner.example/akflow
          type: string
      type: object
    PartnerWebhooksResponseDto:
      properties:
        webhooks:
          description: Configured webhooks (never contain secret material).
          items:
            $ref: "#/components/schemas/PartnerWebhookDto"
          type: array
      type: object
    PartnerWebhookTestEnqueuedDto:
      properties:
        enqueued:
          description: Whether the test delivery was enqueued.
          example: true
          type: boolean
        eventId:
          description: Outbox event identifier.
          example: c0d13fd1-f37a-4537-9841-4d4ee0e3f6b8
          format: uuid
          type: string
      required:
        - enqueued
        - eventId
      type: object
    UpdatePartnerAvailabilityRuleDto:
      properties:
        dayOfWeek:
          description: "Optional replacement weekday in JS/cron convention: 0 Sunday, 6 Saturday."
          example: 1
          maximum: 6
          minimum: 0
          type: integer
        endTime:
          description: Optional replacement end time in HH:mm.
          example: 13:00
          type: string
        generateFrom:
          description: Optional first date for slot regeneration. Must be sent together with generateTo.
          example: 2026-06-01
          format: date
          type: string
        generateTo:
          description: Optional last date for slot regeneration. Must be sent together with generateFrom.
          example: 2026-06-30
          format: date
          type: string
        slotDuration:
          description: Optional replacement slot duration in minutes.
          example: 30
          type: integer
        specialtySlug:
          description: Optional replacement specialty slug. The provider must already have this specialty.
          example: adipositas
          type: string
        startTime:
          description: Optional replacement start time in HH:mm.
          example: 10:00
          type: string
        timezone:
          description: Optional replacement IANA timezone.
          example: Europe/Berlin
          type: string
      type: object
    UpdatePartnerPharmacyRoomDto:
      properties:
        isActive:
          description: Optional active flag. Set false to hide the room from new scheduling.
          example: true
          type: boolean
        name:
          description: Optional updated room display name.
          example: Beratungsraum 2
          type: string
      type: object
    UpdatePartnerResourceModeDto:
      properties: {}
      type: object
  securitySchemes:
    consumerApiKey:
      description: Consumer API key for S2S integrations.
      in: header
      name: X-API-Key
      type: apiKey
info:
  contact: {}
  description: Public server-to-server API for arztkonsultation integration partners.
  title: akflow Partner API
  version: 1.0.0
openapi: 3.0.0
paths:
  /api/v1/s2s/appointments:
    get:
      description: "Lists appointments for the required from/to local date range: tenant-local bookings of the authenticated pharmacy plus cross-consumer bookings that live in a doctor tenant and are correlated to this pharmacy via an ACTIVE partner appointment link (care-network bookings). PENDING or aborted correlations are never visible. The union is deduplicated and sorted by start time; specialty/provider/status filters apply to both sources. Responses are PHI-minimized and include scheduling metadata plus externalPatientRef, but not decrypted patient contact data."
      operationId: listPartnerAppointments
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Start date in YYYY-MM-DD format.
          example: 2026-06-01
          in: query
          name: from
          required: true
          schema:
            format: date
            type: string
        - description: End date in YYYY-MM-DD format.
          example: 2026-06-07
          in: query
          name: to
          required: true
          schema:
            format: date
            type: string
        - description: Filter or target a specific provider. Defaults to the authenticated provider when omitted.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: query
          name: providerId
          required: false
          schema:
            format: uuid
            type: string
        - description: Optional appointment status filter.
          example: CONFIRMED
          in: query
          name: status
          required: false
          schema:
            enum:
              - CONFIRMED
              - COMPLETED
              - NO_SHOW
              - CANCELLED
            type: string
        - description: Specialty slug, for example adipositas.
          example: adipositas
          in: query
          name: specialtySlug
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAppointmentsResponseDto"
          description: Appointments in the requested local date range.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner appointments
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/appointments/{appointmentId}:
    get:
      description: Reads one appointment by booking id or video sessionRef. Tenant-local bookings resolve directly; bookings in a doctor tenant resolve through the pharmacy's own ACTIVE partner appointment link. Ids without such a correlation - including bookings of other tenants and PENDING links - are uniformly hidden as 404.
      operationId: getPartnerAppointment
      parameters:
        - description: "Tenant-local appointment reference: either the Booking id (UUID) or the video call id (sessionRef) delivered in the appointment payload."
          example: 8cb6d8b8-a582-4cd2-8095-f60537a0d3dc
          in: path
          name: appointmentId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAppointmentDto"
          description: PHI-minimized appointment detail.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Get partner appointment
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/appointments/{appointmentId}/cancel:
    post:
      description: Cancels an appointment using the required closed PHI-free reasonCode, releases its slot and room reservation, and emits a booking.cancelled outbox event. Cross-consumer bookings resolved via an ACTIVE partner appointment link are cancelled inside the doctor tenant (including the care-network release saga event); the partner cancellation deadline always comes from the DOCTOR consumer's organization config. Free-text reasons are rejected. Cancelling an already cancelled appointment is idempotent and returns 200 with the current state. Cancellations past the appointment start or past a configured partner cancellation deadline are rejected with 409 and code PARTNER_CANCELLATION_DEADLINE_PASSED. Send an Idempotency-Key header to make retries traceable in the audit trail.
      operationId: cancelPartnerAppointment
      parameters:
        - description: "Tenant-local appointment reference: either the Booking id (UUID) or the video call id (sessionRef) delivered in the appointment payload."
          example: 8cb6d8b8-a582-4cd2-8095-f60537a0d3dc
          in: path
          name: appointmentId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CancelPartnerAppointmentDto"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAppointmentDto"
          description: Cancelled PHI-minimized appointment detail.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Cancel partner appointment
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/bookings:
    post:
      description: Creates a booking for an available slot in the authenticated consumer tenant. Send Idempotency-Key for safe retries; repeated requests with the same key return the original booking result instead of creating duplicates.
      operationId: createBooking
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Optional idempotency key for safe retries of booking creation.
          example: booking-create-2026-05-13-001
          in: header
          name: Idempotency-Key
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateBookingDto"
        required: true
      responses:
        "201":
          description: Booking created or idempotently returned for the submitted slot.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create a booking
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/organizations:
    post:
      description: Creates an organization within the authenticated consumer tenant. Use this endpoint when an integration owns organization provisioning for an MVZ, clinic, or standalone practice.
      operationId: createOrganization
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateOrganizationDto"
        required: true
      responses:
        "201":
          description: Organization created for the authenticated consumer tenant.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create an organization
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies:
    post:
      description: "Registers a pharmacy as its own akflow tenant under the authenticated partner platform key (scope partners:register). Requires an ACTIVE PartnerControl for the calling consumer (403 with code PARTNER_CONTROL_REQUIRED otherwise). Idempotent per (partner, partnerOrgId): a repeated registration returns 200 with the existing registration and never a second tenant or API key - but only for registrations owned by the calling partner consumer; a partnerOrgId registered by another partner consumer answers 404 without confirming its existence. The 201 creation response contains the tenant-scoped API key exactly once. The booking page is published automatically during registration. Tenant activation and realm provisioning run inline with the request (direct activation): the response normally already reports status ACTIVE. Only when the inline provisioning fails transiently does the response report PROVISIONING_PENDING and activation completes asynchronously - poll the GET endpoint until status is ACTIVE in that case."
      operationId: createPartnerPharmacy
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerPharmacyDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRegistrationDto"
          description: Pharmacy tenant registered; includes the one-time tenant API key. Backoffice access is issued exclusively via the login-links endpoint (no owner invite in the response).
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: "Conflict. The desired tenant slug is already taken (code CONSUMER_SLUG_TAKEN, also returned when a concurrent registration wins the same slug), reserved for platform use (code CONSUMER_SLUG_RESERVED), or the partnerOrgId maps to a legacy link that is not yet claimed by any partner consumer (code PARTNER_LINK_UNCLAIMED; run the ownership backfill before retrying). For partner channels that share one symptom-check account, that shared credential must exist on the partner control consumer before pharmacies can be registered: it is missing (code XUND_SHARED_CREDENTIAL_MISSING), not active (code XUND_SHARED_CREDENTIAL_INACTIVE), carries no key material (code XUND_SHARED_CREDENTIAL_UNUSABLE), or several active partner controls claim the channel so the source is ambiguous (code XUND_SHARED_CREDENTIAL_AMBIGUOUS). A platform admin provisions or rotates it before retrying; no tenant is left behind on any of these codes."
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Register a partner pharmacy
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}:
    get:
      description: Returns the registration state for a partner-registered pharmacy, resolved by the partner-controlled partnerOrgId, including the latest offboarding request state when present. Only registrations owned by the calling partner consumer resolve; unknown, foreign and unclaimed partnerOrgIds uniformly answer 404. Never contains API key material.
      operationId: getPartnerPharmacy
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          description: ""
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRegistrationDto"
          description: Registration state for the pharmacy.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Get a partner pharmacy registration
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/login-links:
    post:
      description: "Issues a one-time magic-login link for the pharmacy backoffice (scope partners:login-links). Magic link is the ONLY login path for partner pharmacy backoffice users; fetch a fresh link on every user click and redirect the browser to loginUrl - links must never be cached, embedded in emails, or logged. Requires an ACTIVE PartnerControl (403 PARTNER_CONTROL_REQUIRED) and only resolves pharmacies registered by the calling partner consumer (foreign or unknown partnerOrgIds answer 404). The token is valid for 120 seconds, single use, and travels exclusively in the URL fragment. Without userRef the link targets the pharmacy owner; an unknown userRef creates a restricted PHARMACY_STAFF user just in time. Preconditions: the tenant must be ACTIVE (409 TENANT_NOT_PROVISIONED while provisioning runs, TENANT_INACTIVE when deactivated) and not draining (409 TENANT_DRAINING). Dedicated rate limit: 10 links per minute per pharmacy (429 with Retry-After)."
      operationId: createPartnerPharmacyLoginLink
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerLoginLinkDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerLoginLinkDto"
          description: One-time login link; the token in the URL fragment is shown exactly once.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: "Conflict. Stable codes: TENANT_NOT_PROVISIONED (keep polling the registration until status ACTIVE), TENANT_INACTIVE (deactivated tenant), TENANT_DRAINING (offboarding in progress), IDENTITY_REALM_MISSING, OWNER_NOT_FOUND, LOGIN_TARGET_INACTIVE."
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The dedicated login-link limit (10 per minute per pharmacy) was exceeded; retry after the Retry-After header.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create a one-time backoffice login link
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/offboarding-requests:
    post:
      description: "Requests offboarding (termination) of a partner-registered pharmacy (scope partners:offboard). Only registrations owned by the calling partner consumer resolve (404 otherwise). Since 2026-07-29 this request itself executes the deactivation; there is no platform-admin confirmation step and no 24h delivery drain window. In one transaction the tenant stops admitting new bookings (DRAINING) and the request starts as EXECUTING (never PENDING_REVIEW). Future appointments are then cancelled (including cross-consumer partner bookings) and each cancellation is delivered as its own appointment.cancelled event (wire type consultation.canceled); the partner-bound webhook stays active until these deliveries are out, then webhooks are disabled, tenant API keys revoked and the tenant closed. The final state is reported via the partner_offboarding.completed webhook event (wire type offboarding.completed), which is also sent when the cleanup finished with errors: the tenant is closed either way and the error detail stays internal. Repeated requests are idempotent and return 200 with the surviving request. The reason must be PHI-free."
      operationId: requestPartnerPharmacyOffboarding
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerOffboardingRequestDto"
        required: true
      responses:
        "201":
          description: ""
        "202":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerOffboardingRequestedDto"
          description: Offboarding accepted; deactivation executing.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Request partner pharmacy offboarding
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/resource-mode:
    get:
      description: Reads the pharmacy's resource mode (scope partners:register). TEST means the pharmacy books test resources only (the platform QA pool, e.g. ak-MVZ test doctors); LIVE means real MVZ resources. Newly registered partner pharmacies start in TEST (since 2026-08-02); the switch to LIVE is offered in the partner portal settings via the POST variant. Only registrations owned by the calling partner consumer resolve (404 otherwise).
      operationId: getPartnerPharmacyResourceMode
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Current resource mode of the pharmacy.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Read partner pharmacy resource mode
      tags:
        - s2s
      x-akflow-publication: partner
    post:
      description: "Switches the pharmacy between TEST (test resources from the platform QA pool) and LIVE (real MVZ resources) with scope partners:register. The switch takes effect immediately for slot search and new bookings; existing bookings are untouched. Idempotent: requesting the current mode returns 200 with changed=false. Every actual switch is audited with the caller's api key as actor; the optional reason must be PHI-free. Only registrations owned by the calling partner consumer resolve (404 otherwise)."
      operationId: updatePartnerPharmacyResourceMode
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdatePartnerResourceModeDto"
        required: true
      responses:
        "200":
          description: Resource mode after the request.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Switch partner pharmacy resource mode
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/webhooks:
    get:
      description: Lists the webhook subscriptions of a partner-registered pharmacy (scope webhooks:write). All webhook endpoints require an ACTIVE PartnerControl (403 PARTNER_CONTROL_REQUIRED) and only resolve pharmacies registered by the calling partner consumer (foreign or unclaimed partnerOrgIds answer 404). Responses never contain secret material.
      operationId: listPartnerPharmacyWebhooks
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          description: ""
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerWebhooksResponseDto"
          description: Configured webhooks for the pharmacy.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner pharmacy webhooks
      tags:
        - s2s
      x-akflow-publication: partner
    post:
      description: "Creates a webhook subscription for appointment.*, assessment.completed, partner_onboarding.* and partner_offboarding.* events of a partner-registered pharmacy (see the events enum for the exact, authoritative set). Default delivery is HMAC: the signing secret is generated server-side, stored encrypted and returned exactly once in this response; deliveries are signed with HMAC-SHA256 over `${x-akflow-timestamp}.${body}` in the x-akflow-signature header. Alternatively pass `auth` (OAuth2 client credentials: tokenUrl, clientId, clientSecret, and an optional scope sent as the token request's scope parameter when the partner channel requires one) for receivers that expect bearer-authenticated deliveries, such as a partner Apothekenportal; deliveries then carry a Bearer token plus an Idempotency-Key header and no HMAC headers. Client secrets are stored encrypted and never returned. Webhook mutations answer 409 TENANT_DRAINING while an offboarding saga drains the tenant."
      operationId: createPartnerPharmacyWebhook
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerWebhookDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerWebhookDto"
          description: Webhook created; includes the one-time signing secret.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create partner pharmacy webhook
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/webhooks/{webhookId}:
    delete:
      description: Deactivates a webhook subscription. Deliveries stop immediately.
      operationId: deactivatePartnerPharmacyWebhook
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Webhook identifier.
          in: path
          name: webhookId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          description: ""
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerWebhookDto"
          description: Deactivated webhook.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Deactivate partner pharmacy webhook
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/partners/pharmacies/{partnerOrgId}/webhooks/{webhookId}/test:
    post:
      description: Enqueues a signed webhook.test delivery to the receiver through the regular dispatcher (including retries). Use it to verify signature validation end to end during onboarding.
      operationId: testPartnerPharmacyWebhook
      parameters:
        - description: Partner-controlled pharmacy identifier from the registration call.
          example: pharmacy-4711
          in: path
          name: partnerOrgId
          required: true
          schema:
            format: uuid
            type: string
        - description: Webhook identifier.
          in: path
          name: webhookId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "202":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerWebhookTestEnqueuedDto"
          description: Test delivery enqueued.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Send webhook test delivery
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/pharmacy/rooms:
    get:
      description: Lists consultation rooms for a pharmacy organization in the authenticated API key tenant. pharmacyOrgId is optional only when the tenant has a single active pharmacy organization.
      operationId: listPartnerPharmacyRooms
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Optional pharmacy organization identifier. Required when the tenant has more than one active pharmacy organization.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          in: query
          name: pharmacyOrgId
          required: false
          schema:
            format: uuid
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRoomsResponseDto"
          description: Pharmacy rooms and active room availability rules.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner pharmacy rooms
      tags:
        - s2s
      x-akflow-publication: partner
    post:
      description: Creates a pharmacy consultation room with one initial weekly availability rule. Deactivation is used for lifecycle changes; historical reservations remain intact.
      operationId: createPartnerPharmacyRoom
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerPharmacyRoomDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRoomDto"
          description: Pharmacy room created.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create partner pharmacy room
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/pharmacy/rooms/{roomId}:
    delete:
      description: Deactivates a pharmacy room and its active availability rules. Historical reservations are retained.
      operationId: deactivatePartnerPharmacyRoom
      parameters:
        - description: Pharmacy consultation room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          in: path
          name: roomId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRoomDto"
          description: Pharmacy room deactivated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Deactivate partner pharmacy room
      tags:
        - s2s
      x-akflow-publication: partner
    patch:
      description: Updates a pharmacy room display name or active flag inside the authenticated API key tenant.
      operationId: updatePartnerPharmacyRoom
      parameters:
        - description: Pharmacy consultation room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          in: path
          name: roomId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdatePartnerPharmacyRoomDto"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerPharmacyRoomDto"
          description: Pharmacy room updated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Update partner pharmacy room
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/pharmacy/rooms/{roomId}/availability-rules:
    post:
      description: Adds a weekly availability rule to a pharmacy room. dayOfWeek uses 0=Sunday through 6=Saturday, dates use YYYY-MM-DD, times use HH:mm, and timezone defaults to Europe/Berlin.
      operationId: createPartnerRoomAvailabilityRule
      parameters:
        - description: Pharmacy consultation room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          in: path
          name: roomId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PartnerPharmacyRoomAvailabilityRuleDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerRoomAvailabilityRuleDto"
          description: Room availability rule created.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create partner pharmacy room availability rule
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/pharmacy/rooms/{roomId}/availability-rules/{ruleId}:
    delete:
      description: Deactivates a pharmacy room availability rule. Historical reservations are retained.
      operationId: deactivatePartnerRoomAvailabilityRule
      parameters:
        - description: Pharmacy consultation room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          in: path
          name: roomId
          required: true
          schema:
            format: uuid
            type: string
        - description: Availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          in: path
          name: ruleId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerRoomAvailabilityRuleDto"
          description: Room availability rule deactivated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Deactivate partner pharmacy room availability rule
      tags:
        - s2s
      x-akflow-publication: partner
    patch:
      description: Replaces a pharmacy room availability rule window and keeps the rule active.
      operationId: updatePartnerRoomAvailabilityRule
      parameters:
        - description: Pharmacy consultation room identifier.
          example: ac7515a2-0cf6-4f73-b20b-3b96f3c97c9d
          in: path
          name: roomId
          required: true
          schema:
            format: uuid
            type: string
        - description: Availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          in: path
          name: ruleId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PartnerPharmacyRoomAvailabilityRuleDto"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerRoomAvailabilityRuleDto"
          description: Room availability rule updated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Update partner pharmacy room availability rule
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/providers:
    post:
      description: Creates a provider identity scoped to one organization in the authenticated consumer tenant. Provider identities are tenant-local and are not linked across brands or standalone scheduling tenants. authIssuer and externalId may be omitted together to create an unlinked pending provider. Optional specialtySlugs and availabilityRules allow initial scheduling bootstrap in the same request; availabilityRules additionally require scheduling:write on the API key.
      operationId: createProvider
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateProviderDto"
        required: true
      responses:
        "201":
          description: Provider created and linked to the submitted organization.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create a provider
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/providers/{providerId}/availability-rules:
    post:
      description: Creates a recurring provider availability rule and generates appointment slots for the submitted date range. Dates use YYYY-MM-DD, times use HH:mm, and timezone defaults to Europe/Berlin when omitted.
      operationId: createS2sProviderAvailabilityRule
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateAvailabilityRuleDto"
        required: true
      responses:
        "201":
          description: Availability rule created and slots generated for the requested range.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create provider availability rule
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/providers/{providerId}/slots:
    get:
      description: Lists provider calendar slots for the authenticated API key tenant. When status is omitted, only AVAILABLE slots are returned and slots with active holds are excluded so partner calendars do not offer temporarily reserved times.
      operationId: listS2sProviderSlots
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Start date in YYYY-MM-DD format.
          example: 2026-05-13
          in: query
          name: from
          required: true
          schema:
            format: date
            type: string
        - description: End date in YYYY-MM-DD format.
          example: 2026-05-20
          in: query
          name: to
          required: true
          schema:
            format: date
            type: string
        - description: Specialty slug, for example adipositas.
          example: adipositas
          in: query
          name: specialtySlug
          required: false
          schema:
            type: string
        - description: Optional slot status filter. Defaults to AVAILABLE; AVAILABLE results exclude active slot holds.
          example: AVAILABLE
          in: query
          name: status
          required: false
          schema:
            enum:
              - AVAILABLE
              - BOOKED
              - BLOCKED
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  providerId:
                    description: Provider identifier.
                    example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                    format: uuid
                    type: string
                  range:
                    description: Requested local date range.
                    properties:
                      from:
                        description: Start date.
                        example: 2026-05-13
                        format: date
                        type: string
                      to:
                        description: End date.
                        example: 2026-05-20
                        format: date
                        type: string
                    type: object
                  slots:
                    description: Provider slots sorted by start time.
                    example:
                      - endTime: 2026-05-13T07:30:00.000Z
                        organization:
                          name: MVZ Preview
                          slug: mvz-preview
                        providerId: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                        providerName: Dr. med. Ben Koch
                        slotId: 0d6b61b1-a99e-480c-878f-b8f5d1be0983
                        specialtySlug: adipositas
                        startTime: 2026-05-13T07:00:00.000Z
                        status: AVAILABLE
                        timezone: Europe/Berlin
                    items:
                      description: Provider slot.
                      properties:
                        endTime:
                          description: UTC slot end timestamp.
                          example: 2026-05-13T07:30:00.000Z
                          format: date-time
                          type: string
                        organization:
                          description: Provider organization.
                          properties:
                            name:
                              description: Organization display name.
                              example: MVZ Preview
                              type: string
                            slug:
                              description: Organization slug.
                              example: mvz-preview
                              type: string
                          type: object
                        providerId:
                          description: Provider identifier.
                          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                          format: uuid
                          type: string
                        providerName:
                          description: Provider display name.
                          example: Dr. med. Ben Koch
                          type: string
                        slotId:
                          description: Slot identifier.
                          example: 0d6b61b1-a99e-480c-878f-b8f5d1be0983
                          format: uuid
                          type: string
                        specialtySlug:
                          description: Specialty slug.
                          example: adipositas
                          type: string
                        startTime:
                          description: UTC slot start timestamp.
                          example: 2026-05-13T07:00:00.000Z
                          format: date-time
                          type: string
                        status:
                          description: Slot status.
                          enum:
                            - AVAILABLE
                            - BOOKED
                            - BLOCKED
                          example: AVAILABLE
                          type: string
                        timezone:
                          description: IANA timezone used for local calendar intent.
                          example: Europe/Berlin
                          type: string
                      type: object
                    type: array
                required:
                  - providerId
                  - range
                  - slots
                type: object
          description: Provider slots for the requested local date range.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List provider slots
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/providers/{providerId}/specialties:
    post:
      description: Adds one or more specialty slugs to an existing provider. Send specialtySlug for the legacy single form or specialtySlugs for batch attachment. The specialty must be allowed for the authenticated consumer tenant before public booking can expose matching slots.
      operationId: addProviderSpecialties
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AddSpecialtyDto"
        required: true
      responses:
        "201":
          description: Specialty attached to the provider.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Attach provider specialty
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/scheduling/appointment-types:
    get:
      description: Lists tenant-local appointment types and allowed specialties for partner scheduling. Use organizationId to narrow the result to one organization. Response fields describe which standard and custom intake keys a partner may submit during booking.
      operationId: listPartnerAppointmentTypes
      parameters:
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Optional organization identifier. When omitted, appointment types for all tenant organizations are returned.
          example: 37d0b63d-886d-4a71-875f-2cab61ca8e5e
          in: query
          name: organizationId
          required: false
          schema:
            format: uuid
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAppointmentTypesResponseDto"
          description: Appointment types and allowed specialties for the authenticated consumer tenant.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner appointment types
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/scheduling/providers/{providerId}/availability-rules:
    get:
      description: Lists provider availability rules for the authenticated API key tenant. The providerId path parameter must belong to the tenant bound to the API key.
      operationId: listPartnerProviderAvailabilityRules
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAvailabilityRulesResponseDto"
          description: Provider availability rules.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner provider availability rules
      tags:
        - s2s
      x-akflow-publication: partner
    post:
      description: "Creates one or more recurring provider availability rules and generates appointment slots for the submitted date range. Send a single rule payload for the legacy form or { rules: [...] } for batch creation. dayOfWeek uses 0=Sunday through 6=Saturday, dates use YYYY-MM-DD, times use HH:mm, and timezone defaults to Europe/Berlin."
      operationId: createPartnerProviderAvailabilityRules
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePartnerAvailabilityRuleDto"
        required: true
      responses:
        "201":
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: "#/components/schemas/PartnerAvailabilityRuleResponseDto"
                  - $ref: "#/components/schemas/PartnerAvailabilityRulesResponseDto"
          description: Availability rule created and slots generated for the requested range.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Create partner provider availability rule
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/scheduling/providers/{providerId}/availability-rules/{ruleId}:
    delete:
      description: Deactivates a provider availability rule and removes unbooked generated slots. Historical bookings are never deleted. If booked slots exist, the API returns 409 and emits PHI-free rebooking evidence.
      operationId: deactivatePartnerProviderAvailabilityRule
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          in: path
          name: ruleId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAvailabilityRuleResponseDto"
          description: Availability rule deactivated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Deactivate partner provider availability rule
      tags:
        - s2s
      x-akflow-publication: partner
    patch:
      description: Updates a provider availability rule in the authenticated API key tenant. If generateFrom and generateTo are supplied, both are required and unbooked generated slots for the rule are regenerated. If booked slots exist, the API returns 409 and emits PHI-free rebooking evidence.
      operationId: updatePartnerProviderAvailabilityRule
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Availability rule identifier.
          example: 7d8f9f4e-0d2f-4f10-8e80-6fd2a884fd21
          in: path
          name: ruleId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdatePartnerAvailabilityRuleDto"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PartnerAvailabilityRuleResponseDto"
          description: Availability rule updated.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: Update partner provider availability rule
      tags:
        - s2s
      x-akflow-publication: partner
  /api/v1/s2s/scheduling/providers/{providerId}/slots:
    get:
      description: Lists provider calendar slots for the authenticated API key tenant through the partner scheduling surface. from and to are required local dates in YYYY-MM-DD format. When status is omitted, only AVAILABLE slots are returned and active temporary holds are excluded.
      operationId: listPartnerSchedulingProviderSlots
      parameters:
        - description: Provider identifier.
          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
          in: path
          name: providerId
          required: true
          schema:
            format: uuid
            type: string
        - description: Optional opaque request correlation ID for tracing API calls across systems. Billing audit paths persist only UUIDv4-shaped values and drop free-form values.
          example: 33333333-3333-4333-8333-333333333333
          in: header
          name: X-Correlation-ID
          required: false
          schema:
            type: string
        - description: Start date in YYYY-MM-DD format.
          example: 2026-05-13
          in: query
          name: from
          required: true
          schema:
            format: date
            type: string
        - description: End date in YYYY-MM-DD format.
          example: 2026-05-20
          in: query
          name: to
          required: true
          schema:
            format: date
            type: string
        - description: Specialty slug, for example adipositas.
          example: adipositas
          in: query
          name: specialtySlug
          required: false
          schema:
            type: string
        - description: Optional slot status filter. Defaults to AVAILABLE; AVAILABLE results exclude active slot holds.
          example: AVAILABLE
          in: query
          name: status
          required: false
          schema:
            enum:
              - AVAILABLE
              - BOOKED
              - BLOCKED
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  providerId:
                    description: Provider identifier.
                    example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                    format: uuid
                    type: string
                  range:
                    description: Requested local date range.
                    properties:
                      from:
                        description: Start date.
                        example: 2026-05-13
                        format: date
                        type: string
                      to:
                        description: End date.
                        example: 2026-05-20
                        format: date
                        type: string
                    type: object
                  slots:
                    description: Provider slots sorted by start time.
                    example:
                      - endTime: 2026-05-13T07:30:00.000Z
                        organization:
                          name: MVZ Preview
                          slug: mvz-preview
                        providerId: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                        providerName: Dr. med. Ben Koch
                        slotId: 0d6b61b1-a99e-480c-878f-b8f5d1be0983
                        specialtySlug: adipositas
                        startTime: 2026-05-13T07:00:00.000Z
                        status: AVAILABLE
                        timezone: Europe/Berlin
                    items:
                      description: Provider slot.
                      properties:
                        endTime:
                          description: UTC slot end timestamp.
                          example: 2026-05-13T07:30:00.000Z
                          format: date-time
                          type: string
                        organization:
                          description: Provider organization.
                          properties:
                            name:
                              description: Organization display name.
                              example: MVZ Preview
                              type: string
                            slug:
                              description: Organization slug.
                              example: mvz-preview
                              type: string
                          type: object
                        providerId:
                          description: Provider identifier.
                          example: 5cd4f03b-5c1d-406e-b834-35b4f635c1c3
                          format: uuid
                          type: string
                        providerName:
                          description: Provider display name.
                          example: Dr. med. Ben Koch
                          type: string
                        slotId:
                          description: Slot identifier.
                          example: 0d6b61b1-a99e-480c-878f-b8f5d1be0983
                          format: uuid
                          type: string
                        specialtySlug:
                          description: Specialty slug.
                          example: adipositas
                          type: string
                        startTime:
                          description: UTC slot start timestamp.
                          example: 2026-05-13T07:00:00.000Z
                          format: date-time
                          type: string
                        status:
                          description: Slot status.
                          enum:
                            - AVAILABLE
                            - BOOKED
                            - BLOCKED
                          example: AVAILABLE
                          type: string
                        timezone:
                          description: IANA timezone used for local calendar intent.
                          example: Europe/Berlin
                          type: string
                      type: object
                    type: array
                required:
                  - providerId
                  - range
                  - slots
                type: object
          description: Provider slots for the requested local date range.
        "400":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Bad Request. The request is syntactically valid JSON but contains invalid fields or formats.
        "401":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unauthorized. The X-API-Key header is missing, expired, or invalid.
        "403":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Forbidden. The API key is valid but does not include the required scope.
        "409":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Conflict. The requested write conflicts with existing tenant data or a slot is no longer available.
        "422":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Unprocessable Entity. The request is valid but violates scheduling business rules.
        "429":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Too Many Requests. The integration should back off and retry later.
        "500":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ApiError"
          description: Internal Server Error. Retry only when the operation is idempotent or an Idempotency-Key was supplied.
      security:
        - consumerApiKey: []
      summary: List partner provider slots
      tags:
        - s2s
      x-akflow-publication: partner
servers: []
tags:
  - description: Server-to-server operations for integration partners.
    name: s2s