@medalsocial/sdk 1.8.0 → 1.10.0

package/dist/openapi/medal-social.openapi.json

@@ -1229,25 +1229,38 @@
         }
       }
     },
-    "/api/v1/bookings/{id}": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
-        }
-      ],
+    "/api/v1/bookings/persons": {
       "get": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "getBooking",
-        "summary": "Get a booking",
+        "operationId": "listContactPersons",
+        "summary": "List a contact's persons",
+        "description": "Persons a contact books for — a child, a pet, an employee. No login of their own. Active-only unless `include_inactive` is set.",
+        "parameters": [
+          {
+            "name": "contact_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "include_inactive",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
         "responses": {
           "200": {
-            "description": "Booking.",
+            "description": "Contact persons.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_Booking"
+                  "$ref": "#/components/schemas/ApiResponse_ContactPersonArray"
                 }
               }
             }
@@ -1257,29 +1270,29 @@
           }
         }
       },
-      "patch": {
+      "post": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "updateBooking",
-        "summary": "Annotate a booking",
+        "operationId": "createContactPerson",
+        "summary": "Add a person under a contact",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/UpdateBookingInput"
+                "$ref": "#/components/schemas/CreateContactPersonInput"
               }
             }
           }
         },
         "responses": {
-          "200": {
-            "description": "The updated booking.",
+          "201": {
+            "description": "Created person.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_Booking"
+                  "$ref": "#/components/schemas/ApiResponse_ContactPerson"
                 }
               }
             }
@@ -1290,36 +1303,63 @@
         }
       }
     },
-    "/api/v1/bookings/{id}/cancel": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
+    "/api/v1/bookings/relations": {
+      "get": {
+        "tags": [
+          "Bookings"
+        ],
+        "operationId": "listContactRelations",
+        "summary": "List a contact's relations",
+        "description": "Directional relations a contact holds, split into outgoing and incoming.",
+        "parameters": [
+          {
+            "name": "contact_id",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Outgoing and incoming relations.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_ContactRelations"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
         }
-      ],
+      },
       "post": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "cancelBooking",
-        "summary": "Cancel a booking as the business",
-        "description": "Staff semantics — the workspace's cancel window is bypassed and the cancellation is attributed to staff.",
+        "operationId": "createContactRelation",
+        "summary": "Create a relation from one contact to another",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CancelBookingInput"
+                "$ref": "#/components/schemas/CreateContactRelationInput"
               }
             }
           }
         },
         "responses": {
-          "200": {
-            "description": "Cancel result.",
+          "201": {
+            "description": "Created relation id.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_BookingActionResult"
+                  "$ref": "#/components/schemas/ApiResponse_CreateContactRelationResult"
                 }
               }
             }
@@ -1330,36 +1370,81 @@
         }
       }
     },
-    "/api/v1/bookings/{id}/reschedule": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
+    "/api/v1/bookings/events": {
+      "get": {
+        "tags": [
+          "Bookings"
+        ],
+        "operationId": "listBookingEvents",
+        "summary": "List arrangementer in a date range",
+        "parameters": [
+          {
+            "name": "from",
+            "in": "query",
+            "required": true,
+            "description": "Start of the window, `yyyy-mm-dd`, inclusive.",
+            "schema": {
+              "type": "string",
+              "format": "date"
+            }
+          },
+          {
+            "name": "to",
+            "in": "query",
+            "required": true,
+            "description": "End of the window, `yyyy-mm-dd`, inclusive.",
+            "schema": {
+              "type": "string",
+              "format": "date"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/BookingEventStatus"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Arrangementer in the window.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_BookingEventArray"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
         }
-      ],
+      },
       "post": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "rescheduleBooking",
-        "summary": "Reschedule a booking as the business",
-        "description": "Staff semantics — the reschedule window is bypassed. The old booking is cancelled and a new one inserted, so the response carries a new booking id and a freshly minted manage token.",
+        "operationId": "createBookingEvent",
+        "summary": "Create an arrangement from a template",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RescheduleBookingInput"
+                "$ref": "#/components/schemas/CreateBookingEventInput"
               }
             }
           }
         },
         "responses": {
-          "200": {
-            "description": "Reschedule result.",
+          "201": {
+            "description": "Created arrangement.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_BookingRescheduleResult"
+                  "$ref": "#/components/schemas/ApiResponse_BookingEvent"
                 }
               }
             }
@@ -1370,25 +1455,25 @@
         }
       }
     },
-    "/api/v1/bookings/{id}/no-show": {
+    "/api/v1/bookings/events/{id}": {
       "parameters": [
         {
           "$ref": "#/components/parameters/Id"
         }
       ],
-      "post": {
+      "get": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "markBookingNoShow",
-        "summary": "Mark a booking as a no-show",
+        "operationId": "getBookingEvent",
+        "summary": "Get an arrangement",
         "responses": {
           "200": {
-            "description": "No-show result.",
+            "description": "Arrangement.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_BookingActionResult"
+                  "$ref": "#/components/schemas/ApiResponse_BookingEvent"
                 }
               }
             }
@@ -1399,25 +1484,57 @@
         }
       }
     },
-    "/api/v1/bookings/manage/{token}": {
+    "/api/v1/bookings/{id}": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/ManageToken"
+          "$ref": "#/components/parameters/Id"
         }
       ],
       "get": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "getManagedBooking",
-        "summary": "Get the customer manage summary for a token",
+        "operationId": "getBooking",
+        "summary": "Get a booking",
         "responses": {
           "200": {
-            "description": "Manage summary. An unknown token and a token belonging to another workspace both answer 404, so this is not an existence oracle.",
+            "description": "Booking.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_ManageSummary"
+                  "$ref": "#/components/schemas/ApiResponse_Booking"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Bookings"
+        ],
+        "operationId": "updateBooking",
+        "summary": "Annotate a booking",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateBookingInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The updated booking.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_Booking"
                 }
               }
             }
@@ -1428,19 +1545,19 @@
         }
       }
     },
-    "/api/v1/bookings/manage/{token}/cancel": {
+    "/api/v1/bookings/{id}/cancel": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/ManageToken"
+          "$ref": "#/components/parameters/Id"
         }
       ],
       "post": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "cancelManagedBooking",
-        "summary": "Cancel on the customer's behalf",
-        "description": "Customer semantics — the workspace's cancel window is ENFORCED and the cancellation is attributed to the customer.",
+        "operationId": "cancelBooking",
+        "summary": "Cancel a booking as the business",
+        "description": "Staff semantics — the workspace's cancel window is bypassed and the cancellation is attributed to staff.",
         "requestBody": {
           "required": true,
           "content": {
@@ -1468,19 +1585,19 @@
         }
       }
     },
-    "/api/v1/bookings/manage/{token}/reschedule": {
+    "/api/v1/bookings/{id}/reschedule": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/ManageToken"
+          "$ref": "#/components/parameters/Id"
         }
       ],
       "post": {
         "tags": [
           "Bookings"
         ],
-        "operationId": "rescheduleManagedBooking",
-        "summary": "Reschedule on the customer's behalf",
-        "description": "Customer semantics — the reschedule window is ENFORCED. The response carries a new booking id and a new manage token; the old token stops working.",
+        "operationId": "rescheduleBooking",
+        "summary": "Reschedule a booking as the business",
+        "description": "Staff semantics — the reschedule window is bypassed. The old booking is cancelled and a new one inserted, so the response carries a new booking id and a freshly minted manage token.",
         "requestBody": {
           "required": true,
           "content": {
@@ -1508,31 +1625,25 @@
         }
       }
     },
-    "/api/v1/portal/login/start": {
+    "/api/v1/bookings/{id}/no-show": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
       "post": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "startPortalLogin",
-        "summary": "E-mail a one-time login code",
-        "description": "Always answers 202 `{ status: \"sent\" }`, whether or not the address belongs to a contact — enumeration-safe by design. Rate-limited per address and per caller (`429 RATE_LIMITED`). Not idempotency-keyed. Errors: `400 VALIDATION_ERROR`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PortalLoginStartInput"
-              }
-            }
-          }
-        },
+        "operationId": "markBookingNoShow",
+        "summary": "Mark a booking as a no-show",
         "responses": {
-          "202": {
-            "description": "Code queued (or silently not, for an unknown address).",
+          "200": {
+            "description": "No-show result.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalLoginStartResult"
+                  "$ref": "#/components/schemas/ApiResponse_BookingActionResult"
                 }
               }
             }
@@ -1543,31 +1654,36 @@
         }
       }
     },
-    "/api/v1/portal/login/verify": {
+    "/api/v1/bookings/{id}/payment": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
       "post": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "verifyPortalLogin",
-        "summary": "Exchange the e-mailed code for a session",
-        "description": "A wrong, burned or expired code all answer `401 PORTAL_CODE_INVALID` — the three are not distinguished, so the response is not an oracle for which codes exist. The returned `session_token` is a bearer credential for ONE contact: keep it in an HttpOnly cookie on the site's server and never hand it to the browser. Not idempotency-keyed. Errors: `400 VALIDATION_ERROR`, `401 PORTAL_CODE_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
+        "operationId": "startBookingPayment",
+        "summary": "Start a Vipps payment for a booking",
+        "description": "Reserves (or charges) the booking's amount and returns the wallet redirect URL. The customer must have accepted your terms before this call — `terms_accepted` must be literally `true`, and a body omitting it is a 400. One live payment per booking: a second while one is outstanding answers 409, as does a booking that is not payable or a refusal from Vipps. A `return_url` this workspace's own sites do not vouch for answers 422, not 400 — the URL parses, it is just not yours. 403 when the payments switch or the bookings module is off.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PortalVerifyInput"
+                "$ref": "#/components/schemas/StartBookingPaymentInput"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "The new session.",
+            "description": "The reference and the SHOW-ONCE redirect URL. The URL is never returned again — the payment behind it expires after ten minutes, so a cached one leads into a payment that no longer exists.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalSession"
+                  "$ref": "#/components/schemas/ApiResponse_BookingPaymentStart"
                 }
               }
             }
@@ -1576,51 +1692,21 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      }
-    },
-    "/api/v1/portal/logout": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/PortalSession"
-        }
-      ],
-      "post": {
+      },
+      "get": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "logoutPortal",
-        "summary": "Revoke the session",
-        "description": "Revoking twice reaches the same state — the second call answers `401 PORTAL_SESSION_INVALID`. Not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED` (header missing), `401 PORTAL_SESSION_INVALID` (unknown, expired or revoked), `403 FORBIDDEN`, `429 RATE_LIMITED`.",
-        "responses": {
-          "204": {
-            "description": "Session revoked."
-          },
-          "default": {
-            "$ref": "#/components/responses/ApiError"
-          }
-        }
-      }
-    },
-    "/api/v1/portal/me": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/PortalSession"
-        }
-      ],
-      "get": {
-        "tags": [
-          "Portal"
-        ],
-        "operationId": "getPortalProfile",
-        "summary": "The signed-in contact's profile",
-        "description": "Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `read:portal`), `429 RATE_LIMITED`.",
+        "operationId": "getBookingPayment",
+        "summary": "Read the newest payment attempt on a booking",
+        "description": "Returns the newest attempt only. A booking with no payment yet, an unknown booking id and another workspace's booking all answer 404 alike, so this is not an existence oracle.",
         "responses": {
           "200": {
-            "description": "Profile.",
+            "description": "The payment. `redirect_url` is deliberately absent here.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalProfile"
+                  "$ref": "#/components/schemas/ApiResponse_BookingPayment"
                 }
               }
             }
@@ -1629,31 +1715,38 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      },
-      "patch": {
+      }
+    },
+    "/api/v1/bookings/manage/{token}/payment": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/ManageToken"
+        }
+      ],
+      "post": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "updatePortalProfile",
-        "summary": "Update the signed-in contact's profile",
-        "description": "Only the supplied fields change. `phone: null` clears the number, `family` replaces the whole list, and `marketing_consent` records a `marketing_email` consent decision with source `portal`. Answers the profile as it is after the change. Errors: `400 VALIDATION_ERROR`, `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
+        "operationId": "startManageBookingPayment",
+        "summary": "Start a payment on the customer's behalf",
+        "description": "The manage-token twin of `startBookingPayment` — same body, same responses; only the credential that authorizes it differs.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PortalProfilePatch"
+                "$ref": "#/components/schemas/StartBookingPaymentInput"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Updated profile.",
+            "description": "The reference and the show-once redirect URL.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalProfile"
+                  "$ref": "#/components/schemas/ApiResponse_BookingPaymentStart"
                 }
               }
             }
@@ -1662,28 +1755,21 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      }
-    },
-    "/api/v1/portal/me/bookings": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/PortalSession"
-        }
-      ],
+      },
       "get": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "listPortalBookings",
-        "summary": "The signed-in contact's bookings",
-        "description": "Split into `upcoming` and `past`. An upcoming booking still inside the workspace's policy windows carries `manage_token` and `can_manage: true`; the token opens the site's manage page. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
+        "operationId": "getManageBookingPayment",
+        "summary": "Read the payment on the customer's own booking",
+        "description": "An unknown token, another workspace's token and a booking with no payment yet all answer 404 alike.",
         "responses": {
           "200": {
-            "description": "Bookings.",
+            "description": "The payment. `redirect_url` is deliberately absent here.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalBookings"
+                  "$ref": "#/components/schemas/ApiResponse_BookingPayment"
                 }
               }
             }
@@ -1694,26 +1780,25 @@
         }
       }
     },
-    "/api/v1/portal/me/export": {
+    "/api/v1/bookings/manage/{token}": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/PortalSession"
+          "$ref": "#/components/parameters/ManageToken"
         }
       ],
-      "post": {
+      "get": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "exportPortalData",
-        "summary": "Export everything held about the signed-in contact",
-        "description": "A synchronous GDPR Art. 15 export of the contact's profile, family, consents and bookings, as one JSON document. Read-only, so not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
+        "operationId": "getManagedBooking",
+        "summary": "Get the customer manage summary for a token",
         "responses": {
           "200": {
-            "description": "The export.",
+            "description": "Manage summary. An unknown token and a token belonging to another workspace both answer 404, so this is not an existence oracle.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_PortalExport"
+                  "$ref": "#/components/schemas/ApiResponse_ManageSummary"
                 }
               }
             }
@@ -1724,43 +1809,36 @@
         }
       }
     },
-    "/api/v1/portal/me/delete": {
+    "/api/v1/bookings/manage/{token}/cancel": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/PortalSession"
+          "$ref": "#/components/parameters/ManageToken"
         }
       ],
       "post": {
         "tags": [
-          "Portal"
+          "Bookings"
         ],
-        "operationId": "deletePortalAccount",
-        "summary": "Erase the signed-in contact",
-        "description": "GDPR Art. 17 erasure. The session is revoked as part of the deletion, so a retry answers `401 PORTAL_SESSION_INVALID` rather than deleting anything else. Not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
-        "responses": {
-          "204": {
-            "description": "Contact erased and session revoked."
-          },
-          "default": {
-            "$ref": "#/components/responses/ApiError"
+        "operationId": "cancelManagedBooking",
+        "summary": "Cancel on the customer's behalf",
+        "description": "Customer semantics — the workspace's cancel window is ENFORCED and the cancellation is attributed to the customer.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CancelBookingInput"
+              }
+            }
           }
-        }
-      }
-    },
-    "/api/v1/gdpr/export": {
-      "post": {
-        "tags": [
-          "GDPR"
-        ],
-        "operationId": "requestGdprExport",
-        "summary": "Request a GDPR export",
+        },
         "responses": {
           "200": {
-            "description": "Export request reference.",
+            "description": "Cancel result.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_GdprExportRequest"
+                  "$ref": "#/components/schemas/ApiResponse_BookingActionResult"
                 }
               }
             }
@@ -1771,20 +1849,36 @@
         }
       }
     },
-    "/api/v1/gdpr/exports": {
-      "get": {
+    "/api/v1/bookings/manage/{token}/reschedule": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/ManageToken"
+        }
+      ],
+      "post": {
         "tags": [
-          "GDPR"
+          "Bookings"
         ],
-        "operationId": "listGdprExports",
-        "summary": "List GDPR exports",
+        "operationId": "rescheduleManagedBooking",
+        "summary": "Reschedule on the customer's behalf",
+        "description": "Customer semantics — the reschedule window is ENFORCED. The response carries a new booking id and a new manage token; the old token stops working.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RescheduleBookingInput"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "Export requests.",
+            "description": "Reschedule result.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_GdprExportArray"
+                  "$ref": "#/components/schemas/ApiResponse_BookingRescheduleResult"
                 }
               }
             }
@@ -1795,25 +1889,31 @@
         }
       }
     },
-    "/api/v1/gdpr/exports/{id}": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
-        }
-      ],
-      "get": {
+    "/api/v1/portal/login/start": {
+      "post": {
         "tags": [
-          "GDPR"
+          "Portal"
         ],
-        "operationId": "getGdprExport",
-        "summary": "Get a GDPR export",
+        "operationId": "startPortalLogin",
+        "summary": "E-mail a one-time login code",
+        "description": "Always answers 202 `{ status: \"sent\" }`, whether or not the address belongs to a contact — enumeration-safe by design. Rate-limited per address and per caller (`429 RATE_LIMITED`). Not idempotency-keyed. Errors: `400 VALIDATION_ERROR`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PortalLoginStartInput"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
-            "description": "Export request.",
+          "202": {
+            "description": "Code queued (or silently not, for an unknown address).",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_GdprExport"
+                  "$ref": "#/components/schemas/ApiResponse_PortalLoginStartResult"
                 }
               }
             }
@@ -1824,30 +1924,31 @@
         }
       }
     },
-    "/api/v1/gdpr/consent": {
+    "/api/v1/portal/login/verify": {
       "post": {
         "tags": [
-          "GDPR"
+          "Portal"
         ],
-        "operationId": "recordGdprConsent",
-        "summary": "Record GDPR consent",
+        "operationId": "verifyPortalLogin",
+        "summary": "Exchange the e-mailed code for a session",
+        "description": "A wrong, burned or expired code all answer `401 PORTAL_CODE_INVALID` — the three are not distinguished, so the response is not an oracle for which codes exist. The returned `session_token` is a bearer credential for ONE contact: keep it in an HttpOnly cookie on the site's server and never hand it to the browser. Not idempotency-keyed. Errors: `400 VALIDATION_ERROR`, `401 PORTAL_CODE_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RecordConsentInput"
+                "$ref": "#/components/schemas/PortalVerifyInput"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Consent reference.",
+            "description": "The new session.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_ConsentResult"
+                  "$ref": "#/components/schemas/ApiResponse_PortalSession"
                 }
               }
             }
@@ -1858,31 +1959,49 @@
         }
       }
     },
-    "/api/v1/gdpr/consent/{email}": {
+    "/api/v1/portal/logout": {
       "parameters": [
         {
-          "name": "email",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string",
-            "format": "email"
+          "$ref": "#/components/parameters/PortalSession"
+        }
+      ],
+      "post": {
+        "tags": [
+          "Portal"
+        ],
+        "operationId": "logoutPortal",
+        "summary": "Revoke the session",
+        "description": "Revoking twice reaches the same state — the second call answers `401 PORTAL_SESSION_INVALID`. Not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED` (header missing), `401 PORTAL_SESSION_INVALID` (unknown, expired or revoked), `403 FORBIDDEN`, `429 RATE_LIMITED`.",
+        "responses": {
+          "204": {
+            "description": "Session revoked."
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
           }
         }
+      }
+    },
+    "/api/v1/portal/me": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/PortalSession"
+        }
       ],
       "get": {
         "tags": [
-          "GDPR"
+          "Portal"
         ],
-        "operationId": "getGdprConsent",
-        "summary": "Get GDPR consent records",
+        "operationId": "getPortalProfile",
+        "summary": "The signed-in contact's profile",
+        "description": "Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `read:portal`), `429 RATE_LIMITED`.",
         "responses": {
           "200": {
-            "description": "Consent records.",
+            "description": "Profile.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_ConsentRecordArray"
+                  "$ref": "#/components/schemas/ApiResponse_PortalProfile"
                 }
               }
             }
@@ -1891,32 +2010,31 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      }
-    },
-    "/api/cookie-consent": {
-      "post": {
+      },
+      "patch": {
         "tags": [
-          "GDPR"
+          "Portal"
         ],
-        "operationId": "recordCookieConsent",
-        "summary": "Record cookie consent",
+        "operationId": "updatePortalProfile",
+        "summary": "Update the signed-in contact's profile",
+        "description": "Only the supplied fields change. `phone: null` clears the number, `family` replaces the whole list, and `marketing_consent` records a `marketing_email` consent decision with source `portal`. Answers the profile as it is after the change. Errors: `400 VALIDATION_ERROR`, `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CookieConsentInput"
+                "$ref": "#/components/schemas/PortalProfilePatch"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Cookie consent result.",
+            "description": "Updated profile.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CookieConsentResult"
+                  "$ref": "#/components/schemas/ApiResponse_PortalProfile"
                 }
               }
             }
@@ -1927,20 +2045,26 @@
         }
       }
     },
-    "/api/v1/me/workspaces": {
+    "/api/v1/portal/me/bookings": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/PortalSession"
+        }
+      ],
       "get": {
         "tags": [
-          "Workspaces"
+          "Portal"
         ],
-        "operationId": "listWorkspaces",
-        "summary": "List accessible workspaces",
+        "operationId": "listPortalBookings",
+        "summary": "The signed-in contact's bookings",
+        "description": "Split into `upcoming` and `past`. An upcoming booking still inside the workspace's policy windows carries `manage_token` and `can_manage: true`; the token opens the site's manage page. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
         "responses": {
           "200": {
-            "description": "Workspaces.",
+            "description": "Bookings.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WorkspaceArray"
+                  "$ref": "#/components/schemas/ApiResponse_PortalBookings"
                 }
               }
             }
@@ -1951,73 +2075,26 @@
         }
       }
     },
-    "/api/v1/helpdesk/conversations": {
-      "get": {
+    "/api/v1/portal/me/export": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/PortalSession"
+        }
+      ],
+      "post": {
         "tags": [
-          "Helpdesk"
-        ],
-        "operationId": "listHelpdeskConversations",
-        "summary": "List helpdesk conversations",
-        "parameters": [
-          {
-            "name": "limit",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 100
-            }
-          },
-          {
-            "$ref": "#/components/parameters/Cursor"
-          },
-          {
-            "name": "status",
-            "in": "query",
-            "schema": {
-              "$ref": "#/components/schemas/HelpdeskConversationStatus"
-            }
-          },
-          {
-            "name": "assignee_user_id",
-            "in": "query",
-            "schema": {
-              "type": "string"
-            },
-            "description": "Only conversations assigned to this user."
-          },
-          {
-            "name": "requester",
-            "in": "query",
-            "schema": {
-              "type": "string"
-            },
-            "description": "Match against visitor name/email."
-          },
-          {
-            "name": "query",
-            "in": "query",
-            "schema": {
-              "type": "string"
-            },
-            "description": "Free-text search query."
-          },
-          {
-            "name": "channels",
-            "in": "query",
-            "schema": {
-              "type": "string"
-            },
-            "description": "Comma-separated channel types (e.g. `widget,whatsapp`)."
-          }
+          "Portal"
         ],
+        "operationId": "exportPortalData",
+        "summary": "Export everything held about the signed-in contact",
+        "description": "A synchronous GDPR Art. 15 export of the contact's profile, family, consents and bookings, as one JSON document. Unlike `GET /api/v1/portal/me`, `contact.persons` here includes inactive persons so the export is a complete dump. `relations` lists every relation the contact is a party to, exposing only the counterpart's display name. Read-only, so not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN`, `429 RATE_LIMITED`.",
         "responses": {
           "200": {
-            "description": "Conversations page.",
+            "description": "The export.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PaginatedResponse_HelpdeskConversation"
+                  "$ref": "#/components/schemas/ApiResponse_PortalExport"
                 }
               }
             }
@@ -2028,25 +2105,43 @@
         }
       }
     },
-    "/api/v1/helpdesk/conversations/{id}": {
+    "/api/v1/portal/me/delete": {
       "parameters": [
         {
-          "$ref": "#/components/parameters/Id"
+          "$ref": "#/components/parameters/PortalSession"
         }
       ],
-      "get": {
+      "post": {
         "tags": [
-          "Helpdesk"
+          "Portal"
         ],
-        "operationId": "getHelpdeskConversation",
-        "summary": "Get a helpdesk conversation",
+        "operationId": "deletePortalAccount",
+        "summary": "Erase the signed-in contact",
+        "description": "GDPR Art. 17 erasure. The session is revoked as part of the deletion, so a retry answers `401 PORTAL_SESSION_INVALID` rather than deleting anything else. Not idempotency-keyed. Errors: `401 PORTAL_SESSION_REQUIRED`, `401 PORTAL_SESSION_INVALID`, `403 FORBIDDEN` (key lacks `write:portal`), `429 RATE_LIMITED`.",
+        "responses": {
+          "204": {
+            "description": "Contact erased and session revoked."
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      }
+    },
+    "/api/v1/gdpr/export": {
+      "post": {
+        "tags": [
+          "GDPR"
+        ],
+        "operationId": "requestGdprExport",
+        "summary": "Request a GDPR export",
         "responses": {
           "200": {
-            "description": "Conversation.",
+            "description": "Export request reference.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_HelpdeskConversation"
+                  "$ref": "#/components/schemas/ApiResponse_GdprExportRequest"
                 }
               }
             }
@@ -2055,31 +2150,22 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      },
-      "patch": {
+      }
+    },
+    "/api/v1/gdpr/exports": {
+      "get": {
         "tags": [
-          "Helpdesk"
+          "GDPR"
         ],
-        "operationId": "updateHelpdeskConversation",
-        "summary": "Update a conversation's status or assignee",
-        "description": "Set `status` and/or `assignee_user_id` (`null` unassigns). At least one field is required. Capability-scoped tokens must send `Idempotency-Key` and `X-Capability-Confirmation` headers on this route; API keys with legacy scopes may omit them.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UpdateHelpdeskConversationInput"
-              }
-            }
-          }
-        },
+        "operationId": "listGdprExports",
+        "summary": "List GDPR exports",
         "responses": {
           "200": {
-            "description": "Update result.",
+            "description": "Export requests.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_HelpdeskConversationUpdateResult"
+                  "$ref": "#/components/schemas/ApiResponse_GdprExportArray"
                 }
               }
             }
@@ -2090,7 +2176,7 @@
         }
       }
     },
-    "/api/v1/helpdesk/conversations/{id}/messages": {
+    "/api/v1/gdpr/exports/{id}": {
       "parameters": [
         {
           "$ref": "#/components/parameters/Id"
@@ -2098,41 +2184,17 @@
       ],
       "get": {
         "tags": [
-          "Helpdesk"
-        ],
-        "operationId": "listHelpdeskConversationMessages",
-        "summary": "List conversation messages",
-        "parameters": [
-          {
-            "name": "limit",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 50
-            }
-          },
-          {
-            "$ref": "#/components/parameters/Cursor"
-          }
+          "GDPR"
         ],
+        "operationId": "getGdprExport",
+        "summary": "Get a GDPR export",
         "responses": {
           "200": {
-            "description": "Messages page.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PaginatedResponse_HelpdeskMessage"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "Conversation not found.",
+            "description": "Export request.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiError"
+                  "$ref": "#/components/schemas/ApiResponse_GdprExport"
                 }
               }
             }
@@ -2143,31 +2205,30 @@
         }
       }
     },
-    "/api/v1/helpdesk/replies": {
+    "/api/v1/gdpr/consent": {
       "post": {
         "tags": [
-          "Helpdesk"
+          "GDPR"
         ],
-        "operationId": "createHelpdeskReply",
-        "summary": "Send an operator reply or internal note",
-        "description": "Send an `Idempotency-Key` header so retried requests do not create duplicate messages — it is required for capability-scoped tokens (together with `X-Capability-Confirmation`).",
+        "operationId": "recordGdprConsent",
+        "summary": "Record GDPR consent",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateHelpdeskReplyInput"
+                "$ref": "#/components/schemas/RecordConsentInput"
               }
             }
           }
         },
         "responses": {
-          "201": {
-            "description": "Created reply reference.",
+          "200": {
+            "description": "Consent reference.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_HelpdeskReplyCreateResult"
+                  "$ref": "#/components/schemas/ApiResponse_ConsentResult"
                 }
               }
             }
@@ -2178,20 +2239,31 @@
         }
       }
     },
-    "/api/v1/webhooks": {
+    "/api/v1/gdpr/consent/{email}": {
+      "parameters": [
+        {
+          "name": "email",
+          "in": "path",
+          "required": true,
+          "schema": {
+            "type": "string",
+            "format": "email"
+          }
+        }
+      ],
       "get": {
         "tags": [
-          "Webhooks"
+          "GDPR"
         ],
-        "operationId": "listWebhooks",
-        "summary": "List webhook endpoints",
+        "operationId": "getGdprConsent",
+        "summary": "Get GDPR consent records",
         "responses": {
           "200": {
-            "description": "Webhook endpoints.",
+            "description": "Consent records.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpointArray"
+                  "$ref": "#/components/schemas/ApiResponse_ConsentRecordArray"
                 }
               }
             }
@@ -2200,31 +2272,32 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      },
+      }
+    },
+    "/api/cookie-consent": {
       "post": {
         "tags": [
-          "Webhooks"
+          "GDPR"
         ],
-        "operationId": "createWebhook",
-        "summary": "Create a webhook endpoint",
-        "description": "The response's `data.secret` contains the signing secret EXACTLY ONCE — it can never be retrieved again, so store it securely immediately. An idempotent replay (same `Idempotency-Key`) returns the existing endpoint WITHOUT `secret`. Deliveries are HTTP POSTs signed with `X-Medal-Signature: sha256=<base64(HMAC-SHA256(\"{timestamp}.{rawBody}\", secret))>` plus `X-Medal-Timestamp`, `X-Medal-Event`, and `X-Medal-Delivery-Id` / `Idempotency-Key` headers.",
+        "operationId": "recordCookieConsent",
+        "summary": "Record cookie consent",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateWebhookInput"
+                "$ref": "#/components/schemas/CookieConsentInput"
               }
             }
           }
         },
         "responses": {
-          "201": {
-            "description": "Created endpoint, including the one-time `secret`.",
+          "200": {
+            "description": "Cookie consent result.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
+                  "$ref": "#/components/schemas/CookieConsentResult"
                 }
               }
             }
@@ -2235,25 +2308,20 @@
         }
       }
     },
-    "/api/v1/webhooks/{id}": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
-        }
-      ],
+    "/api/v1/me/workspaces": {
       "get": {
         "tags": [
-          "Webhooks"
+          "Workspaces"
         ],
-        "operationId": "getWebhook",
-        "summary": "Get a webhook endpoint",
+        "operationId": "listWorkspaces",
+        "summary": "List accessible workspaces",
         "responses": {
           "200": {
-            "description": "Webhook endpoint.",
+            "description": "Workspaces.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
+                  "$ref": "#/components/schemas/ApiResponse_WorkspaceArray"
                 }
               }
             }
@@ -2262,31 +2330,104 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      },
-      "patch": {
+      }
+    },
+    "/api/v1/helpdesk/conversations": {
+      "get": {
         "tags": [
-          "Webhooks"
+          "Helpdesk"
         ],
-        "operationId": "updateWebhook",
-        "summary": "Update a webhook endpoint",
-        "description": "Only provided fields change. Pass `null` for `channels` or `channel_connection_ids` to clear that filter.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UpdateWebhookInput"
+        "operationId": "listHelpdeskConversations",
+        "summary": "List helpdesk conversations",
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            }
+          },
+          {
+            "$ref": "#/components/parameters/Cursor"
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "schema": {
+              "$ref": "#/components/schemas/HelpdeskConversationStatus"
+            }
+          },
+          {
+            "name": "assignee_user_id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Only conversations assigned to this user."
+          },
+          {
+            "name": "requester",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Match against visitor name/email."
+          },
+          {
+            "name": "query",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Free-text search query."
+          },
+          {
+            "name": "channels",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "description": "Comma-separated channel types (e.g. `widget,whatsapp`)."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Conversations page.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PaginatedResponse_HelpdeskConversation"
+                }
               }
             }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
           }
-        },
+        }
+      }
+    },
+    "/api/v1/helpdesk/conversations/{id}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
+      "get": {
+        "tags": [
+          "Helpdesk"
+        ],
+        "operationId": "getHelpdeskConversation",
+        "summary": "Get a helpdesk conversation",
         "responses": {
           "200": {
-            "description": "Updated endpoint.",
+            "description": "Conversation.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
+                  "$ref": "#/components/schemas/ApiResponse_HelpdeskConversation"
                 }
               }
             }
@@ -2296,20 +2437,30 @@
           }
         }
       },
-      "delete": {
+      "patch": {
         "tags": [
-          "Webhooks"
+          "Helpdesk"
         ],
-        "operationId": "deleteWebhook",
-        "summary": "Delete a webhook endpoint",
-        "description": "Permanently deletes the endpoint and stops all outbound deliveries. Capability-scoped tokens must send `Idempotency-Key` and `X-Capability-Confirmation` headers on this route; API keys with legacy scopes may omit them.",
+        "operationId": "updateHelpdeskConversation",
+        "summary": "Update a conversation's status or assignee",
+        "description": "Set `status` and/or `assignee_user_id` (`null` unassigns). At least one field is required. Capability-scoped tokens must send `Idempotency-Key` and `X-Capability-Confirmation` headers on this route; API keys with legacy scopes may omit them.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateHelpdeskConversationInput"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "Delete result.",
+            "description": "Update result.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookDeleteResult"
+                  "$ref": "#/components/schemas/ApiResponse_HelpdeskConversationUpdateResult"
                 }
               }
             }
@@ -2320,7 +2471,7 @@
         }
       }
     },
-    "/api/v1/webhooks/{id}/deliveries": {
+    "/api/v1/helpdesk/conversations/{id}/messages": {
       "parameters": [
         {
           "$ref": "#/components/parameters/Id"
@@ -2328,10 +2479,10 @@
       ],
       "get": {
         "tags": [
-          "Webhooks"
+          "Helpdesk"
         ],
-        "operationId": "listWebhookDeliveries",
-        "summary": "List recent deliveries",
+        "operationId": "listHelpdeskConversationMessages",
+        "summary": "List conversation messages",
         "parameters": [
           {
             "name": "limit",
@@ -2339,47 +2490,30 @@
             "schema": {
               "type": "integer",
               "minimum": 1,
-              "maximum": 100
+              "maximum": 50
             }
+          },
+          {
+            "$ref": "#/components/parameters/Cursor"
           }
         ],
         "responses": {
           "200": {
-            "description": "Recent deliveries, most recent first.",
+            "description": "Messages page.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookDeliveryArray"
+                  "$ref": "#/components/schemas/PaginatedResponse_HelpdeskMessage"
                 }
               }
             }
           },
-          "default": {
-            "$ref": "#/components/responses/ApiError"
-          }
-        }
-      }
-    },
-    "/api/v1/webhooks/{id}/test": {
-      "parameters": [
-        {
-          "$ref": "#/components/parameters/Id"
-        }
-      ],
-      "post": {
-        "tags": [
-          "Webhooks"
-        ],
-        "operationId": "testWebhook",
-        "summary": "Queue a test delivery",
-        "description": "Queues a signed `test.ping` delivery to the endpoint.",
-        "responses": {
-          "202": {
-            "description": "Test delivery queued.",
+          "404": {
+            "description": "Conversation not found.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_WebhookTestResult"
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -2390,31 +2524,31 @@
         }
       }
     },
-    "/api/v1/capability-confirmations": {
+    "/api/v1/helpdesk/replies": {
       "post": {
         "tags": [
-          "Capabilities"
+          "Helpdesk"
         ],
-        "operationId": "issueCapabilityConfirmation",
-        "summary": "Issue a capability confirmation token",
-        "description": "Mints a short-lived `X-Capability-Confirmation` token for one pending write. Confirmable write routes require BOTH `Idempotency-Key` and `X-Capability-Confirmation` when the credential holds the capability scope directly; API keys with legacy scopes are exempt. The token is bound to the workspace, auth subject, method, path, required scopes and idempotency key, and expires within 15 minutes. `user_approved: true` asserts that a human on the caller's side approved this exact action.",
+        "operationId": "createHelpdeskReply",
+        "summary": "Send an operator reply or internal note",
+        "description": "Send an `Idempotency-Key` header so retried requests do not create duplicate messages — it is required for capability-scoped tokens (together with `X-Capability-Confirmation`).",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/IssueCapabilityConfirmationInput"
+                "$ref": "#/components/schemas/CreateHelpdeskReplyInput"
               }
             }
           }
         },
         "responses": {
-          "200": {
-            "description": "Minted confirmation token.",
+          "201": {
+            "description": "Created reply reference.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_CapabilityConfirmation"
+                  "$ref": "#/components/schemas/ApiResponse_HelpdeskReplyCreateResult"
                 }
               }
             }
@@ -2425,31 +2559,53 @@
         }
       }
     },
-    "/api/v1/channels/connect-links": {
+    "/api/v1/webhooks": {
+      "get": {
+        "tags": [
+          "Webhooks"
+        ],
+        "operationId": "listWebhooks",
+        "summary": "List webhook endpoints",
+        "responses": {
+          "200": {
+            "description": "Webhook endpoints.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpointArray"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      },
       "post": {
         "tags": [
-          "Channels"
+          "Webhooks"
         ],
-        "operationId": "createChannelConnectLink",
-        "summary": "Mint a hosted connect link",
-        "description": "Mints a single-use hosted connect link that lets an external person (no Medal account required) attach a channel account (e.g. `telegram_inbox`) to the workspace's helpdesk. The response's `data.url` contains the one-time link token EXACTLY ONCE — an idempotent replay (same `Idempotency-Key`) returns the link WITHOUT `url`. Requires the `channel.connect.manage` scope; OAuth callers additionally need the workspace `admin` role.",
+        "operationId": "createWebhook",
+        "summary": "Create a webhook endpoint",
+        "description": "The response's `data.secret` contains the signing secret EXACTLY ONCE — it can never be retrieved again, so store it securely immediately. An idempotent replay (same `Idempotency-Key`) returns the existing endpoint WITHOUT `secret`. Deliveries are HTTP POSTs signed with `X-Medal-Signature: sha256=<base64(HMAC-SHA256(\"{timestamp}.{rawBody}\", secret))>` plus `X-Medal-Timestamp`, `X-Medal-Event`, and `X-Medal-Delivery-Id` / `Idempotency-Key` headers.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateConnectLinkInput"
+                "$ref": "#/components/schemas/CreateWebhookInput"
               }
             }
           }
         },
         "responses": {
           "201": {
-            "description": "Minted connect link, including the one-time `url`.",
+            "description": "Created endpoint, including the one-time `secret`.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiResponse_ConnectLinkCreateResult"
+                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
                 }
               }
             }
@@ -2458,24 +2614,249 @@
             "$ref": "#/components/responses/ApiError"
           }
         }
-      },
+      }
+    },
+    "/api/v1/webhooks/{id}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
       "get": {
         "tags": [
-          "Channels"
+          "Webhooks"
         ],
-        "operationId": "listChannelConnectLinks",
-        "summary": "List connect links",
-        "description": "Link tokens are never returned. Newest first, cursor-paginated. The `channel_type` / `status` filters are applied within each page, so a page may hold fewer than `limit` items while `pagination.has_more` is still true — page off `has_more`, not the item count.",
-        "parameters": [
-          {
-            "name": "limit",
-            "in": "query",
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 100
-            },
-            "description": "Page size (default 50, capped at 100)."
+        "operationId": "getWebhook",
+        "summary": "Get a webhook endpoint",
+        "responses": {
+          "200": {
+            "description": "Webhook endpoint.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      },
+      "patch": {
+        "tags": [
+          "Webhooks"
+        ],
+        "operationId": "updateWebhook",
+        "summary": "Update a webhook endpoint",
+        "description": "Only provided fields change. Pass `null` for `channels` or `channel_connection_ids` to clear that filter.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateWebhookInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Updated endpoint.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookEndpoint"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "Webhooks"
+        ],
+        "operationId": "deleteWebhook",
+        "summary": "Delete a webhook endpoint",
+        "description": "Permanently deletes the endpoint and stops all outbound deliveries. Capability-scoped tokens must send `Idempotency-Key` and `X-Capability-Confirmation` headers on this route; API keys with legacy scopes may omit them.",
+        "responses": {
+          "200": {
+            "description": "Delete result.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookDeleteResult"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      }
+    },
+    "/api/v1/webhooks/{id}/deliveries": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
+      "get": {
+        "tags": [
+          "Webhooks"
+        ],
+        "operationId": "listWebhookDeliveries",
+        "summary": "List recent deliveries",
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Recent deliveries, most recent first.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookDeliveryArray"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      }
+    },
+    "/api/v1/webhooks/{id}/test": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Id"
+        }
+      ],
+      "post": {
+        "tags": [
+          "Webhooks"
+        ],
+        "operationId": "testWebhook",
+        "summary": "Queue a test delivery",
+        "description": "Queues a signed `test.ping` delivery to the endpoint.",
+        "responses": {
+          "202": {
+            "description": "Test delivery queued.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_WebhookTestResult"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      }
+    },
+    "/api/v1/capability-confirmations": {
+      "post": {
+        "tags": [
+          "Capabilities"
+        ],
+        "operationId": "issueCapabilityConfirmation",
+        "summary": "Issue a capability confirmation token",
+        "description": "Mints a short-lived `X-Capability-Confirmation` token for one pending write. Confirmable write routes require BOTH `Idempotency-Key` and `X-Capability-Confirmation` when the credential holds the capability scope directly; API keys with legacy scopes are exempt. The token is bound to the workspace, auth subject, method, path, required scopes and idempotency key, and expires within 15 minutes. `user_approved: true` asserts that a human on the caller's side approved this exact action.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/IssueCapabilityConfirmationInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Minted confirmation token.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_CapabilityConfirmation"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      }
+    },
+    "/api/v1/channels/connect-links": {
+      "post": {
+        "tags": [
+          "Channels"
+        ],
+        "operationId": "createChannelConnectLink",
+        "summary": "Mint a hosted connect link",
+        "description": "Mints a single-use hosted connect link that lets an external person (no Medal account required) attach a channel account (e.g. `telegram_inbox`) to the workspace's helpdesk. The response's `data.url` contains the one-time link token EXACTLY ONCE — an idempotent replay (same `Idempotency-Key`) returns the link WITHOUT `url`. Requires the `channel.connect.manage` scope; OAuth callers additionally need the workspace `admin` role.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateConnectLinkInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Minted connect link, including the one-time `url`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiResponse_ConnectLinkCreateResult"
+                }
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/ApiError"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Channels"
+        ],
+        "operationId": "listChannelConnectLinks",
+        "summary": "List connect links",
+        "description": "Link tokens are never returned. Newest first, cursor-paginated. The `channel_type` / `status` filters are applied within each page, so a page may hold fewer than `limit` items while `pagination.has_more` is still true — page off `has_more`, not the item count.",
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            },
+            "description": "Page size (default 50, capped at 100)."
           },
           {
             "$ref": "#/components/parameters/Cursor"
@@ -4401,6 +4782,28 @@
           "refunded"
         ]
       },
+      "BookingPaymentMode": {
+        "description": "What a booking must have paid before the business honours it: nothing, a reservation captured later, or the full amount up front.",
+        "type": "string",
+        "enum": [
+          "none",
+          "reserve",
+          "prepay"
+        ]
+      },
+      "BookingPaymentState": {
+        "description": "The state of one payment attempt, in Medal's vocabulary rather than the wallet's — a Vipps payment stays AUTHORIZED after a capture, so read the øre aggregates to learn what actually moved.",
+        "type": "string",
+        "enum": [
+          "created",
+          "authorized",
+          "captured",
+          "cancelled",
+          "refunded",
+          "failed",
+          "expired"
+        ]
+      },
       "BookingCreatedVia": {
         "type": "string",
         "enum": [
@@ -4429,12 +4832,16 @@
           "end_ts",
           "booked_for_name",
           "booked_for_birth_year",
+          "booked_for_person_id",
+          "event_id",
+          "event_order",
           "party_sequence_id",
           "status",
           "cancelled_by",
           "cancel_reason",
           "rescheduled_from_id",
           "payment_status",
+          "payment_mode",
           "amount_ore",
           "notes",
           "internal_notes",
@@ -4491,21 +4898,42 @@
               "null"
             ]
           },
-          "party_sequence_id": {
-            "description": "Shared by every booking created in the same party request.",
+          "booked_for_person_id": {
+            "description": "The ContactPerson this booking was made for, if any.",
             "type": [
               "string",
               "null"
             ]
           },
-          "status": {
-            "$ref": "#/components/schemas/BookingStatus"
+          "event_id": {
+            "description": "The BookingEvent this booking is a registration for, if any.",
+            "type": [
+              "string",
+              "null"
+            ]
           },
-          "cancelled_by": {
-            "oneOf": [
-              {
-                "$ref": "#/components/schemas/BookingCancelledBy"
-              },
+          "event_order": {
+            "description": "Position of this booking within its event's registrations, if any.",
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "party_sequence_id": {
+            "description": "Shared by every booking created in the same party request.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "status": {
+            "$ref": "#/components/schemas/BookingStatus"
+          },
+          "cancelled_by": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/BookingCancelledBy"
+              },
               {
                 "type": "null"
               }
@@ -4527,6 +4955,10 @@
           "payment_status": {
             "$ref": "#/components/schemas/BookingPaymentStatus"
           },
+          "payment_mode": {
+            "description": "What this booking required when it was made — frozen at creation. `payment_status: none` cannot tell \"owes nothing\" from \"has not paid yet\"; this can.",
+            "$ref": "#/components/schemas/BookingPaymentMode"
+          },
           "amount_ore": {
             "description": "Price in integer øre. Never a float and never kroner.",
             "type": [
@@ -4588,6 +5020,7 @@
           "weekend_surcharge_pct",
           "resource_requirements",
           "bookable_online",
+          "payment",
           "max_per_booking",
           "color",
           "sort_order",
@@ -4658,6 +5091,17 @@
           "bookable_online": {
             "type": "boolean"
           },
+          "payment": {
+            "description": "Per-service payment requirement. `null` means no override — the workspace rule decides.",
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/BookingPaymentMode"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "max_per_booking": {
             "type": [
               "integer",
@@ -4899,6 +5343,10 @@
             "type": "integer",
             "minimum": 1900,
             "maximum": 2200
+          },
+          "booked_for_person_id": {
+            "description": "Book this line on behalf of a ContactPerson rather than the contact.",
+            "type": "string"
           }
         }
       },
@@ -5022,6 +5470,7 @@
           "party_sequence_id",
           "amount_ore",
           "payment_status",
+          "payment_mode",
           "time_zone",
           "cancel_window_hours",
           "reschedule_window_hours",
@@ -5137,6 +5586,10 @@
               }
             ]
           },
+          "payment_mode": {
+            "description": "What this booking requires — what a manage page checks before offering «Betal nå».",
+            "$ref": "#/components/schemas/BookingPaymentMode"
+          },
           "time_zone": {
             "description": "IANA zone the booking's local times should be rendered in.",
             "type": [
@@ -5228,6 +5681,169 @@
           }
         }
       },
+      "StartBookingPaymentInput": {
+        "description": "Body for `startBookingPayment` and `startManageBookingPayment`.",
+        "type": "object",
+        "required": [
+          "return_url",
+          "terms_accepted"
+        ],
+        "properties": {
+          "return_url": {
+            "description": "Where the wallet returns the customer. Must be a URL one of this workspace's own sites vouches for; anything else answers 422.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048
+          },
+          "terms_accepted": {
+            "description": "Must be literally `true`. The customer has to actively accept the merchant's terms BEFORE a payment is initiated, so omitting it or sending `false` is a 400 and leaves no payment behind.",
+            "const": true,
+            "type": "boolean"
+          },
+          "terms_version": {
+            "description": "The caller's own version label for the terms that were accepted.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64
+          },
+          "terms_text": {
+            "description": "The exact text that was accepted, stored with the consent record.",
+            "type": "string",
+            "maxLength": 2000
+          }
+        }
+      },
+      "BookingPaymentStart": {
+        "description": "The result of starting a payment. `redirect_url` is handed over here and nowhere else.",
+        "type": "object",
+        "required": [
+          "reference",
+          "redirect_url",
+          "state"
+        ],
+        "properties": {
+          "reference": {
+            "description": "The wallet reference for this attempt.",
+            "type": "string"
+          },
+          "redirect_url": {
+            "description": "Send the customer here UNCHANGED — hand it to the Vipps Widget SDK. SHOW-ONCE: it is not returned by `getBookingPayment`, and the payment behind it expires after ten minutes.",
+            "type": "string"
+          },
+          "state": {
+            "$ref": "#/components/schemas/BookingPaymentState"
+          }
+        }
+      },
+      "BookingPayment": {
+        "description": "One payment attempt on a booking. Money is integer øre, and the four aggregates are numbers rather than nulls — \"nothing captured\" is `0`. `redirect_url`, the wallet's own refusal text and the trace id are deliberately absent.",
+        "type": "object",
+        "required": [
+          "reference",
+          "provider",
+          "state",
+          "mode",
+          "attempt",
+          "amount_ore",
+          "authorized_ore",
+          "captured_ore",
+          "refunded_ore",
+          "cancelled_ore",
+          "currency",
+          "capture_guaranteed_until",
+          "terms_version",
+          "terms_accepted_at",
+          "failure_code",
+          "created_at",
+          "updated_at"
+        ],
+        "properties": {
+          "reference": {
+            "type": "string"
+          },
+          "provider": {
+            "const": "vipps",
+            "type": "string"
+          },
+          "state": {
+            "$ref": "#/components/schemas/BookingPaymentState"
+          },
+          "mode": {
+            "description": "Never `none` — a payment exists only where one was required.",
+            "type": "string",
+            "enum": [
+              "reserve",
+              "prepay"
+            ]
+          },
+          "attempt": {
+            "description": "1 for the first attempt on this booking, incrementing per retry.",
+            "type": "integer"
+          },
+          "amount_ore": {
+            "description": "The amount this attempt is for, in integer øre.",
+            "type": "integer"
+          },
+          "authorized_ore": {
+            "type": "integer"
+          },
+          "captured_ore": {
+            "type": "integer"
+          },
+          "refunded_ore": {
+            "type": "integer"
+          },
+          "cancelled_ore": {
+            "type": "integer"
+          },
+          "currency": {
+            "const": "NOK",
+            "type": "string"
+          },
+          "capture_guaranteed_until": {
+            "description": "The last moment a capture is GUARANTEED to succeed. The card behind the wallet may release the reservation afterwards, so a capture past it can fail even though the payment still looks authorized. Null until the customer has approved.",
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "terms_version": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "terms_accepted_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "failure_code": {
+            "description": "The wallet's numeric error code from the last failed operation — what a caller branches on.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "created_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
       "BookingsPagination": {
         "description": "Pagination for a bookings page. `truncated` is the extra statement: the underlying read is capped, and when the cap binds there are matching bookings no cursor from this call reaches — narrow the window.",
         "type": "object",
@@ -6450,6 +7066,12 @@
       "ApiResponse_BookingRescheduleResult": {
         "$ref": "#/components/schemas/Envelope_BookingRescheduleResult"
       },
+      "ApiResponse_BookingPaymentStart": {
+        "$ref": "#/components/schemas/Envelope_BookingPaymentStart"
+      },
+      "ApiResponse_BookingPayment": {
+        "$ref": "#/components/schemas/Envelope_BookingPayment"
+      },
       "ApiResponse_ManageSummary": {
         "$ref": "#/components/schemas/Envelope_ManageSummary"
       },
@@ -7033,6 +7655,28 @@
           }
         }
       },
+      "Envelope_BookingPaymentStart": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/BookingPaymentStart"
+          }
+        }
+      },
+      "Envelope_BookingPayment": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/BookingPayment"
+          }
+        }
+      },
       "Envelope_ManageSummary": {
         "type": "object",
         "required": [
@@ -7145,6 +7789,68 @@
           }
         }
       },
+      "PortalPerson": {
+        "description": "A person the contact books for — a child, a pet — with no login of its own.",
+        "type": "object",
+        "required": [
+          "person_id",
+          "name",
+          "birth_year",
+          "relation_type",
+          "relation_label",
+          "notes",
+          "active"
+        ],
+        "properties": {
+          "person_id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "birth_year": {
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "relation_type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "relation_label": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "notes": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "active": {
+            "type": "boolean",
+            "description": "False for a person the customer removed or that was promoted to its own contact; `me` returns active persons only, the export returns all."
+          }
+        }
+      },
+      "PortalLabels": {
+        "description": "The workspace's own words for the person concept, e.g. `\"Barn\"`.",
+        "type": "object",
+        "required": [
+          "person",
+          "persons"
+        ],
+        "properties": {
+          "person": {
+            "type": "string"
+          },
+          "persons": {
+            "type": "string"
+          }
+        }
+      },
       "PortalProfile": {
         "type": "object",
         "required": [
@@ -7154,6 +7860,8 @@
           "last_name",
           "phone",
           "family",
+          "persons",
+          "labels",
           "marketing_consent",
           "created_at"
         ],
@@ -7188,6 +7896,15 @@
               "$ref": "#/components/schemas/PortalFamilyMember"
             }
           },
+          "persons": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/PortalPerson"
+            }
+          },
+          "labels": {
+            "$ref": "#/components/schemas/PortalLabels"
+          },
           "marketing_consent": {
             "type": "boolean"
           },
@@ -7370,6 +8087,52 @@
           }
         }
       },
+      "PortalExportRelation": {
+        "description": "A relation the exporting contact is a party to; only the counterpart's display name is exposed.",
+        "type": "object",
+        "required": [
+          "direction",
+          "type",
+          "custom_label",
+          "since",
+          "note",
+          "counterpart_name"
+        ],
+        "properties": {
+          "direction": {
+            "type": "string",
+            "enum": [
+              "outgoing",
+              "incoming"
+            ]
+          },
+          "type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "custom_label": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "since": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "description": "Unix timestamp in milliseconds."
+          },
+          "note": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "counterpart_name": {
+            "type": "string"
+          }
+        }
+      },
       "PortalExport": {
         "description": "Everything the workspace holds about the signed-in contact (GDPR Art. 15).",
         "type": "object",
@@ -7378,7 +8141,8 @@
           "contact",
           "family",
           "consents",
-          "bookings"
+          "bookings",
+          "relations"
         ],
         "properties": {
           "exported_at": {
@@ -7405,6 +8169,12 @@
             "items": {
               "$ref": "#/components/schemas/PortalBooking"
             }
+          },
+          "relations": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/PortalExportRelation"
+            }
           }
         }
       },
@@ -8123,6 +8893,495 @@
             "$ref": "#/components/schemas/ChannelConnectionDisconnectResult"
           }
         }
+      },
+      "RelationType": {
+        "description": "How a person or a relation relates to a contact.",
+        "type": "string",
+        "enum": [
+          "guardian",
+          "owner",
+          "employer",
+          "caregiver",
+          "partner",
+          "custom"
+        ]
+      },
+      "ContactPerson": {
+        "description": "A person a contact books for — a child, a pet, an employee. No login of their own.",
+        "type": "object",
+        "required": [
+          "person_id",
+          "contact_id",
+          "name",
+          "birth_year",
+          "relation_type",
+          "relation_label",
+          "notes",
+          "active",
+          "promoted_to_contact_id",
+          "created_at",
+          "updated_at"
+        ],
+        "properties": {
+          "person_id": {
+            "type": "string"
+          },
+          "contact_id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "birth_year": {
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "relation_type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "relation_label": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "notes": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "active": {
+            "type": "boolean"
+          },
+          "promoted_to_contact_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateContactPersonInput": {
+        "type": "object",
+        "required": [
+          "contact_id",
+          "name",
+          "relation_type"
+        ],
+        "properties": {
+          "contact_id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "birth_year": {
+            "type": "integer"
+          },
+          "relation_type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "relation_label": {
+            "type": "string"
+          },
+          "notes": {
+            "type": "string"
+          }
+        }
+      },
+      "ContactRelation": {
+        "description": "One directional relation between two contacts.",
+        "type": "object",
+        "required": [
+          "relation_id",
+          "from_contact_id",
+          "to_contact_id",
+          "type",
+          "custom_label",
+          "since",
+          "note",
+          "counterpart_name",
+          "created_at"
+        ],
+        "properties": {
+          "relation_id": {
+            "type": "string"
+          },
+          "from_contact_id": {
+            "type": "string"
+          },
+          "to_contact_id": {
+            "type": "string"
+          },
+          "type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "custom_label": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "since": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "description": "Unix timestamp in milliseconds."
+          },
+          "note": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "counterpart_name": {
+            "type": "string",
+            "description": "Empty string when the counterpart contact no longer exists."
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "ContactRelations": {
+        "description": "Relations a contact holds, split by direction.",
+        "type": "object",
+        "required": [
+          "outgoing",
+          "incoming"
+        ],
+        "properties": {
+          "outgoing": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContactRelation"
+            }
+          },
+          "incoming": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContactRelation"
+            }
+          }
+        }
+      },
+      "CreateContactRelationInput": {
+        "type": "object",
+        "required": [
+          "from_contact_id",
+          "to_contact_id",
+          "type"
+        ],
+        "properties": {
+          "from_contact_id": {
+            "type": "string"
+          },
+          "to_contact_id": {
+            "type": "string"
+          },
+          "type": {
+            "$ref": "#/components/schemas/RelationType"
+          },
+          "custom_label": {
+            "type": "string"
+          },
+          "since": {
+            "type": "integer",
+            "description": "Unix timestamp in milliseconds."
+          },
+          "note": {
+            "type": "string"
+          }
+        }
+      },
+      "CreateContactRelationResult": {
+        "type": "object",
+        "required": [
+          "relation_id"
+        ],
+        "properties": {
+          "relation_id": {
+            "type": "string"
+          }
+        }
+      },
+      "BookingEventStatus": {
+        "type": "string",
+        "enum": [
+          "draft",
+          "open",
+          "closed",
+          "completed",
+          "cancelled"
+        ]
+      },
+      "BookingEventTemplateKey": {
+        "type": "string",
+        "enum": [
+          "kindergarten_visit",
+          "company_day",
+          "class",
+          "open_day",
+          "custom"
+        ]
+      },
+      "BookingEvent": {
+        "description": "An arrangement — a scheduled group session bookings register against.",
+        "type": "object",
+        "required": [
+          "event_id",
+          "template_id",
+          "host_id",
+          "date",
+          "window_start_minute",
+          "window_end_minute",
+          "place",
+          "capacity",
+          "minimum",
+          "registered_count",
+          "service_ids",
+          "resource_ids",
+          "price_override_ore",
+          "status",
+          "registration_closes_at",
+          "slug",
+          "created_at",
+          "updated_at"
+        ],
+        "properties": {
+          "event_id": {
+            "type": "string"
+          },
+          "template_id": {
+            "type": "string"
+          },
+          "host_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "date": {
+            "description": "yyyy-mm-dd in the workspace time zone.",
+            "type": "string",
+            "format": "date"
+          },
+          "window_start_minute": {
+            "type": "integer"
+          },
+          "window_end_minute": {
+            "type": "integer"
+          },
+          "place": {
+            "type": "string",
+            "enum": [
+              "at_host",
+              "in_house"
+            ]
+          },
+          "capacity": {
+            "type": "integer"
+          },
+          "minimum": {
+            "type": "integer"
+          },
+          "registered_count": {
+            "type": "integer"
+          },
+          "service_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "resource_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "price_override_ore": {
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "status": {
+            "$ref": "#/components/schemas/BookingEventStatus"
+          },
+          "registration_closes_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "slug": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "CreateBookingEventInput": {
+        "type": "object",
+        "required": [
+          "template_key",
+          "date",
+          "window_start_minute",
+          "place",
+          "service_ids",
+          "resource_ids"
+        ],
+        "properties": {
+          "template_key": {
+            "$ref": "#/components/schemas/BookingEventTemplateKey"
+          },
+          "host_id": {
+            "type": "string"
+          },
+          "date": {
+            "type": "string",
+            "format": "date"
+          },
+          "window_start_minute": {
+            "type": "integer"
+          },
+          "window_end_minute": {
+            "type": "integer"
+          },
+          "place": {
+            "type": "string",
+            "enum": [
+              "at_host",
+              "in_house"
+            ]
+          },
+          "capacity": {
+            "type": "integer"
+          },
+          "minimum": {
+            "type": "integer"
+          },
+          "service_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "resource_ids": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "ApiResponse_ContactPersonArray": {
+        "$ref": "#/components/schemas/Envelope_ContactPersonArray"
+      },
+      "ApiResponse_ContactPerson": {
+        "$ref": "#/components/schemas/Envelope_ContactPerson"
+      },
+      "ApiResponse_ContactRelations": {
+        "$ref": "#/components/schemas/Envelope_ContactRelations"
+      },
+      "ApiResponse_CreateContactRelationResult": {
+        "$ref": "#/components/schemas/Envelope_CreateContactRelationResult"
+      },
+      "ApiResponse_BookingEventArray": {
+        "$ref": "#/components/schemas/Envelope_BookingEventArray"
+      },
+      "ApiResponse_BookingEvent": {
+        "$ref": "#/components/schemas/Envelope_BookingEvent"
+      },
+      "Envelope_ContactPersonArray": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContactPerson"
+            }
+          }
+        }
+      },
+      "Envelope_ContactPerson": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/ContactPerson"
+          }
+        }
+      },
+      "Envelope_ContactRelations": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/ContactRelations"
+          }
+        }
+      },
+      "Envelope_CreateContactRelationResult": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/CreateContactRelationResult"
+          }
+        }
+      },
+      "Envelope_BookingEventArray": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/BookingEvent"
+            }
+          }
+        }
+      },
+      "Envelope_BookingEvent": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/BookingEvent"
+          }
+        }
       }
     }
   }