@marcohefti/request-network-api-contracts 0.6.2 → 0.7.0

package/scripts/sync-openapi.mjs

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const openApiDirectory = resolve(root, "specs/openapi");
+const contractVersion = "0.7.0";
+
+const sources = [
+  {
+    id: "request-api",
+    url: "https://api.request.network/open-api/openapi.json",
+    runtimeBaseUrl: "https://api.request.network",
+    filename: "request-network-openapi.json",
+    metaFilename: "request-network-openapi.meta.json",
+    patch: patchRequestApi,
+  },
+  {
+    id: "auth-api",
+    url: "https://auth.request.network/open-api/openapi.json",
+    runtimeBaseUrl: "https://auth.request.network",
+    filename: "request-network-auth-openapi.json",
+    metaFilename: "request-network-auth-openapi.meta.json",
+    patch: patchAuthApi,
+  },
+];
+
+const createSecurePaymentResponse = {
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    requestIds: { type: "array", items: { type: "string" } },
+    securePaymentUrl: { type: "string", format: "uri" },
+    token: { type: "string" },
+    feePlan: { type: "object", nullable: true, additionalProperties: true },
+  },
+  required: ["requestIds", "securePaymentUrl", "token"],
+  description: "Compatibility schema from the public Secure Payments guide and verified production response keys.",
+};
+
+const findSecurePaymentResponse = {
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    token: { type: "string" },
+    securePaymentUrl: { type: "string", format: "uri" },
+    status: { type: "string", enum: ["pending", "completed", "expired", "invalidated"] },
+    paymentType: { type: "string", enum: ["single", "batch"] },
+    createdAt: { type: "string", format: "date-time", nullable: true },
+    expiresAt: { type: "string", format: "date-time" },
+    feePlan: { type: "object", nullable: true, additionalProperties: true },
+  },
+  required: ["token", "securePaymentUrl", "status", "paymentType", "expiresAt"],
+  description: "Compatibility schema from the public Secure Payments guide.",
+};
+
+const getSecurePaymentResponse = {
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    paymentType: { type: "string", enum: ["single", "batch"] },
+    payee: { type: "string" },
+    payees: { type: "array", items: { type: "string" } },
+    network: { type: "string" },
+    amount: { type: "string" },
+    amounts: { type: "array", items: { type: "string" } },
+    paymentCurrency: { type: "string" },
+    paymentCurrencies: { type: "array", items: { type: "string" } },
+    isNativeCurrency: { oneOf: [{ type: "boolean" }, { type: "array", items: { type: "boolean" } }] },
+    status: { type: "string", enum: ["pending", "completed", "expired", "invalidated"] },
+    destination: { type: "object", additionalProperties: true },
+    destinations: { type: "array", items: { type: "object", additionalProperties: true } },
+    reference: { type: "string", nullable: true },
+    paymentOptions: { type: "object", additionalProperties: true },
+    feePlan: { type: "object", nullable: true, additionalProperties: true },
+  },
+  required: ["paymentType", "network", "status"],
+  description: "Compatibility schema from the public Secure Payments guide.",
+};
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function operationCount(spec) {
+  const methods = new Set(["get", "post", "put", "patch", "delete", "options", "head", "trace"]);
+  return Object.values(spec.paths ?? {}).reduce(
+    (total, pathItem) => total + Object.keys(pathItem).filter((key) => methods.has(key)).length,
+    0,
+  );
+}
+
+function normalizeNullableUnions(node, stats) {
+  if (Array.isArray(node)) {
+    for (const value of node) normalizeNullableUnions(value, stats);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+
+  if (Array.isArray(node.type) && node.type.length === 2 && node.type.includes("null")) {
+    node.type = node.type.find((value) => value !== "null");
+    node.nullable = true;
+    stats.nullableUnions += 1;
+  }
+
+  for (const value of Object.values(node)) normalizeNullableUnions(value, stats);
+}
+
+function patchFeeDrift(node, stats) {
+  if (Array.isArray(node)) {
+    for (const value of node) patchFeeDrift(value, stats);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+
+  const properties = node.properties;
+  const typeSchema = properties?.type;
+  if (
+    typeSchema &&
+    Array.isArray(typeSchema.enum) &&
+    ["gas", "platform", "crosschain", "crypto-to-fiat", "offramp"].every((value) => typeSchema.enum.includes(value))
+  ) {
+    if (!typeSchema.enum.includes("protocol")) {
+      typeSchema.enum.push("protocol");
+      stats.feeEnums += 1;
+    }
+    for (const key of ["amount", "amountInUSD", "amountInUsd"]) {
+      if (properties[key]?.type === "string" && properties[key].nullable !== true) {
+        properties[key].nullable = true;
+        stats.feeAmounts += 1;
+      }
+    }
+  }
+
+  for (const value of Object.values(node)) patchFeeDrift(value, stats);
+}
+
+function setResponseSchema(spec, method, endpoint, status, schema) {
+  spec.paths[endpoint][method].responses[status].content["application/json"].schema = structuredClone(schema);
+}
+
+function withFeePlan(schema, feePlan) {
+  const result = structuredClone(schema);
+  result.properties.feePlan = structuredClone(feePlan);
+  return result;
+}
+
+function patchRequestApi(spec) {
+  const stats = { nullableUnions: 0, feeEnums: 0, feeAmounts: 0, securePaymentResponses: 0 };
+  normalizeNullableUnions(spec, stats);
+  patchFeeDrift(spec, stats);
+
+  for (const endpoint of ["/v2/secure-payments", "/v2/secure-payments/payouts", "/v2/secure-payments/batch-payouts"]) {
+    const feePlan = spec.paths[endpoint].post.responses["201"].content["application/json"].schema;
+    setResponseSchema(spec, "post", endpoint, "201", withFeePlan(createSecurePaymentResponse, feePlan));
+    stats.securePaymentResponses += 1;
+  }
+  const findFeePlan = spec.paths["/v2/secure-payments"].get.responses["200"].content["application/json"].schema;
+  setResponseSchema(spec, "get", "/v2/secure-payments", "200", withFeePlan(findSecurePaymentResponse, findFeePlan));
+  const tokenFeePlan = spec.paths["/v2/secure-payments/{token}"].get.responses["200"].content["application/json"].schema;
+  setResponseSchema(spec, "get", "/v2/secure-payments/{token}", "200", withFeePlan(getSecurePaymentResponse, tokenFeePlan));
+  stats.securePaymentResponses += 2;
+
+  spec["x-contract-patches"] = [
+    "oas30-nullable-unions",
+    "runtime-fee-drift",
+    "secure-payment-response-shapes",
+  ];
+  return stats;
+}
+
+function patchAuthApi(spec) {
+  const stats = { nullableUnions: 0, webhookSecurityOperations: 0 };
+  normalizeNullableUnions(spec, stats);
+
+  spec.components ??= {};
+  spec.components.securitySchemes ??= {};
+  spec.components.securitySchemes.session_token = {
+    type: "apiKey",
+    in: "cookie",
+    name: "session_token",
+  };
+  spec.components.securitySchemes.client_id = {
+    type: "apiKey",
+    in: "header",
+    name: "x-client-id",
+    description: "Platform Client ID authentication verified against production webhook operations.",
+  };
+
+  for (const [endpoint, methods] of [
+    ["/v1/webhook", ["get", "post"]],
+    ["/v1/webhook/test", ["post"]],
+    ["/v1/webhook/{webhookId}", ["put", "delete"]],
+  ]) {
+    for (const method of methods) {
+      spec.paths[endpoint][method].security = [{ client_id: [] }, { session_token: [] }];
+      stats.webhookSecurityOperations += 1;
+    }
+  }
+
+  spec["x-contract-patches"] = ["oas30-nullable-unions", "platform-webhook-client-id-auth"];
+  return stats;
+}
+
+async function main() {
+  await mkdir(openApiDirectory, { recursive: true });
+  const fetchedAt = new Date().toISOString();
+  const manifestSources = [];
+
+  for (const source of sources) {
+    const response = await fetch(source.url, { headers: { accept: "application/json" } });
+    if (!response.ok) throw new Error(`${source.id} fetch failed: ${response.status} ${response.statusText}`);
+
+    const rawBody = await response.text();
+    const spec = JSON.parse(rawBody);
+    const patchStats = source.patch(spec);
+    const normalizedBody = `${JSON.stringify(spec)}\n`;
+
+    await writeFile(resolve(openApiDirectory, source.filename), normalizedBody);
+    await writeFile(
+      resolve(openApiDirectory, source.metaFilename),
+      `${JSON.stringify({
+        url: source.url,
+        runtimeBaseUrl: source.runtimeBaseUrl,
+        fetchedAt,
+        etag: response.headers.get("etag"),
+        lastModified: response.headers.get("last-modified"),
+        rawSha256: sha256(rawBody),
+        normalizedSha256: sha256(normalizedBody),
+        patchStats,
+      }, null, 2)}\n`,
+    );
+
+    manifestSources.push({
+      id: source.id,
+      filename: source.filename,
+      sourceUrl: source.url,
+      runtimeBaseUrl: source.runtimeBaseUrl,
+      openapi: spec.openapi,
+      apiVersion: spec.info?.version,
+      operationCount: operationCount(spec),
+      rawSha256: sha256(rawBody),
+      normalizedSha256: sha256(normalizedBody),
+      patches: spec["x-contract-patches"],
+    });
+  }
+
+  const manifest = {
+    contractsVersion: contractVersion,
+    fetchedAt,
+    defaultEnvironment: "production",
+    supportedRuntimeHosts: ["https://api.request.network", "https://auth.request.network"],
+    minimumCompatibleClients: { typescript: "0.7.0", php: "0.7.0" },
+    sources: manifestSources,
+  };
+  await writeFile(resolve(openApiDirectory, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  process.stdout.write(`Synced ${manifestSources.map(({ id, apiVersion, operationCount: count }) => `${id} ${apiVersion} (${count})`).join(", ")}\n`);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/scripts/sync-webhooks.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+
+import { readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const schemaPath = resolve(root, "specs/webhooks/request-network-webhooks.json");
+
+function webhookOperation(summary, schemaName, exampleName) {
+  return {
+    post: {
+      summary,
+      parameters: [{ $ref: "#/components/parameters/XRequestNetworkSignature" }],
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: { $ref: `#/components/schemas/${schemaName}` },
+            examples: { [exampleName]: { $ref: `#/components/examples/${exampleName}` } },
+          },
+        },
+      },
+      responses: {
+        200: { description: "Acknowledged" },
+        401: { description: "Signature verification failed" },
+      },
+      security: [{ RequestSignatureHMAC: [] }],
+    },
+  };
+}
+
+function eventSchema(event, properties, required, description) {
+  return {
+    allOf: [
+      { $ref: "#/components/schemas/WebhookBase" },
+      {
+        type: "object",
+        additionalProperties: true,
+        properties: { event: { const: event }, ...properties },
+        required: ["event", ...required],
+      },
+    ],
+    description,
+  };
+}
+
+async function main() {
+  const schema = JSON.parse(await readFile(schemaPath, "utf8"));
+  schema.info.version = "0.2.0";
+  schema.info.description = "Community-maintained schemas for current Request Network platform/orchestrator webhooks and explicitly classified legacy events. Payload examples follow the official webhook guide fetched 2026-09-03.";
+
+  Object.assign(schema.webhooks, {
+    "client_id.linked": webhookOperation("Client ID linked through hosted onboarding", "ClientIdLinkedEvent", "client_id_linked"),
+    "kyt.screening.completed": webhookOperation("KYT screening reached a definitive result", "KytScreeningCompletedEvent", "kyt_screening_completed"),
+    "secure_payment.user_event": webhookOperation("Secure Payment Page user activity", "SecurePaymentUserEvent", "secure_payment_user_event"),
+    "secure_payment.access_rejected": webhookOperation("Payer-wallet access rejected", "SecurePaymentAccessRejectedEvent", "secure_payment_access_rejected"),
+  });
+
+  Object.assign(schema.components.schemas.WebhookBase.properties, {
+    clientId: { type: "string", description: "Platform Client ID associated with the event." },
+    orchestratorId: { type: "string", description: "Orchestrator associated with the event when applicable." },
+    payerAddress: { type: "string", nullable: true, description: "Resolved payer wallet when available." },
+    payerEoaAddress: { type: "string", nullable: true, description: "Connected payer EOA when available." },
+  });
+
+  Object.assign(schema.components.schemas, {
+    ClientIdLinkedEvent: eventSchema("client_id.linked", {
+      clientId: { type: "string" },
+      orchestratorId: { type: "string" },
+      linkId: { type: "string" },
+      intentId: { type: "string" },
+      externalId: { type: "string" },
+      destinationId: { type: "string" },
+      destinationWalletAddress: { type: "string" },
+      chain: { type: "string" },
+      currency: { type: "string" },
+      timestamp: { type: "string", format: "date-time" },
+    }, ["clientId", "orchestratorId", "linkId", "intentId", "externalId", "destinationId", "destinationWalletAddress", "chain", "currency", "timestamp"], "Orchestrator-only hosted onboarding completion event."),
+    KytScreeningCompletedEvent: eventSchema("kyt.screening.completed", {
+      paymentToken: { type: "string" },
+      clientId: { type: "string" },
+      orchestratorId: { type: "string" },
+      walletAddress: { type: "string" },
+      eoaAddress: { type: "string" },
+      smartAccountAddress: { type: "string", nullable: true },
+      status: { type: "string", enum: ["approved", "rejected"] },
+      provider: { type: "string" },
+      policyId: { type: "string", nullable: true },
+      timestamp: { type: "string", format: "date-time" },
+    }, ["paymentToken", "clientId", "walletAddress", "eoaAddress", "status", "provider", "timestamp"], "Definitive Secure Payment KYT result."),
+    SecurePaymentUserEvent: eventSchema("secure_payment.user_event", {
+      userEvent: { type: "string", enum: ["wallet_connected", "payment_sent_to_wallet", "payment_approved_in_wallet"] },
+      securePaymentToken: { type: "string" },
+      requestId: { type: "string" },
+      requestIds: { type: "array", items: { type: "string" } },
+      clientId: { type: "string" },
+      orchestratorId: { type: "string" },
+      occurredAt: { type: "string", format: "date-time" },
+      timestamp: { type: "string", format: "date-time" },
+      properties: { type: "object", additionalProperties: true },
+    }, ["userEvent", "securePaymentToken", "requestIds", "clientId", "occurredAt", "timestamp", "properties"], "Best-effort browser activity; never settlement proof."),
+    SecurePaymentAccessRejectedEvent: eventSchema("secure_payment.access_rejected", {
+      requestId: { type: "string" },
+      clientId: { type: "string" },
+      orchestratorId: { type: "string" },
+      attemptedPayerWalletAddress: { type: "string" },
+      timestamp: { type: "string", format: "date-time" },
+    }, ["requestId", "clientId", "attemptedPayerWalletAddress", "timestamp"], "Platform-only payer allowlist rejection event."),
+  });
+
+  Object.assign(schema.components.examples, {
+    payment_confirmed: { summary: "Official current settlement example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/payment-confirmed.json"), "utf8")) },
+    payment_failed: { summary: "Official current failure example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/payment-failed.json"), "utf8")) },
+    client_id_linked: { summary: "Official hosted onboarding example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/client-id-linked.json"), "utf8")) },
+    kyt_screening_completed: { summary: "Official definitive KYT example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/kyt-screening-completed.json"), "utf8")) },
+    secure_payment_user_event: { summary: "Official Secure Payment Page activity example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/secure-payment-user-event.json"), "utf8")) },
+    secure_payment_access_rejected: { summary: "Official payer allowlist rejection example", value: JSON.parse(await readFile(resolve(root, "fixtures/webhooks/secure-payment-access-rejected.json"), "utf8")) },
+  });
+
+  await writeFile(schemaPath, `${JSON.stringify(schema, null, 2)}\n`);
+  process.stdout.write("Synchronized current webhook schemas and examples\n");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/scripts/verify.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+const path = require('node:path');
+
+const root = path.join(__dirname, '..');
+const files = [
+  path.join(root, 'specs', 'openapi', 'request-network-openapi.json'),
+  path.join(root, 'specs', 'openapi', 'request-network-openapi.meta.json'),
+  path.join(root, 'specs', 'openapi', 'request-network-auth-openapi.json'),
+  path.join(root, 'specs', 'openapi', 'request-network-auth-openapi.meta.json'),
+  path.join(root, 'specs', 'openapi', 'manifest.json'),
+  path.join(root, 'specs', 'webhooks', 'request-network-webhooks.json'),
+  path.join(root, 'specs', 'webhooks', 'manifest.json'),
+];
+
+for (const file of files) {
+  try {
+    const stats = fs.statSync(file);
+    if (!stats.size) {
+      throw new Error('file is empty');
+    }
+    process.stdout.write(`✔ ${path.relative(root, file)} (${stats.size} bytes)\n`);
+  } catch (error) {
+    console.error(`Failed to verify ${file}:`, error.message);
+    process.exit(1);
+  }
+}
+
+function readJson(relativePath) {
+  return JSON.parse(fs.readFileSync(path.join(root, relativePath), 'utf8'));
+}
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function operationCount(spec) {
+  const methods = new Set(['get', 'post', 'put', 'patch', 'delete', 'options', 'head', 'trace']);
+  return Object.values(spec.paths || {}).reduce(
+    (total, item) => total + Object.keys(item).filter((key) => methods.has(key)).length,
+    0,
+  );
+}
+
+function hasArrayType(node) {
+  if (Array.isArray(node)) return node.some(hasArrayType);
+  if (!node || typeof node !== 'object') return false;
+  if (Array.isArray(node.type)) return true;
+  return Object.values(node).some(hasArrayType);
+}
+
+try {
+  const packageJson = readJson('package.json');
+  const manifest = readJson('specs/openapi/manifest.json');
+  const requestSpec = readJson('specs/openapi/request-network-openapi.json');
+  const authSpec = readJson('specs/openapi/request-network-auth-openapi.json');
+  const requestMeta = readJson('specs/openapi/request-network-openapi.meta.json');
+  const authMeta = readJson('specs/openapi/request-network-auth-openapi.meta.json');
+  const webhookSpec = readJson('specs/webhooks/request-network-webhooks.json');
+  const webhookManifest = readJson('specs/webhooks/manifest.json');
+
+  assert(packageJson.version === manifest.contractsVersion, 'package and manifest versions differ');
+  assert(requestSpec.info.version === '0.31.0', 'unexpected Request API version');
+  assert(authSpec.info.version === '0.14.0', 'unexpected Auth API version');
+  assert(operationCount(requestSpec) === 82, 'Request API operation inventory must contain 82 operations');
+  assert(operationCount(authSpec) === 26, 'Auth API operation inventory must contain 26 operations');
+  assert(!requestSpec.paths['/v1/request/{paymentIntentId}/send'], 'obsolete v1 payment-intent send operation remains');
+  assert(!requestSpec.paths['/v2/request/payment-intents/{paymentIntentId}'], 'obsolete v2 payment-intent send operation remains');
+  assert(!hasArrayType(requestSpec) && !hasArrayType(authSpec), 'OpenAPI 3.0 documents contain unnormalized type arrays');
+  assert(requestSpec['x-contract-patches'].includes('runtime-fee-drift'), 'fee drift patch is not declared');
+  assert(requestSpec['x-contract-patches'].includes('secure-payment-response-shapes'), 'secure-payment response patch is not declared');
+  assert(authSpec['x-contract-patches'].includes('platform-webhook-client-id-auth'), 'Auth webhook security patch is not declared');
+
+  const createResponse = requestSpec.paths['/v2/secure-payments'].post.responses['201'].content['application/json'].schema;
+  for (const key of ['requestIds', 'securePaymentUrl', 'token']) {
+    assert(createResponse.required.includes(key), `secure-payment response does not require ${key}`);
+  }
+
+  for (const [endpoint, methods] of [
+    ['/v1/webhook', ['get', 'post']],
+    ['/v1/webhook/test', ['post']],
+    ['/v1/webhook/{webhookId}', ['put', 'delete']],
+  ]) {
+    for (const method of methods) {
+      const security = authSpec.paths[endpoint][method].security;
+      assert(security.some((item) => item.client_id), `${method.toUpperCase()} ${endpoint} lacks Client ID security`);
+    }
+  }
+
+  for (const source of manifest.sources) {
+    const body = fs.readFileSync(path.join(root, 'specs/openapi', source.filename));
+    const digest = crypto.createHash('sha256').update(body).digest('hex');
+    const meta = source.id === 'request-api' ? requestMeta : authMeta;
+    assert(digest === source.normalizedSha256, `${source.id} normalized hash differs from manifest`);
+    assert(digest === meta.normalizedSha256, `${source.id} normalized hash differs from metadata`);
+    assert(source.runtimeBaseUrl === meta.runtimeBaseUrl, `${source.id} runtime host differs from metadata`);
+  }
+
+  for (const [event, definition] of Object.entries(webhookManifest.currentEvents)) {
+    assert(webhookSpec.webhooks[event], `current webhook schema missing ${event}`);
+    const fixture = readJson(path.join('fixtures/webhooks', definition.fixture));
+    assert(fixture.event === event, `${definition.fixture} contains ${fixture.event}, expected ${event}`);
+  }
+
+  for (const fixtures of Object.values(webhookManifest.legacyEvents)) {
+    for (const fixture of Array.isArray(fixtures) ? fixtures : [fixtures]) {
+      assert(fs.existsSync(path.join(root, 'fixtures/webhooks', fixture)), `legacy fixture missing ${fixture}`);
+    }
+  }
+
+  process.stdout.write('✔ contract inventories, patches, manifests, and webhook fixtures verified\n');
+} catch (error) {
+  console.error('Contract verification failed:', error.message);
+  process.exit(1);
+}

package/specs/README.md

@@ -3,24 +3,28 @@
 This folder holds the contracts consumed by the Request client SDKs.
 
 ```
-openapi/   # auto-generated from the Request REST API
+openapi/   # normalized Request and Auth REST APIs plus provenance
 webhooks/  # manually curated webhook schema
 ```
 
 ## `openapi/`
 - `request-network-openapi.json` – fetched via automation from the upstream
   Request API.
-- `request-network-openapi.meta.json` – metadata captured during fetch (e.g.
-  etag, timestamp, source URL).
+- `request-network-auth-openapi.json` – separately fetched Auth API contract.
+- `*.meta.json` – source URL, runtime host, timestamp, raw/normalized hashes,
+  and patch statistics.
+- `manifest.json` – release versions, operation counts, supported production
+  hosts, patches, and minimum compatible clients.
 
-These files should only change through the regeneration tooling in your SDKs
-(for example, the TypeScript client’s `pnpm run fetch:openapi` or broader
-`pnpm run prepare:spec` commands). Avoid manual edits. Rerun the fetch command
-when upstream changes land and commit the updated JSON + metadata.
+These files change through `npm run sync:openapi` in this repository. Do not
+merge the two APIs: their paths overlap while their hosts and credentials do
+not.
 
 ## `webhooks/`
 - `request-network-webhooks.json` – maintained manually. Update it when webhook
   documentation or behaviour changes, and keep fixtures/tests in sync.
+- `manifest.json` – classifies current versus legacy events and records
+  platform/orchestrator recipients.
 
 This separation ensures automation never overwrites the manual webhook spec while
 making it obvious which files are generated vs. curated.

package/specs/openapi/manifest.json

@@ -0,0 +1,46 @@
+{
+  "contractsVersion": "0.7.0",
+  "fetchedAt": "2026-09-03T09:13:49.531Z",
+  "defaultEnvironment": "production",
+  "supportedRuntimeHosts": [
+    "https://api.request.network",
+    "https://auth.request.network"
+  ],
+  "minimumCompatibleClients": {
+    "typescript": "0.7.0",
+    "php": "0.7.0"
+  },
+  "sources": [
+    {
+      "id": "request-api",
+      "filename": "request-network-openapi.json",
+      "sourceUrl": "https://api.request.network/open-api/openapi.json",
+      "runtimeBaseUrl": "https://api.request.network",
+      "openapi": "3.0.0",
+      "apiVersion": "0.31.0",
+      "operationCount": 82,
+      "rawSha256": "6b93f5b4a16cbc84e1bd1b65e4dbab804dbcdeb1ce623c125691f39e0e09bb3a",
+      "normalizedSha256": "284d42ef291c5ab83cb3328431112f82d847fb24228f9ca41a5b2f9272ca1ecd",
+      "patches": [
+        "oas30-nullable-unions",
+        "runtime-fee-drift",
+        "secure-payment-response-shapes"
+      ]
+    },
+    {
+      "id": "auth-api",
+      "filename": "request-network-auth-openapi.json",
+      "sourceUrl": "https://auth.request.network/open-api/openapi.json",
+      "runtimeBaseUrl": "https://auth.request.network",
+      "openapi": "3.0.0",
+      "apiVersion": "0.14.0",
+      "operationCount": 26,
+      "rawSha256": "9047ed549e768a44762c0d68785ebc495652d53127eaaded73452cebac1098f1",
+      "normalizedSha256": "b37039ced02dd198421280089642db409cdaeb2bbbf09a9753b6ad43043c39a1",
+      "patches": [
+        "oas30-nullable-unions",
+        "platform-webhook-client-id-auth"
+      ]
+    }
+  ]
+}