@mongoui/skills 0.1.4 → 0.1.5

package/skills/flink-flight-api/flink-openapi-integration/scripts/flink_signed_request.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Generate or send signed requests for the Flink open-platform gateway.
+
+Examples:
+  python scripts/flink_signed_request.py ^
+    --method POST ^
+    --path /openapi/v1/flink/zh_CN/airlines/list ^
+    --body-json "{\"page\":1,\"pageSize\":20}" ^
+    --app-key open_app_xxx ^
+    --app-secret sk_xxx
+
+  python scripts/flink_signed_request.py ^
+    --method GET ^
+    --path /openapi/v1/flink/fields ^
+    --query orderNo=dd20251020161158787680281 ^
+    --app-key open_app_xxx ^
+    --app-secret sk_xxx ^
+    --send
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+import sys
+import time
+import urllib.parse
+import urllib.request
+import uuid
+from pathlib import Path
+
+
+def sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def parse_query_items(items: list[str]) -> list[tuple[str, str]]:
+    pairs: list[tuple[str, str]] = []
+    for item in items:
+        if "=" not in item:
+            raise ValueError(f"invalid query item: {item!r}; expected key=value")
+        key, value = item.split("=", 1)
+        pairs.append((key, value))
+    return pairs
+
+
+def canonical_query(pairs: list[tuple[str, str]]) -> str:
+    ordered = sorted(pairs, key=lambda item: (item[0], item[1]))
+    return "&".join(
+        f"{urllib.parse.quote(key, safe='~-._')}={urllib.parse.quote(value, safe='~-._')}"
+        for key, value in ordered
+    )
+
+
+def build_sign_payload(
+    method: str,
+    path: str,
+    query_string: str,
+    body_bytes: bytes,
+    timestamp: str,
+    nonce: str,
+    app_key: str,
+) -> str:
+    return "\n".join(
+        [
+            method.upper(),
+            path,
+            query_string,
+            sha256_hex(body_bytes),
+            timestamp,
+            nonce,
+            app_key,
+        ]
+    )
+
+
+def sign(secret: str, payload: str) -> str:
+    return hmac.new(secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def load_body(args: argparse.Namespace) -> bytes:
+    if args.body_file:
+        return Path(args.body_file).read_bytes()
+    if args.body_json is None:
+        return b""
+    parsed = json.loads(args.body_json)
+    return json.dumps(parsed, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+
+
+def build_url(base_url: str, path: str, query_string: str) -> str:
+    base = base_url.rstrip("/")
+    url = f"{base}{path}"
+    if query_string:
+        url = f"{url}?{query_string}"
+    return url
+
+
+def build_headers(app_key: str, timestamp: str, nonce: str, signature: str, has_body: bool) -> dict[str, str]:
+    headers = {
+        "Accept": "application/json",
+        "X-OP-App-Key": app_key,
+        "X-OP-Timestamp": timestamp,
+        "X-OP-Nonce": nonce,
+        "X-OP-Sign": signature,
+    }
+    if has_body:
+        headers["Content-Type"] = "application/json"
+    return headers
+
+
+def send_request(method: str, url: str, headers: dict[str, str], body_bytes: bytes, timeout: float) -> tuple[int, str]:
+    request = urllib.request.Request(url=url, data=body_bytes or None, headers=headers, method=method.upper())
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.status, response.read().decode("utf-8", errors="replace")
+    except urllib.error.HTTPError as exc:
+        return exc.code, exc.read().decode("utf-8", errors="replace")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Generate or send a signed Flink open-platform request.")
+    parser.add_argument("--base-url", default=os.getenv("OPEN_PLATFORM_BASE_URL", "http://127.0.0.1:8671"))
+    parser.add_argument("--method", required=True)
+    parser.add_argument("--path", required=True)
+    parser.add_argument("--query", action="append", default=[], help="Repeatable key=value query parameter")
+    parser.add_argument("--body-json", help="JSON string request body")
+    parser.add_argument("--body-file", help="Path to a raw request body file")
+    parser.add_argument("--app-key", default=os.getenv("OPEN_PLATFORM_APP_KEY") or os.getenv("OPEN_PLATFORM_OPEN_APP_ID"))
+    parser.add_argument("--app-secret", default=os.getenv("OPEN_PLATFORM_APP_SECRET") or os.getenv("OPEN_PLATFORM_OPEN_SECRET"))
+    parser.add_argument("--timestamp", default=str(int(time.time())))
+    parser.add_argument("--nonce", default=uuid.uuid4().hex)
+    parser.add_argument("--send", action="store_true")
+    parser.add_argument("--timeout", type=float, default=15.0)
+    args = parser.parse_args()
+
+    if not args.app_key or not args.app_secret:
+        print("app key and app secret are required", file=sys.stderr)
+        return 2
+
+    try:
+        query_pairs = parse_query_items(args.query)
+        body_bytes = load_body(args)
+    except Exception as exc:  # pragma: no cover - simple CLI error path
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    query_string = canonical_query(query_pairs)
+    payload = build_sign_payload(
+        method=args.method,
+        path=args.path,
+        query_string=query_string,
+        body_bytes=body_bytes,
+        timestamp=args.timestamp,
+        nonce=args.nonce,
+        app_key=args.app_key,
+    )
+    signature = sign(args.app_secret, payload)
+    headers = build_headers(args.app_key, args.timestamp, args.nonce, signature, bool(body_bytes))
+    url = build_url(args.base_url, args.path, query_string)
+
+    print("URL:")
+    print(url)
+    print()
+    print("Canonical String:")
+    print(payload)
+    print()
+    print("Headers:")
+    print(json.dumps(headers, ensure_ascii=False, indent=2))
+    if body_bytes:
+        print()
+        print("Body:")
+        print(body_bytes.decode("utf-8", errors="replace"))
+
+    if not args.send:
+        return 0
+
+    status, response_text = send_request(args.method, url, headers, body_bytes, args.timeout)
+    print()
+    print(f"HTTP {status}")
+    print(response_text)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skills/glink-hotel-api/glink-openapi-integration/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: glink-openapi-integration
+description: Integrate with the Glink hotel OpenAPI exposed through the platform runtime gateway. Use when Codex needs to read or implement against `docs/swagger/glink-api.json`, choose the correct Glink hotel endpoint, generate `X-OP-*` signatures, explain sandbox or production credential acquisition and reset, or drive static data, hotel search, hotel info, product, order, checkout, invoice, and balance workflows.
+---
+
+# Glink OpenAPI Integration
+
+## Quick Start
+
+Use this skill when the task is "call Glink through the open platform" rather than "call Glink supplier APIs directly".
+
+Start with the smallest reference that answers the request:
+
+- Read `references/auth-and-credentials.md` for signing, headers, key acquisition, reset, and auth troubleshooting.
+- Read `references/api-workflows.md` for hotel search, booking, cancel, checkout, invoice, and balance workflows.
+- Read `references/endpoint-index.md` for exact method, path, required fields, and supplier-field caveats.
+- Use `scripts/glink_signed_request.py` to generate headers, inspect the canonical string, or send a signed request.
+
+## Working Rules
+
+Follow this workflow:
+
+1. Confirm the environment: `sandbox` and `production` credentials are separate.
+2. Confirm the public path under `/openapi/v1/glink/*`.
+3. Build the minimum valid request body from `references/endpoint-index.md`.
+4. Sign the exact public path, sorted query string, and raw body bytes with the platform secret.
+5. Evaluate both HTTP status and response envelope `code`.
+
+Do not violate these rules:
+
+- Always send `X-OP-App-Key`, `X-OP-Timestamp`, `X-OP-Nonce`, and `X-OP-Sign`.
+- Never send supplier-side `partnerCode`, `signature`, `requestType`, or supplier `timestamp`.
+- Never wrap the payload in supplier-style `header` or `businessRequest`; send only business fields.
+- Treat `code=SUCCESS` as success. Treat `code=SUPPLIER_BIZ_ERROR` as a business failure even if HTTP status is `200`.
+- Keep timestamp skew within `+-5` minutes.
+- Reuse of the same nonce under the same app key can trigger `NONCE_REPLAY`.
+- If a swagger schema still shows supplier fields as required, follow the route description first and omit those supplier-managed fields from the client payload.
+
+## Typical Requests
+
+Use these patterns by default:
+
+- Static data: city, country, district, business area, and brand lookup calls
+- Search and booking: destination or keyword lookup -> hotel search or hotel list -> product detail or lowest price -> `checkBooking` -> `createOrder` -> `payOrder` -> `queryOrderDetail`
+- Order aftercare: `cancelOrder`, `queryOrderCheckDetailInfo`, `checkoutApply`, `queryCheckoutDetail`
+- Finance: `createInvoice`, `queryCreditBalance`
+
+## Output Expectations
+
+When answering or coding with this skill:
+
+- Prefer concrete request examples over abstract summaries.
+- State which environment the credential belongs to.
+- State whether the payload should contain only business fields.
+- Call out supplier-field residue in the swagger when relevant.
+- Call out auth failures with the likely root cause and the exact header or field to inspect.

package/skills/glink-hotel-api/glink-openapi-integration/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Glink OpenAPI 接入"
+  short_description: "帮助完成 Glink 酒店开放接口鉴权、凭证获取和业务调用"
+  default_prompt: "Use $glink-openapi-integration to integrate with the Glink hotel open API, including auth, credentials, and endpoint selection."

package/skills/glink-hotel-api/glink-openapi-integration/references/api-workflows.md

@@ -0,0 +1,84 @@
+# Glink API Workflows
+
+## Static Data
+
+Use these calls to build hotel search prerequisites:
+
+- `glink.queryCountryList`
+- `glink.queryCityList`
+- `glink.queryHotCityList`
+- `glink.queryDistrictList`
+- `glink.queryDistrictAndBusiness`
+- `glink.queryBusinessList`
+- `glink.queryHotelPlateList`
+- `glink.queryCityAndHotelByKeyword`
+
+These APIs usually feed city selection, district filters, brand filters, and keyword suggestions.
+
+## Hotel Search And Product Selection
+
+Use this sequence for discovery and pricing:
+
+1. `glink.getDestination` or `glink.queryCityAndHotelByKeyword`
+   - Resolve the destination or keyword to a city or hotel scope.
+2. `glink.getHotelSearch` or `glink.findHotelList`
+   - Search hotels using city, dates, room count, and optional filters.
+3. `glink.queryHotelLowestPrice`
+   - Pull summary pricing for selected hotel IDs.
+4. `glink.queryProductDetail`
+   - Read real-time sellable products for a selected hotel and stay range.
+5. `glink.queryHotelInfo`, `glink.queryHotelImage`, or `glink.queryHotelMainInfoByHotelIds`
+   - Hydrate hotel details for display or validation.
+
+Use `queryHotelAllList`, `queryHotelIdList`, and `queryHotelIncrement` when synchronizing hotel catalogs rather than serving live booking UX.
+
+## Booking Flow
+
+Use this sequence for a normal hotel booking flow:
+
+1. `glink.queryProductDetail`
+   - Identify the exact sellable room and rate.
+2. `glink.checkBooking`
+   - Perform pre-booking validation.
+3. `glink.createOrder`
+   - Submit the order with guest, contact, amount, and price item details.
+4. `glink.payOrder`
+   - Pay when the order flow requires explicit payment.
+5. `glink.queryOrderDetail`
+   - Track final status and supplier-side details.
+
+Key order identifiers:
+
+- `coOrderCode`: your platform-side order number
+- `fcOrderCode`: supplier-side order number when available
+
+Prefer carrying both once they appear, because several aftercare APIs accept one or both.
+
+## Order Aftercare
+
+Use these calls after booking:
+
+- `glink.cancelOrder`
+  - Cancel an order when policy permits.
+- `glink.queryOrderCheckDetailInfo`
+  - Read extended order or check-in related detail.
+- `glink.checkoutApply`
+  - Submit a checkout or refund-like aftercare request for an order.
+- `glink.queryCheckoutDetail`
+  - Query the checkout task by `taskOrderCode`.
+
+## Finance
+
+Use these calls for financial follow-up:
+
+- `glink.createInvoice`
+  - Submit invoice information using business fields only.
+  - Ignore supplier-managed `partnerCode` and `sign` even if they appear in the swagger schema.
+- `glink.queryCreditBalance`
+  - Read remaining credit balance.
+
+## Business Handling Rules
+
+- Do not treat HTTP `200` as enough; inspect `code`.
+- Do not rebuild supplier headers or wrapper payloads; the runtime gateway handles supplier authentication and wrapping.
+- Preserve upstream order identifiers from earlier responses instead of recomputing them.

package/skills/glink-hotel-api/glink-openapi-integration/references/auth-and-credentials.md

@@ -0,0 +1,157 @@
+# Glink Auth And Credentials
+
+## Required Headers
+
+Send these headers on every Glink open-platform request:
+
+- `X-OP-App-Key`
+- `X-OP-Timestamp`
+- `X-OP-Nonce`
+- `X-OP-Sign`
+
+Optional headers that can help tracing or idempotency:
+
+- `X-OP-Client-Request-Id`
+- `X-Trace-Id`
+- `X-Idempotency-Key`
+
+`X-OP-App-Key` is the issued `open_app_id`.
+
+## Signature Algorithm
+
+Build the canonical string in this exact order, separated by newline characters:
+
+```text
+METHOD
+PATH
+CANONICAL_QUERY
+BODY_SHA256
+TIMESTAMP
+NONCE
+APP_KEY
+```
+
+Rules:
+
+- Uppercase `METHOD`.
+- Use the exact public request path, for example `/openapi/v1/glink/queryBusinessList`.
+- Sort query parameters by key and then value before joining them as `k=v&k2=v2`.
+- Hash the raw request body bytes with SHA256 and use the lowercase hex digest.
+- Use the request timestamp exactly as sent in `X-OP-Timestamp`.
+- Use the request nonce exactly as sent in `X-OP-Nonce`.
+- Use the same `open_app_id` that is sent in `X-OP-App-Key`.
+- Sign the canonical string with the plain `open_app_secret` using HMAC-SHA256, then output lowercase hex.
+
+Notes:
+
+- Timestamp may be Unix seconds, Unix milliseconds, or RFC3339.
+- The platform validates timestamp drift within roughly `+-5` minutes.
+- Nonce must be unique for the same app key in a short time window.
+- For empty bodies, hash the empty byte string.
+
+## Platform Wrapping Rules
+
+Glink supplier authentication is handled by the runtime gateway.
+
+Client responsibilities:
+
+- Send only business fields.
+- Sign the public open-platform request.
+
+Do not send:
+
+- `partnerCode`
+- `signature` or `sign` used by the supplier
+- `requestType`
+- supplier-side `timestamp`
+- wrapper objects like `header` or `businessRequest`
+
+Important exception handling:
+
+- `createInvoice` currently still exposes `partnerCode` and `sign` in schema examples and required lists.
+- The route description still says the platform fills those fields automatically.
+- Prefer the route description and treat those fields as supplier-managed.
+
+## Credential Acquisition
+
+Treat credentials as environment-specific.
+
+Sandbox:
+
+1. The developer applies for app access.
+2. The operator activates the app access with `env_type=sandbox`.
+3. The platform records sandbox supplier mapping and issues a sandbox `open_app_id/open_app_secret`.
+4. The app access becomes `sandbox_active`.
+
+Production:
+
+1. The developer submits production access after sandbox work is complete.
+2. The operator approves production with `env_type=production`.
+3. The platform issues a production `open_app_id/open_app_secret`.
+4. The production credential becomes usable only after the app access reaches `production_active`.
+
+Important constraints:
+
+- Sandbox and production credentials are separate and not interchangeable.
+- Developers can see platform credentials only.
+- Developers cannot see supplier-side secrets.
+
+## How To View Or Reset Keys
+
+Developer portal APIs:
+
+- `GET /api/portal/apps/{app_id}/credentials`
+  - Returns the credential list for the app.
+  - Includes `open_app_id`, `provider_code`, `env_type`, `open_secret_version`, and masked secret data.
+  - Does not return the plain secret in normal list queries.
+- `POST /api/portal/apps/{app_id}/credentials/reset`
+  - Resets the platform secret and returns `plain_open_secret`.
+  - If the app has more than one credential mapping, pass both `provider_code` and `env_type`.
+
+Response fields that matter:
+
+- `open_app_id`: the App Key to place into `X-OP-App-Key`
+- `open_secret_masked`: masked secret for display only
+- `open_secret_version`: useful for rotation tracking
+- `plain_open_secret`: returned only on first issuance or reset
+
+Practical guidance:
+
+- If a developer says "I can only see a masked secret", instruct them to use the reset endpoint or the corresponding portal UI action.
+- If the task is only to call sandbox APIs, do not assume production credentials work.
+- If the app has both sandbox and production mappings, always name the target `env_type` explicitly.
+
+## Common Auth Failures
+
+- `APP_KEY_INVALID`
+  - Wrong `open_app_id`, wrong environment, or the credential does not exist.
+- `SIGN_ERROR`
+  - Wrong secret, wrong path, wrong query ordering, wrong body hash, or newline formatting mismatch.
+- `TIMESTAMP_EXPIRED`
+  - Clock skew exceeds the allowed window.
+- `NONCE_REPLAY`
+  - Nonce was reused under the same app key.
+- `PRODUCT_FORBIDDEN`
+  - The app is not enabled for the product, the mapping is not active, or an IP whitelist rule failed.
+
+## Response Contract
+
+The platform wraps business responses in a common envelope:
+
+```json
+{
+  "request_id": "req_xxx",
+  "trace_id": "trc_xxx",
+  "downstream_request_id": "optional",
+  "code": "SUCCESS",
+  "message": "ok",
+  "data": {}
+}
+```
+
+Interpretation:
+
+- `request_id` and `trace_id` are platform-side tracing keys.
+- `downstream_request_id` is the supplier request identifier when available.
+- `code=SUCCESS` means the business call succeeded.
+- `code=SUPPLIER_BIZ_ERROR` means the supplier returned a business error and can still arrive with HTTP `200`.

package/skills/glink-hotel-api/glink-openapi-integration/references/endpoint-index.md

@@ -0,0 +1,126 @@
+# Glink Endpoint Index
+
+All routes are public gateway routes. Sign the public path, not the downstream supplier path.
+
+## Static Data
+
+- `glink.queryBusinessList`
+  - `POST /openapi/v1/glink/queryBusinessList`
+  - Required body fields: `cityCode`
+- `glink.queryCountryList`
+  - `POST /openapi/v1/glink/queryCountryList`
+  - Required body fields: none
+- `glink.queryHotelPlateList`
+  - `POST /openapi/v1/glink/queryHotelPlateList`
+  - Required body fields: none
+- `glink.queryHotCityList`
+  - `POST /openapi/v1/glink/queryHotCityList`
+  - Required body fields: none
+- `glink.queryDistrictList`
+  - `POST /openapi/v1/glink/queryDistrictList`
+  - Required body fields: `cityCode`
+- `glink.queryDistrictAndBusiness`
+  - `POST /openapi/v1/glink/queryDistrictAndBusiness`
+  - Required body fields: `cityCode`
+- `glink.queryCityList`
+  - `POST /openapi/v1/glink/queryCityList`
+  - Required body fields: `countryCode`
+
+## Hotel Query
+
+- `glink.queryCityAndHotelByKeyword`
+  - `POST /openapi/v1/glink/queryCityAndHotelByKeyword`
+  - Required body fields: `keyWord`
+- `glink.getDestination`
+  - `POST /openapi/v1/glink/getDestination`
+  - Required body fields: `keyWord`
+  - Swagger example uses `keyword`; double-check the field naming against current backend behavior before coding around it.
+- `glink.getHotelSearch`
+  - `POST /openapi/v1/glink/getHotelSearch`
+  - Required body fields: none
+  - Common fields: `cityCode`, `checkInDate`, `checkOutDate`, `roomNum`, `language`
+- `glink.findHotelList`
+  - `POST /openapi/v1/glink/findHotelList`
+  - Required body fields from schema: `roomFacilityCodes`, `hotelFacilityCodes`, `checkInDate`, `checkOutDate`, `distance`
+  - Treat this as a high-friction route and inspect the real example payload before implementing.
+- `glink.queryHotelAllList`
+  - `POST /openapi/v1/glink/queryHotelAllList`
+  - Required body fields: none
+
+## Hotel Info
+
+- `glink.queryHotelIdList`
+  - `POST /openapi/v1/glink/queryHotelIdList`
+  - Required body fields: none
+- `glink.queryHotelInfo`
+  - `POST /openapi/v1/glink/queryHotelInfo`
+  - Required body fields: `hotelIds`
+- `glink.queryHotelIncrement`
+  - `POST /openapi/v1/glink/queryHotelIncrement`
+  - Required body fields: `startTime`, `endTime`
+  - Swagger example uses `lastUpdateTime`; inspect schema versus example before generating code.
+- `glink.queryHotelImage`
+  - `POST /openapi/v1/glink/queryHotelImage`
+  - Required body fields: `hotelIds`
+  - Swagger example uses `hotelId`; inspect schema versus example before generating code.
+- `glink.queryHotelMainInfoByHotelIds`
+  - `POST /openapi/v1/glink/queryHotelMainInfoByHotelIds`
+  - Required body fields: `language`
+
+## Product Info
+
+- `glink.queryHotelLowestPrice`
+  - `POST /openapi/v1/glink/queryHotelLowestPrice`
+  - Required body fields: `hotelIds`
+- `glink.queryProductDetail`
+  - `POST /openapi/v1/glink/queryProductDetail`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomNum`
+
+## Order Info
+
+- `glink.checkBooking`
+  - `POST /openapi/v1/glink/checkBooking`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomId`, `ratePlanId`, `roomNum`, `supplyCode`
+- `glink.createOrder`
+  - `POST /openapi/v1/glink/createOrder`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomId`, `ratePlanId`, `roomNum`, `supplyCode`, `totalAmount`, `coOrderCode`, `priceItems`, `guestInfos`, `linkMan`, `linkPhone`, `arriveTime`, `latestArriveTime`
+- `glink.payOrder`
+  - `POST /openapi/v1/glink/payOrder`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- `glink.cancelOrder`
+  - `POST /openapi/v1/glink/cancelOrder`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`, `cancelReson`
+- `glink.queryOrderDetail`
+  - `POST /openapi/v1/glink/queryOrderDetail`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- `glink.queryOrderCheckDetailInfo`
+  - `POST /openapi/v1/glink/queryOrderCheckDetailInfo`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- `glink.checkoutApply`
+  - `POST /openapi/v1/glink/checkoutApply`
+  - Required body fields: `fcOrderCode`, `checkoutReason`, `checkoutRoomInfoList`
+- `glink.queryCheckoutDetail`
+  - `POST /openapi/v1/glink/queryCheckoutDetail`
+  - Required body fields: `taskOrderCode`
+  - Swagger example uses order codes instead of `taskOrderCode`; inspect the live contract before coding.
+
+## Finance
+
+- `glink.createInvoice`
+  - `POST /openapi/v1/glink/createInvoice`
+  - Business-required fields to focus on: `orderCode`, `invoiceTypeInteger`, `invoiceHeader`, `amount`, `applyId`, `invoiceTitleType`, `getMethod`
+  - Schema still marks `partnerCode` and `sign` as required, but route docs say the platform injects supplier auth fields. Do not send supplier-managed fields from the client.
+- `glink.queryCreditBalance`
+  - `POST /openapi/v1/glink/queryCreditBalance`
+  - Required body fields: none
+
+## Global Notes
+
+- Most Glink routes accept plain business JSON bodies with no wrapper objects.
+- Platform error responses can return `401`, `403`, `404`, `500`, `502`, or `504`.
+- Common auth-related `401` codes are `APP_KEY_INVALID`, `SIGN_ERROR`, `TIMESTAMP_EXPIRED`, and `NONCE_REPLAY`.
+- Common `403` cause is `PRODUCT_FORBIDDEN`.