api-sdk-rb 1.11.66

data/lib/api-sdk-rb/api/public_embed_api.rb

@@ -0,0 +1,496 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'cgi'
+
+module ApiSdkRb
+  class PublicEmbedApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Call a gateway operation of an adapter a published widget uses
+    # The door a widget's adapter module calls, from the visitor's browser, for the operations that cannot run in the browser: anything with a secret, a charge in credits or the owner's storage behind it. A widget that uses such an adapter is handed the address of this route as `adapters.url` in its `widgetic:host` message (see the host bridge contract) and calls `{adapters.url}/{adapterId}/{operation}`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **What it serves.** Only an adapter, and a version of it, that the widget's LIVE manifest (what the version that is published uses) lists, and only an operation that runs on the gateway. Anything else is one 404 `ADAPTER_NOT_AVAILABLE`, whatever the reason, so the route is no way to ask what a widget contains. An adapter an administrator stopped offering to NEW widgets keeps serving the widgets that already use it. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). Page script cannot forge it. A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. When the partner of the owner signs the host context, a context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`. **Cost and retries.** An operation priced in credits is charged to the owner of the widget (for a customer a partner manages, to the partner's administrator, within the monthly credits set for that customer), once for each `requestId`, before it runs, and given back if it does not answer. A `requestId` that was charged and not given back is 409 `REQUEST_ALREADY_USED` and the operation is NOT run a second time; one whose charge was given back may be tried again with the same `requestId`. A visitor never sees an owner's balance: a feature that cannot be used because its owner has no credits left, because the customer's monthly credits are spent, or because an administrator stopped the adapter, is the same 503 `ADAPTER_UNAVAILABLE` as every other \"not right now\". The owner is told through a notice. **Limits.** In front of everything, 120 calls a minute for each visitor address and composition and 600 a minute for a composition (429 `RATE_LIMITED`). Then, for each operation of a widget, a rate for each visitor address a minute and a cap for the widget a day: 30 and 5000 for an operation that is free, 10 and 500 for one that costs credits, unless the adapter says otherwise (never above 120 and 100000). A visitor over the rate is 429 `RATE_LIMITED`; a widget over its cap is 429 `WIDGET_LIMIT_REACHED`. Both carry a `Retry-After` header. The body is at most 64 KiB (413 `PAYLOAD_TOO_LARGE`) and JSON (415 `UNSUPPORTED_MEDIA_TYPE`); an operation has 30 seconds to answer (504 `ADAPTER_TIMEOUT`, and the charge is given back).
+    # @param composition_id [String] 
+    # @param adapter_id [String] The id of the adapter, the name its module is known by, for example `upload`.
+    # @param operation [String] The name of one operation of the adapter, as its documentation gives it.
+    # @param public_adapter_call_request [PublicAdapterCallRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [PublicAdapterCallResult]
+    def call_public_composition_adapter_0(composition_id, adapter_id, operation, public_adapter_call_request, opts = {})
+      data, _status_code, _headers = call_public_composition_adapter_0_with_http_info(composition_id, adapter_id, operation, public_adapter_call_request, opts)
+      data
+    end
+
+    # Call a gateway operation of an adapter a published widget uses
+    # The door a widget's adapter module calls, from the visitor's browser, for the operations that cannot run in the browser: anything with a secret, a charge in credits or the owner's storage behind it. A widget that uses such an adapter is handed the address of this route as `adapters.url` in its `widgetic:host` message (see the host bridge contract) and calls `{adapters.url}/{adapterId}/{operation}`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **What it serves.** Only an adapter, and a version of it, that the widget's LIVE manifest (what the version that is published uses) lists, and only an operation that runs on the gateway. Anything else is one 404 `ADAPTER_NOT_AVAILABLE`, whatever the reason, so the route is no way to ask what a widget contains. An adapter an administrator stopped offering to NEW widgets keeps serving the widgets that already use it. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). Page script cannot forge it. A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. When the partner of the owner signs the host context, a context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`. **Cost and retries.** An operation priced in credits is charged to the owner of the widget (for a customer a partner manages, to the partner's administrator, within the monthly credits set for that customer), once for each `requestId`, before it runs, and given back if it does not answer. A `requestId` that was charged and not given back is 409 `REQUEST_ALREADY_USED` and the operation is NOT run a second time; one whose charge was given back may be tried again with the same `requestId`. A visitor never sees an owner's balance: a feature that cannot be used because its owner has no credits left, because the customer's monthly credits are spent, or because an administrator stopped the adapter, is the same 503 `ADAPTER_UNAVAILABLE` as every other \"not right now\". The owner is told through a notice. **Limits.** In front of everything, 120 calls a minute for each visitor address and composition and 600 a minute for a composition (429 `RATE_LIMITED`). Then, for each operation of a widget, a rate for each visitor address a minute and a cap for the widget a day: 30 and 5000 for an operation that is free, 10 and 500 for one that costs credits, unless the adapter says otherwise (never above 120 and 100000). A visitor over the rate is 429 `RATE_LIMITED`; a widget over its cap is 429 `WIDGET_LIMIT_REACHED`. Both carry a `Retry-After` header. The body is at most 64 KiB (413 `PAYLOAD_TOO_LARGE`) and JSON (415 `UNSUPPORTED_MEDIA_TYPE`); an operation has 30 seconds to answer (504 `ADAPTER_TIMEOUT`, and the charge is given back).
+    # @param composition_id [String] 
+    # @param adapter_id [String] The id of the adapter, the name its module is known by, for example `upload`.
+    # @param operation [String] The name of one operation of the adapter, as its documentation gives it.
+    # @param public_adapter_call_request [PublicAdapterCallRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(PublicAdapterCallResult, Integer, Hash)>] PublicAdapterCallResult data, response status code and response headers
+    def call_public_composition_adapter_0_with_http_info(composition_id, adapter_id, operation, public_adapter_call_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.call_public_composition_adapter_0 ...'
+      end
+      # verify the required parameter 'composition_id' is set
+      if @api_client.config.client_side_validation && composition_id.nil?
+        fail ArgumentError, "Missing the required parameter 'composition_id' when calling PublicEmbedApi.call_public_composition_adapter_0"
+      end
+      # verify the required parameter 'adapter_id' is set
+      if @api_client.config.client_side_validation && adapter_id.nil?
+        fail ArgumentError, "Missing the required parameter 'adapter_id' when calling PublicEmbedApi.call_public_composition_adapter_0"
+      end
+      if @api_client.config.client_side_validation && adapter_id.to_s.length > 40
+        fail ArgumentError, 'invalid value for "adapter_id" when calling PublicEmbedApi.call_public_composition_adapter_0, the character length must be smaller than or equal to 40.'
+      end
+
+      pattern = Regexp.new(/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/)
+      if @api_client.config.client_side_validation && adapter_id !~ pattern
+        fail ArgumentError, "invalid value for 'adapter_id' when calling PublicEmbedApi.call_public_composition_adapter_0, must conform to the pattern #{pattern}."
+      end
+
+      # verify the required parameter 'operation' is set
+      if @api_client.config.client_side_validation && operation.nil?
+        fail ArgumentError, "Missing the required parameter 'operation' when calling PublicEmbedApi.call_public_composition_adapter_0"
+      end
+      if @api_client.config.client_side_validation && operation.to_s.length > 40
+        fail ArgumentError, 'invalid value for "operation" when calling PublicEmbedApi.call_public_composition_adapter_0, the character length must be smaller than or equal to 40.'
+      end
+
+      pattern = Regexp.new(/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/)
+      if @api_client.config.client_side_validation && operation !~ pattern
+        fail ArgumentError, "invalid value for 'operation' when calling PublicEmbedApi.call_public_composition_adapter_0, must conform to the pattern #{pattern}."
+      end
+
+      # verify the required parameter 'public_adapter_call_request' is set
+      if @api_client.config.client_side_validation && public_adapter_call_request.nil?
+        fail ArgumentError, "Missing the required parameter 'public_adapter_call_request' when calling PublicEmbedApi.call_public_composition_adapter_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}'.sub('{' + 'compositionId' + '}', CGI.escape(composition_id.to_s)).sub('{' + 'adapterId' + '}', CGI.escape(adapter_id.to_s)).sub('{' + 'operation' + '}', CGI.escape(operation.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(public_adapter_call_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'PublicAdapterCallResult'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.call_public_composition_adapter_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#call_public_composition_adapter_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Append a visitor entry through the gateway
+    # Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). When the request comes from the shared artifact origin, it must also carry the per-composition write token (`X-Widgetic-Write-Token` header or `writeToken` body field, handed to the widget in `widgetic:host` as `entries.writeToken` and returned as `entryWriteToken` on `getPublicCompositionEmbed`). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
+    # @param composition_id [String] 
+    # @param table [String] 
+    # @param public_composition_entry_request [PublicCompositionEntryRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_widgetic_write_token Signed per-composition write token handed to the widget in &#x60;widgetic:host&#x60; as &#x60;entries.writeToken&#x60; (and returned by &#x60;GET /embed/compositions/{compositionId}&#x60; as &#x60;entryWriteToken&#x60;). Required when the request comes from the shared Widgetic artifact origin; verified whenever present.
+    # @return [PublicCompositionEntryCreated]
+    def create_public_composition_entry_0(composition_id, table, public_composition_entry_request, opts = {})
+      data, _status_code, _headers = create_public_composition_entry_0_with_http_info(composition_id, table, public_composition_entry_request, opts)
+      data
+    end
+
+    # Append a visitor entry through the gateway
+    # Public append-only write into a published composition database. No API key. The browser must send a permitted &#x60;Origin&#x60; header (the artifact iframe origin or a website the owner allowed). When the request comes from the shared artifact origin, it must also carry the per-composition write token (&#x60;X-Widgetic-Write-Token&#x60; header or &#x60;writeToken&#x60; body field, handed to the widget in &#x60;widgetic:host&#x60; as &#x60;entries.writeToken&#x60; and returned as &#x60;entryWriteToken&#x60; on &#x60;getPublicCompositionEmbed&#x60;). Host &#x60;context&#x60; is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** &#x60;https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}&#x60;: the root of the API host, NOT under &#x60;/v1&#x60;. A client generated from this description for &#x60;https://api.widgetic.com/v1&#x60; must be given the base address &#x60;https://api.widgetic.com&#x60; for the calls of the &#x60;Public Embed&#x60; tag. **Signed context.** A partner that wants to trust &#x60;context&#x60; (to bill a customer by it, say) makes a signing secret (&#x60;rotatePartnerEntryContextSecret&#x60;), and its server signs the context it hands to the embed. The signature travels inside &#x60;context&#x60; as two reserved keys, &#x60;widgetic_exp&#x60; (UTC seconds, at most seven days ahead) and &#x60;widgetic_sig&#x60;. The gateway checks them after the &#x60;Origin&#x60; and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 &#x60;CONTEXT_SIGNATURE_REQUIRED&#x60;, &#x60;CONTEXT_SIGNATURE_INVALID&#x60; or &#x60;CONTEXT_SIGNATURE_EXPIRED&#x60;; when the check cannot be made just now the answer is a retryable 503 &#x60;CONTEXT_SIGNATURE_UNAVAILABLE&#x60;, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its &#x60;widgetic_exp&#x60; and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a &#x60;submissionId&#x60;, say) in the context. The recipe and a test vector are in the description of &#x60;rotatePartnerEntryContextSecret&#x60;.
+    # @param composition_id [String] 
+    # @param table [String] 
+    # @param public_composition_entry_request [PublicCompositionEntryRequest] 
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_widgetic_write_token Signed per-composition write token handed to the widget in &#x60;widgetic:host&#x60; as &#x60;entries.writeToken&#x60; (and returned by &#x60;GET /embed/compositions/{compositionId}&#x60; as &#x60;entryWriteToken&#x60;). Required when the request comes from the shared Widgetic artifact origin; verified whenever present.
+    # @return [Array<(PublicCompositionEntryCreated, Integer, Hash)>] PublicCompositionEntryCreated data, response status code and response headers
+    def create_public_composition_entry_0_with_http_info(composition_id, table, public_composition_entry_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.create_public_composition_entry_0 ...'
+      end
+      # verify the required parameter 'composition_id' is set
+      if @api_client.config.client_side_validation && composition_id.nil?
+        fail ArgumentError, "Missing the required parameter 'composition_id' when calling PublicEmbedApi.create_public_composition_entry_0"
+      end
+      # verify the required parameter 'table' is set
+      if @api_client.config.client_side_validation && table.nil?
+        fail ArgumentError, "Missing the required parameter 'table' when calling PublicEmbedApi.create_public_composition_entry_0"
+      end
+      # verify the required parameter 'public_composition_entry_request' is set
+      if @api_client.config.client_side_validation && public_composition_entry_request.nil?
+        fail ArgumentError, "Missing the required parameter 'public_composition_entry_request' when calling PublicEmbedApi.create_public_composition_entry_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/{compositionId}/entries/{table}'.sub('{' + 'compositionId' + '}', CGI.escape(composition_id.to_s)).sub('{' + 'table' + '}', CGI.escape(table.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+      header_params[:'X-Widgetic-Write-Token'] = opts[:'x_widgetic_write_token'] if !opts[:'x_widgetic_write_token'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(public_composition_entry_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'PublicCompositionEntryCreated'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.create_public_composition_entry_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#create_public_composition_entry_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Resolve a composition UUID to a published widget URL
+    # Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition's owner listed the websites it may appear on (the workspace's domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor's own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner's list never has to name it. The list stops other websites from showing the embed in a visitor's browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header. 
+    # @param composition_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [GetPublicCompositionEmbed200Response]
+    def get_public_composition_embed_0(composition_id, opts = {})
+      data, _status_code, _headers = get_public_composition_embed_0_with_http_info(composition_id, opts)
+      data
+    end
+
+    # Resolve a composition UUID to a published widget URL
+    # Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition&#39;s owner listed the websites it may appear on (the workspace&#39;s domain list, or the &#x60;allowedDomains&#x60; of a partner the owner administers), a request from any other website is refused with 403 &#x60;DOMAIN_NOT_ALLOWED&#x60;. The website is read from the &#x60;Origin&#x60; header, or the host of &#x60;Referer&#x60; when there is no &#x60;Origin&#x60;; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor&#39;s own machine (&#x60;localhost&#x60;, &#x60;127.0.0.1&#x60; or &#x60;[::1]&#x60;, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (&#x60;platformDomain&#x60; in the answer of &#x60;GET /partners/mine&#x60;), for the widgets of that partner: a partner&#39;s list never has to name it. The list stops other websites from showing the embed in a visitor&#39;s browser; it does not hide the published content from someone who holds the composition ID. **Address.** &#x60;https://api.widgetic.com/embed/compositions/{compositionId}&#x60;: the root of the API host, NOT under &#x60;/v1&#x60;. A client generated from this description for &#x60;https://api.widgetic.com/v1&#x60; must be given the base address &#x60;https://api.widgetic.com&#x60; for the calls of the &#x60;Public Embed&#x60; tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 &#x60;RATE_LIMITED&#x60; with a &#x60;Retry-After&#x60; header. 
+    # @param composition_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(GetPublicCompositionEmbed200Response, Integer, Hash)>] GetPublicCompositionEmbed200Response data, response status code and response headers
+    def get_public_composition_embed_0_with_http_info(composition_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.get_public_composition_embed_0 ...'
+      end
+      # verify the required parameter 'composition_id' is set
+      if @api_client.config.client_side_validation && composition_id.nil?
+        fail ArgumentError, "Missing the required parameter 'composition_id' when calling PublicEmbedApi.get_public_composition_embed_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/{compositionId}'.sub('{' + 'compositionId' + '}', CGI.escape(composition_id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'GetPublicCompositionEmbed200Response'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.get_public_composition_embed_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#get_public_composition_embed_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Embed a published composition with its saved values
+    # Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition's owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic's own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. 
+    # @param composition_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [String]
+    def get_public_composition_iframe_0(composition_id, opts = {})
+      data, _status_code, _headers = get_public_composition_iframe_0_with_http_info(composition_id, opts)
+      data
+    end
+
+    # Embed a published composition with its saved values
+    # Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition&#39;s owner listed the websites it may appear on, the page is sent with &#x60;Content-Security-Policy: frame-ancestors&#x60; naming those websites (and Widgetic&#39;s own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever &#x60;Referer&#x60; policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** &#x60;https://api.widgetic.com/embed/compositions/{compositionId}/frame&#x60;: the root of the API host, NOT under &#x60;/v1&#x60;. A client generated from this description for &#x60;https://api.widgetic.com/v1&#x60; must be given the base address &#x60;https://api.widgetic.com&#x60; for the calls of the &#x60;Public Embed&#x60; tag. 
+    # @param composition_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(String, Integer, Hash)>] String data, response status code and response headers
+    def get_public_composition_iframe_0_with_http_info(composition_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.get_public_composition_iframe_0 ...'
+      end
+      # verify the required parameter 'composition_id' is set
+      if @api_client.config.client_side_validation && composition_id.nil?
+        fail ArgumentError, "Missing the required parameter 'composition_id' when calling PublicEmbedApi.get_public_composition_iframe_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/{compositionId}/frame'.sub('{' + 'compositionId' + '}', CGI.escape(composition_id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['text/html', 'application/json']) unless header_params['Accept']
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'String'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.get_public_composition_iframe_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#get_public_composition_iframe_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Batch-check whether compositions are currently served for embed
+    # Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller's website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+    # @param post_public_composition_embed_status_request [PostPublicCompositionEmbedStatusRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [PostPublicCompositionEmbedStatus200Response]
+    def post_public_composition_embed_status_0(post_public_composition_embed_status_request, opts = {})
+      data, _status_code, _headers = post_public_composition_embed_status_0_with_http_info(post_public_composition_embed_status_request, opts)
+      data
+    end
+
+    # Batch-check whether compositions are currently served for embed
+    # Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as &#x60;GET /embed/compositions/{compositionId}&#x60;: the caller&#39;s website is read from &#x60;Origin&#x60;, or the host of &#x60;Referer&#x60; when there is no &#x60;Origin&#x60;. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** &#x60;https://api.widgetic.com/embed/compositions/status&#x60;: the root of the API host, NOT under &#x60;/v1&#x60;. A client generated from this description for &#x60;https://api.widgetic.com/v1&#x60; must be given the base address &#x60;https://api.widgetic.com&#x60; for the calls of the &#x60;Public Embed&#x60; tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of &#x60;ids&#x60; it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 &#x60;RATE_LIMITED&#x60; for the WHOLE call, with a &#x60;Retry-After&#x60; header and no state for any id: there is no per-composition rate-limit state in the answer.
+    # @param post_public_composition_embed_status_request [PostPublicCompositionEmbedStatusRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(PostPublicCompositionEmbedStatus200Response, Integer, Hash)>] PostPublicCompositionEmbedStatus200Response data, response status code and response headers
+    def post_public_composition_embed_status_0_with_http_info(post_public_composition_embed_status_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.post_public_composition_embed_status_0 ...'
+      end
+      # verify the required parameter 'post_public_composition_embed_status_request' is set
+      if @api_client.config.client_side_validation && post_public_composition_embed_status_request.nil?
+        fail ArgumentError, "Missing the required parameter 'post_public_composition_embed_status_request' when calling PublicEmbedApi.post_public_composition_embed_status_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/status'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(post_public_composition_embed_status_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'PostPublicCompositionEmbedStatus200Response'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.post_public_composition_embed_status_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#post_public_composition_embed_status_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Send the file a visitor chose through the upload adapter of a published widget
+    # The second of the two calls the `upload` adapter's module makes from the visitor's browser (the first, the `begin-upload` operation of `callPublicCompositionAdapter`, answers with the ticket this route takes). The module sends the file itself, as the body, with its media type as the `Content-Type`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/upload/files/{ticket}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **The ticket.** Single-use and valid for ten minutes, given for one file: its name, its media type and its exact size are what the visitor said when the ticket was asked for, after the widget's owner's settings (the kinds of file they take, the largest size) were applied. The `Content-Type` and the `Content-Length` of this request must be those, and the body must be exactly that many bytes (400 `UPLOAD_FILE_CHANGED` otherwise). The gateway never believes the type it was told: the first bytes of the file must be a file of that type and one the owner accepts (422 otherwise). A ticket whose file was stored and is sent again is answered with the same file, so a visitor whose connection dropped after the file landed does not store it twice; a ticket whose attempt failed is spent, and the module asks for a new one. **What it stores.** The file goes to the widget owner's storage: Widgetic's, or the partner's own bucket for a widget of a customer a partner manages. It counts against the owner's storage allowance and is filed in the folder the owner chose, as a file sent by a visitor, which the owner's own file list leaves out. A full allowance, a partner's storage that cannot be used and a stopped feature are all the same 503 `UPLOAD_UNAVAILABLE` to a visitor, and the owner is told through a notice. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. **Limits.** 30 requests a minute for each visitor address and composition and 240 a minute for a composition (429 `RATE_LIMITED`, with a `Retry-After` header); at most 10 MB for a file, and only so many files held in memory at once on each gateway process (503 `UPLOAD_BUSY`, with a `Retry-After`). A file that does not arrive within two minutes is 408 `UPLOAD_TIMEOUT`. Every answer but a success closes the connection, so a client that is refused before it has sent the file reads the answer and stops.
+    # @param composition_id [String] 
+    # @param ticket [String] The ticket the &#x60;begin-upload&#x60; operation answered with.
+    # @param body [File] 
+    # @param [Hash] opts the optional parameters
+    # @return [PublicAdapterFileResult]
+    def upload_public_composition_adapter_file_0(composition_id, ticket, body, opts = {})
+      data, _status_code, _headers = upload_public_composition_adapter_file_0_with_http_info(composition_id, ticket, body, opts)
+      data
+    end
+
+    # Send the file a visitor chose through the upload adapter of a published widget
+    # The second of the two calls the &#x60;upload&#x60; adapter&#39;s module makes from the visitor&#39;s browser (the first, the &#x60;begin-upload&#x60; operation of &#x60;callPublicCompositionAdapter&#x60;, answers with the ticket this route takes). The module sends the file itself, as the body, with its media type as the &#x60;Content-Type&#x60;. It is not meant to be called by hand, and it takes no API key. **Address.** &#x60;https://api.widgetic.com/embed/compositions/{compositionId}/adapters/upload/files/{ticket}&#x60;: the root of the API host, NOT under &#x60;/v1&#x60;. A client generated from this description for &#x60;https://api.widgetic.com/v1&#x60; must be given the base address &#x60;https://api.widgetic.com&#x60; for the calls of the &#x60;Public Embed&#x60; tag. **The ticket.** Single-use and valid for ten minutes, given for one file: its name, its media type and its exact size are what the visitor said when the ticket was asked for, after the widget&#39;s owner&#39;s settings (the kinds of file they take, the largest size) were applied. The &#x60;Content-Type&#x60; and the &#x60;Content-Length&#x60; of this request must be those, and the body must be exactly that many bytes (400 &#x60;UPLOAD_FILE_CHANGED&#x60; otherwise). The gateway never believes the type it was told: the first bytes of the file must be a file of that type and one the owner accepts (422 otherwise). A ticket whose file was stored and is sent again is answered with the same file, so a visitor whose connection dropped after the file landed does not store it twice; a ticket whose attempt failed is spent, and the module asks for a new one. **What it stores.** The file goes to the widget owner&#39;s storage: Widgetic&#39;s, or the partner&#39;s own bucket for a widget of a customer a partner manages. It counts against the owner&#39;s storage allowance and is filed in the folder the owner chose, as a file sent by a visitor, which the owner&#39;s own file list leaves out. A full allowance, a partner&#39;s storage that cannot be used and a stopped feature are all the same 503 &#x60;UPLOAD_UNAVAILABLE&#x60; to a visitor, and the owner is told through a notice. **Who may call.** The same rule as the entry route: a permitted &#x60;Origin&#x60; header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner&#39;s own platform). A request without a permitted &#x60;Origin&#x60; is 403 &#x60;ORIGIN_NOT_ALLOWED&#x60;. A composition that is not served (unpublished, or its owner&#39;s plan does not serve it) is 404, with the codes of the other public embed routes. **Limits.** 30 requests a minute for each visitor address and composition and 240 a minute for a composition (429 &#x60;RATE_LIMITED&#x60;, with a &#x60;Retry-After&#x60; header); at most 10 MB for a file, and only so many files held in memory at once on each gateway process (503 &#x60;UPLOAD_BUSY&#x60;, with a &#x60;Retry-After&#x60;). A file that does not arrive within two minutes is 408 &#x60;UPLOAD_TIMEOUT&#x60;. Every answer but a success closes the connection, so a client that is refused before it has sent the file reads the answer and stops.
+    # @param composition_id [String] 
+    # @param ticket [String] The ticket the &#x60;begin-upload&#x60; operation answered with.
+    # @param body [File] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(PublicAdapterFileResult, Integer, Hash)>] PublicAdapterFileResult data, response status code and response headers
+    def upload_public_composition_adapter_file_0_with_http_info(composition_id, ticket, body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: PublicEmbedApi.upload_public_composition_adapter_file_0 ...'
+      end
+      # verify the required parameter 'composition_id' is set
+      if @api_client.config.client_side_validation && composition_id.nil?
+        fail ArgumentError, "Missing the required parameter 'composition_id' when calling PublicEmbedApi.upload_public_composition_adapter_file_0"
+      end
+      # verify the required parameter 'ticket' is set
+      if @api_client.config.client_side_validation && ticket.nil?
+        fail ArgumentError, "Missing the required parameter 'ticket' when calling PublicEmbedApi.upload_public_composition_adapter_file_0"
+      end
+      if @api_client.config.client_side_validation && ticket.to_s.length > 128
+        fail ArgumentError, 'invalid value for "ticket" when calling PublicEmbedApi.upload_public_composition_adapter_file_0, the character length must be smaller than or equal to 128.'
+      end
+
+      if @api_client.config.client_side_validation && ticket.to_s.length < 20
+        fail ArgumentError, 'invalid value for "ticket" when calling PublicEmbedApi.upload_public_composition_adapter_file_0, the character length must be great than or equal to 20.'
+      end
+
+      pattern = Regexp.new(/^[A-Za-z0-9_-]{20,128}$/)
+      if @api_client.config.client_side_validation && ticket !~ pattern
+        fail ArgumentError, "invalid value for 'ticket' when calling PublicEmbedApi.upload_public_composition_adapter_file_0, must conform to the pattern #{pattern}."
+      end
+
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling PublicEmbedApi.upload_public_composition_adapter_file_0"
+      end
+      # resource path
+      local_var_path = '/embed/compositions/{compositionId}/adapters/upload/files/{ticket}'.sub('{' + 'compositionId' + '}', CGI.escape(composition_id.to_s)).sub('{' + 'ticket' + '}', CGI.escape(ticket.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/pdf', 'audio/aac', 'audio/flac', 'audio/mp4', 'audio/mpeg', 'audio/ogg', 'audio/wav', 'audio/webm', 'image/gif', 'image/heic', 'image/heif', 'image/jpeg', 'image/png', 'image/webp', 'video/mp4', 'video/quicktime', 'video/webm'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'PublicAdapterFileResult'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"PublicEmbedApi.upload_public_composition_adapter_file_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:PUT, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: PublicEmbedApi#upload_public_composition_adapter_file_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/api-sdk-rb/api/tokens_api.rb

@@ -0,0 +1,77 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'cgi'
+
+module ApiSdkRb
+  class TokensApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Validate current authentication token
+    # @param [Hash] opts the optional parameters
+    # @return [ValidateToken200Response]
+    def validate_token_0(opts = {})
+      data, _status_code, _headers = validate_token_0_with_http_info(opts)
+      data
+    end
+
+    # Validate current authentication token
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(ValidateToken200Response, Integer, Hash)>] ValidateToken200Response data, response status code and response headers
+    def validate_token_0_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TokensApi.validate_token_0 ...'
+      end
+      # resource path
+      local_var_path = '/tokens/validate'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'ValidateToken200Response'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['ApiKeyAuth', 'BearerAuth']
+
+      new_options = opts.merge(
+        :operation => :"TokensApi.validate_token_0",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TokensApi#validate_token_0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end